2.9.25¶

Release date: 2025-APR-22

Enhancements¶

The list of the enhancements in MSR 2.9.25 includes:

MSR improved error handling by adding:

ARTIFACT_SCANNER_REPORT_UNAVAILABLE error, to indicate that a report export failed due to missing layer details for the specified artifact. This replaces the previously used generic NO_SUCH_TAG error.
NO_DIGEST_PERMITTED error, to indicate that digest-based references are not supported for report exports.

The list of the addressed issues in MSR 2.9.25 includes:

[ENGDTR-4359] Fixed an issue wherein the PostgreSQL NOTICE logs were incorrectly labelled as errors during vulnerability database synchronisation.
[FIELD-7515] Fixed an issue wherein the Show/Hide button for layer vulnerabilities displayed as enabled for non-admin users in scanning results. The button is now disabled and features a tooltip that explains the restriction.

The following table provides the versioning information for the major middleware components that comprise the MSR 2.9 patch release.

Updated the following middleware component versions to resolve vulnerabilities in MSR:

Resolved CVEs, as detailed:

CVE	Status	Problem details from upstream
CVE-2025-26519	Resolved	musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.
CVE-2024-34155	Resolved	Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
CVE-2024-34156	Resolved	Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.