Security Report - eizen-email-service

🔴 Vulnerabilities (1)
Severity	CVE ID	Package	Installed	Fixed In	Description
MEDIUM	CVE-2024-47081	requests	2.32.3	2.32.4	requests: Requests vulnerable to .netrc credentials leak via malicious URLs
🔑 Secrets (0)
Type	File	Line	Match
✅ No secrets found
⚙️ Misconfigurations (1)
Severity	ID	Check	File	Message
HIGH	DS-0002	Image user should not be 'root'	Dockerfile	Specify at least 1 USER command in Dockerfile with non-root user as argument
📄 Raw JSON Report (click to expand)
{
  "SchemaVersion": 2,
  "Trivy": {
    "Version": "0.69.0"
  },
  "ReportID": "019c3152-d3fe-7491-b8ce-e624ecf25ad5",
  "CreatedAt": "2026-02-06T05:00:37.758300022Z",
  "ArtifactID": "sha256:841d357da74f1573086d37b1a42bf92efd37c2b8f0d4e5d41b0a3793360ae047",
  "ArtifactName": "/src",
  "ArtifactType": "repository",
  "Metadata": {
    "RepoURL": "https://github.com/eizen-ai/eizen-email-service",
    "Branch": "vulnerability-fix",
    "Commit": "5ced1a6a083cff33b0cd2e4e757ff6f4f5489c46",
    "CommitMsg": "feat(email): enhance email sending functionality with attachment handling and error management",
    "Author": "eizen-narendra <narendravarma.dendukuri@eizen.ai>",
    "Committer": "eizen-narendra <narendravarma.dendukuri@eizen.ai>"
  },
  "Results": [
    {
      "Target": "requirements.txt",
      "Class": "lang-pkgs",
      "Type": "pip",
      "Packages": [
        {
          "Name": "email_validator",
          "Identifier": {
            "PURL": "pkg:pypi/email-validator@2.2.0",
            "UID": "bf05522b84e97cd3"
          },
          "Version": "2.2.0",
          "Locations": [
            {
              "StartLine": 2,
              "EndLine": 2
            }
          ],
          "AnalyzedBy": "pip"
        },
        {
          "Name": "fastapi",
          "Identifier": {
            "PURL": "pkg:pypi/fastapi@0.115.12",
            "UID": "fae61dc75ad679ee"
          },
          "Version": "0.115.12",
          "Locations": [
            {
              "StartLine": 1,
              "EndLine": 1
            }
          ],
          "AnalyzedBy": "pip"
        },
        {
          "Name": "python-dotenv",
          "Identifier": {
            "PURL": "pkg:pypi/python-dotenv@1.1.0",
            "UID": "ce4aed990851e16d"
          },
          "Version": "1.1.0",
          "Locations": [
            {
              "StartLine": 3,
              "EndLine": 3
            }
          ],
          "AnalyzedBy": "pip"
        },
        {
          "Name": "requests",
          "Identifier": {
            "PURL": "pkg:pypi/requests@2.32.3",
            "UID": "fce6e524d640e451"
          },
          "Version": "2.32.3",
          "Locations": [
            {
              "StartLine": 4,
              "EndLine": 4
            }
          ],
          "AnalyzedBy": "pip"
        },
        {
          "Name": "uvicorn",
          "Identifier": {
            "PURL": "pkg:pypi/uvicorn@0.34.3",
            "UID": "65f79766989a5340"
          },
          "Version": "0.34.3",
          "Locations": [
            {
              "StartLine": 5,
              "EndLine": 5
            }
          ],
          "AnalyzedBy": "pip"
        }
      ],
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2024-47081",
          "VendorIDs": [
            "GHSA-9hjg-9r4m-mvj7"
          ],
          "PkgName": "requests",
          "PkgIdentifier": {
            "PURL": "pkg:pypi/requests@2.32.3",
            "UID": "fce6e524d640e451"
          },
          "InstalledVersion": "2.32.3",
          "FixedVersion": "2.32.4",
          "Status": "fixed",
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-47081",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory pip",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
          },
          "Fingerprint": "sha256:7069bc9daadf96fbc3e70b5d011083285a216bd22505d5462cd7921fe8cf5f7e",
          "Title": "requests: Requests vulnerable to .netrc credentials leak via malicious URLs",
          "Description": "Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.",
          "Severity": "MEDIUM",
          "CweIDs": [
            "CWE-522"
          ],
          "VendorSeverity": {
            "alma": 2,
            "amazon": 2,
            "azure": 2,
            "cbl-mariner": 2,
            "ghsa": 2,
            "oracle-oval": 2,
            "photon": 2,
            "redhat": 2,
            "rocky": 2,
            "ubuntu": 2
          },
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "V3Score": 5.3
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "V3Score": 5.3
            }
          },
          "References": [
            "http://seclists.org/fulldisclosure/2025/Jun/2",
            "http://www.openwall.com/lists/oss-security/2025/06/03/11",
            "http://www.openwall.com/lists/oss-security/2025/06/03/9",
            "http://www.openwall.com/lists/oss-security/2025/06/04/1",
            "http://www.openwall.com/lists/oss-security/2025/06/04/6",
            "https://access.redhat.com/errata/RHSA-2025:12519",
            "https://access.redhat.com/security/cve/CVE-2024-47081",
            "https://bugzilla.redhat.com/2371272",
            "https://bugzilla.redhat.com/show_bug.cgi?id=2371272",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47081",
            "https://errata.almalinux.org/9/ALSA-2025-12519.html",
            "https://errata.rockylinux.org/RLSA-2025:12519",
            "https://github.com/psf/requests",
            "https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef",
            "https://github.com/psf/requests/pull/6965",
            "https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7",
            "https://linux.oracle.com/cve/CVE-2024-47081.html",
            "https://linux.oracle.com/errata/ELSA-2025-14999.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2024-47081",
            "https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env",
            "https://seclists.org/fulldisclosure/2025/Jun/2",
            "https://ubuntu.com/security/notices/USN-7568-1",
            "https://ubuntu.com/security/notices/USN-7762-1",
            "https://www.cve.org/CVERecord?id=CVE-2024-47081",
            "https://www.openwall.com/lists/oss-security/2025/06/03/9"
          ],
          "PublishedDate": "2025-06-09T18:15:24.983Z",
          "LastModifiedDate": "2025-06-12T16:06:47.857Z"
        }
      ]
    },
    {
      "Target": "Dockerfile",
      "Class": "config",
      "Type": "dockerfile",
      "MisconfSummary": {
        "Successes": 23,
        "Failures": 1
      },
      "Misconfigurations": [
        {
          "Type": "Dockerfile Security Check",
          "ID": "DS-0002",
          "Title": "Image user should not be 'root'",
          "Description": "Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.",
          "Message": "Specify at least 1 USER command in Dockerfile with non-root user as argument",
          "Namespace": "builtin.dockerfile.DS002",
          "Query": "data.builtin.dockerfile.DS002.deny",
          "Resolution": "Add 'USER <non root user name>' line to the Dockerfile",
          "Severity": "HIGH",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ds-0002",
          "References": [
            "https://docs.docker.com/develop/develop-images/dockerfile_best-practices/",
            "https://avd.aquasec.com/misconfig/ds-0002"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Dockerfile",
            "Service": "general"
          }
        }
      ]
    }
  ]
}
🛡️ Security Scan Report

0

1

1

0

0

1
