mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
12c2b37510
* feat(security): polish scan sheets, fix CVE links, surface policy violations Adds cveUrl helper that rewrites Trivy's 404-ing avd.aquasec.com links to cve.org for CVE-prefixed IDs (GHSA and misconfig URLs pass through unchanged). Redesigns both scan sheets with shadow-card-bevel chips, tracked-mono kickers, severity row tinting with a left accent rail, and tabular-nums timestamps. Surfaces a destructive policy-violation banner on scans whose policy_evaluation row flags a block, and fixes the compare sheet's delta ribbon so CRITICAL net-positive deltas render in destructive (not warning) tone. Backend parses the JSON policy_evaluation column at the API boundary so the UI receives a structured object. * chore(security): suppress CVE-2026-32281 and CVE-2026-32283 in Trivy scan Both CVEs affect Go stdlib crypto/x509 and TLS in Docker CLI 29.4.0 (Go 1.26.1) and Compose v5.1.2 (Go 1.25.8). No upstream static binary has been released with the patched Go 1.26.2 or 1.25.9 runtimes yet. Exposure analysis: the Docker CLI and compose plugin connect to the local Docker socket (Unix socket, no TLS) and to public registries with well-known CAs. Neither CVE is exploitable in this configuration. Added alongside sibling entries already in .trivyignore for the same binary versions. Revisit on next Docker CLI and Compose upstream release.
136 lines
6.9 KiB
Plaintext
136 lines
6.9 KiB
Plaintext
# Trivy ignore list
|
|
#
|
|
# Every entry in this file is a known HIGH or CRITICAL CVE that we have
|
|
# consciously accepted risk on and decided not to block CI over. Format:
|
|
#
|
|
# CVE-YYYY-NNNNN
|
|
# # Justification: why we're accepting this risk, and a link or note about
|
|
# # when to revisit (e.g. "blocked on upstream base image update, revisit
|
|
# # when alpine/node:22 ships a fix").
|
|
#
|
|
# Rules:
|
|
# - Every CVE MUST have a justification comment directly above it.
|
|
# - If there is no justification, the CVE is not ignored - add it here only
|
|
# after a human review and a decision to accept the risk.
|
|
# - Review this file on every release; remove entries whose upstream fix has
|
|
# landed.
|
|
#
|
|
# Picked up automatically by aquasecurity/trivy-action from the repo root
|
|
# working directory. Both the pre-push PR scan (.github/workflows/ci.yml) and
|
|
# the release-time re-scan (.github/workflows/docker-publish.yml) honor it.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Bundled inside /usr/local/bin/docker and docker-compose
|
|
# ---------------------------------------------------------------------------
|
|
# Docker CLI 29.4.0 ships Go 1.26.1 and Compose v5.1.2 ships Go 1.25.8.
|
|
# Both Go versions are vulnerable (fix requires Go 1.25.9 or 1.26.2).
|
|
# No upstream static binary ships a patched Go runtime yet. Revisit on the
|
|
# next Docker CLI and Compose release.
|
|
|
|
# Justification: Go stdlib symlink-following in Root.Chmod. Sencho does not
|
|
# use Root.Chmod; the Docker CLI and compose plugin are invoked as
|
|
# subprocesses to manage containers. The vulnerable code path requires a
|
|
# chroot context with attacker-controlled filesystem, which does not apply
|
|
# to our usage. Blocked on upstream Go rebuild; revisit on next CLI/Compose
|
|
# release.
|
|
CVE-2026-32282
|
|
|
|
# Justification: Go stdlib crypto/x509 certificate chain building DoS via
|
|
# crafted certificate. Affects the same Go 1.26.1 (CLI) and 1.25.8 (Compose)
|
|
# runtimes. The Docker CLI and compose plugin validate certificates only from
|
|
# well-known registry CAs and the local Docker socket; they never parse
|
|
# attacker-controlled certificate chains at runtime. Blocked on upstream Go
|
|
# rebuild; revisit on next CLI/Compose release.
|
|
CVE-2026-32281
|
|
|
|
# Justification: Go stdlib TLS stack exhaustion via repeated KeyUpdate messages
|
|
# from a peer. Affects the same Go 1.26.1 (CLI) and 1.25.8 (Compose) runtimes.
|
|
# The Docker CLI connects to the local Docker socket (Unix socket, not TLS) and
|
|
# to public registries using standard TLS with well-known CAs. An attacker
|
|
# would need to be an active TLS peer on those connections to send crafted
|
|
# KeyUpdate messages, which is not possible in our runtime environment.
|
|
# Blocked on upstream Go rebuild; revisit on next CLI/Compose release.
|
|
CVE-2026-32283
|
|
|
|
# Justification: Go stdlib crypto/x509 certificate chain building DoS.
|
|
# Affects the same Go 1.26.1 (CLI) and 1.25.8 (Compose) runtimes as above.
|
|
# The Docker CLI and compose plugin do not perform x509 chain validation
|
|
# against untrusted certificates in our usage (they connect to the local
|
|
# Docker socket or to registries with well-known CAs). Blocked on upstream
|
|
# Go rebuild; revisit on next CLI/Compose release.
|
|
CVE-2026-32280
|
|
|
|
# Justification: Go stdlib crypto/x509 certificate validation bypass due to
|
|
# incorrect DNS name constraint handling. Fixed in Go 1.26.2, but Docker CLI
|
|
# 29.4.0 ships Go 1.26.1 and no newer upstream static binary is available.
|
|
# Same exposure profile as CVE-2026-32280: the Docker CLI and compose plugin
|
|
# only validate certificates from well-known registry CAs and the local
|
|
# Docker socket in our usage, not from attacker-controlled CAs with crafted
|
|
# DNS name constraints. Blocked on upstream Go rebuild; revisit on next
|
|
# CLI/Compose release.
|
|
CVE-2026-33810
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Bundled inside /usr/local/lib/docker/cli-plugins/docker-compose (v5.1.2)
|
|
# ---------------------------------------------------------------------------
|
|
# Compose v5.1.2 is the latest upstream release. It statically links older
|
|
# copies of github.com/docker/docker, buildkit, and otel. We cannot bump
|
|
# these transitively without waiting for a new upstream Compose release.
|
|
# Revisit this block on every Compose release; remove entries as upstream
|
|
# rebuilds ship the fixes.
|
|
|
|
# Justification: github.com/docker/docker v28.5.2 statically bundled in
|
|
# compose v5.1.2. Moby authz bypass applies to a Docker daemon, not to the
|
|
# compose CLI plugin; compose never runs as a daemon. Revisit on next
|
|
# Compose upstream release.
|
|
CVE-2026-34040
|
|
|
|
# Justification: github.com/moby/buildkit v0.27.1 statically bundled in
|
|
# compose v5.1.2. BuildKit arbitrary file write via untrusted frontend is
|
|
# exploited at buildkit build time with attacker-controlled frontends; our
|
|
# compose invocations only call up/down/ps against local user-authored
|
|
# compose files, never as a build frontend. Revisit on next Compose upstream
|
|
# release.
|
|
CVE-2026-33747
|
|
|
|
# Justification: github.com/moby/buildkit v0.27.1 statically bundled in
|
|
# compose v5.1.2. Same exposure profile as CVE-2026-33747 (Git URL fragment
|
|
# subdir exploitation requires invoking buildkit on untrusted repo URLs,
|
|
# which compose does not do in our flow). Revisit on next Compose upstream
|
|
# release.
|
|
CVE-2026-33748
|
|
|
|
# Justification: go.opentelemetry.io/otel/sdk v1.38.0 statically bundled in
|
|
# compose v5.1.2. PATH hijacking requires the attacker to control the
|
|
# process PATH before compose starts; our container starts compose from a
|
|
# fixed PATH with only /usr/local/bin and /usr/bin on it, both owned by
|
|
# root. Revisit on next Compose upstream release.
|
|
CVE-2026-24051
|
|
|
|
# Justification: go.opentelemetry.io/otel/sdk v1.38.0 statically bundled in
|
|
# compose v5.1.2. BSD kenv PATH hijacking only applies on BSD systems; we
|
|
# ship linux/amd64 and linux/arm64. Not applicable in our runtime. Revisit
|
|
# on next Compose upstream release.
|
|
CVE-2026-39883
|
|
|
|
# Justification: google.golang.org/grpc v1.78.0 statically bundled in
|
|
# Docker CLI v29.4.0. Compose v5.1.2 bumped grpc to 1.80.0, resolving this
|
|
# for the compose binary. The CLI still ships 1.78.0. Exploit requires an
|
|
# attacker-controlled HTTP/2 peer talking to a gRPC server; the docker CLI
|
|
# only acts as a gRPC client against the local unix socket, not as a server.
|
|
# Revisit on next Docker CLI release.
|
|
CVE-2026-33186
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Bundled inside /usr/local/lib/node_modules/npm/ (node:22-alpine base image)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Justification: picomatch 4.0.3 is shipped inside the npm CLI that comes
|
|
# bundled with the upstream node:22-alpine base image. We do not run npm at
|
|
# container runtime against user-controlled input; npm is only invoked at
|
|
# build time against our own package.json files. The ReDoS requires an
|
|
# attacker-authored extglob pattern, which is not reachable from any
|
|
# runtime code path. Revisit when a future node:22-alpine base image ships
|
|
# a newer npm that bundles picomatch >= 4.0.4.
|
|
CVE-2026-33671
|