基础信息
项目名称：greenplum-db/gpdb
项目徽章：
仓库地址：https://github.com/pterodactyl/panel
检测报告地址：https://www.murphysec.com/console/report/1718361226185850880/1718361226223599616
此报告由Murphysec提供
漏洞列表
| 漏洞名称 | 漏洞类型 | MPS编号 | CVE编号 | 漏洞等级 |
|---|---|---|---|---|
| 低危 | ||||
| GNU Libiberty 安全漏洞 | 输入验证不恰当 | MPS-2017-1331 | CVE-2016-6131 | 高危 |
| libiberty 数字错误漏洞 | 整数溢出或环绕 | MPS-2017-2066 | CVE-2016-2226 | 高危 |
| libiberty 安全漏洞 | UAF | MPS-2017-2070 | CVE-2016-4487 | 中危 |
| libiberty 安全漏洞 | UAF | MPS-2017-2071 | CVE-2016-4488 | 中危 |
| libiberty 数字错误漏洞 | 整数溢出或环绕 | MPS-2017-2072 | CVE-2016-4489 | 中危 |
| libiberty 数字错误漏洞 | 整数溢出或环绕 | MPS-2017-2073 | CVE-2016-4490 | 中危 |
| libiberty 安全漏洞 | 缓冲区溢出 | MPS-2017-2074 | CVE-2016-4491 | 中危 |
| libiberty 缓冲区错误漏洞 | 缓冲区溢出 | MPS-2017-2075 | CVE-2016-4492 | 中危 |
| libiberty 安全漏洞 | 越界读取 | MPS-2017-2076 | CVE-2016-4493 | 中危 |
| GNU Binutils 安全漏洞 | 不可达退出条件的循环（无限循环） | MPS-2018-14162 | CVE-2018-18700 | 中危 |
| GNU Binutils GNU libiberty 安全漏洞 | 拒绝服务 | MPS-2018-8266 | CVE-2018-12698 | 高危 |
| GNU Binutils 缓冲区错误漏洞 | 越界读取 | MPS-2019-1889 | CVE-2019-9070 | 高危 |
| PostgreSQL 缓冲区错误漏洞 | 越界写入 | MPS-2019-7109 | CVE-2019-10164 | 高危 |
| PostgreSQL 安全漏洞 | 特权上下文切换错误 | MPS-2020-17359 | CVE-2020-25696 | 高危 |
| GNU libiberty 缓冲区错误漏洞 | 缓冲区溢出 | MPS-2021-32366 | CVE-2021-3826 | 高危 |
| PostgreSQL 安全漏洞 | 凭证保护不足 | MPS-2021-35115 | CVE-2021-23222 | 中危 |
| Python 安全漏洞 | ReDoS | MPS-2022-57238 | CVE-2022-40897 | 中危 |
| PostgreSQL 存在内存泄露漏洞 | 内存泄漏 | MPS-2022-58489 | CVE-2022-41862 | 中危 |
缺陷组件
| 组件名称 | 版本 | 最小修复版本 | 依赖关系 | 修复建议 |
|---|---|---|---|---|
| libpq | 9.6.19 | 间接依赖 | 建议修复 | |
| libiberty | 9.1.0 | 间接依赖 | 建议修复 | |
| golang.org/x/net | v0.10.0 | 0.17.0 | 间接依赖 | 可选修复 |
| setuptools | 34 | 65.5.1 | 间接依赖 | 可选修复 |
许可证风险
| 许可证类型 | 相关组件 | 许可证风险 |
|---|---|---|
| LGPL-2.1 | 2 | 中 |
| BSD-3-Clause | 10 | 低 |
| MIT | 23 | 低 |
| BSD-2-Clause | 2 | 低 |
| 自定义许可证 | 10 | 低 |
| Apache-2.0 | 9 | 低 |
| PostgreSQL | 1 | 低 |
| GPL-2.0-or-later | 1 | 低 |
| GPL-3.0 | 1 | 中 |
| MPL-2.0 | 1 | 低 |
SBOM清单
| 组件名称 | 组件版本 | 是否直接依赖 | 仓库 |
|---|---|---|---|
| libiberty | 9.1.0 | 间接依赖 | |
| EINVAL | 间接依赖 | pip | |
| DbURL | 间接依赖 | pip | |
| egg_info | 间接依赖 | pip | |
| golang.org/x/net | v0.10.0 | 间接依赖 | go |
| error | 间接依赖 | pip | |
| github.com/jackc/pgpassfile | v1.0.0 | 间接依赖 | go |
| github.com/pkg/errors | v0.9.1 | 间接依赖 | go |
| libpq | 间接依赖 | ||
| indirect2 | 间接依赖 | pip | |
| start_database_if_not_started | 间接依赖 | pip | |
| github.com/jackc/pgio | v1.0.0 | 间接依赖 | go |
| connect | 间接依赖 | pip | |
| get_abi3_suffix | 间接依赖 | pip | |
| rst.linker | 1.9 | 间接依赖 | pip |
| PIPE | 间接依赖 | pip | |
| DistutilsOptionError | 间接依赖 | pip | |
| github.com/spf13/cast | v1.5.1 | 间接依赖 | go |
| drop_database_if_exists | 间接依赖 | pip | |
| google.golang.org/protobuf | v1.30.0 | 直接依赖 | go |
| http_client | 间接依赖 | pip | |
| github.com/golang/protobuf | v1.5.3 | 间接依赖 | go |
| SegmentReconfigurer | 间接依赖 | pip | |
| GpTestCase | 间接依赖 | pip | |
| when | 间接依赖 | pip | |
| raise_from | 间接依赖 | pip | |
| call | 间接依赖 | pip | |
| mock | 5.0.0 | 间接依赖 | pip |
| timedelta | 间接依赖 | pip | |
| PIDLockHeld | 间接依赖 | pip | |
| github.com/spf13/cobra | v1.6.1 | 直接依赖 | go |
| manifest_maker | 间接依赖 | pip | |
| run_tests | 间接依赖 | pip | |
| github.com/jackc/pgservicefile | v0.0.0-20221227161230-091c0ba34f0a | 间接依赖 | go |
| PKG_DIRECTORY | 间接依赖 | pip | |
| build_ext | 间接依赖 | pip | |
| GpArray | 间接依赖 | pip | |
| setuptools | 34 | 间接依赖 | pip |
| splitext | 间接依赖 | pip | |
| check_values | 间接依赖 | pip | |
| github.com/jackc/pgconn | v1.14.0 | 间接依赖 | go |
| github.com/blang/semver | v3.5.1+incompatible | 间接依赖 | go |
| indirect1 | 间接依赖 | pip | |
| libpq | 9.6.19 | 间接依赖 | |
| MagicMock | 间接依赖 | pip | |
| net.ipv4.ip_local_reserved_ports | 65330 | 间接依赖 | pip |
| Popen | 间接依赖 | pip | |
| initialize | 间接依赖 | pip | |
| gopkg.in/yaml.v3 | v3.0.1 | 间接依赖 | go |
| get_config_vars | 间接依赖 | pip | |
| pylint | 间接依赖 | pip | |
| gppylib | 间接依赖 | pip | |
| OperationWorkerPool | 间接依赖 | pip | |
| path | 间接依赖 | pip | |
| github.com/subosito/gotenv | v1.4.2 | 间接依赖 | go |
| get_config_var | 间接依赖 | pip | |
| github.com/golang/mock | v1.6.0 | 直接依赖 | go |
| given | 间接依赖 | pip | |
| github.com/jmoiron/sqlx | v1.3.5 | 间接依赖 | go |
| a | 间接依赖 | pip | |
| github.com/spf13/afero | v1.9.5 | 间接依赖 | go |
| google.golang.org/genproto | v0.0.0-20230410155749-daa745c078e1 | 间接依赖 | go |
| StateMachine | 间接依赖 | pip | |
| behave | 间接依赖 | pip | |
| commands | 间接依赖 | pip | |
| github.com/spf13/jwalterweatherman | v1.1.0 | 间接依赖 | go |
| ProgramArgumentValidationException | 间接依赖 | pip | |
| github.com/spf13/pflag | v1.0.5 | 间接依赖 | go |
| github.com/greenplum-db/gp-common-go-libs | v1.0.11 | 直接依赖 | go |
| Command | 间接依赖 | pip | |
| check_output | 间接依赖 | pip | |
| github.com/fsnotify/fsnotify | v1.6.0 | 间接依赖 | go |
| Configuration | 间接依赖 | pip | |
| logilab | 间接依赖 | pip | |
| geos | 间接依赖 | ||
| ExecutionError | 间接依赖 | pip | |
| gparray | 间接依赖 | pip | |
| golang.org/x/crypto | v0.9.0 | 间接依赖 | go |
| Segment | 间接依赖 | pip | |
| pkg_resources | 间接依赖 | pip | |
| plpgsql | 间接依赖 | perl | |
| gpconfig_modules | 间接依赖 | pip | |
| PostgreSQL | 9.5.0 | 间接依赖 | perl |
| map | 间接依赖 | pip | |
| Mock | 间接依赖 | pip | |
| github.com/jackc/pgproto3/v2 | v2.3.2 | 间接依赖 | go |
| github.com/jackc/pgtype | v1.14.0 | 间接依赖 | go |
| github.com/google/go-cmp | v0.5.9 | 间接依赖 | go |
| google.golang.org/grpc | v1.55.0 | 直接依赖 | go |
| iteritems | 间接依赖 | pip | |
| product | 间接依赖 | pip | |
| recoveryinfo | 间接依赖 | pip | |
| WorkerPool | 间接依赖 | pip | |
| RemoveFile | 间接依赖 | pip | |
| task | 间接依赖 | pip | |
| UserData | 间接依赖 | pip | |
| line_reader | 间接依赖 | pip | |
| imports | 间接依赖 | pip | |
| jaraco.packaging | 3.2 | 间接依赖 | pip |
| DistutilsError | 间接依赖 | pip | |
| github.com/jackc/pgx/v4 | v4.18.1 | 间接依赖 | go |
| GpAddMirrorsProgram | 间接依赖 | pip | |
| golang.org/x/sys | v0.8.0 | 间接依赖 | go |
| ENOENT | 间接依赖 | pip | |
| github.com/mitchellh/mapstructure | v1.5.0 | 间接依赖 | go |
| then | 间接依赖 | pip | |
| github.com/onsi/gomega | v1.27.2 | 间接依赖 | go |
| github.com/hashicorp/hcl | v1.0.0 | 间接依赖 | go |
| github.com/spf13/viper | v1.16.0 | 直接依赖 | go |
| join | 间接依赖 | pip | |
| FTS_PROBE_QUERY | 间接依赖 | pip | |
| starmap | 间接依赖 | pip | |
| github.com/inconshreveable/mousetrap | v1.0.1 | 间接依赖 | go |
| github.com/magiconair/properties | v1.8.7 | 间接依赖 | go |
| github.com/jackc/chunkreader/v2 | v2.0.1 | 间接依赖 | go |
| DistutilsFileError | 间接依赖 | pip | |
| patch | 间接依赖 | pip | |
| TEST_local_base | 间接依赖 | pip | |
| state | 间接依赖 | pip | |
| github.com/pelletier/go-toml/v2 | v2.0.8 | 间接依赖 | go |
| customize_compiler | 间接依赖 | pip | |
| PY_COMPILED | 间接依赖 | pip | |
| get_path | 间接依赖 | pip | |
| gplog | 间接依赖 | pip | |
| PIDLockFile | 间接依赖 | pip | |
| RemoveDirectory | 间接依赖 | pip | |
| gopkg.in/ini.v1 | v1.67.0 | 间接依赖 | go |
| github.com/DATA-DOG/go-sqlmock | v1.5.0 | 间接依赖 | go |
| the | 间接依赖 | pip | |
| KERNEL32.dll | 间接依赖 | ||
| golang.org/x/text | v0.9.0 | 间接依赖 | go |
| REMOTE | 间接依赖 | pip |