Amazon Linux 2 images incorrectly marked as end-of-support by security analyzers

While reviewing results from my automated scans, I noticed that some Amazon Linux 2-based Lambda base images are being incorrectly tagged as end-of-support (EOSL) by tools like Trivy.

From what I can tell, Amazon Linux 2 is still officially supported through June 30, 2026, as noted in the following sources:

- [Amazon Linux 2 FAQs – End of Support](https://aws.amazon.com/amazon-linux-2/faqs/#topic-0:~:text=Amazon%20Linux%202%20end%20of%20support%20date%20(End%20of%20Life%2C%20or%20EOL)%20will%20be%20on%202026%2D06%2D30.)
- [Lambda Runtime Support Policy Table](https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtimes-supported)

It’s not entirely clear to me whether this is an issue on Trivy’s side, or if there’s a breakdown somewhere in how advisory or lifecycle information is being surfaced from Amazon Linux to downstream tools. Either way, it’s leading to some images being mistakenly treated as deprecated, which could cause confusion for others tracking Lambda image support status.

I've already updated my tooling to work around this, but wanted to share in case there's something deeper to look into.

Example

```
{
"SchemaVersion": 2,
"CreatedAt": "2025-07-01T10:18:41.315930172Z",
"ArtifactName": "public.ecr.aws/lambda/python:3.11",
"ArtifactType": "container_image",
"Metadata": {
"Size": 716780032,
"OS": {
"Family": "amazon",
"Name": "2 (Karoo)",
"EOSL": true <- HERE IT IS
},
"ImageID": "sha256:dca720cbe37afd78f6512ccaa35bc80118b1f36d892079dac2c4119f190fbd9f",
"DiffIDs": [
"sha256:a082bad551c7cd40a6be2a8ec60104fd6fb6f4d2de5caeef0f83e5bda1aa5ab0",
"sha256:322f2973fd4e10507bf9b5bbb64d4ec0305eb7a39ebef0d98b090a1af547b979",
"sha256:4563055ea4878cb61bddd3602021e9d08e1cdabf9b664e9687fba00faed3d293",
"sha256:0aad5424398f6b7910611512c1462fe1750c11685c4795c1e2eeeda4d60d5ee1",
"sha256:d8ee7ac798c5ebcada0d3f15490271bfb13345f1081e34539dac896e31822eb2",
"sha256:ae9adbc0a547d8787c5890a859d6978d1fae38455199a082849b5db2b6a2aff3"
],
"RepoTags": [
"public.ecr.aws/lambda/python:3.11"
],
"RepoDigests": [
"public.ecr.aws/lambda/python@sha256:759fbc2f7568156874aa6eb0ddce083a242f78104927edfb17e7f3fcd3caf420"
],
"ImageConfig": {
"architecture": "amd64",
"container": "e03baf5b4fc8f77ba767a5ad6ea0eae55411c8b6777073a719026544334b4491",
"created": "2025-06-19T12:24:07.331899498Z",
"docker_version": "20.10.22",
"history": [
{
"author": "AWS Lambda",
"created": "2025-06-19T12:17:56Z",
"created_by": "ARCHITECTURE amd64",
"empty_layer": true
},
{
"author": "AWS Lambda",
"created": "2025-06-19T12:17:56Z",
"created_by": "ADD file:a0bd85d097f139ca4ca721ceeeae4f677e82ef1fea646194d248b91dc9463c8e /"
},
{
"author": "AWS Lambda",
"created": "2025-06-19T12:17:56Z",
"created_by": "ADD file:3590d8d90ea1b8d387b635bb589d30519654c4c7615f3e4332194105b56574a4 /"
},
{
"author": "AWS Lambda",
"created": "2025-06-19T12:17:56Z",
"created_by": "ADD file:3992841ff82b4bcd501778dc2e0a1d75539c977c48a3a4794940a7b0446e51d9 /"
},
{
"author": "AWS Lambda",
"created": "2025-06-19T12:17:56Z",
"created_by": "ADD file:020e547580a25092dd291ed8a9a7ff9cf0d75a2c765a977734a176a24fc3faeb /"
},
{
"author": "AWS Lambda",
"created": "2025-06-19T12:17:56Z",
"created_by": "ADD file:98ed9100ca6b92c55a29940afe63226d030c9ac6a323a3d763cc12180ee16648 /"
},
{
"author": "AWS Lambda",
"created": "2025-06-19T12:17:56Z",
"created_by": "ADD file:92561418a8dceff09954ff51aa945b97777f19872be3600f5294d7b9e6c22007 /"
},
{
"author": "AWS Lambda",
"created": "2025-06-19T12:17:56Z",
"created_by": "WORKDIR /var/task",
"empty_layer": true
},
{
"author": "AWS Lambda",
"created": "2025-06-19T12:17:56Z",
"created_by": "ENV LANG=en_US.UTF-8",
"empty_layer": true
},
{
"author": "AWS Lambda",
"created": "2025-06-19T12:17:56Z",
"created_by": "ENV TZ=:/etc/localtime",
"empty_layer": true
},
{
"author": "AWS Lambda",
"created": "2025-06-19T12:17:56Z",
"created_by": "ENV PATH=/var/lang/bin:/usr/local/bin:/usr/bin/:/bin:/opt/bin",
"empty_layer": true
},
{
"author": "AWS Lambda",
"created": "2025-06-19T12:17:56Z",
"created_by": "ENV LD_LIBRARY_PATH=/var/lang/lib:/lib64:/usr/lib64:/var/runtime:/var/runtime/lib:/var/task:/var/task/lib:/opt/lib",
"empty_layer": true
},
{
"author": "AWS Lambda",
"created": "2025-06-19T12:17:56Z",
"created_by": "ENV LAMBDA_TASK_ROOT=/var/task",
"empty_layer": true
},
{
"author": "AWS Lambda",
"created": "2025-06-19T12:17:56Z",
"created_by": "ENV LAMBDA_RUNTIME_DIR=/var/runtime",
"empty_layer": true
},
{
"author": "AWS Lambda",
"created": "2025-06-19T12:17:56Z",
"created_by": "ENTRYPOINT [ \"/lambda-entrypoint.sh\" ]",
"empty_layer": true
},
{
"created": "2025-06-19T12:24:07.331899498Z",
"created_by": "/bin/sh -c #(nop) LABEL com.amazonaws.lambda.platform.kernel=k510ga",
"empty_layer": true
}
],
"os": "linux",
"rootfs": {
"type": "layers",
"diff_ids": [
"sha256:a082bad551c7cd40a6be2a8ec60104fd6fb6f4d2de5caeef0f83e5bda1aa5ab0",
"sha256:322f2973fd4e10507bf9b5bbb64d4ec0305eb7a39ebef0d98b090a1af547b979",
"sha256:4563055ea4878cb61bddd3602021e9d08e1cdabf9b664e9687fba00faed3d293",
"sha256:0aad5424398f6b7910611512c1462fe1750c11685c4795c1e2eeeda4d60d5ee1",
"sha256:d8ee7ac798c5ebcada0d3f15490271bfb13345f1081e34539dac896e31822eb2",
"sha256:ae9adbc0a547d8787c5890a859d6978d1fae38455199a082849b5db2b6a2aff3"
]
},
"config": {
"Entrypoint": [
"/lambda-entrypoint.sh"
],
"Env": [
"LANG=en_US.UTF-8",
"TZ=:/etc/localtime",
"PATH=/var/lang/bin:/usr/local/bin:/usr/bin/:/bin:/opt/bin",
"LD_LIBRARY_PATH=/var/lang/lib:/lib64:/usr/lib64:/var/runtime:/var/runtime/lib:/var/task:/var/task/lib:/opt/lib",
"LAMBDA_TASK_ROOT=/var/task",
"LAMBDA_RUNTIME_DIR=/var/runtime"
],
"Image": "sha256:d894f004d408ad97d8ffcabe7022389e8608fec69f2619b070faf62276f7c642",
"Labels": {
"com.amazonaws.lambda.platform.kernel": "k510ga"
},
"WorkingDir": "/var/task"
}
},
"Layers": [
{
"Size": 314869760,
"Digest": "sha256:bd7c4c5b3f7ef5b08cc8b76b9510a588d9092a1714b2e1c5a682f867cc3cfb24",
"DiffID": "sha256:a082bad551c7cd40a6be2a8ec60104fd6fb6f4d2de5caeef0f83e5bda1aa5ab0"
},
{
"Size": 661504,
"Digest": "sha256:3590d8d90ea1b8d387b635bb589d30519654c4c7615f3e4332194105b56574a4",
"DiffID": "sha256:322f2973fd4e10507bf9b5bbb64d4ec0305eb7a39ebef0d98b090a1af547b979"
},
{
"Size": 2560,
"Digest": "sha256:3992841ff82b4bcd501778dc2e0a1d75539c977c48a3a4794940a7b0446e51d9",
"DiffID": "sha256:4563055ea4878cb61bddd3602021e9d08e1cdabf9b664e9687fba00faed3d293"
},
{
"Size": 7081984,
"Digest": "sha256:020e547580a25092dd291ed8a9a7ff9cf0d75a2c765a977734a176a24fc3faeb",
"DiffID": "sha256:0aad5424398f6b7910611512c1462fe1750c11685c4795c1e2eeeda4d60d5ee1"
},
{
"Size": 394101248,
"Digest": "sha256:98ed9100ca6b92c55a29940afe63226d030c9ac6a323a3d763cc12180ee16648",
"DiffID": "sha256:d8ee7ac798c5ebcada0d3f15490271bfb13345f1081e34539dac896e31822eb2"
},
{
"Size": 62976,
"Digest": "sha256:92561418a8dceff09954ff51aa945b97777f19872be3600f5294d7b9e6c22007",
"DiffID": "sha256:ae9adbc0a547d8787c5890a859d6978d1fae38455199a082849b5db2b6a2aff3"
}
]
},
"Results": [
{
"Target": "public.ecr.aws/lambda/python:3.11 (amazon 2 (Karoo))",
"Class": "os-pkgs",
"Type": "amazon",
"Vulnerabilities": [
{
"VulnerabilityID": "CVE-2025-6021",
"PkgID": "libxml2@2.9.1-6.amzn2.5.17.x86_64",
"PkgName": "libxml2",
"PkgIdentifier": {
"PURL": "pkg:rpm/amazon/libxml2@2.9.1-6.amzn2.5.17?arch=x86_64\u0026distro=amazon-2+%28Karoo%29",
"UID": "3135e9fc7a1896ac"
},
"InstalledVersion": "2.9.1-6.amzn2.5.17",
"FixedVersion": "2.9.1-6.amzn2.5.18",
"Status": "fixed",
"Layer": {
"Digest": "sha256:bd7c4c5b3f7ef5b08cc8b76b9510a588d9092a1714b2e1c5a682f867cc3cfb24",
"DiffID": "sha256:a082bad551c7cd40a6be2a8ec60104fd6fb6f4d2de5caeef0f83e5bda1aa5ab0"
},
"SeveritySource": "amazon",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-6021",
"DataSource": {
"ID": "amazon",
"Name": "Amazon Linux Security Center",
"URL": "https://alas.aws.amazon.com/"
},
"Title": "libxml2: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2",
"Description": "A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.",
"Severity": "HIGH",
"CweIDs": [
"CWE-121"
],
"VendorSeverity": {
"amazon": 3,
"redhat": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2025-6021",
"https://bugzilla.redhat.com/show_bug.cgi?id=2372406",
"https://nvd.nist.gov/vuln/detail/CVE-2025-6021",
"https://www.cve.org/CVERecord?id=CVE-2025-6021"
],
"PublishedDate": "2025-06-12T13:15:25.59Z",
"LastModifiedDate": "2025-06-12T16:06:20.18Z"
}
]
},
{
"Target": "Python",
"Class": "lang-pkgs",
"Type": "python-pkg",
"Vulnerabilities": [
{
"VulnerabilityID": "CVE-2022-40897",
"PkgName": "setuptools",
"PkgPath": "var/lang/lib/python3.11/site-packages/setuptools-65.5.0.dist-info/METADATA",
"PkgIdentifier": {
"PURL": "pkg:pypi/setuptools@65.5.0",
"UID": "26b04e76b4db1c46"
},
"InstalledVersion": "65.5.0",
"FixedVersion": "65.5.1",
"Status": "fixed",
"Layer": {
"Digest": "sha256:98ed9100ca6b92c55a29940afe63226d030c9ac6a323a3d763cc12180ee16648",
"DiffID": "sha256:d8ee7ac798c5ebcada0d3f15490271bfb13345f1081e34539dac896e31822eb2"
},
"SeveritySource": "ghsa",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-40897",
"DataSource": {
"ID": "ghsa",
"Name": "GitHub Security Advisory pip",
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"Title": "pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py",
"Description": "Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.",
"Severity": "HIGH",
"CweIDs": [
"CWE-1333"
],
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"bitnami": 2,
"cbl-mariner": 2,
"ghsa": 3,
"nvd": 2,
"oracle-oval": 2,
"photon": 2,
"redhat": 2,
"rocky": 2,
"ubuntu": 2
},
"CVSS": {
"bitnami": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
},
"ghsa": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
},
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2023:0952",
"https://access.redhat.com/security/cve/CVE-2022-40897",
"https://bugzilla.redhat.com/2158559",
"https://bugzilla.redhat.com/show_bug.cgi?id=2158559",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40897",
"https://errata.almalinux.org/9/ALSA-2023-0952.html",
"https://errata.rockylinux.org/RLSA-2023:0952",
"https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2022-43012.yaml",
"https://github.com/pypa/setuptools",
"https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200",
"https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be",
"https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1",
"https://github.com/pypa/setuptools/issues/3659",
"https://linux.oracle.com/cve/CVE-2022-40897.html",
"https://linux.oracle.com/errata/ELSA-2024-2987.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H",
"https://nvd.nist.gov/vuln/detail/CVE-2022-40897",
"https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages",
"https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/",
"https://pyup.io/vulnerabilities/CVE-2022-40897/52495",
"https://pyup.io/vulnerabilities/CVE-2022-40897/52495/",
"https://security.netapp.com/advisory/ntap-20230214-0001",
"https://security.netapp.com/advisory/ntap-20230214-0001/",
"https://security.netapp.com/advisory/ntap-20240621-0006",
"https://security.netapp.com/advisory/ntap-20240621-0006/",
"https://setuptools.pypa.io/en/latest",
"https://ubuntu.com/security/notices/USN-5817-1",
"https://www.cve.org/CVERecord?id=CVE-2022-40897"
],
"PublishedDate": "2022-12-23T00:15:13.987Z",
"LastModifiedDate": "2024-11-21T07:22:13.787Z"
},
{
"VulnerabilityID": "CVE-2024-6345",
"PkgName": "setuptools",
"PkgPath": "var/lang/lib/python3.11/site-packages/setuptools-65.5.0.dist-info/METADATA",
"PkgIdentifier": {
"PURL": "pkg:pypi/setuptools@65.5.0",
"UID": "26b04e76b4db1c46"
},
"InstalledVersion": "65.5.0",
"FixedVersion": "70.0.0",
"Status": "fixed",
"Layer": {
"Digest": "sha256:98ed9100ca6b92c55a29940afe63226d030c9ac6a323a3d763cc12180ee16648",
"DiffID": "sha256:d8ee7ac798c5ebcada0d3f15490271bfb13345f1081e34539dac896e31822eb2"
},
"SeveritySource": "ghsa",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-6345",
"DataSource": {
"ID": "ghsa",
"Name": "GitHub Security Advisory pip",
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"Title": "pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools",
"Description": "A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.",
"Severity": "HIGH",
"CweIDs": [
"CWE-94"
],
"VendorSeverity": {
"alma": 3,
"amazon": 3,
"azure": 3,
"bitnami": 3,
"cbl-mariner": 3,
"ghsa": 3,
"oracle-oval": 3,
"photon": 3,
"redhat": 3,
"rocky": 3,
"ubuntu": 2
},
"CVSS": {
"bitnami": {
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"V3Score": 8.8
},
"ghsa": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"V3Score": 8.8
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"V3Score": 8.8
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:6726",
"https://access.redhat.com/security/cve/CVE-2024-6345",
"https://bugzilla.redhat.com/2297771",
"https://bugzilla.redhat.com/show_bug.cgi?id=2297771",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6345",
"https://errata.almalinux.org/9/ALSA-2024-6726.html",
"https://errata.rockylinux.org/RLSA-2024:6726",
"https://github.com/pypa/setuptools",
"https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0",
"https://github.com/pypa/setuptools/pull/4332",
"https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5",
"https://linux.oracle.com/cve/CVE-2024-6345.html",
"https://linux.oracle.com/errata/ELSA-2024-6726.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-6345",
"https://ubuntu.com/security/notices/USN-7002-1",
"https://www.cve.org/CVERecord?id=CVE-2024-6345"
],
"PublishedDate": "2024-07-15T01:15:01.73Z",
"LastModifiedDate": "2024-11-21T09:49:28.17Z"
},
{
"VulnerabilityID": "CVE-2025-47273",
"PkgName": "setuptools",
"PkgPath": "var/lang/lib/python3.11/site-packages/setuptools-65.5.0.dist-info/METADATA",
"PkgIdentifier": {
"PURL": "pkg:pypi/setuptools@65.5.0",
"UID": "26b04e76b4db1c46"
},
"InstalledVersion": "65.5.0",
"FixedVersion": "78.1.1",
"Status": "fixed",
"Layer": {
"Digest": "sha256:98ed9100ca6b92c55a29940afe63226d030c9ac6a323a3d763cc12180ee16648",
"DiffID": "sha256:d8ee7ac798c5ebcada0d3f15490271bfb13345f1081e34539dac896e31822eb2"
},
"SeveritySource": "ghsa",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-47273",
"DataSource": {
"ID": "ghsa",
"Name": "GitHub Security Advisory pip",
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"Title": "setuptools: Path Traversal Vulnerability in setuptools PackageIndex",
"Description": "setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.",
"Severity": "HIGH",
"CweIDs": [
"CWE-22"
],
"VendorSeverity": {
"amazon": 3,
"azure": 3,
"bitnami": 3,
"ghsa": 3,
"nvd": 3,
"oracle-oval": 2,
"photon": 3,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"V3Score": 8.8
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"V3Score": 7.1
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2025-47273",
"https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2025-49.yaml",
"https://github.com/pypa/setuptools",
"https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88",
"https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b",
"https://github.com/pypa/setuptools/issues/4946",
"https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf",
"https://linux.oracle.com/cve/CVE-2025-47273.html",
"https://linux.oracle.com/errata/ELSA-2025-9940.html",
"https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html",
"https://nvd.nist.gov/vuln/detail/CVE-2025-47273",
"https://ubuntu.com/security/notices/USN-7544-1",
"https://www.cve.org/CVERecord?id=CVE-2025-47273"
],
"PublishedDate": "2025-05-17T16:15:19.11Z",
"LastModifiedDate": "2025-06-12T16:29:01.66Z"
},
{
"VulnerabilityID": "CVE-2025-50181",
"PkgName": "urllib3",
"PkgPath": "var/lang/lib/python3.11/site-packages/urllib3-1.26.19.dist-info/METADATA",
"PkgIdentifier": {
"PURL": "pkg:pypi/urllib3@1.26.19",
"UID": "5d7c47497d320ce4"
},
"InstalledVersion": "1.26.19",
"FixedVersion": "2.5.0",
"Status": "fixed",
"Layer": {
"Digest": "sha256:98ed9100ca6b92c55a29940afe63226d030c9ac6a323a3d763cc12180ee16648",
"DiffID": "sha256:d8ee7ac798c5ebcada0d3f15490271bfb13345f1081e34539dac896e31822eb2"
},
"SeveritySource": "ghsa",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-50181",
"DataSource": {
"ID": "ghsa",
"Name": "GitHub Security Advisory pip",
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"Title": "urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation",
"Description": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-601"
],
"VendorSeverity": {
"ghsa": 2,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"ghsa": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 5.3
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 5.3
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2025-50181",
"https://github.com/urllib3/urllib3",
"https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857",
"https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v",
"https://nvd.nist.gov/vuln/detail/CVE-2025-50181",
"https://ubuntu.com/security/notices/USN-7599-1",
"https://ubuntu.com/security/notices/USN-7599-2",
"https://www.cve.org/CVERecord?id=CVE-2025-50181"
],
"PublishedDate": "2025-06-19T01:15:24.453Z",
"LastModifiedDate": "2025-06-23T20:16:59.783Z"
}
]
},
{
"Target": "usr/local/bin/aws-lambda-rie",
"Class": "lang-pkgs",
"Type": "gobinary"
}
]
}
```