photon 3.0 contains security vulnerabilities

photon 2.0 and 4.0 versions may also have similar problems

The software packages (including those installed through tdnf in the software repository) and the corresponding vulnerabilities are:

apache portable runtime (apr)
CVE-2021-35940

bash
CVE-2019-18276

berkeleydb
CVE-2016-0682 CVE-2016-0689 CVE-2016-0692 CVE-2016-0694 CVE-2016-3418 CVE-2017-3604 CVE-2017-3605 CVE-2017-3606 CVE-2017-3607 CVE-2017-3608 CVE-2017-3609 CVE-2017-3610 CVE-2017-3611 CVE-2017-3612 CVE-2017-3613 CVE-2017-3614 CVE-2017-3615 CVE-2017-3616 CVE-2017-3616

curl
CVE-2021-22945 CVE-2021-22947 CVE-2021-22946

cyrus-sasl
CVE-2019-19906

expat
CVE-2013-0340

glibc
CVE-2019-9192 CVE-2019-9169 CVE-2020-1751 CVE-2019-19126 CVE-2020-1752 CVE-2020-6096 CVE-2013-4412 CVE-2020-10029 CVE-2018-19591 CVE-2019-6488 CVE-2016-10739 CVE-2019-25013 CVE-2021-3326 CVE-2020-27618 CVE-2021-33574 CVE-2021-35942 CVE-2021-38604 CVE-2018-20796

kerberos
CVE-2020-28196 CVE-2021-36222 CVE-2021-37750 CVE-2018-20217

lz4
CVE-2021-3520 CVE-2014-4715

ncurses
CVE-2018-19217 CVE-2021-39537

pip
CVE-2021-3572

sqlite
CVE-2021-20227

zstd
CVE-2021-24032

No files, tests, or entry points are named. Start by reviewing the listed vulnerable packages and CVEs across Photon 2.0, 3.0, and 4.0, then determine the repository's package update process; the work is done when the reported vulnerabilities are addressed or their affected versions are clarified.