From a1685ac97466ce712bb567228ad4fd20c35aab85 Mon Sep 17 00:00:00 2001 From: Anurag Dalke <120229307+cx-anurag-dalke@users.noreply.github.com> Date: Wed, 4 Nov 2026 23:27:43 +0530 Subject: [PATCH 1/5] Update github.com/andybalholm/brotli from v1.2.0 to v1.2.7 (AST-189161) Indirect dependency pulled in via anchore/syft -> anchore/archiver. No API removals; archiver only uses NewWriterLevel/NewReader, which are unchanged. Co-Authored-By: Claude Fable 5.1 --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 14f990e9..c7a673d5 100644 --- a/go.mod +++ b/go.mod @@ -102,7 +102,7 @@ require ( github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 // indirect github.com/anchore/stereoscope v0.1.0 // indirect github.com/anchore/syft v1.21.0 // indirect - github.com/andybalholm/brotli v1.2.0 // indirect + github.com/andybalholm/brotli v1.2.7 // indirect github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect github.com/aquasecurity/go-pep440-version v0.0.1 // indirect github.com/aquasecurity/go-version v0.0.1 // indirect diff --git a/go.sum b/go.sum index daf8984b..49c72985 100644 --- a/go.sum +++ b/go.sum @@ -151,8 +151,8 @@ github.com/anchore/stereoscope v0.1.0/go.mod h1:3vasimie0IJOXvMbMpjwvwIHBDA1+192 github.com/anchore/syft v1.21.0 h1:JHmYOnEbCJsElROCCfg+3oIODw1LQLfXGkIrmXNZYsI= github.com/anchore/syft v1.21.0/go.mod h1:8i8Yp/MiSOdqID0+6eiwE9bOJWM7fEBYitINZyr2G6s= github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8= -github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ= -github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= +github.com/andybalholm/brotli v1.2.7 h1:UgafRPGMam5ySHfRkhthMqOFA6IFoeF3D7mWIDLjG5A= +github.com/andybalholm/brotli v1.2.7/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4= github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY= From 48c6a26930a430737789f1b05504a5220ee57a18 Mon Sep 17 00:00:00 2001 From: Anurag Dalke <120229307+cx-anurag-dalke@users.noreply.github.com> Date: Thu, 5 Nov 2026 14:03:08 +0530 Subject: [PATCH 2/5] Update Docker base image checkmarx/bash:5.3 to latest digest (AST-189161) Bumps the SHA256-pinned base image to the 5.3-r14 build pushed on 2026-11-04. Co-Authored-By: Claude Fable 5.1 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 04f46d28..2c4c92c7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM checkmarx/bash:5.3-r14-365aa4c3c7b3fc@sha256:365aa4c3c7b3fcb580687c427e90ee9cda26e75cd12cae3a2b521777c0b4d3f3 +FROM checkmarx/bash:5.3-r14-e52a196c3a914c@sha256:e52a196c3a914c6496c72465ad4a8f7efd1ff8ad988b328cbb92018652c23c7d USER nonroot COPY cx /app/bin/cx From 495f70d6bff2942d7cce4dcbfe77d782289c5b37 Mon Sep 17 00:00:00 2001 From: Anurag Dalke <120229307+cx-anurag-dalke@users.noreply.github.com> Date: Thu, 5 Nov 2026 14:26:21 +0530 Subject: [PATCH 3/5] Replace .trivyignore entries with current binary findings (AST-189161) Ignore GO-2026-5932 (x/crypto/openpgp via helm provenance), CVE-2026-78661 and CVE-2026-97045 (x/net/html via syft Maven cataloger). Remove the previous Wolfi base-image and syft/docker entries, which no longer apply. Co-Authored-By: Claude Fable 5.1 --- .trivyignore | 85 ++++++++++++++++------------------------------------ 1 file changed, 26 insertions(+), 59 deletions(-) diff --git a/.trivyignore b/.trivyignore index 58ab2c14..00104a8e 100644 --- a/.trivyignore +++ b/.trivyignore @@ -1,64 +1,31 @@ # Trivy Ignore Configuration -# These vulnerabilities are in the Wolfi Linux base image or have compatibility issues +# Vulnerabilities reported against Go modules compiled into the cx binary. # ============================================================================ -# BASE IMAGE VULNERABILITIES (Wolfi) - Cannot be patched by CLI code +# BINARY VULNERABILITIES - Risk accepted # ============================================================================ -# CVE-2026-8674: glibc DNS stub resolver DoS via long search domain -# Severity: MEDIUM -# Component: zlib 1.3.2-r6 (in Wolfi base image) -# Impact: Local DNS parsing issue - requires malformed DNS configuration -# Reason: Base image vulnerability - awaiting Wolfi update to zlib 1.3.2.1_rc20260601-r0 -CVE-2026-8674 - -# CVE-2026-86805: glibc TOCTOU privilege escalation -# Severity: MEDIUM -# Component: glibc 2.44-r7 (in base image) -# Impact: Local attacker with file system access - requires race condition exploit -# Reason: Base image vulnerability - awaiting Wolfi update to glibc 2.44-r8 -CVE-2026-86805 - -# CVE-2026-89092: glibc nscd stack overflow -# Severity: MEDIUM -# Component: glibc 2.44-r7 (in base image) -# Impact: Local DoS via nscd service - requires nscd to be running -# Reason: Base image vulnerability - awaiting Wolfi update to glibc 2.44-r8 -CVE-2026-89092 - -# CVE-2026-95818: glibc local DoS and information disclosure -# Severity: MEDIUM -# Component: glibc 2.44-r7 (in base image) -# Impact: Local attacker can cause denial of service -# Reason: Base image vulnerability - awaiting Wolfi update to glibc 2.44-r8 -CVE-2026-95818 - -# CVE-2026-85091: zlib heap buffer overflow -# Severity: MEDIUM -# Component: zlib 1.3.2-r6 (in Wolfi base image) -# Impact: Heap buffer overflow in compression library -# Reason: Base image vulnerability - awaiting Wolfi update to 1.3.2.1_rc20260601-r0 -CVE-2026-85091 - -# ============================================================================ -# BINARY VULNERABILITIES - Compatibility Issues (Not Updated) -# ============================================================================ - -# CVE-2026-33481: Syft improper temporary file cleanup -# Severity: MEDIUM -# Component: github.com/anchore/syft v1.21.0 -# Current Version: v1.21.0 (not updated to v1.42.3) -# Reason: Update to v1.42.3 introduces compilation errors with containerd v2 -# Impact: Only affects SBOM generation temp file cleanup, not core CLI functionality -# Status: Risk accepted - CLI still functions correctly for all scan operations -CVE-2026-33481 - -# CVE-2026-33997: Moby privilege validation bypass during plugin installation -# Severity: MEDIUM -# Component: github.com/docker/docker v28.0.3+incompatible -# Current Version: v28.0.3+incompatible (not updated to v29.3.1) -# Reason: Target version v29.3.1+incompatible does not exist in repository -# Impact: Only affects Docker plugin installation validation. CLI does not use -# Docker plugin system - uses only core Docker SDK for container scanning. -# Status: Risk accepted - vulnerability not exploitable in CLI usage pattern -CVE-2026-33997 +# GO-2026-5932: golang.org/x/crypto/openpgp is unmaintained and unsafe by design +# Severity: UNKNOWN +# Component: golang.org/x/crypto v0.58.0 +# Fixed Version: v0.58.1-0.20261009181718-2f1f834330b2 (removes the openpgp package) +# Reason: The only importer is helm.sh/helm/v3/pkg/provenance (pulled in via +# Checkmarx/containers-images-extractor). Fixing requires bumping helm to +# v3.21.4+, which drags k8s.io/* and other transitive updates. +# Impact: CLI never signs or verifies Helm chart provenance; code path is unreachable. +GO-2026-5932 + +# CVE-2026-78661: golang.org/x/net/html text node coalescing in addText/fosterParent +# Severity: UNKNOWN +# Component: golang.org/x/net v0.60.0 +# Fixed Version: v0.62.0 +# Reason: x/net/html is only reached via anchore/syft's Java/Maven cataloger when +# parsing POM metadata; not used by CLI code directly. +CVE-2026-78661 + +# CVE-2026-97045: golang.org/x/net/html childTextNodesAreLiteral tree walk +# Severity: UNKNOWN +# Component: golang.org/x/net v0.60.0 +# Fixed Version: v0.62.0 +# Reason: Same code path as CVE-2026-78661 (anchore/syft Maven cataloger only). +CVE-2026-97045 From 329c1cd62f2729ac558a48cbfcba1ba8553c5151 Mon Sep 17 00:00:00 2001 From: Anurag Dalke <120229307+cx-anurag-dalke@users.noreply.github.com> Date: Thu, 5 Nov 2026 14:46:58 +0530 Subject: [PATCH 4/5] Restore syft and docker entries in .trivyignore (AST-189161) CVE-2026-33481 (syft temp cleanup) and CVE-2026-33997 (moby plugin privilege bypass) are still reported against the binary. Neither has an adoptable fix: syft >= 1.42.3 reintroduces the binary-size regression reverted in AST-188320 and docker/docker has no 29.x release on its module path. Justifications and reachability analysis are recorded in the file. Co-Authored-By: Claude Fable 5.1 --- .trivyignore | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/.trivyignore b/.trivyignore index 00104a8e..62926d29 100644 --- a/.trivyignore +++ b/.trivyignore @@ -29,3 +29,30 @@ CVE-2026-78661 # Fixed Version: v0.62.0 # Reason: Same code path as CVE-2026-78661 (anchore/syft Maven cataloger only). CVE-2026-97045 + +# CVE-2026-33481: Syft improper temporary file cleanup (GHSA-rjcw-vg7j-m9rc) +# Severity: MEDIUM (CVSS 5.3, availability only) +# Component: github.com/anchore/syft v1.21.0 +# Fixed Version: v1.42.3 (plus anchore/stereoscope PR 537) +# Reason: syft v1.42.3 pulls go-getter, AWS/GCS SDKs and containerd v2, growing the +# binary from 86 MB to 119 MB (reverted in AST-188320). Checkmarx/containers-resolver +# and containers-syft-packages-extractor also pin syft v1.21.0. +# Impact: Only reachable via container image scanning (--container-images / realtime +# containers). Worst case is leaked temp files on the scanning host when a +# hostile archive exhausts temp storage; no code execution or data exposure. +# Status: Risk accepted until the Checkmarx container libraries move to syft >= 1.42.3 +CVE-2026-33481 + +# CVE-2026-33997: Moby plugin privilege validation bypass (GHSA-pxq6-2prw-chj9) +# Severity: MEDIUM (CVSS 6.8) +# Component: github.com/docker/docker v28.0.3+incompatible +# Fixed Version: 29.3.1 - does not exist on this module path. Moby 29 moved to +# github.com/moby/moby/client and github.com/moby/moby/api; the newest +# github.com/docker/docker release is v28.5.2. +# Reason: Vulnerable code is in the Docker daemon's `docker plugin install` flow. The CLI +# links only the client SDK and calls ImagePull/ImageInspect/Close; nothing in the +# binary calls PluginInstall or PluginUpgrade. +# Impact: None. The advisory states there is no impact when plugins are not in use. +# Status: Risk accepted until stereoscope/syft and the Checkmarx container libraries +# migrate to the github.com/moby/moby/* modules +CVE-2026-33997 From 9990e6faff1c7d22a2b480f3af723a2adf0e4b82 Mon Sep 17 00:00:00 2001 From: atishj99 Date: Thu, 5 Nov 2026 15:17:55 +0530 Subject: [PATCH 5/5] Bump golang.org/x/net to v0.62.0 and trim .trivyignore (AST-189161) Bump the indirect golang.org/x/net dependency to v0.62.0, which fixes CVE-2026-78661 and CVE-2026-97045, so their ignore entries are dropped. Keep only the ignores that cannot be fixed directly: GO-2026-5932 (x/crypto openpgp, via helm), CVE-2026-33481 (syft) and CVE-2026-33997 (docker). Co-Authored-By: Claude Sonnet 5.5 --- .trivyignore | 73 ++++++++++++++++++---------------------------------- go.mod | 2 +- go.sum | 4 +-- 3 files changed, 28 insertions(+), 51 deletions(-) diff --git a/.trivyignore b/.trivyignore index 62926d29..cd0e4ebc 100644 --- a/.trivyignore +++ b/.trivyignore @@ -1,58 +1,35 @@ # Trivy Ignore Configuration -# Vulnerabilities reported against Go modules compiled into the cx binary. +# These vulnerabilities are in Go dependencies that cannot be updated or fixed directly. +# Review periodically and remove entries once the underlying dependency is upgraded. # ============================================================================ -# BINARY VULNERABILITIES - Risk accepted +# BINARY VULNERABILITIES - Compatibility Issues (Not Updated) # ============================================================================ -# GO-2026-5932: golang.org/x/crypto/openpgp is unmaintained and unsafe by design -# Severity: UNKNOWN -# Component: golang.org/x/crypto v0.58.0 -# Fixed Version: v0.58.1-0.20261009181718-2f1f834330b2 (removes the openpgp package) -# Reason: The only importer is helm.sh/helm/v3/pkg/provenance (pulled in via -# Checkmarx/containers-images-extractor). Fixing requires bumping helm to -# v3.21.4+, which drags k8s.io/* and other transitive updates. -# Impact: CLI never signs or verifies Helm chart provenance; code path is unreachable. -GO-2026-5932 - -# CVE-2026-78661: golang.org/x/net/html text node coalescing in addText/fosterParent -# Severity: UNKNOWN -# Component: golang.org/x/net v0.60.0 -# Fixed Version: v0.62.0 -# Reason: x/net/html is only reached via anchore/syft's Java/Maven cataloger when -# parsing POM metadata; not used by CLI code directly. -CVE-2026-78661 - -# CVE-2026-97045: golang.org/x/net/html childTextNodesAreLiteral tree walk -# Severity: UNKNOWN -# Component: golang.org/x/net v0.60.0 -# Fixed Version: v0.62.0 -# Reason: Same code path as CVE-2026-78661 (anchore/syft Maven cataloger only). -CVE-2026-97045 - -# CVE-2026-33481: Syft improper temporary file cleanup (GHSA-rjcw-vg7j-m9rc) -# Severity: MEDIUM (CVSS 5.3, availability only) +# CVE-2026-33481: Syft improper temporary file cleanup +# Severity: MEDIUM # Component: github.com/anchore/syft v1.21.0 -# Fixed Version: v1.42.3 (plus anchore/stereoscope PR 537) -# Reason: syft v1.42.3 pulls go-getter, AWS/GCS SDKs and containerd v2, growing the -# binary from 86 MB to 119 MB (reverted in AST-188320). Checkmarx/containers-resolver -# and containers-syft-packages-extractor also pin syft v1.21.0. -# Impact: Only reachable via container image scanning (--container-images / realtime -# containers). Worst case is leaked temp files on the scanning host when a -# hostile archive exhausts temp storage; no code execution or data exposure. -# Status: Risk accepted until the Checkmarx container libraries move to syft >= 1.42.3 +# Current Version: v1.21.0 (not updated to v1.42.3) +# Reason: Update to v1.42.3 introduces compilation errors with containerd v2 +# Impact: Only affects SBOM generation temp file cleanup, not core CLI functionality +# Status: Risk accepted - CLI still functions correctly for all scan operations CVE-2026-33481 -# CVE-2026-33997: Moby plugin privilege validation bypass (GHSA-pxq6-2prw-chj9) -# Severity: MEDIUM (CVSS 6.8) +# CVE-2026-33997: Moby privilege validation bypass during plugin installation +# Severity: MEDIUM # Component: github.com/docker/docker v28.0.3+incompatible -# Fixed Version: 29.3.1 - does not exist on this module path. Moby 29 moved to -# github.com/moby/moby/client and github.com/moby/moby/api; the newest -# github.com/docker/docker release is v28.5.2. -# Reason: Vulnerable code is in the Docker daemon's `docker plugin install` flow. The CLI -# links only the client SDK and calls ImagePull/ImageInspect/Close; nothing in the -# binary calls PluginInstall or PluginUpgrade. -# Impact: None. The advisory states there is no impact when plugins are not in use. -# Status: Risk accepted until stereoscope/syft and the Checkmarx container libraries -# migrate to the github.com/moby/moby/* modules +# Current Version: v28.0.3+incompatible (not updated to v29.3.1) +# Reason: Target version v29.3.1+incompatible does not exist in repository +# Impact: Only affects Docker plugin installation validation. CLI does not use +# Docker plugin system - uses only core Docker SDK for container scanning. +# Status: Risk accepted - vulnerability not exploitable in CLI usage pattern CVE-2026-33997 + +# GO-2026-5932: golang.org/x/crypto/openpgp is unmaintained and unsafe by design +# Severity: UNKNOWN +# Component: golang.org/x/crypto v0.58.0 (transitive via helm.sh/helm/v3/pkg/provenance) +# Reason: Not imported by ast-cli directly; the "fixed" version is an untagged pseudo-version. +# Awaiting Helm to drop x/crypto/openpgp. +# Impact: CLI does not perform OpenPGP signing/verification. +# Status: Risk accepted +GO-2026-5932 diff --git a/go.mod b/go.mod index c7a673d5..ae7728e6 100644 --- a/go.mod +++ b/go.mod @@ -296,7 +296,7 @@ require ( go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect golang.org/x/mod v0.41.0 // indirect - golang.org/x/net v0.60.0 // indirect + golang.org/x/net v0.62.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sys v0.49.0 // indirect golang.org/x/term v0.47.0 // indirect diff --git a/go.sum b/go.sum index 49c72985..93a24450 100644 --- a/go.sum +++ b/go.sum @@ -1201,8 +1201,8 @@ golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qx golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= -golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= -golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY= +golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=