Potential Vulnerabilities

[yodaphone]

Hi

Scanned the image using Trivy and i see 1 critical vulnerability in the sqlite-libs library

Report Summary

┌───────────────────────────────────────────┬─────────────────┬─────────────────┬─────────┐
│                  Target                   │      Type       │ Vulnerabilities │ Secrets │
├───────────────────────────────────────────┼─────────────────┼─────────────────┼─────────┤
│ shlinkio/shlink:stable (alpine 3.21.4)    │     alpine      │        1        │    -    │
├───────────────────────────────────────────┼─────────────────┼─────────────────┼─────────┤
│ etc/shlink/bin/rr                         │    gobinary     │        1        │    -    │
├───────────────────────────────────────────┼─────────────────┼─────────────────┼─────────┤
│ etc/shlink/vendor/composer/installed.json │ composer-vendor │        0        │    -    │
└───────────────────────────────────────────┴─────────────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


shlinkio/shlink:stable (alpine 3.21.4)
======================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)

┌─────────────┬───────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────┐
│   Library   │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │                   Title                   │
├─────────────┼───────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────┤
│ sqlite-libs │ CVE-2025-6965 │ CRITICAL │ fixed  │ 3.48.0-r2         │ 3.48.0-r3     │ sqlite: Integer Truncation in SQLite      │
│             │               │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-6965 │
└─────────────┴───────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────┘

etc/shlink/bin/rr (gobinary)
============================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────┐
│               Library               │    Vulnerability    │ Severity │ Status │ Installed Version │ Fixed Version │                          Title                           │
├─────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ github.com/go-viper/mapstructure/v2 │ GHSA-fv92-fjc5-jj9h │ MEDIUM   │ fixed  │ v2.2.1            │ 2.3.0         │ mapstructure May Leak Sensitive Information in Logs When │
│                                     │                     │          │        │                   │               │ Processing Malformed Data                                │
│                                     │                     │          │        │                   │               │ https://github.com/advisories/GHSA-fv92-fjc5-jj9h        │

[acelaya]

SQLite is not supported for production anyway. It's just there for quick testing of Shlink capabilities.