Posts made by geraldizo_0690

geraldizo_0690

Thanks for the response.
I am using mcr.microsoft.com/mssql/server:2025-CU2-ubuntu-24.04 as the container image.

geraldizo_0690

These are our configuration for automatic assessment.

geraldizo_0690

Perhaps this list can help you on investigation!

---- Begin:  ----
cryptography 39.0.2 is Noncompliant in pypi.
Reason: Vulnerability (PGV-2610853)
<p>cryptography 39.0.2 is Noncompliant in pypi.</p>
<p>Reason: Vulnerability (PGV-2610853)</p>

---- Begin:  ----
cryptography 39.0.2 is Noncompliant in pypi-combined.
Reason: Vulnerability (PGV-2610853)
<p>cryptography 39.0.2 is Noncompliant in pypi-combined.</p>
<p>Reason: Vulnerability (PGV-2610853)</p>

---- Begin:  ----
cryptography 40.0.2 is Noncompliant in pypi.
Reason: Vulnerability (PGV-2610853)
<p>cryptography 40.0.2 is Noncompliant in pypi.</p>
<p>Reason: Vulnerability (PGV-2610853)</p>

---- Begin:  ----
cryptography 40.0.2 is Noncompliant in pypi.
Reason: Vulnerability (PGV-2610853)
<p>cryptography 40.0.2 is Noncompliant in pypi.</p>
<p>Reason: Vulnerability (PGV-2610853)</p>

---- Begin:  ----
cryptography 40.0.2 is Noncompliant in pypi-combined.
Reason: Vulnerability (PGV-2610853)
<p>cryptography 40.0.2 is Noncompliant in pypi-combined.</p>
<p>Reason: Vulnerability (PGV-2610853)</p>

---- Begin:  ----
cryptography 40.0.2 is Noncompliant in pypi-combined.
Reason: Vulnerability (PGV-2610853)
<p>cryptography 40.0.2 is Noncompliant in pypi-combined.</p>
<p>Reason: Vulnerability (PGV-2610853)</p>

---- Begin:  ----
cryptography 43.0.1 is Noncompliant in pypi.
Reason: Vulnerability (PGV-2610853)
<p>cryptography 43.0.1 is Noncompliant in pypi.</p>
<p>Reason: Vulnerability (PGV-2610853)</p>

---- Begin:  ----
cryptography 43.0.1 is Noncompliant in daasi-group.
Reason: Vulnerability (PGV-2610853)
<p>cryptography 43.0.1 is Noncompliant in daasi-group.</p>
<p>Reason: Vulnerability (PGV-2610853)</p>

---- Begin:  ----
cryptography 43.0.1 is Noncompliant in daasi-group.
Reason: Vulnerability (PGV-2610853)
<p>cryptography 43.0.1 is Noncompliant in daasi-group.</p>
<p>Reason: Vulnerability (PGV-2610853)</p>

---- Begin:  ----
cryptography 45.0.7 is Noncompliant in pypi.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 45.0.7 is Noncompliant in pypi.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 45.0.7 is Noncompliant in pypi.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 45.0.7 is Noncompliant in pypi.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 45.0.7 is Noncompliant in pypi-combined.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 45.0.7 is Noncompliant in pypi-combined.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 46.0.2 is Noncompliant in pypi.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 46.0.2 is Noncompliant in pypi.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 46.0.2 is Noncompliant in pypi.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 46.0.2 is Noncompliant in pypi.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 46.0.2 is Noncompliant in pypi-combined.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 46.0.2 is Noncompliant in pypi-combined.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 46.0.2 is Noncompliant in pypi-combined.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 46.0.2 is Noncompliant in pypi-combined.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 46.0.3 is Noncompliant in pypi.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 46.0.3 is Noncompliant in pypi.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 46.0.3 is Noncompliant in pypi.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 46.0.3 is Noncompliant in pypi.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 46.0.3 is Noncompliant in pypi.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 46.0.3 is Noncompliant in pypi.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 46.0.3 is Noncompliant in pypi.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 46.0.3 is Noncompliant in pypi.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 46.0.3 is Noncompliant in pypi-combined.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 46.0.3 is Noncompliant in pypi-combined.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 46.0.3 is Noncompliant in pypi-combined.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 46.0.3 is Noncompliant in pypi-combined.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 46.0.3 is Noncompliant in pypi-combined.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 46.0.3 is Noncompliant in pypi-combined.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 46.0.4 is Noncompliant in pypi.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 46.0.4 is Noncompliant in pypi.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 46.0.4 is Noncompliant in pypi.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 46.0.4 is Noncompliant in pypi.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
cryptography 46.0.4 is Noncompliant in pypi-combined.
Reason: Vulnerability (PGV-2610853); No license detected
<p>cryptography 46.0.4 is Noncompliant in pypi-combined.</p>
<p>Reason: Vulnerability (PGV-2610853); No license detected</p>

---- Begin:  ----
inetutils-telnet 2:2.4-2+deb12u1 is Noncompliant in debian.
Reason: Vulnerability (PGV-2608729); Vulnerability (PGV-2608720); No license detected
<p>inetutils-telnet 2:2.4-2+deb12u1 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2608729); Vulnerability (PGV-2608720); No license detected</p>

---- Begin:  ----
inetutils-telnet 2:2.4-2+deb12u2 is Noncompliant in debian-bookworm-security.
Reason: Vulnerability (PGV-2608729); Vulnerability (PGV-2608720); No license detected
<p>inetutils-telnet 2:2.4-2+deb12u2 is Noncompliant in debian-bookworm-security.</p>
<p>Reason: Vulnerability (PGV-2608729); Vulnerability (PGV-2608720); No license detected</p>

---- Begin:  ----
inetutils-telnet 2:2.4-2+deb12u3 is Noncompliant in debian-bookworm-security.
Reason: Vulnerability (PGV-2608729); Vulnerability (PGV-2608720); No license detected
<p>inetutils-telnet 2:2.4-2+deb12u3 is Noncompliant in debian-bookworm-security.</p>
<p>Reason: Vulnerability (PGV-2608729); Vulnerability (PGV-2608720); No license detected</p>

---- Begin:  ----
klibc-utils 2.0.12-1 is Noncompliant in debian.
Reason: Vulnerability (PGV-2603766); Vulnerability (PGV-2603774); Vulnerability (PGV-2603772); No license detected
<p>klibc-utils 2.0.12-1 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2603766); Vulnerability (PGV-2603774); Vulnerability (PGV-2603772); No license detected</p>

---- Begin:  ----
klibc-utils 2.0.14-1 is Noncompliant in debian.
Reason: Vulnerability (PGV-2603774); No license detected
<p>klibc-utils 2.0.14-1 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2603774); No license detected</p>

---- Begin:  ----
libklibc 2.0.12-1 is Noncompliant in debian.
Reason: Vulnerability (PGV-2603766); Vulnerability (PGV-2603774); Vulnerability (PGV-2603772); No license detected
<p>libklibc 2.0.12-1 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2603766); Vulnerability (PGV-2603774); Vulnerability (PGV-2603772); No license detected</p>

---- Begin:  ----
libklibc 2.0.14-1 is Noncompliant in debian.
Reason: Vulnerability (PGV-2603774); No license detected
<p>libklibc 2.0.14-1 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2603774); No license detected</p>

---- Begin:  ----
libnss3 2:3.110-1+deb13u1 is Noncompliant in debian.
Reason: Vulnerability (PGV-2616618); No license detected
<p>libnss3 2:3.110-1+deb13u1 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2616618); No license detected</p>

---- Begin:  ----
libnss3 2:3.110-1+deb13u1 is Noncompliant in debian-trixie-security.
Reason: Vulnerability (PGV-2616618); No license detected
<p>libnss3 2:3.110-1+deb13u1 is Noncompliant in debian-trixie-security.</p>
<p>Reason: Vulnerability (PGV-2616618); No license detected</p>

---- Begin:  ----
libnss3 2:3.110-1 is Noncompliant in debian.
Reason: Vulnerability (PGV-2616618); No license detected
<p>libnss3 2:3.110-1 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2616618); No license detected</p>

---- Begin:  ----
libnss3 2:3.61-1+deb11u5 is Noncompliant in debian-bullseye-security.
Reason: Vulnerability (PGV-2616923); Vulnerability (PGV-2616626); Vulnerability (PGV-2616618); Vulnerability (PGV-2616614); No license detected
<p>libnss3 2:3.61-1+deb11u5 is Noncompliant in debian-bullseye-security.</p>
<p>Reason: Vulnerability (PGV-2616923); Vulnerability (PGV-2616626); Vulnerability (PGV-2616618); Vulnerability (PGV-2616614); No license detected</p>

---- Begin:  ----
libnss3 2:3.87.1-1+deb12u1 is Noncompliant in debian-bookworm-security.
Reason: Vulnerability (PGV-2616923); Vulnerability (PGV-2616626); Vulnerability (PGV-2616618); Vulnerability (PGV-2616614); No license detected
<p>libnss3 2:3.87.1-1+deb12u1 is Noncompliant in debian-bookworm-security.</p>
<p>Reason: Vulnerability (PGV-2616923); Vulnerability (PGV-2616626); Vulnerability (PGV-2616618); Vulnerability (PGV-2616614); No license detected</p>

---- Begin:  ----
libnss3 2:3.87.1-1+deb12u2 is Noncompliant in debian-bookworm-security.
Reason: Vulnerability (PGV-2616923); Vulnerability (PGV-2616626); Vulnerability (PGV-2616618); Vulnerability (PGV-2616614); No license detected
<p>libnss3 2:3.87.1-1+deb12u2 is Noncompliant in debian-bookworm-security.</p>
<p>Reason: Vulnerability (PGV-2616923); Vulnerability (PGV-2616626); Vulnerability (PGV-2616618); Vulnerability (PGV-2616614); No license detected</p>

---- Begin:  ----
libnss3-dev 2:3.110-1+deb13u1 is Noncompliant in debian.
Reason: Vulnerability (PGV-2616618); No license detected
<p>libnss3-dev 2:3.110-1+deb13u1 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2616618); No license detected</p>

---- Begin:  ----
libnss3-dev 2:3.110-1+deb13u1 is Noncompliant in debian-trixie-security.
Reason: Vulnerability (PGV-2616618); No license detected
<p>libnss3-dev 2:3.110-1+deb13u1 is Noncompliant in debian-trixie-security.</p>
<p>Reason: Vulnerability (PGV-2616618); No license detected</p>

---- Begin:  ----
libnss3-dev 2:3.87.1-1+deb12u2 is Noncompliant in debian-bookworm-security.
Reason: Vulnerability (PGV-2616923); Vulnerability (PGV-2616626); Vulnerability (PGV-2616618); Vulnerability (PGV-2616614); No license detected
<p>libnss3-dev 2:3.87.1-1+deb12u2 is Noncompliant in debian-bookworm-security.</p>
<p>Reason: Vulnerability (PGV-2616923); Vulnerability (PGV-2616626); Vulnerability (PGV-2616618); Vulnerability (PGV-2616614); No license detected</p>

---- Begin:  ----
libnss3-tools 2:3.110-1+deb13u1 is Noncompliant in debian-trixie-security.
Reason: Vulnerability (PGV-2616618); No license detected
<p>libnss3-tools 2:3.110-1+deb13u1 is Noncompliant in debian-trixie-security.</p>
<p>Reason: Vulnerability (PGV-2616618); No license detected</p>

---- Begin:  ----
libpng-dev 1.6.39-2+deb12u1 is Noncompliant in debian.
Reason: Vulnerability (PGV-2603789); No license detected
<p>libpng-dev 1.6.39-2+deb12u1 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2603789); No license detected</p>

---- Begin:  ----
libpng-dev 1.6.39-2+deb12u3 is Noncompliant in debian-bookworm-security.
Reason: Vulnerability (PGV-2603789); No license detected
<p>libpng-dev 1.6.39-2+deb12u3 is Noncompliant in debian-bookworm-security.</p>
<p>Reason: Vulnerability (PGV-2603789); No license detected</p>

---- Begin:  ----
libpng-dev 1.6.39-2+deb12u4 is Noncompliant in debian-bookworm-security.
Reason: Vulnerability (PGV-2603789); No license detected
<p>libpng-dev 1.6.39-2+deb12u4 is Noncompliant in debian-bookworm-security.</p>
<p>Reason: Vulnerability (PGV-2603789); No license detected</p>

---- Begin:  ----
libpng-tools 1.6.39-2+deb12u3 is Noncompliant in debian-bookworm-security.
Reason: Vulnerability (PGV-2603789); No license detected
<p>libpng-tools 1.6.39-2+deb12u3 is Noncompliant in debian-bookworm-security.</p>
<p>Reason: Vulnerability (PGV-2603789); No license detected</p>

---- Begin:  ----
libpng-tools 1.6.39-2+deb12u4 is Noncompliant in debian-bookworm-security.
Reason: Vulnerability (PGV-2603789); No license detected
<p>libpng-tools 1.6.39-2+deb12u4 is Noncompliant in debian-bookworm-security.</p>
<p>Reason: Vulnerability (PGV-2603789); No license detected</p>

---- Begin:  ----
libsnmp40 5.9+dfsg-4+deb11u3 is Noncompliant in debian-bullseye-security.
Reason: Vulnerability (PGV-2601834); No license detected
<p>libsnmp40 5.9+dfsg-4+deb11u3 is Noncompliant in debian-bullseye-security.</p>
<p>Reason: Vulnerability (PGV-2601834); No license detected</p>

---- Begin:  ----
libsnmp40 5.9+dfsg-4+deb11u3 is Noncompliant in debian-bullseye-security.
Reason: Vulnerability (PGV-2601834); No license detected
<p>libsnmp40 5.9+dfsg-4+deb11u3 is Noncompliant in debian-bullseye-security.</p>
<p>Reason: Vulnerability (PGV-2601834); No license detected</p>

---- Begin:  ----
libsnmp40t64 5.9.4+dfsg-2+deb13u1 is Noncompliant in debian-trixie-security.
Reason: Vulnerability (PGV-2601826); No license detected
<p>libsnmp40t64 5.9.4+dfsg-2+deb13u1 is Noncompliant in debian-trixie-security.</p>
<p>Reason: Vulnerability (PGV-2601826); No license detected</p>

---- Begin:  ----
libsnmp40t64 5.9.4+dfsg-2 is Noncompliant in debian.
Reason: Vulnerability (PGV-2601826); No license detected
<p>libsnmp40t64 5.9.4+dfsg-2 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2601826); No license detected</p>

---- Begin:  ----
libsnmp-base 5.9.3+dfsg-2+deb12u1 is Noncompliant in debian-bookworm-security.
Reason: Vulnerability (PGV-2601826); Vulnerability (PGV-2601823); Vulnerability (PGV-2601820); No license detected
<p>libsnmp-base 5.9.3+dfsg-2+deb12u1 is Noncompliant in debian-bookworm-security.</p>
<p>Reason: Vulnerability (PGV-2601826); Vulnerability (PGV-2601823); Vulnerability (PGV-2601820); No license detected</p>

---- Begin:  ----
libsnmp-base 5.9.3+dfsg-2 is Noncompliant in debian.
Reason: Vulnerability (PGV-2601826); Vulnerability (PGV-2601823); Vulnerability (PGV-2601820); No license detected
<p>libsnmp-base 5.9.3+dfsg-2 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2601826); Vulnerability (PGV-2601823); Vulnerability (PGV-2601820); No license detected</p>

---- Begin:  ----
libsnmp-base 5.9.4+dfsg-2+deb13u1 is Noncompliant in debian-trixie-security.
Reason: Vulnerability (PGV-2601826); No license detected
<p>libsnmp-base 5.9.4+dfsg-2+deb13u1 is Noncompliant in debian-trixie-security.</p>
<p>Reason: Vulnerability (PGV-2601826); No license detected</p>

---- Begin:  ----
libsnmp-base 5.9.4+dfsg-2 is Noncompliant in debian.
Reason: Vulnerability (PGV-2601826); No license detected
<p>libsnmp-base 5.9.4+dfsg-2 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2601826); No license detected</p>

---- Begin:  ----
libsnmp-base 5.9+dfsg-4+deb11u3 is Noncompliant in debian-bullseye-security.
Reason: Vulnerability (PGV-2601834); Vulnerability (PGV-2601826); Vulnerability (PGV-2601823); Vulnerability (PGV-2601820); No license detected
<p>libsnmp-base 5.9+dfsg-4+deb11u3 is Noncompliant in debian-bullseye-security.</p>
<p>Reason: Vulnerability (PGV-2601834); Vulnerability (PGV-2601826); Vulnerability (PGV-2601823); Vulnerability (PGV-2601820); No license detected</p>

---- Begin:  ----
libtasn1-6 4.19.0-2+deb12u1 is Noncompliant in debian.
Reason: Vulnerability (PGV-2603126); Vulnerability (PGV-2603138); Vulnerability (PGV-2603132); No license detected
<p>libtasn1-6 4.19.0-2+deb12u1 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2603126); Vulnerability (PGV-2603138); Vulnerability (PGV-2603132); No license detected</p>

---- Begin:  ----
libtasn1-6 4.19.0-2+deb12u1 is Noncompliant in debian-bookworm-security.
Reason: Vulnerability (PGV-2603126); Vulnerability (PGV-2603138); Vulnerability (PGV-2603132); No license detected
<p>libtasn1-6 4.19.0-2+deb12u1 is Noncompliant in debian-bookworm-security.</p>
<p>Reason: Vulnerability (PGV-2603126); Vulnerability (PGV-2603138); Vulnerability (PGV-2603132); No license detected</p>

---- Begin:  ----
libtasn1-6 4.19.0-3ubuntu0.24.04.2 is Noncompliant in ubuntu.
Reason: Vulnerability (PGV-2603138); Vulnerability (PGV-2603132); No license detected
<p>libtasn1-6 4.19.0-3ubuntu0.24.04.2 is Noncompliant in ubuntu.</p>
<p>Reason: Vulnerability (PGV-2603138); Vulnerability (PGV-2603132); No license detected</p>

---- Begin:  ----
libtasn1-6 4.20.0-2 is Noncompliant in debian.
Reason: Vulnerability (PGV-2603138); Vulnerability (PGV-2603132); No license detected
<p>libtasn1-6 4.20.0-2 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2603138); Vulnerability (PGV-2603132); No license detected</p>

---- Begin:  ----
python39-setuptools 44.1.1-150300.7.12.1 is Noncompliant in opensuse-update-sle-15.6.
Reason: Vulnerability (PGV-2384240); No license detected
<p>python39-setuptools 44.1.1-150300.7.12.1 is Noncompliant in opensuse-update-sle-15.6.</p>
<p>Reason: Vulnerability (PGV-2384240); No license detected</p>

---- Begin:  ----
python3-pil 11.1.0-5+deb13u1 is Noncompliant in debian-trixie-security.
Reason: Vulnerability (PGV-2612706); No license detected
<p>python3-pil 11.1.0-5+deb13u1 is Noncompliant in debian-trixie-security.</p>
<p>Reason: Vulnerability (PGV-2612706); No license detected</p>

---- Begin:  ----
python3-pil.imagetk 11.1.0-5+deb13u1 is Noncompliant in debian-trixie-security.
Reason: Vulnerability (PGV-2612706); No license detected
<p>python3-pil.imagetk 11.1.0-5+deb13u1 is Noncompliant in debian-trixie-security.</p>
<p>Reason: Vulnerability (PGV-2612706); No license detected</p>

---- Begin:  ----
snmp 5.9.3+dfsg-2+deb12u1 is Noncompliant in debian-bookworm-security.
Reason: Vulnerability (PGV-2601826); Vulnerability (PGV-2601823); Vulnerability (PGV-2601820); No license detected
<p>snmp 5.9.3+dfsg-2+deb12u1 is Noncompliant in debian-bookworm-security.</p>
<p>Reason: Vulnerability (PGV-2601826); Vulnerability (PGV-2601823); Vulnerability (PGV-2601820); No license detected</p>

---- Begin:  ----
snmp 5.9.3+dfsg-2 is Noncompliant in debian.
Reason: Vulnerability (PGV-2601826); Vulnerability (PGV-2601823); Vulnerability (PGV-2601820); No license detected
<p>snmp 5.9.3+dfsg-2 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2601826); Vulnerability (PGV-2601823); Vulnerability (PGV-2601820); No license detected</p>

---- Begin:  ----
snmp 5.9.4+dfsg-2+deb13u1 is Noncompliant in debian-trixie-security.
Reason: Vulnerability (PGV-2601826); No license detected
<p>snmp 5.9.4+dfsg-2+deb13u1 is Noncompliant in debian-trixie-security.</p>
<p>Reason: Vulnerability (PGV-2601826); No license detected</p>

---- Begin:  ----
snmp 5.9.4+dfsg-2 is Noncompliant in debian.
Reason: Vulnerability (PGV-2601826); No license detected
<p>snmp 5.9.4+dfsg-2 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2601826); No license detected</p>

---- Begin:  ----
telnet 0.17+2.4-2+deb12u1 is Noncompliant in debian.
Reason: Vulnerability (PGV-2608729); Vulnerability (PGV-2608720); No license detected
<p>telnet 0.17+2.4-2+deb12u1 is Noncompliant in debian.</p>
<p>Reason: Vulnerability (PGV-2608729); Vulnerability (PGV-2608720); No license detected</p>

---- Begin:  ----
telnet 0.17+2.4-2+deb12u2 is Noncompliant in debian-bookworm-security.
Reason: Vulnerability (PGV-2608729); Vulnerability (PGV-2608720); No license detected
<p>telnet 0.17+2.4-2+deb12u2 is Noncompliant in debian-bookworm-security.</p>
<p>Reason: Vulnerability (PGV-2608729); Vulnerability (PGV-2608720); No license detected</p>

---- Begin:  ----
telnet 0.17+2.4-2+deb12u3 is Noncompliant in debian-bookworm-security.
Reason: Vulnerability (PGV-2608729); Vulnerability (PGV-2608720); No license detected
<p>telnet 0.17+2.4-2+deb12u3 is Noncompliant in debian-bookworm-security.</p>
<p>Reason: Vulnerability (PGV-2608729); Vulnerability (PGV-2608720); No license detected</p>

However these notifications of Non-compliant Packages have been done on April 11th.

geraldizo_0690

Hi,

Thanks for the response. We have the version 2025.25 (Build 11) with MSSQL

Those are just a few examples. However, there are more packages from Debian or other Feedstypes that are associated with security vulnerabilities from PyPi and NPM.

geraldizo_0690

Hello There,

Since April 11, 2026 00:45:46, there have suddenly been several security vulnerabilities flagged as critical, even though their CVSS scores are well below 9.0.

For example, there are many Debian packages that have been blocked due to security vulnerabilities in PyPI or NPM.

Here are some screenshots illustrating this. Are these classifications really correct?

geraldizo_0690

I actually haven't looked into pgutil yet. I'll check it out.

But overall, ProGet does a pretty good job. Right now, I really can't think of anything that ProGet can solve uniquely.

geraldizo_0690

The intended use case is to improve the identification of vulnerable software packages in circulation.

This would allow me to determine which package(deb or rpm) on which host is at risk, thereby notifying the host owner and taking further action. However, the number of software packages on individual hosts can be very high.

On the Otter side, of course, systems can be administered with ease and an additional vault system. The use of inventoried configurations via groups and roles is particularly easy to implement. You wouldn’t need to learn any additional configuration or scripting language for this. You can, of course, learn OtterScript. But you don’t have to. It offers simple integration with Linux and Windows systems. Such a tool is particularly ideal for Windows server systems.

Perhaps you should continue to retain the usage/statistics in Proget. After all, the package/container scanner only needs JSON to feed the usage/statistics with information.

geraldizo_0690

Thank you very much.

geraldizo_0690

Hi, thanks for the info.

We find this feature very interesting because packages can be tracked using Proget and Otter.
This allows users to check whether the packages they use have already been updated with the latest security updates.

But it’s not a big deal if the feature is no longer supported soon.

It appears to be just a JSON interface that is used between Proget and Otter.

Btw. Offtopic

Can you take a look here again, I find it better to continue this thread instead of opening a new thread with the same topic:
https://forums.inedo.com/topic/5635/support-for-notautomatic-butautomaticupgrades-headers-in-debian-feed-release-files?_=1775537208917

Thank you very much

geraldizo_0690

Additional Information:

proget[1916719]: Scan using Otter at http://otter/ failed: Unexpected character encountered while parsing value: <. Path '', line 0, position 0.

geraldizo_0690

Dear Supporters,

we are trying to get Package/Container Usage work.

Our Testenvironment in containers:

ProGet 2025.24(Build 5)
MSSQL
Otter 2025.3 (Build 1)

The problem is, as soon as a server has been assigned into a role, for executing checkconfiguration with activated "Configuration drift:", the package/container scanner inside of ProGet will get the following error while scanning. And there is no information about package usage have been transfered from otter to proget.

Have any clue, why is this happening?

Scan using Otter at http://otter/ failed: Invalid name.

System.ArgumentException: Invalid name.
   at Inedo.UPack.UniversalPackageId.Parse(String s)
   at Inedo.ProGet.Extensions.PackageContainerScanners.OtterScanner.OtterPackageData..ctor(String server, FeedType type, JObject obj) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E648765\Src\src\ProGet\Extensions\PackageContainerScanners\OtterScanner.cs:line 147
   at Inedo.ProGet.Extensions.PackageContainerScanners.OtterScanner.<>c__DisplayClass12_0.<ReadPackages>b__0(JObject p) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E648765\Src\src\ProGet\Extensions\PackageContainerScanners\OtterScanner.cs:line 128
   at System.Linq.Enumerable.ConcatIterator`1.MoveNext()
   at Inedo.ProGet.Service.PackageContainerScannerRunner.GetPackageRecords(Context db, IEnumerable`1 packages)+MoveNext() in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E648765\Src\src\ProGet\Service\TaskRunners\PackageContainerScannerRunner.cs:line 71
   at System.Collections.Generic.List`1..ctor(IEnumerable`1 collection)
   at System.Linq.Enumerable.ToList[TSource](IEnumerable`1 source)
   at Inedo.ProGet.Service.PackageContainerScannerRunner.ScanAsync(TaskRunnerSubtask`1 subtask, PackageContainerScanner scanner) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E648765\Src\src\ProGet\Service\TaskRunners\PackageContainerScannerRunner.cs:line 46

::PackageContainerScannerRunner Error on 04/01/2026 10:12:11::

Thank you.
Best regards

geraldizo_0690

I have a small issue to report. Btw. adding the headers works perfectly. However, the fields don't allow spaces. Like here to see. "Debian Backports"
Can you make the fields compatible for values with spaces?

geraldizo_0690

proget:25.0.22-ci.4 seems to work.

The CPU consumption stays steady while ProGet is not under heavy load. The Debian connectors does not grow infitely. So for the third day this is the output:

root@xxxxxxxxxxxxxx:/usr/share/ProGet/LocalStorage/Connectors# du -chs * | grep G
2.6G    total

I'll get back to you on this in a week.
Thank you for the support.

geraldizo_0690

Hi,

we had the same issue.

For Debian Trixie, there is a negative effect with sqv (Seqouia Verification Tool) using the universal signing key. When verifying the signing key, a message with (... --not-after ...) and exit status 1 is displayed. It is necessary to check whether the time has been synchronized correctly!!!

Here is what you need to check:

timedatectl
 ...
 System clock synchronized: yes # It should be yes, if your environment is using ntp-server.
 ...

geraldizo_0690

@gdivis Thank you very much. We will do the test. Stay tuned for my feedback.

geraldizo_0690

Thank you for your response. We also have a Proget test environment where we can test this. We would like to test it.

Here is another example of this behavior. These are only Debian connectors:

root@xxxxxxxxxxxxxx:/usr/share/ProGet/LocalStorage/Connectors# du -chs * | grep G
2.4G    C104
2.5G    C105
2.5G    C106
62G     C117
13G     C266
9.2G    C268
15G     C281
3.1G    C63
119G    total

geraldizo_0690

Hi,

some Debian feeds, especially for kali-rolling, are very slow after a day since the connector was renewed. I have to repeatedly reset or renew the connector in order to be able to work with it.

If not, an “apt update” takes several minutes or it is going to be stucked up. The index.sqlite files grow to up to 50 GB. In addition, index.sqilte3-shm and -wal also grow to almost the same size. And CPU consumption increases proportionally to these problems. And if the connectors are not renewed, the sqlite database consumes all the available storage space in the partition where the volumes for packages are located.

Additional Information:

Upstream link that we are testing and using:
http://mirror.netcologne.de/kali/
http://http.kali.org/kali

ProGet version: 2025.20(Build 23) with external database (MSSQL), both in containers

Connector configuration: Index poll frequency is already set to triple digits in minutes.

Further Information I've already researched:

Please investigate this behavior. In addition to RPM repos, we also use a lot of Debian repos.
If the cause is known, can you implement additional clean measures in addition to “Index poll frequency”?

Can the problem perhaps be avoided by using a proxy?

geraldizo_0690

Update:

And we found some images like busybox:1.37 which is directly pulled from upstream dockerhub. This is the same case. The ProGet-Layer-Scanner is not able to find any packages in there.

geraldizo_0690

Hi,

thanks for quick response.

Yes, we do see that logs. And we are not using gzip as compression-format. So this is a naturely the effect, when we are using zstd. right?

For the moment is the solution, to avoid using other compression-format, because ProGet Layer-Scanner is not supporting zstd???

geraldizo_0690

Hello,

We always use podman push with --compression-format=zstd:chunked in our CI/CD.

But when it comes to layer scanning on ProGet, neither the packages nor the vulnerabilities are suddenly listed for the pushed images.

Otherwise, images pushed with the default settings of podman push are scanned correctly.

Thank you very much and best regards