gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-07-26 11:49:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): suppress CVE-2026-41567 and CVE-2026-42306 against vendored docker-compose moby library (VEX) (#1102)

Browse Source 
The v0.81.13 Docker publish workflow failed on the post-build Trivy
re-scan because the moby/Docker vulnerability database picked up two new
HIGH CVEs against `github.com/docker/docker v28.5.2+incompatible`, which
docker-compose v5.1.3 vendors statically as a client-side API/codec
library. The CVEs were not present in the PR-side Trivy DB three hours
earlier, so PR CI passed but the release re-scan failed.

Both CVEs are daemon-side: CVE-2026-41567 targets the daemon's
PUT /containers/{id}/archive handler, CVE-2026-42306 is a race in the
daemon-side bind-mount resolution that backs `docker cp`. docker-compose
never acts as the daemon, never serves these routes, and Sencho only
invokes compose for up/down/ps. The vulnerable code paths are
unreachable. The fix lives on the github.com/moby/moby/v2 module path;
until upstream compose migrates, v28.5.2+incompatible remains the only
Go-module-resolvable version compose can reference. Same triage shape as
the existing CVE-2026-34040 entry, so the new statements mirror its top-
level products purl form.

Bumps OpenVEX document version 4 -> 5 and updates last_updated /
timestamp to 2026-05-18.
This commit is contained in:
Anso
2026-05-18 17:36:52 -04:00
committed by GitHub
parent 7dff6127e7
commit 596cce3507
1 changed files with 33 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/vex/sencho.openvex.json
+33 -3
View File
@@ -3,9 +3,9 @@
"@id": "https://github.com/studio-saelix/sencho/security/vex/sencho.openvex.json",
"author": "Studio Saelix",
"role": "Vendor",
"timestamp": "2026-04-29T00:00:00Z",
"last_updated": "2026-04-29T00:00:00Z",
"version": 4,
"timestamp": "2026-05-18T00:00:00Z",
"last_updated": "2026-05-18T00:00:00Z",
"version": 5,
"statements": [
{
"vulnerability": {
@@ -21,6 +21,36 @@
"status": "not_affected",
"justification": "vulnerable_code_not_in_execute_path",
"impact_statement": "The authorization bypass affects Docker Engine's daemon-side plugin authorization hook on oversized request bodies. docker-compose v5.1.3 statically bundles docker/docker v28.5.2+incompatible as a client-side library for API types and codecs; it never acts as a daemon and never runs authorization hooks. Sencho invokes compose only for up/down/ps operations against local user-authored compose files. The daemon auth code path is not reachable. The advisory's 'fixed in 29.3.1' refers to Docker Engine the daemon product. The Go library containing the fix is github.com/moby/moby/v2 (a new module path adopted on the docker-29.x branch), not github.com/docker/docker. Until upstream compose migrates to the v2 import path, v28.5.2+incompatible is the only Go-module-resolvable version."
},
{
"vulnerability": {
"@id": "https://www.cve.org/CVERecord?id=CVE-2026-41567",
"name": "CVE-2026-41567",
"description": "Docker: PUT /containers/{id}/archive executes container binary on the host"
},
"products": [
{
"@id": "pkg:golang/github.com/docker/docker@v28.5.2+incompatible"
}
],
"status": "not_affected",
"justification": "vulnerable_code_not_in_execute_path",
"impact_statement": "The vulnerable code is the Docker Engine daemon-side handler for the PUT /containers/{id}/archive endpoint, which under certain conditions resolves the archive target by executing a binary from inside the container on the host. docker-compose v5.1.3 statically bundles docker/docker v28.5.2+incompatible as a client-side library for API types and codecs; it never serves daemon HTTP routes. Sencho invokes compose only for up/down/ps operations against local user-authored compose files and never calls the /archive route in either direction. The daemon-side archive handler is not reachable. The fix lives on the github.com/moby/moby/v2 module path; until upstream compose migrates to the v2 import path, v28.5.2+incompatible is the only Go-module-resolvable version of the affected library that compose can reference."
},
{
"vulnerability": {
"@id": "https://www.cve.org/CVERecord?id=CVE-2026-42306",
"name": "CVE-2026-42306",
"description": "Docker: Race condition in docker cp allows bind mount redirection to host"
},
"products": [
{
"@id": "pkg:golang/github.com/docker/docker@v28.5.2+incompatible"
}
],
"status": "not_affected",
"justification": "vulnerable_code_not_in_execute_path",
"impact_statement": "The race condition is in the Docker Engine daemon-side bind-mount resolution path that backs `docker cp`, where a concurrent rename can redirect a copy operation onto a host path. docker-compose v5.1.3 statically bundles docker/docker v28.5.2+incompatible as a client-side library for API types and codecs; it never serves the daemon-side cp endpoint and never resolves bind mounts on the host. Sencho invokes compose only for up/down/ps operations against local user-authored compose files and does not invoke `docker cp` through compose. The vulnerable daemon-side code path is not reachable. The fix lives on the github.com/moby/moby/v2 module path; until upstream compose migrates to the v2 import path, v28.5.2+incompatible is the only Go-module-resolvable version of the affected library that compose can reference."
}
]
}