diff --git a/.trivyignore b/.trivyignore index 58ab2c14..cd0e4ebc 100644 --- a/.trivyignore +++ b/.trivyignore @@ -1,44 +1,6 @@ # Trivy Ignore Configuration -# These vulnerabilities are in the Wolfi Linux base image or have compatibility issues - -# ============================================================================ -# BASE IMAGE VULNERABILITIES (Wolfi) - Cannot be patched by CLI code -# ============================================================================ - -# CVE-2026-8674: glibc DNS stub resolver DoS via long search domain -# Severity: MEDIUM -# Component: zlib 1.3.2-r6 (in Wolfi base image) -# Impact: Local DNS parsing issue - requires malformed DNS configuration -# Reason: Base image vulnerability - awaiting Wolfi update to zlib 1.3.2.1_rc20260601-r0 -CVE-2026-8674 - -# CVE-2026-86805: glibc TOCTOU privilege escalation -# Severity: MEDIUM -# Component: glibc 2.44-r7 (in base image) -# Impact: Local attacker with file system access - requires race condition exploit -# Reason: Base image vulnerability - awaiting Wolfi update to glibc 2.44-r8 -CVE-2026-86805 - -# CVE-2026-89092: glibc nscd stack overflow -# Severity: MEDIUM -# Component: glibc 2.44-r7 (in base image) -# Impact: Local DoS via nscd service - requires nscd to be running -# Reason: Base image vulnerability - awaiting Wolfi update to glibc 2.44-r8 -CVE-2026-89092 - -# CVE-2026-95818: glibc local DoS and information disclosure -# Severity: MEDIUM -# Component: glibc 2.44-r7 (in base image) -# Impact: Local attacker can cause denial of service -# Reason: Base image vulnerability - awaiting Wolfi update to glibc 2.44-r8 -CVE-2026-95818 - -# CVE-2026-85091: zlib heap buffer overflow -# Severity: MEDIUM -# Component: zlib 1.3.2-r6 (in Wolfi base image) -# Impact: Heap buffer overflow in compression library -# Reason: Base image vulnerability - awaiting Wolfi update to 1.3.2.1_rc20260601-r0 -CVE-2026-85091 +# These vulnerabilities are in Go dependencies that cannot be updated or fixed directly. +# Review periodically and remove entries once the underlying dependency is upgraded. # ============================================================================ # BINARY VULNERABILITIES - Compatibility Issues (Not Updated) @@ -62,3 +24,12 @@ CVE-2026-33481 # Docker plugin system - uses only core Docker SDK for container scanning. # Status: Risk accepted - vulnerability not exploitable in CLI usage pattern CVE-2026-33997 + +# GO-2026-5932: golang.org/x/crypto/openpgp is unmaintained and unsafe by design +# Severity: UNKNOWN +# Component: golang.org/x/crypto v0.58.0 (transitive via helm.sh/helm/v3/pkg/provenance) +# Reason: Not imported by ast-cli directly; the "fixed" version is an untagged pseudo-version. +# Awaiting Helm to drop x/crypto/openpgp. +# Impact: CLI does not perform OpenPGP signing/verification. +# Status: Risk accepted +GO-2026-5932 diff --git a/Dockerfile b/Dockerfile index 04f46d28..2c4c92c7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM checkmarx/bash:5.3-r14-365aa4c3c7b3fc@sha256:365aa4c3c7b3fcb580687c427e90ee9cda26e75cd12cae3a2b521777c0b4d3f3 +FROM checkmarx/bash:5.3-r14-e52a196c3a914c@sha256:e52a196c3a914c6496c72465ad4a8f7efd1ff8ad988b328cbb92018652c23c7d USER nonroot COPY cx /app/bin/cx diff --git a/go.mod b/go.mod index 14f990e9..ae7728e6 100644 --- a/go.mod +++ b/go.mod @@ -102,7 +102,7 @@ require ( github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 // indirect github.com/anchore/stereoscope v0.1.0 // indirect github.com/anchore/syft v1.21.0 // indirect - github.com/andybalholm/brotli v1.2.0 // indirect + github.com/andybalholm/brotli v1.2.7 // indirect github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect github.com/aquasecurity/go-pep440-version v0.0.1 // indirect github.com/aquasecurity/go-version v0.0.1 // indirect @@ -296,7 +296,7 @@ require ( go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect golang.org/x/mod v0.41.0 // indirect - golang.org/x/net v0.60.0 // indirect + golang.org/x/net v0.62.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sys v0.49.0 // indirect golang.org/x/term v0.47.0 // indirect diff --git a/go.sum b/go.sum index daf8984b..93a24450 100644 --- a/go.sum +++ b/go.sum @@ -151,8 +151,8 @@ github.com/anchore/stereoscope v0.1.0/go.mod h1:3vasimie0IJOXvMbMpjwvwIHBDA1+192 github.com/anchore/syft v1.21.0 h1:JHmYOnEbCJsElROCCfg+3oIODw1LQLfXGkIrmXNZYsI= github.com/anchore/syft v1.21.0/go.mod h1:8i8Yp/MiSOdqID0+6eiwE9bOJWM7fEBYitINZyr2G6s= github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8= -github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ= -github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= +github.com/andybalholm/brotli v1.2.7 h1:UgafRPGMam5ySHfRkhthMqOFA6IFoeF3D7mWIDLjG5A= +github.com/andybalholm/brotli v1.2.7/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4= github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY= @@ -1201,8 +1201,8 @@ golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qx golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= -golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= -golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY= +golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=