# Snyk test report

December 14th 2025, 12:33:08 am (UTC+00:00)

Scanned the following paths:

- redis:7.2.11-alpine (apk)
- redis:7.2.11-alpine/tianon/gosu//usr/local/bin/gosu (gomodules)

2 known vulnerabilities
10 vulnerable dependency paths
19 dependencies

## CVE-2024-58251

low severity

- Package Manager: alpine:3.21
- Vulnerable module: busybox/busybox
- Introduced through: docker-image|redis@7.2.11-alpine and busybox/busybox@1.37.0-r13

### Detailed paths

- Introduced through: docker-image|redis@7.2.11-alpine › busybox/busybox@1.37.0-r13
- Introduced through: docker-image|redis@7.2.11-alpine › alpine-baselayout/alpine-baselayout@3.6.8-r1 › busybox/busybox-binsh@1.37.0-r13 › busybox/busybox@1.37.0-r13
- Introduced through: docker-image|redis@7.2.11-alpine › busybox/busybox-binsh@1.37.0-r13
- Introduced through: docker-image|redis@7.2.11-alpine › alpine-baselayout/alpine-baselayout@3.6.8-r1 › busybox/busybox-binsh@1.37.0-r13
- Introduced through: docker-image|redis@7.2.11-alpine › busybox/ssl_client@1.37.0-r13

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `busybox` package and not the `busybox` package as distributed by `Alpine`. See `How to fix?` for `Alpine:3.21` relevant fixed versions and status.

In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.

## Remediation

Upgrade `Alpine:3.21` `busybox` to version 1.37.0-r14 or higher.

## References

- https://bugs.busybox.net/show_bug.cgi?id=15922
- https://www.busybox.net
- https://www.busybox.net/downloads/
- http://www.openwall.com/lists/oss-security/2025/04/23/6

More about this vulnerability

## CVE-2025-46394

low severity

- Package Manager: alpine:3.21
- Vulnerable module: busybox/busybox
- Introduced through: docker-image|redis@7.2.11-alpine and busybox/busybox@1.37.0-r13

### Detailed paths

- Introduced through: docker-image|redis@7.2.11-alpine › busybox/busybox@1.37.0-r13
- Introduced through: docker-image|redis@7.2.11-alpine › alpine-baselayout/alpine-baselayout@3.6.8-r1 › busybox/busybox-binsh@1.37.0-r13 › busybox/busybox@1.37.0-r13
- Introduced through: docker-image|redis@7.2.11-alpine › busybox/busybox-binsh@1.37.0-r13
- Introduced through: docker-image|redis@7.2.11-alpine › alpine-baselayout/alpine-baselayout@3.6.8-r1 › busybox/busybox-binsh@1.37.0-r13
- Introduced through: docker-image|redis@7.2.11-alpine › busybox/ssl_client@1.37.0-r13

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `busybox` package and not the `busybox` package as distributed by `Alpine`. See `How to fix?` for `Alpine:3.21` relevant fixed versions and status.

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

## Remediation

Upgrade `Alpine:3.21` `busybox` to version 1.37.0-r14 or higher.

## References

- https://bugs.busybox.net/show_bug.cgi?id=16018
- https://www.busybox.net
- https://www.busybox.net/downloads/
- http://www.openwall.com/lists/oss-security/2025/04/23/5
- http://www.openwall.com/lists/oss-security/2025/04/24/3

More about this vulnerability