12 lines
974 B
Markdown
12 lines
974 B
Markdown
# calcom — triage (group D)
|
|
Pins: calcom/cal.com:v6.2.0 (source repo calcom/cal.diy), postgres:18-alpine.
|
|
## GHSA-p3f6-52gv-cj7m (critical, 2024) — NOT-A-FINDING: about the project's own CI (`pull_request_target` workflow
|
|
`.github/workflows/pr.yml` / check-types.yml repo takeover), not the shipped product.
|
|
## GHSA-cpf2-q635-xrwx / CVE-2023-37919 (low, 2023) — NOT-A-FINDING: range "app.cal.com" (hosted service); NVD CPE
|
|
range ends at <= 3.1.4, far below v6.2.0. Unsure whether v6.2.0 now ends other sessions on 2FA enable (NextAuth JWT
|
|
sessions); even if not, it only matters to an attacker who already holds a stolen session.
|
|
Lane: NOT_A_FINDING. No target.
|
|
Side observation: Docker Hub calcom/cal.com newest tag is v6.2.0 (2026-03-02) and the release list ends there — no image
|
|
in ~8 months; worth a staleness check (abandoned/renamed image?).
|
|
Classifier note: drop advisories whose title names `.github/workflows`/`action.yml`, and ranges that are a hostname.
|