3.4 - Security fixes
Security fixes provided in 3.4.5-funcrel
| CAST service | CVE | Severity | Description/Package | Affected CAST release |
|---|---|---|---|---|
| admin-center | CVE-2025-4949 | Critical | org.eclipse.jgit:org.eclipse.jgit | 3.4.4-funcrel |
| admin-center | CVE-2020-36843 | High | net.i2p.crypto:eddsa | 3.4.4-funcrel |
| admin-center | CVE-2025-46392 | High | commons-configuration:commons-configuration | 3.4.4-funcrel |
| admin-center | CVE-2025-48924 | High | org.apache.commons:commons-lang3, commons-lang:commons-lang | 3.4.4-funcrel |
| ai-service | CVE-2025-7709 | Critical | libsqlite3-0 | 3.4.4-funcrel |
| ai-service | CVE-2025-9230 | Critical | openssl, libssl3t64, openssl-provider-legacy | 3.4.4-funcrel |
| ai-service | CVE-2025-3262 | High | transformers | 3.4.4-funcrel |
| ai-service | CVE-2025-6921 | High | transformers | 3.4.4-funcrel |
| ai-service | CVE-2025-8941 | High | libpam0g, libpam-runtime, libpam-modules, libpam-modules-bin | 3.4.4-funcrel |
| ai-service | CVE-2025-9231 | High | openssl, libssl3t64, openssl-provider-legacy | 3.4.4-funcrel |
| ai-service | CVE-2025-9232 | High | openssl, libssl3t64, openssl-provider-legacy | 3.4.4-funcrel |
| ai-service | CVE-2025-3263 | Medium | transformers | 3.4.4-funcrel |
| ai-service | CVE-2025-3264 | Medium | transformers | 3.4.4-funcrel |
| ai-service | CVE-2025-3777 | Medium | transformers | 3.4.4-funcrel |
| ai-service | CVE-2025-3933 | Medium | transformers | 3.4.4-funcrel |
| ai-service | CVE-2025-5197 | Medium | transformers | 3.4.4-funcrel |
| ai-service | CVE-2025-6051 | Medium | transformers | 3.4.4-funcrel |
| ai-service | CVE-2025-6638 | Medium | transformers | 3.4.4-funcrel |
| ai-service | CVE-2025-8869 | Medium | pip | 3.4.4-funcrel |
| analysis-node | CVE-2025-48924 | High | org.apache.commons:commons-lang3 | 3.4.4-funcrel |
| analysis-node | CVE-2022-45787 | Medium | org.apache.james:apache-mime4j | 3.4.4-funcrel |
| analysis-node | CVE-2023-4218 | Medium | org.eclipse.platform:org.eclipse.core.runtime | 3.4.4-funcrel |
| analysis-node | CVE-2025-8869 | Medium | pip | 3.4.4-funcrel |
| auth | CVE-2025-46392 | High | commons-configuration:commons-configuration | 3.4.4-funcrel |
| auth | CVE-2025-48924 | High | org.apache.commons:commons-lang3, commons-lang:commons-lang | 3.4.4-funcrel |
| gateway | CVE-2025-22227 | High | io.projectreactor.netty:reactor-netty-http | 3.4.4-funcrel |
| gateway | CVE-2025-41249 | High | org.springframework:spring-core | 3.4.4-funcrel |
| gateway | CVE-2025-46392 | High | commons-configuration:commons-configuration | 3.4.4-funcrel |
| gateway | CVE-2025-48924 | High | org.apache.commons:commons-lang3, commons-lang:commons-lang | 3.4.4-funcrel |
| gateway | CVE-2020-13956 | High | org.apache.httpcomponents:httpclient | 3.4.4-funcrel |
| gateway | CVE-2025-41242 | High | org.springframework:spring-webmvc | 3.4.4-funcrel |
| neo4j | CVE-2025-22227 | High | io.projectreactor.netty:reactor-netty-http | 3.4.4-funcrel |
| neo4j | CVE-2025-48924 | High | org.apache.commons:commons-lang3 | 3.4.4-funcrel |
| neo4j | CVE-2025-53864 | High | com.nimbusds:nimbus-jose-jwt | 3.4.4-funcrel |
| sso-service | CVE-2025-48924 | High | org.apache.commons:commons-lang3 | 3.4.4-funcrel |
| imaging-viewer | CVE-2025-9230 | Critical | libssl3, libcrypto3 | 3.4.4-funcrel |
| imaging-viewer | CVE-2025-9231 | High | libssl3, libcrypto3 | 3.4.4-funcrel |
| imaging-viewer | CVE-2025-9232 | High | libssl3, libcrypto3 | 3.4.4-funcrel |
| imaging-viewer | CVE-2025-47910 | Medium | Go | 3.4.4-funcrel |
| postgresql | CVE-2025-49794 | Critical | libxml2 | 3.4.4-funcrel |
| postgresql | CVE-2025-49796 | Critical | libxml2 | 3.4.4-funcrel |
| postgresql | CVE-2025-49795 | High | libxml2 | 3.4.4-funcrel |
| postgresql | CVE-2025-6021 | High | libxml2 | 3.4.4-funcrel |
| postgresql | CVE-2025-6170 | Low | libxml2 | 3.4.4-funcrel |
Security fixes provided in 3.4.4-funcrel
| CAST image | CVE | Severity | Description | Affected CAST release |
|---|---|---|---|---|
| admin-center | CVE-2025-41249 | HIGH | org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability | 3.4.3-funcrel |
| auth-service | CVE-2025-41248 | HIGH | org.springframework.security/spring-security-core: Spring Security authorization bypass | 3.4.3-funcrel |
| auth-service | CVE-2025-41249 | HIGH | org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability | 3.4.3-funcrel |
| gateway | CVE-2025-41249 | HIGH | org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability | 3.4.3-funcrel |
| analysis-node | CVE-2025-58060 | HIGH | cups: Authentication Bypass in CUPS Authorization Handling | 3.4.3-funcrel |
| dashboards | CVE-2025-41249 | HIGH | org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability | 3.4.3-funcrel |
| ai-service | CVE-2025-58050 | HIGH | pcre2: PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS | 3.4.3-funcrel |
Security fixes provided in 3.4.3-funcrel
| CAST image | CVE | Severity | Description | Affected CAST release |
|---|---|---|---|---|
| admin-center | CVE-2025-48989 | HIGH | tomcat: http/2 “MadeYouReset” DoS attack through HTTP/2 control frames | 3.4.2-funcrel |
| admin-center | CVE-2025-55163 | HIGH | netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability | 3.4.2-funcrel |
| analysis-node | CVE-2025-47273 | HIGH | setuptools: Path Traversal Vulnerability in setuptools PackageIndex | 3.4.2_core8.4.5 |
| analysis-node | CVE-2025-5914 | HIGH | libarchive: Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c | 3.4.2_core8.4.5 |
| analysis-node | CVE-2025-6020 | HIGH | linux-pam: Linux-pam directory Traversal | 3.4.2_core8.4.5 |
| analysis-node | CVE-2025-8941 | HIGH | linux-pam: Incomplete fix for CVE-2025-6020 | 3.4.2_core8.4.5 |
| ai-service | CVE-2025-6984 | HIGH | langchain-community: Langchain-community insecure XML parsing | 3.4.2-funcrel |
| auth-service | CVE-2025-55163 | HIGH | netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability | 3.4.2-funcrel |
| console | CVE-2025-55163 | HIGH | netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability | 3.4.2-funcrel |
| dashboards-v3 | CVE-2025-48989 | HIGH | tomcat: http/2 “MadeYouReset” DoS attack through HTTP/2 control frames | 3.4.2-funcrel |
| gateway | CVE-2025-48989 | HIGH | tomcat: http/2 “MadeYouReset” DoS attack through HTTP/2 control frames | 3.4.2-funcrel |
| gateway | CVE-2025-55163 | HIGH | netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability | 3.4.2-funcrel |
| neo4j | CVE-2025-58060 | HIGH | cups: Authentication Bypass in CUPS Authorization Handling | 3.4.2-funcrel |
| neo4j | CVE-2025-6020 | HIGH | linux-pam: Linux-pam directory Traversal | 3.4.2-funcrel |
| neo4j | CVE-2025-8941 | HIGH | linux-pam: Incomplete fix for CVE-2025-6020 | 3.4.2-funcrel |
| sso-service | CVE-2025-55163 | HIGH | netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability | 3.4.2-funcrel |
| viewer | - | - | Removal of fast-glob NPM glob pattern matching package | 3.4.2-funcrel |
Security fixes provided in 3.4.1-funcrel
| CAST image | CVE | Severity | Description | Affected CAST release |
|---|---|---|---|---|
| admin-center | CVE-2022-41404 | HIGH | org.ini4j: unspecified DoS | 3.4.0-funcrel |
| admin-center | CVE-2025-6965 | CRITICAL | sqlite: Integer Truncation in SQLite | 3.4.0-funcrel |
| analysis-node | CVE-2022-41404 | HIGH | org.ini4j: unspecified DoS | 3.4.0-funcrel_core8.4.4 |
| analysis-node | CVE-2025-30761 | HIGH | openjdk: Improve scripting supports (Oracle CPU 2025-07) | 3.4.0-funcrel_core8.4.4 |
| analysis-node | CVE-2025-48976 | HIGH | apache-commons-fileupload: Apache Commons FileUpload DoS via part headers | 3.4.0-funcrel_core8.4.4 |
| auth-service | CVE-2025-6965 | CRITICAL | sqlite: Integer Truncation in SQLite | 3.4.0-funcrel |
| console | CVE-2025-6965 | CRITICAL | sqlite: Integer Truncation in SQLite | 3.4.0-funcrel |
| dashboards | CVE-2022-41404 | HIGH | org.ini4j: unspecified DoS | 3.4.0-funcrel |
| etl-service | CVE-2025-22868 | HIGH | golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws | 3.4.0-funcrel |
| etl-service | CVE-2025-6965 | CRITICAL | sqlite: Integer Truncation in SQLite | 3.4.0-funcrel |
| gateway | CVE-2025-6965 | CRITICAL | sqlite: Integer Truncation in SQLite | 3.4.0-funcrel |
| sso-service | CVE-2025-30749 | HIGH | openjdk: Better Glyph drawing (Oracle CPU 2025-07) | 3.4.0-funcrel |
| sso-service | CVE-2025-49146 | HIGH | pgjdbc: pgjdbc insecure authentication in channel binding | 3.4.0-funcrel |
| sso-service | CVE-2025-50059 | HIGH | openjdk: Improve HTTP client header handling (Oracle CPU 2025-07) | 3.4.0-funcrel |
| sso-service | CVE-2025-50106 | HIGH | openjdk: Glyph out-of-memory access and crash (Oracle CPU 2025-07) | 3.4.0-funcrel |
| viewer | CVE-2025-22868 | HIGH | golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws | 3.4.0-funcrel |
| viewer | CVE-2025-30749 | HIGH | openjdk: Better Glyph drawing (Oracle CPU 2025-07) | 3.4.0-funcrel |
| viewer | CVE-2025-50059 | HIGH | openjdk: Improve HTTP client header handling (Oracle CPU 2025-07) | 3.4.0-funcrel |
| viewer | CVE-2025-50106 | HIGH | openjdk: Glyph out-of-memory access and crash (Oracle CPU 2025-07) | 3.4.0-funcrel |
Security fixes provided in 3.4.0-funcrel
| CAST image | CVE | Description | Affected CAST release |
|---|---|---|---|
| admin-center | CVE-2025-48988 | tomcat: Apache Tomcat DoS in multipart upload | 3.3.0-funcrel |
| admin-center | CVE-2025-49146 | pgjdbc: pgjdbc insecure authentication in channel binding | 3.3.0-funcrel |
| auth-service | CVE-2025-41235 | Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies | 3.3.0-funcrel |
| ai-service | CVE-2024-12718 | cpython: python: Bypass extraction filter to modify file metadata outside extraction directory | 3.3.0-funcrel |
| ai-service | CVE-2025-29087 | sqlite: Integer Overflow in SQLite concat_ws Function | 3.3.0-funcrel |
| ai-service | CVE-2025-4138 | cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory | 3.3.0-funcrel |
| ai-service | CVE-2025-4330 | cpython: python: Extraction filter bypass for linking outside extraction directory | 3.3.0-funcrel |
| ai-service | CVE-2025-4517 | python: cpython: Arbitrary writes via tarfile realpath overflow | 3.3.0-funcrel |
| ai-service | CVE-2025-4565 | python-protobuf: Unbounded recursion in Python Protobuf | 3.3.0-funcrel |
| ai-service | CVE-2025-47273 | setuptools: Path Traversal Vulnerability in setuptools PackageIndex | 3.3.0-funcrel |
| analysis-node | CVE-2025-48379 | python-pillow: pillow: Pillow DDS Heap Buffer Overflow | 3.3.0-funcrel_core8.4.3 |
| console | CVE-2025-41235 | Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies | 3.3.0-funcrel |
| dashboards | CVE-2025-22235 | org.springframework.boot/spring-boot: Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed | 3.3.0-funcrel |
| dashboards | CVE-2025-48988 | tomcat: Apache Tomcat DoS in multipart upload | 3.3.0-funcrel |
| dashboards | CVE-2025-49146 | pgjdbc: pgjdbc insecure authentication in channel binding | 3.3.0-funcrel |
| etl-service | CVE-2025-22874 | crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509 | 3.3.0-funcrel |
| gateway | CVE-2025-41235 | Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies | 3.3.0-funcrel |
| gateway | CVE-2025-48988 | tomcat: Apache Tomcat DoS in multipart upload | 3.3.0-funcrel |
| neo4j | CVE-2025-1948 | jetty-http2-common: Jetty HTTP/2 Header List Size Vulnerability | 3.3.0-funcrel |
| sso-service | CVE-2025-3501 | org.keycloak.protocol.services: Keycloak hostname verification | 3.3.0-funcrel |
| viewer | CVE-2024-12718 | cpython: python: Bypass extraction filter to modify file metadata outside extraction directory | 3.3.0-funcrel |
| viewer | CVE-2025-22874 | crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509 | 3.3.0-funcrel |
| viewer | CVE-2025-4138 | cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory | 3.3.0-funcrel |
| viewer | CVE-2025-4330 | cpython: python: Extraction filter bypass for linking outside extraction directory | 3.3.0-funcrel |
| viewer | CVE-2025-4517 | python: cpython: Arbitrary writes via tarfile realpath overflow | 3.3.0-funcrel |