MSM Download Tool Packed Image Not Exist

The HTML to PDF converter Dompdf has been found to have a vulnerability that allows attackers to call arbitrary URLs with arbitrary protocols. This issue has been patched in version v0.70.0, and users are advised to upgrade immediately. The vulnerability is caused by the difference in attribute parsers between Dompdf and php-svg-lib.

In addition to this issue, another vulnerability was discovered in Syft, a CLI tool for generating Software Bill of Materials (SBOMs) from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFT_ATTEST_PASSWORD environment variable.

The issue affects users who have the SYFT_ATTEST_PASSWORD environment variable set with credentials, regardless of whether they are using the attest command or not. The password is used to decrypt the private key during the signing process while generating an SBOM attestation.

A workaround for this issue is to ensure that only trusted images are used and that only trusted users have permissions to import images. Users should also update to the latest versions of Syft to resolve the issue.

Furthermore, a denial-of-service vulnerability was found in containerd, an open-source container runtime. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. The issue has been fixed in version 1.6.18 and 1.5.18.

In summary, it is essential to keep your software up-to-date to avoid security vulnerabilities and ensure the integrity of your system.

Msm download tool packed image not exist