Package Search Help
You can use boolean logic (e.g. AND/OR/NOT) for complex search queries. For more help and examples, see the search documentation.
Search by package name:
my-package (implicit)
name:my-package (explicit)
Search by package filename:
filename:my-package.ext
Search by package tag:
tag:latest
Search by package version:
version:1.0.0
prerelease:true (prereleases)
prerelease:false (no prereleases)
Search by package architecture:
architecture:x86_64
Search by package distribution:
distribution:el
Search by package license:
license:MIT
Search by package format:
format:deb
Search by package status:
status:in_progress
Search by package file checksum:
checksum:5afba
Search by package security status:
severity:critical
Search by package vulnerabilities:
vulnerabilities:>1
vulnerabilities:<1000
Search by # of package downloads:
downloads:>8
downloads:<100
Search by package type:
type:binary
type:source
Search by package size (bytes):
size:>50000
size:<10000
Search by dependency name/version:
dependency:log4j
dependency:log4j=1.0.0
dependency:log4j>1.0.0
Search by uploaded date:
uploaded:>"1 day ago"
uploaded:<"August 14, 2022 EST"
Search by entitlement token (identifier):
entitlement:3lKPVJPosCsY
Search by policy violation:
policy_violated:true
deny_policy_violated:true
license_policy_violated:true
vulnerability_policy_violated:true
Search by repository:
repository:repo-name
Search by last download date:
last_downloaded:<"30 days ago"
last_downloaded:>"August 14, 2022 EST"
Search queries for all Debian-specific (and related) package types
Search by component:
deb_component:unstable
Search queries for all Maven-specific (and related) package types
Search by group ID:
maven_group_id:org.apache
Search queries for all Docker-specific (and related) package types
Search by image digest:
docker_image_digest:sha256:7c5..6d4
(full hashref only)
Search by layer digest:
docker_layer_digest:sha256:4c4..ae4
(full hashref only)
Search queries for all Generic-specific package types
Search by file path:
generic_filepath:path/to/file.txt
Search by directory:
generic_directory:path/to
Field type modifiers (depending on the type, you can influence behaviour)
For all queries, you can use:
~foo for negation
For string queries, you can use:
^foo to anchor to start of term
foo$ to anchor to end of term
foo*bar for fuzzy matching
For number/date or version queries, you can use:
>foo for values greater than
>=foo for values greater / equal
<foo for values less than
<=foo for values less / equal
Need a secure and centralised artifact repository to deliver Alpine,
Cargo,
CocoaPods,
Composer,
Conan,
Conda,
CRAN,
Dart,
Debian,
Docker,
Generic,
Go,
Helm,
Hex,
HuggingFace,
LuaRocks,
Maven,
MCP,
npm,
NuGet,
P2,
Python,
RedHat,
Ruby,
Swift,
Terraform,
Vagrant,
VSX,
Raw & More packages?
Cloudsmith is the new standard in Package / Artifact Management and Software Distribution.
With support for all major package formats, you can trust us to manage your software supply chain.
Debian
NuGet
RedHat
eventstore
kurrentdb
26.1.0-experimental-arm64-1…
One-liner (summary)
A certifiably-awesome package curated by trainstation, hosted by Cloudsmith.
Description
A certifiably-awesome package curated by trainstation, hosted by Cloudsmith.
| Status | Completed |
|---|---|
| Checksum (MD5) | 378e4fef92cb38ec367684c1f5e56c11 |
| Checksum (SHA-1) | a1b1ee9c96cfbbfea6c5dbdaa67322a81dcdb508 |
| Checksum (SHA-256) | 48b9d3d675ace24f0625def30bf5ba5a5aa17f5ccc31bbe3409d2ad4352cd701 |
| Checksum (SHA-512) | 5c71de3d6ee6360c570e51e126861aa13be8b039652825a8d8b43eb251ae196c14… |
| GPG Signature | |
| GPG Fingerprint | add5007d2a49659fcc308d62501c1f0df3660d29 |
| Storage Region | Dublin, Ireland |
| Type | Binary (contains binaries and binary artifacts) |
| Uploaded At | 1 month, 2 weeks ago |
| Uploaded By |
|
| Slug Id | kurrentdb-fqz1 |
| Unique Id | zw4qc86U0r8F |
| Version (Raw) | 26.1.0-experimental-arm64-10.0-noble |
| Version (Parsed) |
|
| Orig Version (Raw) | 48b9d3d675ace24f0625def30bf5ba5a5aa17f5ccc31bbe3409d2ad4352cd701 |
| Orig Version (Parsed) |
|
| docker-specific metadata | |
| Image Digest | sha256:48b9d3d675ace24f0625def30bf5ba5a5aa17f5ccc31bbe3409d2ad4352cd701 |
| Config Digest | sha256:cf4c4417584751a8478ffa2bc72bdb2ccebfaec93de8b17fc0ad59a3a3808c26 |
| V1 OCI Index Digest | sha256:48cc0e729d1eae97b64ef44a7a02fcb1730ab9afe2bf2a32dff66e73230a955c |
| V1 Distribution (Signed) Digest | sha256:22e0651d3e4545fe991099dbc362ed2d7821ac3fed07205b933fa2a7bf86903c |
| V1 OCI Digest | sha256:ada5fa2a27999d837b9db62849deafe74c5599a8bd4de48ccd8b541e47650893 |
| V2 Distribution List Digest | sha256:241ef14c4201b2309026a414b1afff111847099066edfd2b9af6f68ff7c5b7e1 |
| V1 Distribution Digest | sha256:e69fc7aaa296e3363b6a29c6d590fa3c0ee0faac99b54903cd09313d55607302 |
| V2 Distribution Digest | sha256:48b9d3d675ace24f0625def30bf5ba5a5aa17f5ccc31bbe3409d2ad4352cd701 |
| extended metadata | |
| Manifest Type | V2 Distribution |
| Architecture | arm64 |
| Config | |
| Created | 2026-04-29 15:32:39 UTC |
| Os | linux |
This package was uploaded with the following V2 Distribution manifest:
{
"schemaVersion": 2,
"mediaType": "application/vnd.docker.distribution.manifest.v2+json",
"config": {
"mediaType": "application/vnd.docker.container.image.v1+json",
"size": 7057,
"digest": "sha256:47b712bf1d240900e07829a4bb6082b26569a4e5bd37a23f787bda8527125d1f"
},
"layers": [
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 29946643,
"digest": "sha256:4d88d96e89e537c10a69b755c70c4f2b448950a4749458ab96635289bc066427"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 16794637,
"digest": "sha256:c96859496d68f17f73f00d7050328617913433d2c124d9959f0c4f4a01104efa"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 3568,
"digest": "sha256:8ef9abff070d3697eea29435b9d2eda84acb5eeb05dc9e1587aa83e48107af6d"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 46055554,
"digest": "sha256:079571e9aac23856ce80418a8c31a17ff84781d7409767c53bf02e4db5d91912"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 2811426,
"digest": "sha256:000de5a539c4cac0720ddcfe2289bdd959c724eb8fe254c358207d8128fe5d8d"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 1337,
"digest": "sha256:8c014d26e278cfd8bb167d563c07e181d0091a18ad9cee980027bb79a2b94555"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 148142857,
"digest": "sha256:80784851c1adc5dc301a223a0e238943a40b9622472548dc69af31ca8ac3865c"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 32,
"digest": "sha256:4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 192,
"digest": "sha256:504026e0436e7a76e334fa2eb6216ecb8040113ba788ceb455167f7de432ad8f"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 192,
"digest": "sha256:75eb16d6644b3ef76539fc40d78b076c269f797f212bcb2783e3e338b008153d"
}
]
}|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) ARG RELEASE |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) ARG LAUNCHPAD_BUILD_ARCH |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) LABEL org.opencontainers.image.version=24.04 |
32 bytes | ||
|
Digest:
sha256:4d88d96e89e537c10a69b755c70c4f2b448950a4749458ab96635289bc066427
Command: /bin/sh -c #(nop) ADD file:c98b7645109cdf61ab97492b90629581b1b7cb925b9d58a5787a4aaeb719f2be in / |
28.6 MB | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) CMD ["/bin/bash"] |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ENV APP_UID=1654 ASPNETCORE_HTTP_PORTS=8080 DOTNET_RUNNING_IN_CONTAINER=true |
32 bytes | ||
|
Digest:
sha256:c96859496d68f17f73f00d7050328617913433d2c124d9959f0c4f4a01104efa
Command: RUN /bin/sh -c apt-get update && apt-get install -y --no-install-recommends ca-certificates libc6 libgcc-s1 libicu74 libssl3t64 libstdc++6 tzdata tzdata-legacy && rm -rf /var/lib/apt/lists/* # buildkit |
16.0 MB | ||
|
Digest:
sha256:8ef9abff070d3697eea29435b9d2eda84acb5eeb05dc9e1587aa83e48107af6d
Command: RUN /bin/sh -c groupadd --gid=$APP_UID app && useradd --no-log-init --uid=$APP_UID --gid=$APP_UID --create-home app # buildkit |
3.5 KB | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ARG DATABASE_ARCHIVE_DIR=kurrentdb-26.1.0-experimental-linux-arm64.tar.gz |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ARG UID=1001 |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ARG GID=1001 |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ENV LANGUAGE=en_US:en DEBIAN_FRONTEND=noninteractive ACCEPT_EULA=Y |
32 bytes | ||
|
Digest:
sha256:079571e9aac23856ce80418a8c31a17ff84781d7409767c53bf02e4db5d91912
Command: RUN |3 DATABASE_ARCHIVE_DIR=kurrentdb-26.1.0-experimental-linux-arm64.tar.gz UID=1001 GID=1001 /bin/sh -c apt-get update && apt-get upgrade -y && apt-get clean # buildkit |
43.9 MB | ||
|
Digest:
sha256:000de5a539c4cac0720ddcfe2289bdd959c724eb8fe254c358207d8128fe5d8d
Command: RUN |3 DATABASE_ARCHIVE_DIR=kurrentdb-26.1.0-experimental-linux-arm64.tar.gz UID=1001 GID=1001 /bin/sh -c apt update && apt install -y adduser curl && rm -rf /var/lib/apt/lists/* # buildkit |
2.7 MB | ||
|
Digest:
sha256:8c014d26e278cfd8bb167d563c07e181d0091a18ad9cee980027bb79a2b94555
Command: RUN |3 DATABASE_ARCHIVE_DIR=kurrentdb-26.1.0-experimental-linux-arm64.tar.gz UID=1001 GID=1001 /bin/sh -c addgroup --gid ${GID} "kurrent" && adduser --disabled-password --gecos "" --ingroup "kurrent" --no-create-home --uid ${UID} "kurrent" # buildkit |
1.3 KB | ||
|
Digest:
sha256:80784851c1adc5dc301a223a0e238943a40b9622472548dc69af31ca8ac3865c
Command: COPY --chown=kurrent:kurrent kurrentdb-26.1.0-experimental-linux-arm64.tar.gz /opt/kurrentdb/ # buildkit |
141.3 MB | ||
|
Digest:
sha256:4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1
Command: WORKDIR /opt/kurrentdb |
32 bytes | ||
|
Digest:
sha256:504026e0436e7a76e334fa2eb6216ecb8040113ba788ceb455167f7de432ad8f
Command: RUN |3 DATABASE_ARCHIVE_DIR=kurrentdb-26.1.0-experimental-linux-arm64.tar.gz UID=1001 GID=1001 /bin/sh -c mkdir -p /var/lib/kurrentdb && mkdir -p /var/log/kurrentdb && mkdir -p /etc/kurrentdb && chown -R kurrent:kurrent /var/lib/kurrentdb /var/log/kurrentdb /etc/kurrentdb # buildkit |
192 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: USER kurrent |
32 bytes | ||
|
Digest:
sha256:75eb16d6644b3ef76539fc40d78b076c269f797f212bcb2783e3e338b008153d
Command: RUN |3 DATABASE_ARCHIVE_DIR=kurrentdb-26.1.0-experimental-linux-arm64.tar.gz UID=1001 GID=1001 /bin/sh -c echo "NodeIp: 0.0.0.0\nReplicationIp: 0.0.0.0" >> /etc/kurrentdb/kurrentdb.conf # buildkit |
192 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: VOLUME [/var/lib/kurrentdb] |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: VOLUME [/var/log/kurrentdb] |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: EXPOSE map[1112/tcp:{}] |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: EXPOSE map[1113/tcp:{}] |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: EXPOSE map[2113/tcp:{}] |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: HEALTHCHECK &{["CMD-SHELL" "curl --fail --insecure https://localhost:2113/health/live || curl --fail http://localhost:2113/health/live || exit 1"] "5s" "5s" "0s" "0s" '\x18'} |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: ENTRYPOINT ["/opt/kurrentdb/kurrentd"] |
32 bytes |
| Newer |
|
kurrentdb |
27 |
|
||
| Newer |
|
kurrentdb |
2 |
|
||
| Newer |
|
kurrentdb |
30 |
|
||
| Newer |
|
kurrentdb |
2 |
|
||
|
|
kurrentdb |
4 |
|
|||
| Older |
|
kurrentdb |
1 |
|
||
| Older |
|
kurrentdb |
36 |
|
||
| Older |
|
kurrentdb |
5 |
|
||
| Older |
|
kurrentdb |
5 |
|
||
| Older |
|
kurrentdb |
5 |
|
||
| Older |
|
kurrentdb |
30 |
|
||
| Older |
|
kurrentdb |
8 |
|
||
| Older |
|
kurrentdb |
1099 |
|
||
| Older |
|
kurrentdb |
12 |
|
||
| Older |
|
kurrentdb |
31 |
|
||
| Older |
|
kurrentdb |
5 |
|
||
| Older |
|
kurrentdb |
7 |
|
||
| Older |
|
kurrentdb |
5 |
|
||
| Older |
|
kurrentdb |
15 |
|
||
| Older |
|
kurrentdb |
35 |
|
Last scanned
1 month, 2 weeks ago
Scan result
Vulnerable
Vulnerability count
10
Max. severity
Medium| Target: | zw4qc86U0r8F.sbom-cyclonedx.json (ubuntu 24.04) | |
| MEDIUM |
CVE-2026-27456: util-linux: TOCTOU in the mount program when setting up loop devicesutil-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.Package Name: bsdutils Installed Version: 1:2.39.3-9ubuntu6.5 Fixed Version: References: access.redhat.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-2219: It was discovered that dpkg-deb (a component of dpkg, the Debian packa ...It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).Package Name: dpkg Installed Version: 1.22.6ubuntu6.5 Fixed Version: References: bugs.debian.org git.dpkg.org www.cve.org |
|
| MEDIUM |
CVE-2026-27456: util-linux: TOCTOU in the mount program when setting up loop devicesutil-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.Package Name: libblkid1 Installed Version: 2.39.3-9ubuntu6.5 Fixed Version: References: access.redhat.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character setsThe iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.Package Name: libc-bin Installed Version: 2.39-0ubuntu8.7 Fixed Version: References: access.redhat.com inbox.sourceware.org nvd.nist.gov packages.fedoraproject.org sourceware.org sourceware.org sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server responseCalling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.Package Name: libc-bin Installed Version: 2.39-0ubuntu8.7 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2026-4438: glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functionsCalling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.Package Name: libc-bin Installed Version: 2.39-0ubuntu8.7 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character setsThe iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.Package Name: libc6 Installed Version: 2.39-0ubuntu8.7 Fixed Version: References: access.redhat.com inbox.sourceware.org nvd.nist.gov packages.fedoraproject.org sourceware.org sourceware.org sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server responseCalling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.Package Name: libc6 Installed Version: 2.39-0ubuntu8.7 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2026-4438: glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functionsCalling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.Package Name: libc6 Installed Version: 2.39-0ubuntu8.7 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2026-27456: util-linux: TOCTOU in the mount program when setting up loop devicesutil-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.Package Name: libmount1 Installed Version: 2.39.3-9ubuntu6.5 Fixed Version: References: access.redhat.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-27456: util-linux: TOCTOU in the mount program when setting up loop devicesutil-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.Package Name: libsmartcols1 Installed Version: 2.39.3-9ubuntu6.5 Fixed Version: References: access.redhat.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-27456: util-linux: TOCTOU in the mount program when setting up loop devicesutil-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.Package Name: libuuid1 Installed Version: 2.39.3-9ubuntu6.5 Fixed Version: References: access.redhat.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-27456: util-linux: TOCTOU in the mount program when setting up loop devicesutil-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.Package Name: mount Installed Version: 2.39.3-9ubuntu6.5 Fixed Version: References: access.redhat.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2025-45582: tar: Tar path traversalGNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory.Package Name: tar Installed Version: 1.35+dfsg-3build1 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.gnu.org nvd.nist.gov www.cve.org www.gnu.org www.gnu.org www.gnu.org www.gnu.org |
|
| MEDIUM |
CVE-2026-5704: tar: tar: Hidden file injection via crafted archivesA flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.Package Name: tar Installed Version: 1.35+dfsg-3build1 Fixed Version: References: www.openwall.com www.openwall.com www.openwall.com access.redhat.com bugzilla.redhat.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-27456: util-linux: TOCTOU in the mount program when setting up loop devicesutil-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.Package Name: util-linux Installed Version: 2.39.3-9ubuntu6.5 Fixed Version: References: access.redhat.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2024-2236: libgcrypt: vulnerable to Marvin AttackA timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.Package Name: libgcrypt20 Installed Version: 1.10.3-2build1 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org dev.gnupg.org errata.almalinux.org errata.rockylinux.org github.com gitlab.com linux.oracle.com linux.oracle.com lists.gnupg.org nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2025-5222: icu: Stack buffer overflow in the SRBRoot::addTag functionA stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.Package Name: libicu74 Installed Version: 74.2-1ubuntu3.1 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov unicode-org.atlassian.net www.cve.org |
|
| LOW |
CVE-2024-56433: shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromiseshadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.Package Name: login Installed Version: 1:4.13+dfsg1-4ubuntu3.2 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2024-56433: shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromiseshadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.Package Name: passwd Installed Version: 1:4.13+dfsg1-4ubuntu3.2 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org |
|
Package statistics are no longer available on cloudsmith.io. Please visit our new web app to access this feature.
You can embed a badge in another website that shows this or the latest version of this package.
To embed the badge for this specific package version, use the following:
[](https://cloudsmith.io/~eventstore/repos/kurrent-preview/packages/detail/docker/kurrentdb/48b9d3d675ace24f0625def30bf5ba5a5aa17f5ccc31bbe3409d2ad4352cd701/a=arm64;xpo=linux/)|This version of 'kurrentdb' @ Cloudsmith|
.. |This version of 'kurrentdb' @ Cloudsmith| image:: https://api.cloudsmith.com/v1/badges/version/eventstore/kurrent-preview/docker/kurrentdb/26.1.0-experimental-arm64-10.0-noble/a=arm64;xpo=linux/?render=true
:target: https://cloudsmith.io/~eventstore/repos/kurrent-preview/packages/detail/docker/kurrentdb/48b9d3d675ace24f0625def30bf5ba5a5aa17f5ccc31bbe3409d2ad4352cd701/a=arm64;xpo=linux/image::https://api.cloudsmith.com/v1/badges/version/eventstore/kurrent-preview/docker/kurrentdb/26.1.0-experimental-arm64-10.0-noble/a=arm64;xpo=linux/?render=true[link="https://cloudsmith.io/~eventstore/repos/kurrent-preview/packages/detail/docker/kurrentdb/48b9d3d675ace24f0625def30bf5ba5a5aa17f5ccc31bbe3409d2ad4352cd701/a=arm64;xpo=linux/",title="This version of 'kurrentdb' @ Cloudsmith"]<a href="https://cloudsmith.io/~eventstore/repos/kurrent-preview/packages/detail/docker/kurrentdb/48b9d3d675ace24f0625def30bf5ba5a5aa17f5ccc31bbe3409d2ad4352cd701/a=arm64;xpo=linux/"><img src="https://api.cloudsmith.com/v1/badges/version/eventstore/kurrent-preview/docker/kurrentdb/26.1.0-experimental-arm64-10.0-noble/a=arm64;xpo=linux/?render=true" alt="This version of 'kurrentdb' @ Cloudsmith" /></a>rendered as:
To embed the badge for the latest package version, use the following:
[](https://cloudsmith.io/~eventstore/repos/kurrent-preview/packages/detail/docker/kurrentdb/latest/a=arm64;xpo=linux/)|Latest version of 'kurrentdb' @ Cloudsmith|
.. |Latest version of 'kurrentdb' @ Cloudsmith| image:: https://api.cloudsmith.com/v1/badges/version/eventstore/kurrent-preview/docker/kurrentdb/latest/a=arm64;xpo=linux/?render=true&show_latest=true
:target: https://cloudsmith.io/~eventstore/repos/kurrent-preview/packages/detail/docker/kurrentdb/latest/a=arm64;xpo=linux/image::https://api.cloudsmith.com/v1/badges/version/eventstore/kurrent-preview/docker/kurrentdb/latest/a=arm64;xpo=linux/?render=true&show_latest=true[link="https://cloudsmith.io/~eventstore/repos/kurrent-preview/packages/detail/docker/kurrentdb/latest/a=arm64;xpo=linux/",title="Latest version of 'kurrentdb' @ Cloudsmith"]<a href="https://cloudsmith.io/~eventstore/repos/kurrent-preview/packages/detail/docker/kurrentdb/latest/a=arm64;xpo=linux/"><img src="https://api.cloudsmith.com/v1/badges/version/eventstore/kurrent-preview/docker/kurrentdb/latest/a=arm64;xpo=linux/?render=true&show_latest=true" alt="Latest version of 'kurrentdb' @ Cloudsmith" /></a>rendered as:
These instructions assume you have setup the repository first (or read it).
To pull kurrentdb @ reference/tag d8b9643c-bdb9-42e5-8eab-773584e8b179:
docker pull docker.eventstore.com/kurrent-preview/kurrentdb:d8b9643c-bdb9-42e5-8eab-773584e8b179You can also pull the latest version of this image (if it exists):
docker pull docker.eventstore.com/kurrent-preview/kurrentdb:latestTo refer to this image after pulling in a Dockerfile, specify the following:
FROM docker.eventstore.com/kurrent-preview/kurrentdb:d8b9643c-bdb9-42e5-8eab-773584e8b179Note: You should replace d8b9643c-bdb9-42e5-8eab-773584e8b179 with an alternative reference to pull, such as: 26.1.0-experimental-arm64-10.0-noble.
