Skip to content

Document and suppress Trivy issues 652-657 (libssl3t64, stdlib, unknown) #659

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tomwillis608 merged 3 commits into from
May 6, 2026
Merged

Document and suppress Trivy issues 652-657 (libssl3t64, stdlib, unknown) #659

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
46aa3a9
Initial plan
Copilot May 3, 2026
dff3c24
Document CVE-2026-31789 mitigation
Copilot May 3, 2026
9995b3a
Document CVE-2026-28387/28388/28389/32281/32283
Copilot May 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 47 additions & 0 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -492,6 +492,46 @@ CVE-2026-33671
# We will monitor NVD/Trivy updates and remove this ignore once actionable details exist.
# Acceptance date: 2026-04-18
CVE-2026-32282
# Accepted Risk: Unknown vulnerability in app container (CVE-2026-32283)
# Trivy detected CVE-2026-32283 but provided no specific package or version information.
# The affected component is listed as "app" with package "unknown" and version "unknown".
# No fixed version is currently available, so no direct patch can be applied.
# This may be a false positive or a newly published CVE with incomplete metadata.
# We will monitor NVD/Trivy updates and remove this ignore once actionable details exist.
# Acceptance date: 2026-05-03
CVE-2026-32283
# Accepted Risk: Unknown vulnerability in app container (CVE-2026-28387)
# Trivy detected CVE-2026-28387 but provided no specific package or version information.
# The affected component is listed as "app" with package "unknown" and version "unknown".
# No fixed version is currently available, so no direct patch can be applied.
# This may be a false positive or a newly published CVE with incomplete metadata.
# We will monitor NVD/Trivy updates and remove this ignore once actionable details exist.
# Acceptance date: 2026-05-03
CVE-2026-28387
# Accepted Risk: Unknown vulnerability in app container (CVE-2026-28388)
# Trivy detected CVE-2026-28388 but provided no specific package or version information.
# The affected component is listed as "app" with package "unknown" and version "unknown".
# No fixed version is currently available, so no direct patch can be applied.
# This may be a false positive or a newly published CVE with incomplete metadata.
# We will monitor NVD/Trivy updates and remove this ignore once actionable details exist.
# Acceptance date: 2026-05-03
CVE-2026-28388
# Accepted Risk: Unknown vulnerability in app container (CVE-2026-28389)
# Trivy detected CVE-2026-28389 but provided no specific package or version information.
# The affected component is listed as "app" with package "unknown" and version "unknown".
# No fixed version is currently available, so no direct patch can be applied.
# This may be a false positive or a newly published CVE with incomplete metadata.
# We will monitor NVD/Trivy updates and remove this ignore once actionable details exist.
# Acceptance date: 2026-05-03
CVE-2026-28389
# Accepted Risk: Go stdlib vulnerability in app container (CVE-2026-32281)
# Trivy reports this against package "stdlib" in component "app".
# GitHub CLI v2.86.0 is compiled with Go 1.25.5, which is vulnerable.
# Fixed in Go 1.25.9 and 1.26.2. Waiting for upstream gh CLI to rebuild with patched Go.
# Risk is currently low in our context: gh is used for outbound calls to trusted GitHub APIs
# from short-lived, isolated GitHub Actions runners.
# Acceptance date: 2026-05-03
CVE-2026-32281
# Accepted Risk: Go stdlib vulnerability in app container (CVE-2026-32280)
# Trivy reports this against package "stdlib" in component "app".
# GitHub CLI v2.86.0 is compiled with Go 1.25.5, which is vulnerable.
Expand All @@ -507,3 +547,10 @@ CVE-2026-32280
# Trivy may detect vulnerable versions in cached/intermediate layers before upgrade.
# Acceptance date: 2026-04-18
CVE-2026-28390
# Mitigated: libssl3t64 OpenSSL Vulnerability (CVE-2026-31789)
# The CVE affects libssl3t64 versions prior to 3.5.4-1~deb13u2 in Debian 13 (Trixie).
# The Dockerfile uses node:24.13.1-trixie-slim and runs apt-get upgrade -y, which updates
# libssl3t64 to the latest patched Debian security version (3.5.4-1~deb13u2 or later).
# Trivy may detect vulnerable versions in cached/intermediate layers before upgrade.
# Acceptance date: 2026-05-03
CVE-2026-31789
162 changes: 162 additions & 0 deletions docs/threat_model.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1727,6 +1727,147 @@ This section documents specific security findings that have been analyzed, triag
* **References:**
* [NVD CVE-2026-32282](https://nvd.nist.gov/vuln/detail/CVE-2026-32282)

### CVE-2026-32283: Unknown App Container Vulnerability

* **Component:** `app` (unknown package)
* **Scanner:** Trivy
* **Severity:** UNKNOWN
* **Status:** **Accepted Risk / Suppressed**
* **Analysis:**
* **The Vulnerability:** CVE-2026-32283 is reported without package attribution or version details.
* **The Fix:** No fixed version is available because the affected package is unknown.
* **Current Status (as of May 2026):** The repository already applies standard hardening controls in the Dockerfile:
* The base image is upgraded with `apt-get upgrade -y`
* NPM transitive dependencies are aggressively refreshed using `npm update --depth 99 --omit=dev --ignore-scripts`
* GitHub CLI is installed from verified release checksums
* **Why Trivy Detects It:** The detection may be:
* A false positive from generic signature matching without package attribution
* Incomplete CVE metadata in the vulnerability database
* Detection against intermediate build layers or stale scanner data
* **Risk Assessment:**
* **Likelihood:** Unknown. Without package details, exploitability in this action cannot be determined.
* **Impact:** Unknown. Without a known affected package, scope and impact cannot be quantified.
* **Overall Risk:** Low-to-unknown but currently acceptable as a temporary exception because no actionable remediation path exists and baseline hardening controls are already in place.
* **Mitigation:** The vulnerability is temporarily accepted and suppressed via `.trivyignore` until actionable package metadata or a fixed version is published. We will:
* Monitor updates to CVE-2026-32283 in NVD/Trivy databases
* Re-run scans regularly and remove the suppression as soon as a concrete fix path is available
* Continue applying routine OS and dependency updates in container builds
* **Acceptance Date:** 2026-05-03
* **References:**
* [NVD CVE-2026-32283](https://nvd.nist.gov/vuln/detail/CVE-2026-32283)

### CVE-2026-28387: Unknown App Container Vulnerability

* **Component:** `app` (unknown package)
* **Scanner:** Trivy
* **Severity:** HIGH
* **Status:** **Accepted Risk / Suppressed**
* **Analysis:**
* **The Vulnerability:** CVE-2026-28387 is reported without package attribution or version details.
* **The Fix:** No fixed version is available because the affected package is unknown.
* **Current Status (as of May 2026):** The repository already applies standard hardening controls in the Dockerfile:
* The base image is upgraded with `apt-get upgrade -y`
* NPM transitive dependencies are aggressively refreshed using `npm update --depth 99 --omit=dev --ignore-scripts`
* GitHub CLI is installed from verified release checksums
* **Why Trivy Detects It:** The detection may be:
* A false positive from generic signature matching without package attribution
* Incomplete CVE metadata in the vulnerability database
* Detection against intermediate build layers or stale scanner data
* **Risk Assessment:**
* **Likelihood:** Unknown. Without package details, exploitability in this action cannot be determined.
* **Impact:** Unknown. Without a known affected package, scope and impact cannot be quantified.
* **Overall Risk:** Low-to-unknown but currently acceptable as a temporary exception because no actionable remediation path exists and baseline hardening controls are already in place.
* **Mitigation:** The vulnerability is temporarily accepted and suppressed via `.trivyignore` until actionable package metadata or a fixed version is published. We will:
* Monitor updates to CVE-2026-28387 in NVD/Trivy databases
* Re-run scans regularly and remove the suppression as soon as a concrete fix path is available
* Continue applying routine OS and dependency updates in container builds
* **Acceptance Date:** 2026-05-03
* **References:**
* [NVD CVE-2026-28387](https://nvd.nist.gov/vuln/detail/CVE-2026-28387)

### CVE-2026-28388: Unknown App Container Vulnerability

* **Component:** `app` (unknown package)
* **Scanner:** Trivy
* **Severity:** UNKNOWN
* **Status:** **Accepted Risk / Suppressed**
* **Analysis:**
* **The Vulnerability:** CVE-2026-28388 is reported without package attribution or version details.
* **The Fix:** No fixed version is available because the affected package is unknown.
* **Current Status (as of May 2026):** The repository already applies standard hardening controls in the Dockerfile:
* The base image is upgraded with `apt-get upgrade -y`
* NPM transitive dependencies are aggressively refreshed using `npm update --depth 99 --omit=dev --ignore-scripts`
* GitHub CLI is installed from verified release checksums
* **Why Trivy Detects It:** The detection may be:
* A false positive from generic signature matching without package attribution
* Incomplete CVE metadata in the vulnerability database
* Detection against intermediate build layers or stale scanner data
* **Risk Assessment:**
* **Likelihood:** Unknown. Without package details, exploitability in this action cannot be determined.
* **Impact:** Unknown. Without a known affected package, scope and impact cannot be quantified.
* **Overall Risk:** Low-to-unknown but currently acceptable as a temporary exception because no actionable remediation path exists and baseline hardening controls are already in place.
* **Mitigation:** The vulnerability is temporarily accepted and suppressed via `.trivyignore` until actionable package metadata or a fixed version is published. We will:
* Monitor updates to CVE-2026-28388 in NVD/Trivy databases
* Re-run scans regularly and remove the suppression as soon as a concrete fix path is available
* Continue applying routine OS and dependency updates in container builds
* **Acceptance Date:** 2026-05-03
* **References:**
* [NVD CVE-2026-28388](https://nvd.nist.gov/vuln/detail/CVE-2026-28388)

### CVE-2026-28389: Unknown App Container Vulnerability

* **Component:** `app` (unknown package)
* **Scanner:** Trivy
* **Severity:** UNKNOWN
* **Status:** **Accepted Risk / Suppressed**
* **Analysis:**
* **The Vulnerability:** CVE-2026-28389 is reported without package attribution or version details.
* **The Fix:** No fixed version is available because the affected package is unknown.
* **Current Status (as of May 2026):** The repository already applies standard hardening controls in the Dockerfile:
* The base image is upgraded with `apt-get upgrade -y`
* NPM transitive dependencies are aggressively refreshed using `npm update --depth 99 --omit=dev --ignore-scripts`
* GitHub CLI is installed from verified release checksums
* **Why Trivy Detects It:** The detection may be:
* A false positive from generic signature matching without package attribution
* Incomplete CVE metadata in the vulnerability database
* Detection against intermediate build layers or stale scanner data
* **Risk Assessment:**
* **Likelihood:** Unknown. Without package details, exploitability in this action cannot be determined.
* **Impact:** Unknown. Without a known affected package, scope and impact cannot be quantified.
* **Overall Risk:** Low-to-unknown but currently acceptable as a temporary exception because no actionable remediation path exists and baseline hardening controls are already in place.
* **Mitigation:** The vulnerability is temporarily accepted and suppressed via `.trivyignore` until actionable package metadata or a fixed version is published. We will:
* Monitor updates to CVE-2026-28389 in NVD/Trivy databases
* Re-run scans regularly and remove the suppression as soon as a concrete fix path is available
* Continue applying routine OS and dependency updates in container builds
* **Acceptance Date:** 2026-05-03
* **References:**
* [NVD CVE-2026-28389](https://nvd.nist.gov/vuln/detail/CVE-2026-28389)

### CVE-2026-32281: Go Standard Library (stdlib) Vulnerability

* **Component:** `stdlib` (Go standard library embedded in `gh` binary)
* **Scanner:** Trivy
* **Severity:** HIGH
* **Status:** **Accepted Risk / Suppressed**
* **Analysis:**
* **The Vulnerability:** CVE-2026-32281 is a HIGH severity vulnerability in the Go standard library (`stdlib`) detected in the app container image.
* **The Fix:** Fixed in Go 1.25.9 and 1.26.2.
* **Current Status (as of May 2026):** The Dockerfile pins GitHub CLI to `v2.86.0`, which is compiled with Go 1.25.5. This version is below the fixed Go versions for CVE-2026-32281.
* **Why We Cannot Upgrade Yet:** We rely on upstream GitHub CLI release artifacts. Until GitHub CLI publishes a release built with Go 1.25.9+ or 1.26.2+, we cannot directly remediate this CVE in the embedded `gh` binary.
* **Attack Surface in Our Context:** The action uses `gh` for outbound requests to trusted GitHub APIs in ephemeral GitHub Actions runners. No inbound Go service endpoint is exposed by this action.
* **Risk Assessment:**
* **Likelihood:** Low. Exploitation would require an attacker to influence the specific vulnerable code path through our constrained usage of `gh`.
* **Impact:** Medium. A successful exploit would be limited to the current ephemeral workflow run.
* **Overall Risk:** Low-to-medium and temporarily acceptable while awaiting an upstream GitHub CLI rebuild with patched Go.
* **Mitigation Strategy:**
1. Monitor GitHub CLI releases for builds using Go 1.25.9+ or 1.26.2+
2. Upgrade the Dockerfile `GH_VERSION` immediately when a patched release is available
3. Keep the temporary `.trivyignore` suppression only until an upstream patched binary is available
* **Acceptance Date:** 2026-05-03
* **References:**
* [NVD CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281)
* [GitHub CLI Repository](https://github.com/cli/cli)

### CVE-2026-32280: Go Standard Library (stdlib) Vulnerability

* **Component:** `stdlib` (Go standard library embedded in `gh` binary)
Expand Down Expand Up @@ -1773,6 +1914,27 @@ This section documents specific security findings that have been analyzed, triag
* [NVD CVE-2026-28390](https://nvd.nist.gov/vuln/detail/CVE-2026-28390)
* [Debian Security Tracker](https://security-tracker.debian.org/tracker/CVE-2026-28390)

### CVE-2026-31789: libssl3t64 OpenSSL Vulnerability

* **Component:** `libssl3t64` (Debian system package, OpenSSL runtime library)
* **Scanner:** Trivy
* **Severity:** CRITICAL
* **Status:** **Mitigated / Suppressed**
* **Analysis:**
* **The Vulnerability:** CVE-2026-31789 is a CRITICAL severity vulnerability in `libssl3t64`. Trivy reports the fixed version as `3.5.4-1~deb13u2`.
* **The Fix:** Upgrade `libssl3t64` to `3.5.4-1~deb13u2` or later from Debian 13 security repositories.
* **Current Status (as of May 2026):** The Dockerfile uses `node:24.13.1-trixie-slim` and explicitly runs `apt-get update && apt-get upgrade -y` during image build. This upgrades system packages, including `libssl3t64`, to current security-patched versions (`3.5.4-1~deb13u2` or later).
* **Why Trivy Detects It:** Trivy can detect vulnerable package versions in cached or intermediate image layers before the `apt-get upgrade -y` layer executes.
* **Risk Assessment:**
* **Likelihood:** Low. The Docker build process upgrades `libssl3t64` to a fixed version during image creation.
* **Impact:** High if unpatched. `libssl3t64` is a core crypto runtime library used by multiple tools in the container.
* **Overall Risk:** Low in the final built image because the fixed version is applied during build.
* **Mitigation:** Continue using `apt-get upgrade -y` in the Docker build to apply Debian security updates. The vulnerability is suppressed in `.trivyignore` because findings are expected from pre-upgrade layers or scanner timing.
* **Acceptance Date:** 2026-05-03
* **References:**
* [NVD CVE-2026-31789](https://nvd.nist.gov/vuln/detail/CVE-2026-31789)
* [Debian Security Tracker](https://security-tracker.debian.org/tracker/CVE-2026-31789)

### General Dependency Policy

* **OS Level:** The container is built on `node:24.13.1-trixie-slim` to ensure the underlying Debian packages are on the latest stable channel (Debian 13/Trixie), minimizing system-level CVEs. An explicit `apt-get upgrade -y` command is run during build to apply all available security patches for system packages.
Expand Down
Loading