Security vulnerability in jaz #136
Description
Hi everybody,
in our image scanning via mend.io we found a HIGH security vulnerability in one our FROM mcr.microsoft.com/openjdk/jdk:21-ubuntu images, which seems to be coming in via /usr/bin/jaz (which had been recently added via #132):
Unreachable: 2 Vulnerabilities were found unreachable, which are 100%% of the total vulnerabilities.
GO (/usr/bin/jaz)
+---------+------------------+----------+--------------+-------------------+---------------+-----------------------------------------------------------+
| LIBRARY | VULNERABILITY ID | SEVERITY | REACHABILITY | INSTALLED VERSION | FIXED VERSION | DETAILS |
+---------+------------------+----------+--------------+-------------------+---------------+-----------------------------------------------------------+
| stdlib | CVE-2025-61729 | HIGH | Unreachable | 1.24.10 | 1.24.11 | https://www.mend.io/vulnerability-database/CVE-2025-61729 |
+---------+------------------+----------+--------------+-------------------+---------------+-----------------------------------------------------------+
| stdlib | CVE-2025-61727 | UNKNOWN | Unreachable | 1.24.10 | 1.24.11 | https://www.mend.io/vulnerability-database/CVE-2025-61727 |
+---------+------------------+----------+--------------+-------------------+---------------+-----------------------------------------------------------+
Links:
- https://www.mend.io/vulnerability-database/CVE-2025-61729
- https://www.mend.io/vulnerability-database/CVE-2025-61727
In the current mcr.microsoft.com/openjdk/jdk:21-ubuntu image from today (sha256:be600c23cdb2182ce3528b66a0bf59c781dc89e13bf3600b3deb4f5223900efd), there is jaz 0.0.0~preview+20251126.1 installed, but no newer versions available.
(maybe this is rather for the jaz repo, but I couldn't find it -- so as it surfaced via the mcr.microsoft.com/openjdk/jdk:21-ubuntu I'm reporting it here...)