Package Search Help

You can use boolean logic (e.g. AND/OR/NOT) for complex search queries. For more help and examples, see the search documentation.

Search by package name:
my-package (implicit)
name:my-package (explicit)

Search by package filename:
filename:my-package.ext 

Search by package tag:
tag:latest 

Search by package version:
version:1.0.0  prerelease:true (prereleases)
prerelease:false (no prereleases)

Search by package architecture:
architecture:x86_64 

Search by package distribution:
distribution:el 

Search by package license:
license:MIT 

Search by package format:
format:deb 

Search by package status:
status:in_progress 

Search by package file checksum:
checksum:5afba 

Search by package security status:
severity:critical 

Search by package vulnerabilities:
vulnerabilities:>1 
vulnerabilities:<1000 

Search by # of package downloads:
downloads:>8 
downloads:<100 

Search by package type:
type:binary 
type:source 

Search by package size (bytes):
size:>50000 
size:<10000 

Search by dependency name/version:
dependency:log4j 
dependency:log4j=1.0.0 
dependency:log4j>1.0.0 

Search by uploaded date:
uploaded:>"1 day ago" 
uploaded:<"August 14, 2022 EST" 

Search by entitlement token (identifier):
entitlement:3lKPVJPosCsY 

Search by policy violation:
policy_violated:true
deny_policy_violated:true
license_policy_violated:true
vulnerability_policy_violated:true

Search by repository:
repository:repo-name

Search by last download date:
last_downloaded:<"30 days ago" 
last_downloaded:>"August 14, 2022 EST" 

Search queries for all Debian-specific (and related) package types

Search by component:
deb_component:unstable

Search queries for all Maven-specific (and related) package types

Search by group ID:
maven_group_id:org.apache

Search queries for all Docker-specific (and related) package types

Search by image digest:
docker_image_digest:sha256:7c5..6d4
(full hashref only)

Search by layer digest:
docker_layer_digest:sha256:4c4..ae4
(full hashref only)

Search queries for all Generic-specific package types

Search by file path:
generic_filepath:path/to/file.txt

Search by directory:
generic_directory:path/to

Field type modifiers (depending on the type, you can influence behaviour)

For all queries, you can use:
~foo for negation

For string queries, you can use:
^foo to anchor to start of term
foo$ to anchor to end of term
foo*bar for fuzzy matching

For number/date or version queries, you can use:
>foo for values greater than
>=foo for values greater / equal
<foo for values less than
<=foo for values less / equal

Need a secure and centralised artifact repository to deliver Alpine, Cargo, CocoaPods, Composer, Conan, Conda, CRAN, Dart, Debian, Docker, Generic, Go, Helm, Hex, HuggingFace, LuaRocks, Maven, MCP, npm, NuGet, P2, Python, RedHat, Ruby, Swift, Terraform, Vagrant, VSX, Raw & More packages?

Cloudsmith is the new standard in Package / Artifact Management and Software Distribution.

With support for all major package formats, you can trust us to manage your software supply chain.

Start My Free Trial
Set Me Up
 Public — eventstore eventstore (Kurrent) / kurrent-lts
A certifiably-awesome public package repository curated by Kurrent, hosted by Cloudsmith.
Packages 15 Package Groups 1 Public Keys

Docker logo kurrentdb  26.0.2

Download

One-liner (summary)

A certifiably-awesome package curated by Timothy Coleman, hosted by Cloudsmith.

Description

A certifiably-awesome package curated by Timothy Coleman, hosted by Cloudsmith.

License

Unknown

Size

238.3 MB

Downloads

93

Tags

image amd64 linux 26.0.2-x64-10.0-nob… e6324a21-f867-4941-… 26.0 latest 1 more

Status  Completed
Checksum (MD5) 36477a4b58fd4218742ea9049200109e
Checksum (SHA-1) 7831c551efc388477c6f8fa3dd6b32ef430c75c3
Checksum (SHA-256) 968525aaa6fc7011edd1d66259add70ac1d229a4a507b7557f495cacf748654f
Checksum (SHA-512) 6e81a3364d8aeeb3f34168d18896e017003d23d386bcffda4bf0e0129cbe3dbfcf…
GPG Signature
Download
GPG Fingerprint 5d4d90c6ce485df1b33cf37fc39876bc6ae970d8
Storage Region  Dublin, Ireland
Type  Binary (contains binaries and binary artifacts)
Uploaded At 1 month ago
Uploaded By timothy-coleman
Slug Id kurrentdb-78vq
Unique Id 8nzsepemevZn
Version (Raw) 26.0.2
Version (Parsed)
  • Major: 26
  • Minor: 0
  • Patch: 2
  • Type: SemVer (Strict)
Orig Version (Raw) 968525aaa6fc7011edd1d66259add70ac1d229a4a507b7557f495cacf748654f
Orig Version (Parsed)
  • Type: Unknown
  docker-specific metadata
Image Digest sha256:968525aaa6fc7011edd1d66259add70ac1d229a4a507b7557f495cacf748654f
Config Digest sha256:a5410b63dbf4a47eb485311e2b824de5153d9ba04567d8353e5e3a82b95d3088
V1 OCI Index Digest sha256:91c4fcffd707606163426a3430cb6155cf435572927ec05375f234111ff067c9
V1 Distribution (Signed) Digest sha256:b3707012e28b170a82fdcb5cff7b3ffb3ad1b592aa2a1b1ec3c7d5475a03df79
V1 OCI Digest sha256:77a3db1c9e39668e8e27637eb7ad48bcdaa1455ba655287152eec6c212ccde35
V2 Distribution List Digest sha256:f521713b03e0430c7158181fc48f76d4c971fc7e075819bc708c3f56fe19e9ef
V1 Distribution Digest sha256:1efb4a4439fa21031d2023973ff354fea6c1af6e8c3f71653b6fb8e9377bf7a3
V2 Distribution Digest sha256:968525aaa6fc7011edd1d66259add70ac1d229a4a507b7557f495cacf748654f
  extended metadata
Manifest Type V2 Distribution
Architecture amd64
Config
Entrypoint
/opt/kurrentdb/kurrentd
Env
ACCEPT_EULA=Y | APP_UID=1654 | ASPNETCORE_HTTP_PORTS=8080 | DEBIAN_FRONTEND=noninteractive | DOTNET_RUNNING_IN_CONTAINER=true | LANGUAGE=en_US:en | PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Exposed Ports
1112/tcp | 1113/tcp | 2113/tcp
Healthcheck
Interval
5000000000
Retries
24
Test
CMD-SHELL | curl --fail --insecure https://localhost:2113/health/live || curl --fail http://localhost:2113/health/live || exit 1
Timeout
5000000000
Labels
'org.opencontainers.image.version' '24.04'
Labels
'org.opencontainers.image.ref.name' 'ubuntu'
User
kurrent
Volumes
/var/lib/kurrentdb | /var/log/kurrentdb
Working Dir
/opt/kurrentdb
Created 2026-03-12 17:27:00 UTC
Os linux

This package was uploaded with the following V2 Distribution manifest: 

{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
   "config": {
      "mediaType": "application/vnd.docker.container.image.v1+json",
      "size": 7141,
      "digest": "sha256:b766e2f51cbc40e3494987c7b7a7c9765c24295ea18729eb7e2795bec363cf9f"
   },
   "layers": [
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 30599062,
         "digest": "sha256:18dbadc1f2f937d7ebdfa4481fb1f6f43b26e93f5bdc4cef3cef98d7f0ae77aa"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 16817917,
         "digest": "sha256:704963e232f342b96c60bdfb01af172d594f628704fd496267217cfbdf015be6"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 3540,
         "digest": "sha256:9b17970d26426d469389c7908b3d65add9053f11bea37a8f8e961b8c203ba9b7"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 41345452,
         "digest": "sha256:0bc075d466bc7e0aa1ec00b63434b8967d16a2a5cbf27b9830e0ec87651e0ab9"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 2755413,
         "digest": "sha256:f97018f853bd604e6dc1d09870434d8d3f1a910186daa63b7288ec54affec22f"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 1338,
         "digest": "sha256:b851519c9a74c5ff03d42f8c113201511a489641a05f7002f50933c793a85e74"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 158349770,
         "digest": "sha256:00d7a2ab2404ca187a81aea2c51f7618c9ae25aca2437522a185b23c627fffaa"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 32,
         "digest": "sha256:4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 192,
         "digest": "sha256:e7f8a99588e71021a6d6be641d48d79a17fa38e658343e3e4ceddd32b99d9ede"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 190,
         "digest": "sha256:35c2a8fdd3c053d6a821ab05472e6af90d423cfd1928bb28167de99895a7fb1e"
      }
   ]
}
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) ARG RELEASE
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) ARG LAUNCHPAD_BUILD_ARCH
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) LABEL org.opencontainers.image.ref.name=ubuntu
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) LABEL org.opencontainers.image.version=24.04
 32 bytes
Digest: sha256:18dbadc1f2f937d7ebdfa4481fb1f6f43b26e93f5bdc4cef3cef98d7f0ae77aa
Command: /bin/sh -c #(nop) ADD file:3f78aa860931e0853077f09eb31eddbeeef8a9dd70977305b4876aa176770721 in /
29.2 MB
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) CMD ["/bin/bash"]
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ENV APP_UID=1654 ASPNETCORE_HTTP_PORTS=8080 DOTNET_RUNNING_IN_CONTAINER=true
 32 bytes
Digest: sha256:704963e232f342b96c60bdfb01af172d594f628704fd496267217cfbdf015be6
Command: RUN /bin/sh -c apt-get update && apt-get install -y --no-install-recommends ca-certificates libc6 libgcc-s1 libicu74 libssl3t64 libstdc++6 tzdata tzdata-legacy && rm -rf /var/lib/apt/lists/* # buildkit
 16.0 MB
Digest: sha256:9b17970d26426d469389c7908b3d65add9053f11bea37a8f8e961b8c203ba9b7
Command: RUN /bin/sh -c groupadd --gid=$APP_UID app && useradd --no-log-init --uid=$APP_UID --gid=$APP_UID --create-home app # buildkit
 3.5 KB
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ARG DATABASE_ARCHIVE_DIR=kurrentdb-26.0.2-linux-x64.tar.gz
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ARG UID=1001
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ARG GID=1001
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ENV LANGUAGE=en_US:en DEBIAN_FRONTEND=noninteractive ACCEPT_EULA=Y
 32 bytes
Digest: sha256:0bc075d466bc7e0aa1ec00b63434b8967d16a2a5cbf27b9830e0ec87651e0ab9
Command: RUN |3 DATABASE_ARCHIVE_DIR=kurrentdb-26.0.2-linux-x64.tar.gz UID=1001 GID=1001 /bin/sh -c apt-get update && apt-get upgrade -y && apt-get clean # buildkit
 39.4 MB
Digest: sha256:f97018f853bd604e6dc1d09870434d8d3f1a910186daa63b7288ec54affec22f
Command: RUN |3 DATABASE_ARCHIVE_DIR=kurrentdb-26.0.2-linux-x64.tar.gz UID=1001 GID=1001 /bin/sh -c apt update && apt install -y adduser curl && rm -rf /var/lib/apt/lists/* # buildkit
 2.6 MB
Digest: sha256:b851519c9a74c5ff03d42f8c113201511a489641a05f7002f50933c793a85e74
Command: RUN |3 DATABASE_ARCHIVE_DIR=kurrentdb-26.0.2-linux-x64.tar.gz UID=1001 GID=1001 /bin/sh -c addgroup --gid ${GID} "kurrent" && adduser --disabled-password --gecos "" --ingroup "kurrent" --no-create-home --uid ${UID} "kurrent" # buildkit
 1.3 KB
Digest: sha256:00d7a2ab2404ca187a81aea2c51f7618c9ae25aca2437522a185b23c627fffaa
Command: COPY --chown=kurrent:kurrent kurrentdb-26.0.2-linux-x64.tar.gz /opt/kurrentdb/ # buildkit
 151.0 MB
Digest: sha256:4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1
Command: WORKDIR /opt/kurrentdb
 32 bytes
Digest: sha256:e7f8a99588e71021a6d6be641d48d79a17fa38e658343e3e4ceddd32b99d9ede
Command: RUN |3 DATABASE_ARCHIVE_DIR=kurrentdb-26.0.2-linux-x64.tar.gz UID=1001 GID=1001 /bin/sh -c mkdir -p /var/lib/kurrentdb && mkdir -p /var/log/kurrentdb && mkdir -p /etc/kurrentdb && chown -R kurrent:kurrent /var/lib/kurrentdb /var/log/kurrentdb /etc/kurrentdb # buildkit
 192 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: USER kurrent
 32 bytes
Digest: sha256:35c2a8fdd3c053d6a821ab05472e6af90d423cfd1928bb28167de99895a7fb1e
Command: RUN |3 DATABASE_ARCHIVE_DIR=kurrentdb-26.0.2-linux-x64.tar.gz UID=1001 GID=1001 /bin/sh -c echo "NodeIp: 0.0.0.0\nReplicationIp: 0.0.0.0" >> /etc/kurrentdb/kurrentdb.conf # buildkit
 190 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: VOLUME [/var/lib/kurrentdb]
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: VOLUME [/var/log/kurrentdb]
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: EXPOSE map[1112/tcp:{}]
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: EXPOSE map[1113/tcp:{}]
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: EXPOSE map[2113/tcp:{}]
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: HEALTHCHECK &{["CMD-SHELL" "curl --fail --insecure https://localhost:2113/health/live || curl --fail http://localhost:2113/health/live || exit 1"] "5s" "5s" "0s" "0s" '\x18'}
 32 bytes
Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ENTRYPOINT ["/opt/kurrentdb/kurrentd"]
 32 bytes
  Docker logo
kurrentdb
 26.0.2
image amd64 linux 26.0.2-x64-10.0-nob… e6324a21-f867-4941-… 26.0 latest 1 more
238.3 MB — 1 month ago
93 timothy-coleman
 Older Docker logo
kurrentdb
 26.0.1
image amd64 linux 26.0.1-x64-10.0-nob… ff541ec3-69d4-47d1-…
245.6 MB — 2 months, 1 week ago
68 timothy-coleman
 Older Docker logo
kurrentdb
 26.0.0
image amd64 linux 26.0.0-x64-10.0-nob… 048218d3-0542-472c-…
236.9 MB — 2 months, 4 weeks ago
39 timothy-coleman
Only packages within the same repository are displayed. The current package you're viewing is highlighted.

Last scanned

1 month ago

Scan result

Vulnerable

Vulnerability count

9

Max. severity

Medium
Target: mo3fI3ZZbNNm.sbom-cyclonedx.json (ubuntu 24.04)
MEDIUM

CVE-2025-68972: gnupg: GnuPG: Signature bypass via form feed character in signed messages

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Package Name: gpgv
Installed Version: 2.4.4-2ubuntu17.4
Fixed Version:

References: access.redhat.com gpg.fail media.ccc.de news.ycombinator.com nvd.nist.gov www.cve.org
MEDIUM

CVE-2025-8941: linux-pam: Incomplete fix for CVE-2025-6020

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Package Name: libpam-modules
Installed Version: 1.5.3-5ubuntu5.5
Fixed Version:

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org
MEDIUM

CVE-2025-8941: linux-pam: Incomplete fix for CVE-2025-6020

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Package Name: libpam-modules-bin
Installed Version: 1.5.3-5ubuntu5.5
Fixed Version:

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org
MEDIUM

CVE-2025-8941: linux-pam: Incomplete fix for CVE-2025-6020

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Package Name: libpam-runtime
Installed Version: 1.5.3-5ubuntu5.5
Fixed Version:

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org
MEDIUM

CVE-2025-8941: linux-pam: Incomplete fix for CVE-2025-6020

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Package Name: libpam0g
Installed Version: 1.5.3-5ubuntu5.5
Fixed Version:

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org
MEDIUM

CVE-2026-3731: libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler

A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.

Package Name: libssh-4
Installed Version: 0.10.6-2ubuntu0.3
Fixed Version:

References: access.redhat.com gitlab.com nvd.nist.gov vuldb.com vuldb.com vuldb.com www.cve.org www.libssh.org www.libssh.org
MEDIUM

CVE-2025-45582: tar: Tar path traversal

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory.

Package Name: tar
Installed Version: 1.35+dfsg-3build1
Fixed Version:

References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.gnu.org nvd.nist.gov www.cve.org www.gnu.org www.gnu.org www.gnu.org www.gnu.org
LOW

CVE-2016-2781: coreutils: Non-privileged session can escape to the parent session in chroot

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Package Name: coreutils
Installed Version: 9.4-3ubuntu6.1
Fixed Version:

References: seclists.org www.openwall.com www.openwall.com access.redhat.com lists.apache.org lore.kernel.org mirrors.edge.kernel.org nvd.nist.gov www.cve.org
LOW

CVE-2022-3219: gnupg: denial of service issue (resource consumption) using compressed packets

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

Package Name: gpgv
Installed Version: 2.4.4-2ubuntu17.4
Fixed Version:

References: access.redhat.com bugzilla.redhat.com dev.gnupg.org dev.gnupg.org marc.info nvd.nist.gov security.netapp.com www.cve.org
LOW

CVE-2024-2236: libgcrypt: vulnerable to Marvin Attack

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

Package Name: libgcrypt20
Installed Version: 1.10.3-2build1
Fixed Version:

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org dev.gnupg.org errata.almalinux.org errata.rockylinux.org github.com gitlab.com linux.oracle.com linux.oracle.com lists.gnupg.org nvd.nist.gov www.cve.org
LOW

CVE-2025-5222: icu: Stack buffer overflow in the SRBRoot::addTag function

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

Package Name: libicu74
Installed Version: 74.2-1ubuntu3.1
Fixed Version:

References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov www.cve.org
LOW

CVE-2024-56433: shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

Package Name: login
Installed Version: 1:4.13+dfsg1-4ubuntu3.2
Fixed Version:

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org
LOW

CVE-2024-56433: shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

Package Name: passwd
Installed Version: 1:4.13+dfsg1-4ubuntu3.2
Fixed Version:

References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org

You can embed a badge in another website that shows this or the latest version of this package.

To embed the badge for this specific package version, use the following: 

[![This version of 'kurrentdb' @ Cloudsmith](https://api.cloudsmith.com/v1/badges/version/eventstore/kurrent-lts/docker/kurrentdb/26.0.2/a=amd64;xpo=linux/?render=true)](https://cloudsmith.io/~eventstore/repos/kurrent-lts/packages/detail/docker/kurrentdb/968525aaa6fc7011edd1d66259add70ac1d229a4a507b7557f495cacf748654f/a=amd64;xpo=linux/)
|This version of 'kurrentdb' @ Cloudsmith|
.. |This version of 'kurrentdb' @ Cloudsmith| image:: https://api.cloudsmith.com/v1/badges/version/eventstore/kurrent-lts/docker/kurrentdb/26.0.2/a=amd64;xpo=linux/?render=true
   :target: https://cloudsmith.io/~eventstore/repos/kurrent-lts/packages/detail/docker/kurrentdb/968525aaa6fc7011edd1d66259add70ac1d229a4a507b7557f495cacf748654f/a=amd64;xpo=linux/
image::https://api.cloudsmith.com/v1/badges/version/eventstore/kurrent-lts/docker/kurrentdb/26.0.2/a=amd64;xpo=linux/?render=true[link="https://cloudsmith.io/~eventstore/repos/kurrent-lts/packages/detail/docker/kurrentdb/968525aaa6fc7011edd1d66259add70ac1d229a4a507b7557f495cacf748654f/a=amd64;xpo=linux/",title="This version of 'kurrentdb' @ Cloudsmith"]
<a href="https://cloudsmith.io/~eventstore/repos/kurrent-lts/packages/detail/docker/kurrentdb/968525aaa6fc7011edd1d66259add70ac1d229a4a507b7557f495cacf748654f/a=amd64;xpo=linux/"><img src="https://api.cloudsmith.com/v1/badges/version/eventstore/kurrent-lts/docker/kurrentdb/26.0.2/a=amd64;xpo=linux/?render=true" alt="This version of 'kurrentdb' @ Cloudsmith" /></a>

rendered as: This version of 'kurrentdb' @ Cloudsmith

To embed the badge for the latest package version, use the following: 

[![Latest version of 'kurrentdb' @ Cloudsmith](https://api.cloudsmith.com/v1/badges/version/eventstore/kurrent-lts/docker/kurrentdb/latest/a=amd64;xpo=linux/?render=true&show_latest=true)](https://cloudsmith.io/~eventstore/repos/kurrent-lts/packages/detail/docker/kurrentdb/latest/a=amd64;xpo=linux/)
|Latest version of 'kurrentdb' @ Cloudsmith|
.. |Latest version of 'kurrentdb' @ Cloudsmith| image:: https://api.cloudsmith.com/v1/badges/version/eventstore/kurrent-lts/docker/kurrentdb/latest/a=amd64;xpo=linux/?render=true&show_latest=true
   :target: https://cloudsmith.io/~eventstore/repos/kurrent-lts/packages/detail/docker/kurrentdb/latest/a=amd64;xpo=linux/
image::https://api.cloudsmith.com/v1/badges/version/eventstore/kurrent-lts/docker/kurrentdb/latest/a=amd64;xpo=linux/?render=true&show_latest=true[link="https://cloudsmith.io/~eventstore/repos/kurrent-lts/packages/detail/docker/kurrentdb/latest/a=amd64;xpo=linux/",title="Latest version of 'kurrentdb' @ Cloudsmith"]
<a href="https://cloudsmith.io/~eventstore/repos/kurrent-lts/packages/detail/docker/kurrentdb/latest/a=amd64;xpo=linux/"><img src="https://api.cloudsmith.com/v1/badges/version/eventstore/kurrent-lts/docker/kurrentdb/latest/a=amd64;xpo=linux/?render=true&show_latest=true" alt="Latest version of 'kurrentdb' @ Cloudsmith" /></a>

rendered as: Latest version of 'kurrentdb' @ Cloudsmith

These instructions assume you have setup the repository first (or read it).

To pull kurrentdb @ reference/tag latest: 

docker pull docker.eventstore.com/kurrent-lts/kurrentdb:latest

To refer to this image after pulling in a Dockerfile, specify the following: 

FROM docker.eventstore.com/kurrent-lts/kurrentdb:latest

Note: You should replace latest with an alternative reference to pull, such as: lts, 26.0, 26.0.2, e6324a21-f867-4941-a2ed-176684be27c7 and 26.0.2-x64-10.0-noble.

Still stuck? Need help? Don't panic. Just contact us for help (even if you're not a customer).
Previous Version: 26.0.1
Next Version
Top