Skip to content

[container-image-scan] Container findings for ghcr.io/github/gh-aw-mcpg:v0.4.8 #51707

Description

@github-actions

Summary

  • Image: ghcr.io/github/gh-aw-mcpg:v0.4.8
  • Pinned reference: ghcr.io/github/gh-aw-mcpg:v0.4.8@sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8
  • Vulnerabilities: 6 total (0 Critical, 6 High)
  • License violations: 59

Vulnerabilities

6 vulnerabilities (click to expand)

Licenses

59 license policy violations (click to expand)
  • ca-certificates-bundle@20260611-r0 (MPL-2.0)
  • libgcc@15.2.0-r5 (LGPL-2.1-or-later, GPL-2.0-or-later)
  • libsasl@2.1.28-r9 (BSD-3-Clause-Attribution, BSD-4-Clause)
  • libldap@2.6.13-r0 (OLDAP-2.8)
  • libncursesw@6.6_p20260516-r0 (X11)
  • zlib@1.3.2-r0 (Zlib)
  • libgcrypt@1.12.2-r0 (GPL-2.0-or-later, LGPL-2.1-or-later)
  • libgpg-error@1.61-r0 (GPL-2.0-or-later, LGPL-2.1-or-later)
  • passt@2026.05.26-r0 (GPL-2.0-or-later)
  • glib@2.88.1-r1 (LGPL-2.1-or-later)
  • libmount@2.42.1-r0 (LGPL-2.1-or-later)
  • libcap2@2.78-r0 (GPL-2.0-only)
  • alpine-baselayout@3.7.2-r1 (GPL-2.0-only)
  • ca-certificates@20260611-r0 (MPL-2.0)
  • gnupg-gpgconf@2.4.9-r1 (GPL-3.0-or-later)
  • gpgsm@2.4.9-r1 (GPL-3.0-or-later)
  • libunistring@1.4.2-r0 (GPL-2.0-or-later, LGPL-3.0-or-later)
  • zstd-libs@1.5.7-r2 (GPL-2.0-or-later)
  • libmnl@1.0.5-r2 (LGPL-2.1-or-later)
  • alpine-baselayout-data@3.7.2-r1 (GPL-2.0-only)
  • gnupg-keyboxd@2.4.9-r1 (GPL-3.0-or-later)
  • libidn2@2.3.8-r0 (GPL-2.0-or-later, LGPL-3.0-or-later)
  • musl-utils@1.2.6-r2 (GPL-2.0-or-later)
  • libtasn1@4.21.0-r0 (LGPL-2.1-or-later)
  • libnftnl@1.3.1-r0 (GPL-2.0-or-later)
  • fuse3@3.18.2-r0 (GPL-2.0-only, LGPL-2.1-only)
  • libbz2@1.0.8-r6 (bzip2-1.0.6)
  • libapk@3.0.6-r0 (GPL-2.0-only)
  • gdbm@1.26-r0 (GPL-3.0-or-later)
  • crun@1.28-r0 (GPL-2.0-or-later, LGPL-2.1-or-later)
  • pinentry@1.3.2-r0 (GPL-2.0-or-later)
  • libblkid@2.42.1-r0 (LGPL-2.1-or-later)
  • gnupg-dirmngr@2.4.9-r1 (GPL-3.0-or-later)
  • gpg@2.4.9-r1 (GPL-3.0-or-later)
  • gpg-agent@2.4.9-r1 (GPL-3.0-or-later)
  • scanelf@1.3.9-r1 (GPL-2.0-only)
  • busybox-binsh@1.37.0-r31 (GPL-2.0-only)
  • ssl_client@1.37.0-r31 (GPL-2.0-only)
  • bash@5.3.9-r1 (GPL-3.0-or-later)
  • gnutls@3.8.13-r0 (LGPL-2.1-or-later)
  • libassuan@3.0.2-r0 (LGPL-2.1-or-later)
  • apk-tools@3.0.6-r0 (GPL-2.0-only)
  • nftables@1.1.6-r1 (GPL-2.0-or-later)
  • gpgme@2.0.1-r1 (LGPL-2.1-or-later, GPL-3.0-or-later)
  • readline@8.3.3-r1 (GPL-3.0-or-later)
  • gmp@6.3.0-r4 (GPL-2.0-or-later, LGPL-3.0-or-later)
  • fuse-common@3.18.2-r0 (GPL-2.0-only, LGPL-2.1-only)
  • sqlite-libs@3.53.2-r0 (blessing)
  • fuse3-libs@3.18.2-r0 (GPL-2.0-only, LGPL-2.1-only)
  • libksba@1.7.0-r0 (GPL-3.0-only, LGPL-3.0-only, GPL-2.0-only)
  • npth@1.8-r0 (LGPL-2.0-or-later)
  • catatonit@0.2.1-r0 (GPL-2.0-or-later)
  • fuse-overlayfs@1.16-r0 (GPL-2.0-or-later)
  • nettle@3.10.2-r0 (GPL-2.0-or-later, LGPL-3.0-or-later)
  • libintl@1.0-r0 (LGPL-2.1-or-later)
  • libseccomp@2.6.0-r2 (LGPL-2.1-or-later)
  • libmd@1.2.0-r0 (AND, Beerware, Domain, Public)
  • ncurses-terminfo-base@6.6_p20260516-r0 (X11)
  • busybox@1.37.0-r31 (GPL-2.0-only)

Remediation

  • Rebuild with Go 1.25.12/1.26.5+ to fix GO-2026-5037 and GO-2026-4970.
  • Bump golang.org/x/text to 0.39.0+ to resolve GO-2026-5970.
  • Bump github.com/sigstore/fulcio to 1.8.6+ to resolve GHSA-f5mr-q85p-6hh6.
  • Bump google.golang.org/grpc to 1.82.1+ to resolve GHSA-hrxh-6v49-42gf.
  • Review flagged GPL/LGPL Alpine and gnupg-related license violations against project policy.

Generated by 🛡️ Daily Container Image Security Scan · auto · 445.4 AIC · ⌖ 18.1 AIC · ⊞ 6.5K ·

Metadata

Metadata

Labels

cookieIssue Monster Loves Cookies!security

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions