From aafeab2ff7ed2a646733e2c4f36c6bcfaf0e8a89 Mon Sep 17 00:00:00 2001 From: "Cheng-Chen, Chen" Date: Sun, 11 Oct 2026 16:56:25 +0800 Subject: [PATCH 1/2] fix: package Engine 0.183.336 audit outcome correction in Server 1.6.520 --- README.md | 308 ++--- docs/releases/server-1.6.520.md | 33 + server/Dockerfile.web-compose-release | 14 +- server/build-api-explorer-patch-image.sh | 10 +- server/build-component-candidate.sh | 4 +- server/security/openvex.json | 1564 +++++++++++----------- server/security/vendor-pending.json | 122 +- 7 files changed, 1045 insertions(+), 1010 deletions(-) create mode 100644 docs/releases/server-1.6.520.md diff --git a/README.md b/README.md index 61695aba2c..44dbdf2fe6 100644 --- a/README.md +++ b/README.md @@ -1,153 +1,155 @@ -# PastureStack Server - -Server packages the orchestration engine, web console, node agent, -authentication service, proxy, catalog, and database into a Docker image for -managing environments, hosts, stacks, services, containers, storage, and networking. - -PastureStack is an independent community effort to preserve and modernize the -Rancher 1.6 ecosystem. It is not affiliated with Rancher Labs or SUSE. -This fork of [`rancher/rancher`](https://github.com/rancher/rancher) preserves -upstream history, authorship, licenses, and notices. - -## Current release - -Server `v1.6.519` packages Web Console `1.6.181` -and Orchestration Engine `v0.183.335`. API Keys support full, custom and closed -policies, optional expiry, and key-scoped durable audit records. Their permissions -remain bounded by the owner's current role and environment access. Delegated -terminal/log access requires the verified Host API audit capability and the -compatible Linux Node Agent lifecycle. -Custom Key Project targets share the normal API's live membership checks; -membership never bypasses Key rules or unrelated resource authorization. - -The console supports OIDC, TOTP and passkeys, role-aware resource operations, -container resource/hardware settings, and movable terminal/log windows. -Hardware options require compatible node software and actual host capabilities; -GPU device access is not exclusive GPU allocation. Audit queries and exports -cover retained records with environment-aware access and bounded pagination. -Explicit date bounds remain attached to every audit page, so an older interval -does not scan newer records first. Oversized queries retain the console filters -and offer explicit narrowing or retry. Export failures are translated on the -page instead of downloaded as error files. An export failure keeps successful -query results intact; scan and export limits are retained. -The Key modal owns initial focus and yields to keyboard or pointer interaction. -Audit export closes its own menu before locking the request, allowing consecutive -JSON, CSV and XLSX downloads without leaving a disabled menu open. -Key scope choices use the viewer's authorized environment list. Environment, -stack and resource selectors close before dependent loading or verification. -See the [release note](docs/releases/server-1.6.519.md) for exact -component identities and verification boundaries. A version or packaged feature -does not establish that every resource/role/hardware combination has been tested. - -## API Keys - -Choose allow-by-default with deny exceptions, or deny-by-default with allow -exceptions, with optional expiry. Without exceptions these retain full or closed -access. Search for resource names; the editor and reviewed changes include a -resource-by-operation policy matrix, not an extra grant of authority. The maximum access -is always the Key owner's current account/environment RBAC; a Key never grants -an additional role. Existing legacy Keys are not automatically narrowed on upgrade. -New Key secrets are shown once at creation and are not returned by later lists or -details. Per-Key audit separates authorization, the HTTP response and any later -job/stream completion. Environment-Key audit rechecks live Engine access in -Engine-verified project contexts; a caller-supplied project header is not a grant. -Open a Key's audit from its action menu; the close control follows the audit -filters, results and details, below the audit block. -Scope options and unselected hints use readable light/dark theme text, including -keyboard highlighting; narrow layouts keep the matrix in its own scroll region. -Errors use the existing API status/code and console error -handling. See the [API Key guide](docs/api-keys.md) for policy and audit contracts. - -## Quick start - -Public GHCR downloads do not require a registry login. Use the published numeric -version tag and keep all three named volumes: - -```sh -docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \ - -v pasturestack-cattle:/var/lib/cattle \ - -v pasturestack-mysql:/var/lib/mysql \ - -v pasturestack-mysqllog:/var/log/mysql \ - ghcr.io/pasturestack/server:v1.6.519 -``` - -For HTTPS termination at a reverse proxy, set the exact public origin: - -```yaml -services: - pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.519 - restart: unless-stopped - ports: - - "8080:8080" - environment: - PROXY_PLATFORM_PUBLIC_ORIGIN: https://stack.example.com - volumes: - - pasturestack-cattle:/var/lib/cattle - - pasturestack-mysql:/var/lib/mysql - - pasturestack-mysqllog:/var/log/mysql - -volumes: - pasturestack-cattle: - pasturestack-mysql: - pasturestack-mysqllog: -``` - -`PROXY_PLATFORM_PUBLIC_ORIGIN` accepts only `scheme://host[:port]`, without -credentials, path, query, or fragment. Configure HTTPS, authentication, backups, -and access policies before exposing the platform. Supported JVM and embedded -MariaDB environment variables are in [performance settings](docs/performance/README.md). - -## Upgrade and rollback - -Back up the database and volumes, test a restore, then follow the -[upgrade guide](docs/upgrades/README.md). Preserve existing volume names, -environment variables, restart policy, AppArmor, and reverse-proxy configuration. -Do not replace existing volumes with new empty ones or run `docker compose down -v`. - -Persisted image/download/catalog/Docker compatibility settings can outlive an -image upgrade; review their effective values. The migration tool is read-only -by default and requires explicit apply/rollback. Keep the previous image and -backup: after a database migration, rollback may require restoring matching data, -not merely selecting an older image tag. - -After using API Key policy or expiry, do not downgrade directly to a -policy-unaware Engine: an older version can treat a restricted or expired Key -as full access. Follow the [API Key rollback safety guide](docs/upgrades/api-key-policy-rollback.md) -before any downgrade or database restore. - -[GitHub Releases](https://github.com/PastureStack/server/releases) contain -versioned assets, SHA-256 checksums, and release records. Built-in templates come -from pinned [`catalog-templates`](https://github.com/PastureStack/catalog-templates) -source. Historical changes belong in [release notes](docs/releases). - -## Development - -Server consumes pinned source commits and verified component artifacts. -For local source/shell validation: - -```sh -bash scripts/test -bash scripts/check-server-source-gates.sh -``` - -Runtime, database migration, registration, backup/restore, and upgrade validation -use isolated hosts. Publication is a separate, manually dispatched workflow. -See [ORIGIN.md](ORIGIN.md) and [SECURITY.md](SECURITY.md). - -The component candidate build uses the same release Dockerfile and verification -gates. `server/build-component-candidate.sh` requires actual component commits -and SHA-256 values; it does not publish or deploy. Set -`PASTURESTACK_COMPONENT_ARTIFACT_DIR` to an isolated directory with the five -component assets for an unpublished candidate. Without it, the same hashes -verify the versioned HTTPS release assets. - -## Language and licensing - -The console packages thirteen locales, including Traditional Chinese for Taiwan. -Server bootstrap messages accept `PASTURESTACK_LOCALE=en-US` or `zh-TW`; -protocol fields and persisted identifiers are not translated. - -The inherited project uses [Apache License 2.0](LICENSE), with attribution in -[COPYRIGHT_DETAILS.md](COPYRIGHT_DETAILS.md). Bundled components retain their own -licenses and notices. +# PastureStack Server + +Server packages the orchestration engine, web console, node agent, +authentication service, proxy, catalog, and database into a Docker image for +managing environments, hosts, stacks, services, containers, storage, and networking. + +PastureStack is an independent community effort to preserve and modernize the +Rancher 1.6 ecosystem. It is not affiliated with Rancher Labs or SUSE. +This fork of [`rancher/rancher`](https://github.com/rancher/rancher) preserves +upstream history, authorship, licenses, and notices. + +## Current release + +Server `v1.6.520` packages Web Console `1.6.181` +and Orchestration Engine `v0.183.336`. API Keys support full, custom and closed +policies, optional expiry, and key-scoped durable audit records. Their permissions +remain bounded by the owner's current role and environment access. Delegated +terminal/log access requires the verified Host API audit capability and the +compatible Linux Node Agent lifecycle. +Custom Key Project targets share the normal API's live membership checks; +membership never bypasses Key rules or unrelated resource authorization. + +The console supports OIDC, TOTP and passkeys, role-aware resource operations, +container resource/hardware settings, and movable terminal/log windows. +Hardware options require compatible node software and actual host capabilities; +GPU device access is not exclusive GPU allocation. Audit queries and exports +cover retained records with environment-aware access and bounded pagination. +Explicit date bounds remain attached to every audit page, so an older interval +does not scan newer records first. Oversized queries retain the console filters +and offer explicit narrowing or retry. Export failures are translated on the +page instead of downloaded as error files. An export failure keeps successful +query results intact; scan and export limits are retained. +The Key modal owns initial focus and yields to keyboard or pointer interaction. +Audit export closes its own menu before locking the request, allowing consecutive +JSON, CSV and XLSX downloads without leaving a disabled menu open. +Key scope choices use the viewer's authorized environment list. Environment, +stack and resource selectors close before dependent loading or verification. +See the [release note](docs/releases/server-1.6.520.md) for exact +component identities and verification boundaries. A version or packaged feature +does not establish that every resource/role/hardware combination has been tested. + +## API Keys + +Choose allow-by-default with deny exceptions, or deny-by-default with allow +exceptions, with optional expiry. Without exceptions these retain full or closed +access. Search for resource names; the editor and reviewed changes include a +resource-by-operation policy matrix, not an extra grant of authority. The maximum access +is always the Key owner's current account/environment RBAC; a Key never grants +an additional role. Existing legacy Keys are not automatically narrowed on upgrade. +New Key secrets are shown once at creation and are not returned by later lists or +details. Per-Key audit separates authorization, the HTTP response and any later +job/stream completion. A successful WebSocket upgrade is recorded as a successful +HTTP `101` handshake, not as proof of the stream's later completion. +Environment-Key audit rechecks live Engine access in +Engine-verified project contexts; a caller-supplied project header is not a grant. +Open a Key's audit from its action menu; the close control follows the audit +filters, results and details, below the audit block. +Scope options and unselected hints use readable light/dark theme text, including +keyboard highlighting; narrow layouts keep the matrix in its own scroll region. +Errors use the existing API status/code and console error +handling. See the [API Key guide](docs/api-keys.md) for policy and audit contracts. + +## Quick start + +Public GHCR downloads do not require a registry login. Use the published numeric +version tag and keep all three named volumes: + +```sh +docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \ + -v pasturestack-cattle:/var/lib/cattle \ + -v pasturestack-mysql:/var/lib/mysql \ + -v pasturestack-mysqllog:/var/log/mysql \ + ghcr.io/pasturestack/server:v1.6.520 +``` + +For HTTPS termination at a reverse proxy, set the exact public origin: + +```yaml +services: + pasturestack-server: + image: ghcr.io/pasturestack/server:v1.6.520 + restart: unless-stopped + ports: + - "8080:8080" + environment: + PROXY_PLATFORM_PUBLIC_ORIGIN: https://stack.example.com + volumes: + - pasturestack-cattle:/var/lib/cattle + - pasturestack-mysql:/var/lib/mysql + - pasturestack-mysqllog:/var/log/mysql + +volumes: + pasturestack-cattle: + pasturestack-mysql: + pasturestack-mysqllog: +``` + +`PROXY_PLATFORM_PUBLIC_ORIGIN` accepts only `scheme://host[:port]`, without +credentials, path, query, or fragment. Configure HTTPS, authentication, backups, +and access policies before exposing the platform. Supported JVM and embedded +MariaDB environment variables are in [performance settings](docs/performance/README.md). + +## Upgrade and rollback + +Back up the database and volumes, test a restore, then follow the +[upgrade guide](docs/upgrades/README.md). Preserve existing volume names, +environment variables, restart policy, AppArmor, and reverse-proxy configuration. +Do not replace existing volumes with new empty ones or run `docker compose down -v`. + +Persisted image/download/catalog/Docker compatibility settings can outlive an +image upgrade; review their effective values. The migration tool is read-only +by default and requires explicit apply/rollback. Keep the previous image and +backup: after a database migration, rollback may require restoring matching data, +not merely selecting an older image tag. + +After using API Key policy or expiry, do not downgrade directly to a +policy-unaware Engine: an older version can treat a restricted or expired Key +as full access. Follow the [API Key rollback safety guide](docs/upgrades/api-key-policy-rollback.md) +before any downgrade or database restore. + +[GitHub Releases](https://github.com/PastureStack/server/releases) contain +versioned assets, SHA-256 checksums, and release records. Built-in templates come +from pinned [`catalog-templates`](https://github.com/PastureStack/catalog-templates) +source. Historical changes belong in [release notes](docs/releases). + +## Development + +Server consumes pinned source commits and verified component artifacts. +For local source/shell validation: + +```sh +bash scripts/test +bash scripts/check-server-source-gates.sh +``` + +Runtime, database migration, registration, backup/restore, and upgrade validation +use isolated hosts. Publication is a separate, manually dispatched workflow. +See [ORIGIN.md](ORIGIN.md) and [SECURITY.md](SECURITY.md). + +The component candidate build uses the same release Dockerfile and verification +gates. `server/build-component-candidate.sh` requires actual component commits +and SHA-256 values; it does not publish or deploy. Set +`PASTURESTACK_COMPONENT_ARTIFACT_DIR` to an isolated directory with the five +component assets for an unpublished candidate. Without it, the same hashes +verify the versioned HTTPS release assets. + +## Language and licensing + +The console packages thirteen locales, including Traditional Chinese for Taiwan. +Server bootstrap messages accept `PASTURESTACK_LOCALE=en-US` or `zh-TW`; +protocol fields and persisted identifiers are not translated. + +The inherited project uses [Apache License 2.0](LICENSE), with attribution in +[COPYRIGHT_DETAILS.md](COPYRIGHT_DETAILS.md). Bundled components retain their own +licenses and notices. diff --git a/docs/releases/server-1.6.520.md b/docs/releases/server-1.6.520.md new file mode 100644 index 0000000000..f6aad7d3a0 --- /dev/null +++ b/docs/releases/server-1.6.520.md @@ -0,0 +1,33 @@ +# Server v1.6.520 + +Packages Orchestration Engine `v0.183.336` and the unchanged Web Console +`1.6.181`. This patch fixes audit classification for successful WebSocket +upgrades. An HTTP `101` response now records `SUCCEEDED` for the response phase; +it does not claim that the stream or a later operation completed successfully. +Explicit `DENY`, preview suppression, failed/cancelled operations, and ordinary +HTTP failure classifications remain intact. The change neither grants access +nor weakens revocation, expiry, MFA or the Key owner's live permissions. + +## Verification scope + +The Engine's focused audit suite covers 30 tests, including HTTP `101`, `100`, +`200`, `202`, denied requests, previews, and explicit operation outcomes. +The defect was reproduced through a real Key-authenticated subscription: the +connection opened and received server pings, then the server closed it after +the Key was revoked, while the successful handshake had been mislabelled as a +failure. Publication and deployment evidence must confirm the corrected audit +classification on the packaged image; source tests alone are not that evidence. + +This patch does not change the console, authentication service, proxy, catalog, +node packages, database schema, or deployment settings. Existing pagination and +membership-revocation evidence remains scoped to the resources and roles it +actually covered; it is not a claim of whole-matrix acceptance. + +## Upgrade and rollback + +Use `ghcr.io/pasturestack/server:v1.6.520` after its immutable release is +published. Preserve the existing environment variables, volumes, network, +restart policy and security options. No database migration is introduced. +The compatible prior release `v1.6.519` is the rollback target; rolling back +restores the known HTTP `101` audit-classification defect. Do not roll back to +a policy-unaware release: follow the [API Key recovery guidance](../upgrades/api-key-policy-rollback.md). diff --git a/server/Dockerfile.web-compose-release b/server/Dockerfile.web-compose-release index 3774e1486d..1b280bae0e 100644 --- a/server/Dockerfile.web-compose-release +++ b/server/Dockerfile.web-compose-release @@ -79,9 +79,9 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.4 ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=49c4579829a04e758045fae02a5a9fca12bb0ba3af0d5e979cf9eb97f23a88a9 ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=98c7faea665b7eb95206b8c73a6f47d644c5d2d0eae53f274f6a15faf5205744 ARG ORCHESTRATION_ENGINE_RELEASE_BASE_URL=https://github.com/PastureStack/orchestration-engine/releases/download -ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.335 +ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.336 ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar -ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=98a665f59bced8f7c084e786280100e0571390b04eeffad140e633b463d8a204 +ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=bd0dabf0bd87a859b97941657ae18e8dd551e390697494348c101782a508f136 ARG COMPOSE_EXECUTOR_RELEASE_BASE_URL=https://github.com/PastureStack/compose-cli/releases/download ARG COMPOSE_EXECUTOR_VERSION=0.14.37 ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=5ff465601930218f531885a384f231d969033e4cef794ce33d16bfe24e5c1c81 @@ -565,9 +565,9 @@ FROM ${BASE_IMAGE} ARG SOURCE_DATE_EPOCH ARG PASTURESTACK_SERVER_REVISION -ARG SERVER_RELEASE_TAG=v1.6.519 -ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.335 -ARG ORCHESTRATION_ENGINE_VERSION=0.183.335 +ARG SERVER_RELEASE_TAG=v1.6.520 +ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.336 +ARG ORCHESTRATION_ENGINE_VERSION=0.183.336 ARG ENGINE_READONLY_SCHEMA_SHA256=7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233 ARG ENGINE_RESTRICTED_SCHEMA_SHA256=f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51 ARG HOST_API_VERSION=0.38.5 @@ -606,8 +606,8 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.4 ARG WEBHOOK_AUTOMATION_SERVICE_COMMIT=400118b893843d2a7d7c65cc70c3449d76c4a8d8 ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=49c4579829a04e758045fae02a5a9fca12bb0ba3af0d5e979cf9eb97f23a88a9 ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=98c7faea665b7eb95206b8c73a6f47d644c5d2d0eae53f274f6a15faf5205744 -ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=98a665f59bced8f7c084e786280100e0571390b04eeffad140e633b463d8a204 -ARG ORCHESTRATION_ENGINE_COMMIT=8fd5e7d3021507647064da1ae9c9c3a6eeb4c725 +ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=bd0dabf0bd87a859b97941657ae18e8dd551e390697494348c101782a508f136 +ARG ORCHESTRATION_ENGINE_COMMIT=1c7d4537becfd578d568582564b72e7c4d0b1e93 ARG HOST_PROVISIONER_VERSION=0.39.8 ARG HOST_PROVISIONER_COMMIT=385e5b536c108f17fdfcdec84c01750a5be5ab1c ARG HOST_PROVISIONER_ARCHIVE_SHA256=d775f36a613b1a486a5e60d6ad61fdbd1ebb4bd22422cbb6dcb70fdd7c4abf0c diff --git a/server/build-api-explorer-patch-image.sh b/server/build-api-explorer-patch-image.sh index 84b690d98d..a03edf4190 100755 --- a/server/build-api-explorer-patch-image.sh +++ b/server/build-api-explorer-patch-image.sh @@ -14,14 +14,14 @@ if [[ -n "$(git status --porcelain --untracked-files=normal)" ]]; then fi revision=${PASTURESTACK_SERVER_REVISION:-$(git rev-parse HEAD)} -server_release_tag=${SERVER_RELEASE_TAG:-v1.6.519} +server_release_tag=${SERVER_RELEASE_TAG:-v1.6.520} source_date_epoch=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)} base_image=${BASE_IMAGE:-ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403} orchestration_engine_release_base_url=${ORCHESTRATION_ENGINE_RELEASE_BASE_URL:-https://github.com/PastureStack/orchestration-engine/releases/download} -orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.335} +orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.336} orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar} -orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-98a665f59bced8f7c084e786280100e0571390b04eeffad140e633b463d8a204} -orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-8fd5e7d3021507647064da1ae9c9c3a6eeb4c725} +orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-bd0dabf0bd87a859b97941657ae18e8dd551e390697494348c101782a508f136} +orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-1c7d4537becfd578d568582564b72e7c4d0b1e93} orchestration_engine_version=${orchestration_engine_release_tag#v} engine_readonly_schema_sha256=${ENGINE_READONLY_SCHEMA_SHA256:-7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233} engine_restricted_schema_sha256=${ENGINE_RESTRICTED_SCHEMA_SHA256:-f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51} @@ -101,7 +101,7 @@ usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-5ce usage_telemetry_agent_binary_sha256=${USAGE_TELEMETRY_AGENT_BINARY_SHA256:-e62a21270142181315293d7e11482288ffe8fc4d91cc8fe07dacc90b461f3709} supported_docker_range='~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2 || v29.8.0' newest_docker_version=v29.8.0 -image=${IMAGE:-pasturestack-validation/server:v1.6.519} +image=${IMAGE:-pasturestack-validation/server:v1.6.520} build_options=() [[ "$revision" =~ ^[0-9a-f]{40}$ ]] diff --git a/server/build-component-candidate.sh b/server/build-component-candidate.sh index 55cfd1da5b..2b0f7877a7 100755 --- a/server/build-component-candidate.sh +++ b/server/build-component-candidate.sh @@ -14,8 +14,8 @@ for name in "${required[@]}"; do case "$name" in *_COMMIT) [[ ${!name} =~ ^[0-9a-f]{40}$ ]] ;; *) [[ ${!name} =~ ^[0-9a-f]{64}$ ]] ;; esac export "$name" done -export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.519} -export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.335} +export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.520} +export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.336} export ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.181} export WEB_CONSOLE_ARTIFACT="web-console-${WEB_CONSOLE_RELEASE_TAG}.tar.gz" diff --git a/server/security/openvex.json b/server/security/openvex.json index a23281f82d..897082b88b 100644 --- a/server/security/openvex.json +++ b/server/security/openvex.json @@ -1,782 +1,782 @@ -{ - "@context": "https://openvex.dev/ns/v0.2.0", - "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.519", - "author": "PastureStack Security", - "timestamp": "2026-10-02T22:05:00Z", - "version": 51, - "statements": [ - { - "vulnerability": { - "name": "CVE-2024-2236" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libgcrypt20@1.12.0-2ubuntu1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_in_execute_path", - "impact_statement": "The issue is an RSA decryption timing side channel. The runtime GPG verifier is removed and a bounded executable-link audit found no remaining executable under /usr/bin, /usr/sbin, or /usr/share/cattle linked to libgcrypt." - }, - { - "vulnerability": { - "name": "CVE-2024-56433" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/login.defs@4.17.4-2ubuntu3?arch=all&distro=ubuntu-26.04&epoch=1" - }, - { - "@id": "pkg:deb/ubuntu/passwd@4.17.4-2ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The affected subordinate-ID allocation path is absent: login.defs, subuid, subgid, passwd, useradd, usermod, groupadd, newuidmap, and newgidmap are removed from the final runtime." - }, - { - "vulnerability": { - "name": "CVE-2024-52005" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/git@2.53.0-1ubuntu1?arch=amd64&distro=ubuntu-26.04&epoch=1" - }, - { - "@id": "pkg:deb/ubuntu/git-man@2.53.0-1ubuntu1?arch=all&distro=ubuntu-26.04&epoch=1" - } - ], - "status": "fixed", - "impact_statement": "The upstream advisory lists affected Git release lines only through 2.48.1; the final runtime enforces Git 2.53.0 for Catalog HTTPS clone and fetch operations." - }, - { - "vulnerability": { - "name": "CVE-2026-8932" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.7?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.7?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.7?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "The final runtime installs Ubuntu 26.04 curl and both shipped libcurl variants at 8.18.0-1ubuntu2.7, including the 2026-09-24 security update, and enforces the exact installed versions during image assembly and post-build validation." - }, - { - "vulnerability": { - "name": "CVE-2025-1352" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libelf1t64@0.194-4?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The affected eu-strip utility is absent from the final runtime." - }, - { - "vulnerability": { - "name": "CVE-2025-1376" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libelf1t64@0.194-4?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The affected eu-readelf utility is absent from the final runtime." - }, - { - "vulnerability": { - "name": "CVE-2025-66382" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final runtime removes both libexpat.so.1 and git-http-push, the sole executable that linked to Expat; Catalog requires only Git HTTPS clone, fetch, and checkout." - }, - { - "vulnerability": { - "name": "CVE-2026-13757" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libp11-kit0@0.26.2-2?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_in_execute_path", - "impact_statement": "The vulnerable p11-kit RPC server executable is absent and the final runtime exposes no p11-kit RPC Unix socket." - }, - { - "vulnerability": { - "name": "CVE-2026-18477" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "GNU tar and the container source-build workflow are removed from the final runtime, so the vulnerable incremental restore path is absent." - }, - { - "vulnerability": { - "name": "CVE-2026-18508" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "GNU tar and the container source-build workflow are removed from the final runtime, so the vulnerable one-top-level extraction path is absent." - }, - { - "vulnerability": { - "name": "CVE-2026-18798" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libssl3t64@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/openssl-provider-legacy@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "The final runtime installs and verifies Ubuntu 26.04 OpenSSL packages at 3.5.5-1ubuntu3.6, which includes the USN-8678-1 fix and the subsequent USN-8847-1 fixes. SHA-256 checksums extracted from the signed official packages must match all seven package-owned CLI, library, engine and legacy provider files in the final image." - }, - { - "vulnerability": { - "name": "CVE-2026-75803" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libssl3t64@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/openssl-provider-legacy@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "Ubuntu identifies 3.5.5-1ubuntu3.5 as fixed for CVE-2026-75803. The final runtime installs the subsequent official 3.5.5-1ubuntu3.6 packages from a signed snapshot, replacing the former upstream 3.5.8 CLI, libraries, engines and legacy provider. Installed versions, package-owned bytes, provider paths and curl/MariaDB linkage are validated; no package-metadata-only replacement is accepted." - }, - { - "vulnerability": { - "name": "CVE-2026-27171" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/zlib1g@1.3.dfsg%2Breally1.3.1-1ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1" - } - ], - "status": "fixed", - "impact_statement": "The package database describes the base layer, but the final runtime replaces libz.so.1 with verified upstream zlib 1.3.2 and validates the active mariadbd linkage." - }, - { - "vulnerability": { - "name": "CVE-2026-27456" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/bsdutils@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" - }, - { - "@id": "pkg:deb/ubuntu/libblkid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libmount1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libsmartcols1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libuuid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/login@4.16.0-2%2Breally2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" - }, - { - "@id": "pkg:deb/ubuntu/mount@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The issue is in the privileged mount utility. mount and umount are removed from the final runtime; no SUID mount entry point remains." - }, - { - "vulnerability": { - "name": "CVE-2026-3184" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/bsdutils@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" - }, - { - "@id": "pkg:deb/ubuntu/libblkid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libmount1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libsmartcols1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libuuid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/login@4.16.0-2%2Breally2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" - }, - { - "@id": "pkg:deb/ubuntu/mount@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The issue is in login -h processing. login is removed from the final runtime." - }, - { - "vulnerability": { - "name": "CVE-2026-40228" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libsystemd-shared@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libsystemd0@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libudev1@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/systemd@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The vulnerable systemd-journald executable, service units, and sockets are removed from the final runtime." - }, - { - "vulnerability": { - "name": "CVE-2026-53910" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/diffutils@3.12-1?arch=amd64&distro=ubuntu-26.04&epoch=1" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The advisory is specific to diff3 line mapping. The final Server runtime removes /usr/bin/diff3 and validates its absence while retaining only the unaffected diffutils tools required by existing image checks." - }, - { - "vulnerability": { - "name": "CVE-2026-54371" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libattr1@2.5.2-4?arch=amd64&distro=ubuntu-26.04&epoch=1" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The affected getfattr and setfattr command-line utilities are absent from the final runtime." - }, - { - "vulnerability": { - "name": "CVE-2026-56391" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/gnu-coreutils@9.7-3ubuntu2.1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "The final runtime replaces uniq with GNU coreutils 9.11 plus upstream fix commit d64e35a8a4c0e4608321433e0d84d917e4e36371 and runs a multibyte -w regression test during build and image validation." - }, - { - "vulnerability": { - "name": "CVE-2026-56392" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/gnu-coreutils@9.7-3ubuntu2.1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The affected unexpand executable is removed from the final runtime." - }, - { - "vulnerability": { - "name": "GO-2026-5932" - }, - "products": [ - { - "@id": "pkg:golang/golang.org/x/crypto@v0.55.0" - }, - { - "@id": "pkg:golang/golang.org/x/crypto@v0.56.0" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "GO-2026-5932 applies only to the unmaintained golang.org/x/crypto/openpgp packages. The committed source graph and govulncheck evidence contain no openpgp import or reachable symbol in authentication-service, compose-executor, or host-provisioner." - }, - { - "vulnerability": { - "name": "CVE-2026-32776" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-32777" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-32778" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-41080" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-45186" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-50219" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56131" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56132" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56403" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56404" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56405" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56406" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56407" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56408" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56409" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56410" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56411" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56412" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-66046" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-72522" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-76641" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-76957" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-57062" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/gpgv@2.4.8-4ubuntu3?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The affected CMS parser is gpgsm. Both gpgsm and gpgv are removed and their absence is validated in the final runtime; no GnuPG CMS decryption entry point is shipped." - }, - { - "vulnerability": { - "name": "CVE-2026-56855" - }, - "products": [ - { - "@id": "pkg:golang/golang.org/x/crypto@v0.55.0" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "After upgrading Host Provisioner and Compose Executor to x/crypto v0.56.0, only the checksum-pinned authentication-service binary retains module v0.55.0. Its exact v0.4.42 source at 5589ef8fda68ae56e1afd64096965d452ee8a17e and vendored dependency graph import md4/ripemd160 but no golang.org/x/crypto/ssh package. These two advisories require SSH channel dispatch, which is absent from that binary. This statement must not be reused for an SSH-bearing v0.55.0 binary." - }, - { - "vulnerability": { - "name": "CVE-2026-78662" - }, - "products": [ - { - "@id": "pkg:golang/golang.org/x/crypto@v0.55.0" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "After upgrading Host Provisioner and Compose Executor to x/crypto v0.56.0, only the checksum-pinned authentication-service binary retains module v0.55.0. Its exact v0.4.42 source at 5589ef8fda68ae56e1afd64096965d452ee8a17e and vendored dependency graph import md4/ripemd160 but no golang.org/x/crypto/ssh package. These two advisories require SSH channel dispatch, which is absent from that binary. This statement must not be reused for an SSH-bearing v0.55.0 binary." - }, - { - "vulnerability": { - "name": "CVE-2026-18374" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_in_execute_path", - "impact_statement": "The issue requires a caller to pass an attacker-controlled fopen mode containing an empty ,ccs= conversion specification. The Server runtime does not accept or construct fopen mode strings from user input; the image gate scans the exact Java, Go, shell and service entrypoint set and rejects any ,ccs= use. Ubuntu still lists the Resolute package status as needs evaluation, so this is an execution-path determination rather than a claim that package version 2.43-2ubuntu2.4 fixes the defect." - }, - { - "vulnerability": { - "name": "CVE-2026-12087" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-12087. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." - }, - { - "vulnerability": { - "name": "CVE-2026-13221" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-13221. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." - }, - { - "vulnerability": { - "name": "CVE-2026-57432" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-57432. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." - }, - { - "vulnerability": { - "name": "CVE-2026-57433" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-57433. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." - } - ] -} +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.520", + "author": "PastureStack Security", + "timestamp": "2026-10-02T22:05:00Z", + "version": 51, + "statements": [ + { + "vulnerability": { + "name": "CVE-2024-2236" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libgcrypt20@1.12.0-2ubuntu1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "The issue is an RSA decryption timing side channel. The runtime GPG verifier is removed and a bounded executable-link audit found no remaining executable under /usr/bin, /usr/sbin, or /usr/share/cattle linked to libgcrypt." + }, + { + "vulnerability": { + "name": "CVE-2024-56433" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/login.defs@4.17.4-2ubuntu3?arch=all&distro=ubuntu-26.04&epoch=1" + }, + { + "@id": "pkg:deb/ubuntu/passwd@4.17.4-2ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The affected subordinate-ID allocation path is absent: login.defs, subuid, subgid, passwd, useradd, usermod, groupadd, newuidmap, and newgidmap are removed from the final runtime." + }, + { + "vulnerability": { + "name": "CVE-2024-52005" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/git@2.53.0-1ubuntu1?arch=amd64&distro=ubuntu-26.04&epoch=1" + }, + { + "@id": "pkg:deb/ubuntu/git-man@2.53.0-1ubuntu1?arch=all&distro=ubuntu-26.04&epoch=1" + } + ], + "status": "fixed", + "impact_statement": "The upstream advisory lists affected Git release lines only through 2.48.1; the final runtime enforces Git 2.53.0 for Catalog HTTPS clone and fetch operations." + }, + { + "vulnerability": { + "name": "CVE-2026-8932" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.7?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.7?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.7?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "The final runtime installs Ubuntu 26.04 curl and both shipped libcurl variants at 8.18.0-1ubuntu2.7, including the 2026-09-24 security update, and enforces the exact installed versions during image assembly and post-build validation." + }, + { + "vulnerability": { + "name": "CVE-2025-1352" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libelf1t64@0.194-4?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The affected eu-strip utility is absent from the final runtime." + }, + { + "vulnerability": { + "name": "CVE-2025-1376" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libelf1t64@0.194-4?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The affected eu-readelf utility is absent from the final runtime." + }, + { + "vulnerability": { + "name": "CVE-2025-66382" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final runtime removes both libexpat.so.1 and git-http-push, the sole executable that linked to Expat; Catalog requires only Git HTTPS clone, fetch, and checkout." + }, + { + "vulnerability": { + "name": "CVE-2026-13757" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libp11-kit0@0.26.2-2?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "The vulnerable p11-kit RPC server executable is absent and the final runtime exposes no p11-kit RPC Unix socket." + }, + { + "vulnerability": { + "name": "CVE-2026-18477" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "GNU tar and the container source-build workflow are removed from the final runtime, so the vulnerable incremental restore path is absent." + }, + { + "vulnerability": { + "name": "CVE-2026-18508" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "GNU tar and the container source-build workflow are removed from the final runtime, so the vulnerable one-top-level extraction path is absent." + }, + { + "vulnerability": { + "name": "CVE-2026-18798" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libssl3t64@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/openssl-provider-legacy@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "The final runtime installs and verifies Ubuntu 26.04 OpenSSL packages at 3.5.5-1ubuntu3.6, which includes the USN-8678-1 fix and the subsequent USN-8847-1 fixes. SHA-256 checksums extracted from the signed official packages must match all seven package-owned CLI, library, engine and legacy provider files in the final image." + }, + { + "vulnerability": { + "name": "CVE-2026-75803" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libssl3t64@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/openssl-provider-legacy@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu identifies 3.5.5-1ubuntu3.5 as fixed for CVE-2026-75803. The final runtime installs the subsequent official 3.5.5-1ubuntu3.6 packages from a signed snapshot, replacing the former upstream 3.5.8 CLI, libraries, engines and legacy provider. Installed versions, package-owned bytes, provider paths and curl/MariaDB linkage are validated; no package-metadata-only replacement is accepted." + }, + { + "vulnerability": { + "name": "CVE-2026-27171" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/zlib1g@1.3.dfsg%2Breally1.3.1-1ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1" + } + ], + "status": "fixed", + "impact_statement": "The package database describes the base layer, but the final runtime replaces libz.so.1 with verified upstream zlib 1.3.2 and validates the active mariadbd linkage." + }, + { + "vulnerability": { + "name": "CVE-2026-27456" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/bsdutils@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" + }, + { + "@id": "pkg:deb/ubuntu/libblkid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libmount1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libsmartcols1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libuuid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/login@4.16.0-2%2Breally2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" + }, + { + "@id": "pkg:deb/ubuntu/mount@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The issue is in the privileged mount utility. mount and umount are removed from the final runtime; no SUID mount entry point remains." + }, + { + "vulnerability": { + "name": "CVE-2026-3184" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/bsdutils@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" + }, + { + "@id": "pkg:deb/ubuntu/libblkid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libmount1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libsmartcols1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libuuid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/login@4.16.0-2%2Breally2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" + }, + { + "@id": "pkg:deb/ubuntu/mount@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The issue is in login -h processing. login is removed from the final runtime." + }, + { + "vulnerability": { + "name": "CVE-2026-40228" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libsystemd-shared@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libsystemd0@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libudev1@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/systemd@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The vulnerable systemd-journald executable, service units, and sockets are removed from the final runtime." + }, + { + "vulnerability": { + "name": "CVE-2026-53910" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/diffutils@3.12-1?arch=amd64&distro=ubuntu-26.04&epoch=1" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The advisory is specific to diff3 line mapping. The final Server runtime removes /usr/bin/diff3 and validates its absence while retaining only the unaffected diffutils tools required by existing image checks." + }, + { + "vulnerability": { + "name": "CVE-2026-54371" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libattr1@2.5.2-4?arch=amd64&distro=ubuntu-26.04&epoch=1" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The affected getfattr and setfattr command-line utilities are absent from the final runtime." + }, + { + "vulnerability": { + "name": "CVE-2026-56391" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/gnu-coreutils@9.7-3ubuntu2.1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "The final runtime replaces uniq with GNU coreutils 9.11 plus upstream fix commit d64e35a8a4c0e4608321433e0d84d917e4e36371 and runs a multibyte -w regression test during build and image validation." + }, + { + "vulnerability": { + "name": "CVE-2026-56392" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/gnu-coreutils@9.7-3ubuntu2.1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The affected unexpand executable is removed from the final runtime." + }, + { + "vulnerability": { + "name": "GO-2026-5932" + }, + "products": [ + { + "@id": "pkg:golang/golang.org/x/crypto@v0.55.0" + }, + { + "@id": "pkg:golang/golang.org/x/crypto@v0.56.0" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "GO-2026-5932 applies only to the unmaintained golang.org/x/crypto/openpgp packages. The committed source graph and govulncheck evidence contain no openpgp import or reachable symbol in authentication-service, compose-executor, or host-provisioner." + }, + { + "vulnerability": { + "name": "CVE-2026-32776" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-32777" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-32778" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-41080" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-45186" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-50219" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56131" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56132" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56403" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56404" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56405" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56406" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56407" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56408" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56409" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56410" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56411" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56412" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-66046" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-72522" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-76641" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-76957" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-57062" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/gpgv@2.4.8-4ubuntu3?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The affected CMS parser is gpgsm. Both gpgsm and gpgv are removed and their absence is validated in the final runtime; no GnuPG CMS decryption entry point is shipped." + }, + { + "vulnerability": { + "name": "CVE-2026-56855" + }, + "products": [ + { + "@id": "pkg:golang/golang.org/x/crypto@v0.55.0" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "After upgrading Host Provisioner and Compose Executor to x/crypto v0.56.0, only the checksum-pinned authentication-service binary retains module v0.55.0. Its exact v0.4.42 source at 5589ef8fda68ae56e1afd64096965d452ee8a17e and vendored dependency graph import md4/ripemd160 but no golang.org/x/crypto/ssh package. These two advisories require SSH channel dispatch, which is absent from that binary. This statement must not be reused for an SSH-bearing v0.55.0 binary." + }, + { + "vulnerability": { + "name": "CVE-2026-78662" + }, + "products": [ + { + "@id": "pkg:golang/golang.org/x/crypto@v0.55.0" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "After upgrading Host Provisioner and Compose Executor to x/crypto v0.56.0, only the checksum-pinned authentication-service binary retains module v0.55.0. Its exact v0.4.42 source at 5589ef8fda68ae56e1afd64096965d452ee8a17e and vendored dependency graph import md4/ripemd160 but no golang.org/x/crypto/ssh package. These two advisories require SSH channel dispatch, which is absent from that binary. This statement must not be reused for an SSH-bearing v0.55.0 binary." + }, + { + "vulnerability": { + "name": "CVE-2026-18374" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "The issue requires a caller to pass an attacker-controlled fopen mode containing an empty ,ccs= conversion specification. The Server runtime does not accept or construct fopen mode strings from user input; the image gate scans the exact Java, Go, shell and service entrypoint set and rejects any ,ccs= use. Ubuntu still lists the Resolute package status as needs evaluation, so this is an execution-path determination rather than a claim that package version 2.43-2ubuntu2.4 fixes the defect." + }, + { + "vulnerability": { + "name": "CVE-2026-12087" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-12087. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." + }, + { + "vulnerability": { + "name": "CVE-2026-13221" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-13221. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." + }, + { + "vulnerability": { + "name": "CVE-2026-57432" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-57432. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." + }, + { + "vulnerability": { + "name": "CVE-2026-57433" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-57433. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." + } + ] +} diff --git a/server/security/vendor-pending.json b/server/security/vendor-pending.json index 0a5995e857..594ac16253 100644 --- a/server/security/vendor-pending.json +++ b/server/security/vendor-pending.json @@ -1,61 +1,61 @@ -{ - "schemaVersion": 1, - "release": "v1.6.519", - "generatedAt": "2026-10-10T00:00:00Z", - "policy": { - "allowedSeverities": [ - "LOW", - "MEDIUM" - ], - "requiresEmptyFixedVersion": true, - "vendorStatus": "needs-evaluation", - "scanTarget": "merged-rootfs", - "trivyTarget": "/rootfs (ubuntu 26.04)" - }, - "findings": [ - { - "vulnerabilityId": "CVE-2026-85091", - "severity": "MEDIUM", - "vendorStatus": "needs-evaluation", - "source": "https://ubuntu.com/security/CVE-2026-85091", - "reviewAfter": "2026-10-20", - "packages": [ - { "name": "zlib1g", "installedVersion": "1:1.3.dfsg+really1.3.1-1ubuntu3.1" } - ] - }, - { - "vulnerabilityId": "CVE-2026-86145", - "severity": "MEDIUM", - "vendorStatus": "needs-evaluation", - "source": "https://ubuntu.com/security/CVE-2026-86145", - "reviewAfter": "2026-10-20", - "packages": [ - { "name": "libpcre2-8-0", "installedVersion": "10.46-1build1" }, - { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } - ] - }, - { - "vulnerabilityId": "CVE-2026-89092", - "severity": "MEDIUM", - "vendorStatus": "needs-evaluation", - "source": "https://ubuntu.com/security/CVE-2026-89092", - "reviewAfter": "2026-10-20", - "packages": [ - { "name": "libc-bin", "installedVersion": "2.43-2ubuntu2.4" }, - { "name": "libc-gconv-modules-extra", "installedVersion": "2.43-2ubuntu2.4" }, - { "name": "libc6", "installedVersion": "2.43-2ubuntu2.4" } - ] - }, - { - "vulnerabilityId": "CVE-2026-89161", - "severity": "MEDIUM", - "vendorStatus": "needs-evaluation", - "source": "https://ubuntu.com/security/CVE-2026-89161", - "reviewAfter": "2026-10-20", - "packages": [ - { "name": "libpcre2-8-0", "installedVersion": "10.46-1build1" }, - { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } - ] - } - ] -} +{ + "schemaVersion": 1, + "release": "v1.6.520", + "generatedAt": "2026-10-10T00:00:00Z", + "policy": { + "allowedSeverities": [ + "LOW", + "MEDIUM" + ], + "requiresEmptyFixedVersion": true, + "vendorStatus": "needs-evaluation", + "scanTarget": "merged-rootfs", + "trivyTarget": "/rootfs (ubuntu 26.04)" + }, + "findings": [ + { + "vulnerabilityId": "CVE-2026-85091", + "severity": "MEDIUM", + "vendorStatus": "needs-evaluation", + "source": "https://ubuntu.com/security/CVE-2026-85091", + "reviewAfter": "2026-10-20", + "packages": [ + { "name": "zlib1g", "installedVersion": "1:1.3.dfsg+really1.3.1-1ubuntu3.1" } + ] + }, + { + "vulnerabilityId": "CVE-2026-86145", + "severity": "MEDIUM", + "vendorStatus": "needs-evaluation", + "source": "https://ubuntu.com/security/CVE-2026-86145", + "reviewAfter": "2026-10-20", + "packages": [ + { "name": "libpcre2-8-0", "installedVersion": "10.46-1build1" }, + { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } + ] + }, + { + "vulnerabilityId": "CVE-2026-89092", + "severity": "MEDIUM", + "vendorStatus": "needs-evaluation", + "source": "https://ubuntu.com/security/CVE-2026-89092", + "reviewAfter": "2026-10-20", + "packages": [ + { "name": "libc-bin", "installedVersion": "2.43-2ubuntu2.4" }, + { "name": "libc-gconv-modules-extra", "installedVersion": "2.43-2ubuntu2.4" }, + { "name": "libc6", "installedVersion": "2.43-2ubuntu2.4" } + ] + }, + { + "vulnerabilityId": "CVE-2026-89161", + "severity": "MEDIUM", + "vendorStatus": "needs-evaluation", + "source": "https://ubuntu.com/security/CVE-2026-89161", + "reviewAfter": "2026-10-20", + "packages": [ + { "name": "libpcre2-8-0", "installedVersion": "10.46-1build1" }, + { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } + ] + } + ] +} From 90b3d42d20aa1518fbb031f592efb8755c12da93 Mon Sep 17 00:00:00 2001 From: "Cheng-Chen, Chen" Date: Sun, 11 Oct 2026 16:56:43 +0800 Subject: [PATCH 2/2] fix: package Engine 0.183.336 audit outcome correction in Server 1.6.520 --- README.md | 310 +++--- server/security/openvex.json | 1564 +++++++++++++-------------- server/security/vendor-pending.json | 122 +-- 3 files changed, 998 insertions(+), 998 deletions(-) diff --git a/README.md b/README.md index 44dbdf2fe6..7d63f4b2ab 100644 --- a/README.md +++ b/README.md @@ -1,155 +1,155 @@ -# PastureStack Server - -Server packages the orchestration engine, web console, node agent, -authentication service, proxy, catalog, and database into a Docker image for -managing environments, hosts, stacks, services, containers, storage, and networking. - -PastureStack is an independent community effort to preserve and modernize the -Rancher 1.6 ecosystem. It is not affiliated with Rancher Labs or SUSE. -This fork of [`rancher/rancher`](https://github.com/rancher/rancher) preserves -upstream history, authorship, licenses, and notices. - -## Current release - -Server `v1.6.520` packages Web Console `1.6.181` -and Orchestration Engine `v0.183.336`. API Keys support full, custom and closed -policies, optional expiry, and key-scoped durable audit records. Their permissions -remain bounded by the owner's current role and environment access. Delegated -terminal/log access requires the verified Host API audit capability and the -compatible Linux Node Agent lifecycle. -Custom Key Project targets share the normal API's live membership checks; -membership never bypasses Key rules or unrelated resource authorization. - -The console supports OIDC, TOTP and passkeys, role-aware resource operations, -container resource/hardware settings, and movable terminal/log windows. -Hardware options require compatible node software and actual host capabilities; -GPU device access is not exclusive GPU allocation. Audit queries and exports -cover retained records with environment-aware access and bounded pagination. -Explicit date bounds remain attached to every audit page, so an older interval -does not scan newer records first. Oversized queries retain the console filters -and offer explicit narrowing or retry. Export failures are translated on the -page instead of downloaded as error files. An export failure keeps successful -query results intact; scan and export limits are retained. -The Key modal owns initial focus and yields to keyboard or pointer interaction. -Audit export closes its own menu before locking the request, allowing consecutive -JSON, CSV and XLSX downloads without leaving a disabled menu open. -Key scope choices use the viewer's authorized environment list. Environment, -stack and resource selectors close before dependent loading or verification. -See the [release note](docs/releases/server-1.6.520.md) for exact -component identities and verification boundaries. A version or packaged feature -does not establish that every resource/role/hardware combination has been tested. - -## API Keys - -Choose allow-by-default with deny exceptions, or deny-by-default with allow -exceptions, with optional expiry. Without exceptions these retain full or closed -access. Search for resource names; the editor and reviewed changes include a -resource-by-operation policy matrix, not an extra grant of authority. The maximum access -is always the Key owner's current account/environment RBAC; a Key never grants -an additional role. Existing legacy Keys are not automatically narrowed on upgrade. -New Key secrets are shown once at creation and are not returned by later lists or -details. Per-Key audit separates authorization, the HTTP response and any later -job/stream completion. A successful WebSocket upgrade is recorded as a successful -HTTP `101` handshake, not as proof of the stream's later completion. -Environment-Key audit rechecks live Engine access in -Engine-verified project contexts; a caller-supplied project header is not a grant. -Open a Key's audit from its action menu; the close control follows the audit -filters, results and details, below the audit block. -Scope options and unselected hints use readable light/dark theme text, including -keyboard highlighting; narrow layouts keep the matrix in its own scroll region. -Errors use the existing API status/code and console error -handling. See the [API Key guide](docs/api-keys.md) for policy and audit contracts. - -## Quick start - -Public GHCR downloads do not require a registry login. Use the published numeric -version tag and keep all three named volumes: - -```sh -docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \ - -v pasturestack-cattle:/var/lib/cattle \ - -v pasturestack-mysql:/var/lib/mysql \ - -v pasturestack-mysqllog:/var/log/mysql \ - ghcr.io/pasturestack/server:v1.6.520 -``` - -For HTTPS termination at a reverse proxy, set the exact public origin: - -```yaml -services: - pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.520 - restart: unless-stopped - ports: - - "8080:8080" - environment: - PROXY_PLATFORM_PUBLIC_ORIGIN: https://stack.example.com - volumes: - - pasturestack-cattle:/var/lib/cattle - - pasturestack-mysql:/var/lib/mysql - - pasturestack-mysqllog:/var/log/mysql - -volumes: - pasturestack-cattle: - pasturestack-mysql: - pasturestack-mysqllog: -``` - -`PROXY_PLATFORM_PUBLIC_ORIGIN` accepts only `scheme://host[:port]`, without -credentials, path, query, or fragment. Configure HTTPS, authentication, backups, -and access policies before exposing the platform. Supported JVM and embedded -MariaDB environment variables are in [performance settings](docs/performance/README.md). - -## Upgrade and rollback - -Back up the database and volumes, test a restore, then follow the -[upgrade guide](docs/upgrades/README.md). Preserve existing volume names, -environment variables, restart policy, AppArmor, and reverse-proxy configuration. -Do not replace existing volumes with new empty ones or run `docker compose down -v`. - -Persisted image/download/catalog/Docker compatibility settings can outlive an -image upgrade; review their effective values. The migration tool is read-only -by default and requires explicit apply/rollback. Keep the previous image and -backup: after a database migration, rollback may require restoring matching data, -not merely selecting an older image tag. - -After using API Key policy or expiry, do not downgrade directly to a -policy-unaware Engine: an older version can treat a restricted or expired Key -as full access. Follow the [API Key rollback safety guide](docs/upgrades/api-key-policy-rollback.md) -before any downgrade or database restore. - -[GitHub Releases](https://github.com/PastureStack/server/releases) contain -versioned assets, SHA-256 checksums, and release records. Built-in templates come -from pinned [`catalog-templates`](https://github.com/PastureStack/catalog-templates) -source. Historical changes belong in [release notes](docs/releases). - -## Development - -Server consumes pinned source commits and verified component artifacts. -For local source/shell validation: - -```sh -bash scripts/test -bash scripts/check-server-source-gates.sh -``` - -Runtime, database migration, registration, backup/restore, and upgrade validation -use isolated hosts. Publication is a separate, manually dispatched workflow. -See [ORIGIN.md](ORIGIN.md) and [SECURITY.md](SECURITY.md). - -The component candidate build uses the same release Dockerfile and verification -gates. `server/build-component-candidate.sh` requires actual component commits -and SHA-256 values; it does not publish or deploy. Set -`PASTURESTACK_COMPONENT_ARTIFACT_DIR` to an isolated directory with the five -component assets for an unpublished candidate. Without it, the same hashes -verify the versioned HTTPS release assets. - -## Language and licensing - -The console packages thirteen locales, including Traditional Chinese for Taiwan. -Server bootstrap messages accept `PASTURESTACK_LOCALE=en-US` or `zh-TW`; -protocol fields and persisted identifiers are not translated. - -The inherited project uses [Apache License 2.0](LICENSE), with attribution in -[COPYRIGHT_DETAILS.md](COPYRIGHT_DETAILS.md). Bundled components retain their own -licenses and notices. +# PastureStack Server + +Server packages the orchestration engine, web console, node agent, +authentication service, proxy, catalog, and database into a Docker image for +managing environments, hosts, stacks, services, containers, storage, and networking. + +PastureStack is an independent community effort to preserve and modernize the +Rancher 1.6 ecosystem. It is not affiliated with Rancher Labs or SUSE. +This fork of [`rancher/rancher`](https://github.com/rancher/rancher) preserves +upstream history, authorship, licenses, and notices. + +## Current release + +Server `v1.6.520` packages Web Console `1.6.181` +and Orchestration Engine `v0.183.336`. API Keys support full, custom and closed +policies, optional expiry, and key-scoped durable audit records. Their permissions +remain bounded by the owner's current role and environment access. Delegated +terminal/log access requires the verified Host API audit capability and the +compatible Linux Node Agent lifecycle. +Custom Key Project targets share the normal API's live membership checks; +membership never bypasses Key rules or unrelated resource authorization. + +The console supports OIDC, TOTP and passkeys, role-aware resource operations, +container resource/hardware settings, and movable terminal/log windows. +Hardware options require compatible node software and actual host capabilities; +GPU device access is not exclusive GPU allocation. Audit queries and exports +cover retained records with environment-aware access and bounded pagination. +Explicit date bounds remain attached to every audit page, so an older interval +does not scan newer records first. Oversized queries retain the console filters +and offer explicit narrowing or retry. Export failures are translated on the +page instead of downloaded as error files. An export failure keeps successful +query results intact; scan and export limits are retained. +The Key modal owns initial focus and yields to keyboard or pointer interaction. +Audit export closes its own menu before locking the request, allowing consecutive +JSON, CSV and XLSX downloads without leaving a disabled menu open. +Key scope choices use the viewer's authorized environment list. Environment, +stack and resource selectors close before dependent loading or verification. +See the [release note](docs/releases/server-1.6.520.md) for exact +component identities and verification boundaries. A version or packaged feature +does not establish that every resource/role/hardware combination has been tested. + +## API Keys + +Choose allow-by-default with deny exceptions, or deny-by-default with allow +exceptions, with optional expiry. Without exceptions these retain full or closed +access. Search for resource names; the editor and reviewed changes include a +resource-by-operation policy matrix, not an extra grant of authority. The maximum access +is always the Key owner's current account/environment RBAC; a Key never grants +an additional role. Existing legacy Keys are not automatically narrowed on upgrade. +New Key secrets are shown once at creation and are not returned by later lists or +details. Per-Key audit separates authorization, the HTTP response and any later +job/stream completion. A successful WebSocket upgrade is recorded as a successful +HTTP `101` handshake, not as proof of the stream's later completion. +Environment-Key audit rechecks live Engine access in +Engine-verified project contexts; a caller-supplied project header is not a grant. +Open a Key's audit from its action menu; the close control follows the audit +filters, results and details, below the audit block. +Scope options and unselected hints use readable light/dark theme text, including +keyboard highlighting; narrow layouts keep the matrix in its own scroll region. +Errors use the existing API status/code and console error +handling. See the [API Key guide](docs/api-keys.md) for policy and audit contracts. + +## Quick start + +Public GHCR downloads do not require a registry login. Use the published numeric +version tag and keep all three named volumes: + +```sh +docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \ + -v pasturestack-cattle:/var/lib/cattle \ + -v pasturestack-mysql:/var/lib/mysql \ + -v pasturestack-mysqllog:/var/log/mysql \ + ghcr.io/pasturestack/server:v1.6.520 +``` + +For HTTPS termination at a reverse proxy, set the exact public origin: + +```yaml +services: + pasturestack-server: + image: ghcr.io/pasturestack/server:v1.6.520 + restart: unless-stopped + ports: + - "8080:8080" + environment: + PROXY_PLATFORM_PUBLIC_ORIGIN: https://stack.example.com + volumes: + - pasturestack-cattle:/var/lib/cattle + - pasturestack-mysql:/var/lib/mysql + - pasturestack-mysqllog:/var/log/mysql + +volumes: + pasturestack-cattle: + pasturestack-mysql: + pasturestack-mysqllog: +``` + +`PROXY_PLATFORM_PUBLIC_ORIGIN` accepts only `scheme://host[:port]`, without +credentials, path, query, or fragment. Configure HTTPS, authentication, backups, +and access policies before exposing the platform. Supported JVM and embedded +MariaDB environment variables are in [performance settings](docs/performance/README.md). + +## Upgrade and rollback + +Back up the database and volumes, test a restore, then follow the +[upgrade guide](docs/upgrades/README.md). Preserve existing volume names, +environment variables, restart policy, AppArmor, and reverse-proxy configuration. +Do not replace existing volumes with new empty ones or run `docker compose down -v`. + +Persisted image/download/catalog/Docker compatibility settings can outlive an +image upgrade; review their effective values. The migration tool is read-only +by default and requires explicit apply/rollback. Keep the previous image and +backup: after a database migration, rollback may require restoring matching data, +not merely selecting an older image tag. + +After using API Key policy or expiry, do not downgrade directly to a +policy-unaware Engine: an older version can treat a restricted or expired Key +as full access. Follow the [API Key rollback safety guide](docs/upgrades/api-key-policy-rollback.md) +before any downgrade or database restore. + +[GitHub Releases](https://github.com/PastureStack/server/releases) contain +versioned assets, SHA-256 checksums, and release records. Built-in templates come +from pinned [`catalog-templates`](https://github.com/PastureStack/catalog-templates) +source. Historical changes belong in [release notes](docs/releases). + +## Development + +Server consumes pinned source commits and verified component artifacts. +For local source/shell validation: + +```sh +bash scripts/test +bash scripts/check-server-source-gates.sh +``` + +Runtime, database migration, registration, backup/restore, and upgrade validation +use isolated hosts. Publication is a separate, manually dispatched workflow. +See [ORIGIN.md](ORIGIN.md) and [SECURITY.md](SECURITY.md). + +The component candidate build uses the same release Dockerfile and verification +gates. `server/build-component-candidate.sh` requires actual component commits +and SHA-256 values; it does not publish or deploy. Set +`PASTURESTACK_COMPONENT_ARTIFACT_DIR` to an isolated directory with the five +component assets for an unpublished candidate. Without it, the same hashes +verify the versioned HTTPS release assets. + +## Language and licensing + +The console packages thirteen locales, including Traditional Chinese for Taiwan. +Server bootstrap messages accept `PASTURESTACK_LOCALE=en-US` or `zh-TW`; +protocol fields and persisted identifiers are not translated. + +The inherited project uses [Apache License 2.0](LICENSE), with attribution in +[COPYRIGHT_DETAILS.md](COPYRIGHT_DETAILS.md). Bundled components retain their own +licenses and notices. diff --git a/server/security/openvex.json b/server/security/openvex.json index 897082b88b..e2a75fbba8 100644 --- a/server/security/openvex.json +++ b/server/security/openvex.json @@ -1,782 +1,782 @@ -{ - "@context": "https://openvex.dev/ns/v0.2.0", - "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.520", - "author": "PastureStack Security", - "timestamp": "2026-10-02T22:05:00Z", - "version": 51, - "statements": [ - { - "vulnerability": { - "name": "CVE-2024-2236" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libgcrypt20@1.12.0-2ubuntu1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_in_execute_path", - "impact_statement": "The issue is an RSA decryption timing side channel. The runtime GPG verifier is removed and a bounded executable-link audit found no remaining executable under /usr/bin, /usr/sbin, or /usr/share/cattle linked to libgcrypt." - }, - { - "vulnerability": { - "name": "CVE-2024-56433" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/login.defs@4.17.4-2ubuntu3?arch=all&distro=ubuntu-26.04&epoch=1" - }, - { - "@id": "pkg:deb/ubuntu/passwd@4.17.4-2ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The affected subordinate-ID allocation path is absent: login.defs, subuid, subgid, passwd, useradd, usermod, groupadd, newuidmap, and newgidmap are removed from the final runtime." - }, - { - "vulnerability": { - "name": "CVE-2024-52005" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/git@2.53.0-1ubuntu1?arch=amd64&distro=ubuntu-26.04&epoch=1" - }, - { - "@id": "pkg:deb/ubuntu/git-man@2.53.0-1ubuntu1?arch=all&distro=ubuntu-26.04&epoch=1" - } - ], - "status": "fixed", - "impact_statement": "The upstream advisory lists affected Git release lines only through 2.48.1; the final runtime enforces Git 2.53.0 for Catalog HTTPS clone and fetch operations." - }, - { - "vulnerability": { - "name": "CVE-2026-8932" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.7?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.7?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.7?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "The final runtime installs Ubuntu 26.04 curl and both shipped libcurl variants at 8.18.0-1ubuntu2.7, including the 2026-09-24 security update, and enforces the exact installed versions during image assembly and post-build validation." - }, - { - "vulnerability": { - "name": "CVE-2025-1352" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libelf1t64@0.194-4?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The affected eu-strip utility is absent from the final runtime." - }, - { - "vulnerability": { - "name": "CVE-2025-1376" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libelf1t64@0.194-4?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The affected eu-readelf utility is absent from the final runtime." - }, - { - "vulnerability": { - "name": "CVE-2025-66382" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final runtime removes both libexpat.so.1 and git-http-push, the sole executable that linked to Expat; Catalog requires only Git HTTPS clone, fetch, and checkout." - }, - { - "vulnerability": { - "name": "CVE-2026-13757" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libp11-kit0@0.26.2-2?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_in_execute_path", - "impact_statement": "The vulnerable p11-kit RPC server executable is absent and the final runtime exposes no p11-kit RPC Unix socket." - }, - { - "vulnerability": { - "name": "CVE-2026-18477" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "GNU tar and the container source-build workflow are removed from the final runtime, so the vulnerable incremental restore path is absent." - }, - { - "vulnerability": { - "name": "CVE-2026-18508" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "GNU tar and the container source-build workflow are removed from the final runtime, so the vulnerable one-top-level extraction path is absent." - }, - { - "vulnerability": { - "name": "CVE-2026-18798" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libssl3t64@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/openssl-provider-legacy@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "The final runtime installs and verifies Ubuntu 26.04 OpenSSL packages at 3.5.5-1ubuntu3.6, which includes the USN-8678-1 fix and the subsequent USN-8847-1 fixes. SHA-256 checksums extracted from the signed official packages must match all seven package-owned CLI, library, engine and legacy provider files in the final image." - }, - { - "vulnerability": { - "name": "CVE-2026-75803" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libssl3t64@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/openssl-provider-legacy@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "Ubuntu identifies 3.5.5-1ubuntu3.5 as fixed for CVE-2026-75803. The final runtime installs the subsequent official 3.5.5-1ubuntu3.6 packages from a signed snapshot, replacing the former upstream 3.5.8 CLI, libraries, engines and legacy provider. Installed versions, package-owned bytes, provider paths and curl/MariaDB linkage are validated; no package-metadata-only replacement is accepted." - }, - { - "vulnerability": { - "name": "CVE-2026-27171" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/zlib1g@1.3.dfsg%2Breally1.3.1-1ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1" - } - ], - "status": "fixed", - "impact_statement": "The package database describes the base layer, but the final runtime replaces libz.so.1 with verified upstream zlib 1.3.2 and validates the active mariadbd linkage." - }, - { - "vulnerability": { - "name": "CVE-2026-27456" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/bsdutils@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" - }, - { - "@id": "pkg:deb/ubuntu/libblkid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libmount1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libsmartcols1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libuuid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/login@4.16.0-2%2Breally2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" - }, - { - "@id": "pkg:deb/ubuntu/mount@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The issue is in the privileged mount utility. mount and umount are removed from the final runtime; no SUID mount entry point remains." - }, - { - "vulnerability": { - "name": "CVE-2026-3184" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/bsdutils@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" - }, - { - "@id": "pkg:deb/ubuntu/libblkid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libmount1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libsmartcols1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libuuid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/login@4.16.0-2%2Breally2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" - }, - { - "@id": "pkg:deb/ubuntu/mount@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The issue is in login -h processing. login is removed from the final runtime." - }, - { - "vulnerability": { - "name": "CVE-2026-40228" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libsystemd-shared@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libsystemd0@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libudev1@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/systemd@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The vulnerable systemd-journald executable, service units, and sockets are removed from the final runtime." - }, - { - "vulnerability": { - "name": "CVE-2026-53910" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/diffutils@3.12-1?arch=amd64&distro=ubuntu-26.04&epoch=1" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The advisory is specific to diff3 line mapping. The final Server runtime removes /usr/bin/diff3 and validates its absence while retaining only the unaffected diffutils tools required by existing image checks." - }, - { - "vulnerability": { - "name": "CVE-2026-54371" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libattr1@2.5.2-4?arch=amd64&distro=ubuntu-26.04&epoch=1" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The affected getfattr and setfattr command-line utilities are absent from the final runtime." - }, - { - "vulnerability": { - "name": "CVE-2026-56391" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/gnu-coreutils@9.7-3ubuntu2.1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "The final runtime replaces uniq with GNU coreutils 9.11 plus upstream fix commit d64e35a8a4c0e4608321433e0d84d917e4e36371 and runs a multibyte -w regression test during build and image validation." - }, - { - "vulnerability": { - "name": "CVE-2026-56392" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/gnu-coreutils@9.7-3ubuntu2.1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The affected unexpand executable is removed from the final runtime." - }, - { - "vulnerability": { - "name": "GO-2026-5932" - }, - "products": [ - { - "@id": "pkg:golang/golang.org/x/crypto@v0.55.0" - }, - { - "@id": "pkg:golang/golang.org/x/crypto@v0.56.0" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "GO-2026-5932 applies only to the unmaintained golang.org/x/crypto/openpgp packages. The committed source graph and govulncheck evidence contain no openpgp import or reachable symbol in authentication-service, compose-executor, or host-provisioner." - }, - { - "vulnerability": { - "name": "CVE-2026-32776" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-32777" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-32778" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-41080" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-45186" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-50219" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56131" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56132" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56403" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56404" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56405" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56406" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56407" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56408" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56409" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56410" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56411" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-56412" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-66046" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-72522" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-76641" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-76957" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." - }, - { - "vulnerability": { - "name": "CVE-2026-57062" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/gpgv@2.4.8-4ubuntu3?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "The affected CMS parser is gpgsm. Both gpgsm and gpgv are removed and their absence is validated in the final runtime; no GnuPG CMS decryption entry point is shipped." - }, - { - "vulnerability": { - "name": "CVE-2026-56855" - }, - "products": [ - { - "@id": "pkg:golang/golang.org/x/crypto@v0.55.0" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "After upgrading Host Provisioner and Compose Executor to x/crypto v0.56.0, only the checksum-pinned authentication-service binary retains module v0.55.0. Its exact v0.4.42 source at 5589ef8fda68ae56e1afd64096965d452ee8a17e and vendored dependency graph import md4/ripemd160 but no golang.org/x/crypto/ssh package. These two advisories require SSH channel dispatch, which is absent from that binary. This statement must not be reused for an SSH-bearing v0.55.0 binary." - }, - { - "vulnerability": { - "name": "CVE-2026-78662" - }, - "products": [ - { - "@id": "pkg:golang/golang.org/x/crypto@v0.55.0" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_present", - "impact_statement": "After upgrading Host Provisioner and Compose Executor to x/crypto v0.56.0, only the checksum-pinned authentication-service binary retains module v0.55.0. Its exact v0.4.42 source at 5589ef8fda68ae56e1afd64096965d452ee8a17e and vendored dependency graph import md4/ripemd160 but no golang.org/x/crypto/ssh package. These two advisories require SSH channel dispatch, which is absent from that binary. This statement must not be reused for an SSH-bearing v0.55.0 binary." - }, - { - "vulnerability": { - "name": "CVE-2026-18374" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04" - } - ], - "status": "not_affected", - "justification": "vulnerable_code_not_in_execute_path", - "impact_statement": "The issue requires a caller to pass an attacker-controlled fopen mode containing an empty ,ccs= conversion specification. The Server runtime does not accept or construct fopen mode strings from user input; the image gate scans the exact Java, Go, shell and service entrypoint set and rejects any ,ccs= use. Ubuntu still lists the Resolute package status as needs evaluation, so this is an execution-path determination rather than a claim that package version 2.43-2ubuntu2.4 fixes the defect." - }, - { - "vulnerability": { - "name": "CVE-2026-12087" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-12087. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." - }, - { - "vulnerability": { - "name": "CVE-2026-13221" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-13221. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." - }, - { - "vulnerability": { - "name": "CVE-2026-57432" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-57432. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." - }, - { - "vulnerability": { - "name": "CVE-2026-57433" - }, - "products": [ - { - "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" - }, - { - "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" - } - ], - "status": "fixed", - "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-57433. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." - } - ] -} +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.520", + "author": "PastureStack Security", + "timestamp": "2026-10-02T22:05:00Z", + "version": 51, + "statements": [ + { + "vulnerability": { + "name": "CVE-2024-2236" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libgcrypt20@1.12.0-2ubuntu1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "The issue is an RSA decryption timing side channel. The runtime GPG verifier is removed and a bounded executable-link audit found no remaining executable under /usr/bin, /usr/sbin, or /usr/share/cattle linked to libgcrypt." + }, + { + "vulnerability": { + "name": "CVE-2024-56433" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/login.defs@4.17.4-2ubuntu3?arch=all&distro=ubuntu-26.04&epoch=1" + }, + { + "@id": "pkg:deb/ubuntu/passwd@4.17.4-2ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The affected subordinate-ID allocation path is absent: login.defs, subuid, subgid, passwd, useradd, usermod, groupadd, newuidmap, and newgidmap are removed from the final runtime." + }, + { + "vulnerability": { + "name": "CVE-2024-52005" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/git@2.53.0-1ubuntu1?arch=amd64&distro=ubuntu-26.04&epoch=1" + }, + { + "@id": "pkg:deb/ubuntu/git-man@2.53.0-1ubuntu1?arch=all&distro=ubuntu-26.04&epoch=1" + } + ], + "status": "fixed", + "impact_statement": "The upstream advisory lists affected Git release lines only through 2.48.1; the final runtime enforces Git 2.53.0 for Catalog HTTPS clone and fetch operations." + }, + { + "vulnerability": { + "name": "CVE-2026-8932" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.7?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.7?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.7?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "The final runtime installs Ubuntu 26.04 curl and both shipped libcurl variants at 8.18.0-1ubuntu2.7, including the 2026-09-24 security update, and enforces the exact installed versions during image assembly and post-build validation." + }, + { + "vulnerability": { + "name": "CVE-2025-1352" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libelf1t64@0.194-4?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The affected eu-strip utility is absent from the final runtime." + }, + { + "vulnerability": { + "name": "CVE-2025-1376" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libelf1t64@0.194-4?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The affected eu-readelf utility is absent from the final runtime." + }, + { + "vulnerability": { + "name": "CVE-2025-66382" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final runtime removes both libexpat.so.1 and git-http-push, the sole executable that linked to Expat; Catalog requires only Git HTTPS clone, fetch, and checkout." + }, + { + "vulnerability": { + "name": "CVE-2026-13757" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libp11-kit0@0.26.2-2?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "The vulnerable p11-kit RPC server executable is absent and the final runtime exposes no p11-kit RPC Unix socket." + }, + { + "vulnerability": { + "name": "CVE-2026-18477" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "GNU tar and the container source-build workflow are removed from the final runtime, so the vulnerable incremental restore path is absent." + }, + { + "vulnerability": { + "name": "CVE-2026-18508" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "GNU tar and the container source-build workflow are removed from the final runtime, so the vulnerable one-top-level extraction path is absent." + }, + { + "vulnerability": { + "name": "CVE-2026-18798" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libssl3t64@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/openssl-provider-legacy@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "The final runtime installs and verifies Ubuntu 26.04 OpenSSL packages at 3.5.5-1ubuntu3.6, which includes the USN-8678-1 fix and the subsequent USN-8847-1 fixes. SHA-256 checksums extracted from the signed official packages must match all seven package-owned CLI, library, engine and legacy provider files in the final image." + }, + { + "vulnerability": { + "name": "CVE-2026-75803" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libssl3t64@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/openssl-provider-legacy@3.5.5-1ubuntu3.6?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu identifies 3.5.5-1ubuntu3.5 as fixed for CVE-2026-75803. The final runtime installs the subsequent official 3.5.5-1ubuntu3.6 packages from a signed snapshot, replacing the former upstream 3.5.8 CLI, libraries, engines and legacy provider. Installed versions, package-owned bytes, provider paths and curl/MariaDB linkage are validated; no package-metadata-only replacement is accepted." + }, + { + "vulnerability": { + "name": "CVE-2026-27171" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/zlib1g@1.3.dfsg%2Breally1.3.1-1ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1" + } + ], + "status": "fixed", + "impact_statement": "The package database describes the base layer, but the final runtime replaces libz.so.1 with verified upstream zlib 1.3.2 and validates the active mariadbd linkage." + }, + { + "vulnerability": { + "name": "CVE-2026-27456" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/bsdutils@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" + }, + { + "@id": "pkg:deb/ubuntu/libblkid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libmount1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libsmartcols1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libuuid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/login@4.16.0-2%2Breally2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" + }, + { + "@id": "pkg:deb/ubuntu/mount@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The issue is in the privileged mount utility. mount and umount are removed from the final runtime; no SUID mount entry point remains." + }, + { + "vulnerability": { + "name": "CVE-2026-3184" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/bsdutils@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" + }, + { + "@id": "pkg:deb/ubuntu/libblkid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libmount1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libsmartcols1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libuuid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/login@4.16.0-2%2Breally2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&epoch=1" + }, + { + "@id": "pkg:deb/ubuntu/mount@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The issue is in login -h processing. login is removed from the final runtime." + }, + { + "vulnerability": { + "name": "CVE-2026-40228" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libsystemd-shared@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libsystemd0@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libudev1@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/systemd@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The vulnerable systemd-journald executable, service units, and sockets are removed from the final runtime." + }, + { + "vulnerability": { + "name": "CVE-2026-53910" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/diffutils@3.12-1?arch=amd64&distro=ubuntu-26.04&epoch=1" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The advisory is specific to diff3 line mapping. The final Server runtime removes /usr/bin/diff3 and validates its absence while retaining only the unaffected diffutils tools required by existing image checks." + }, + { + "vulnerability": { + "name": "CVE-2026-54371" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libattr1@2.5.2-4?arch=amd64&distro=ubuntu-26.04&epoch=1" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The affected getfattr and setfattr command-line utilities are absent from the final runtime." + }, + { + "vulnerability": { + "name": "CVE-2026-56391" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/gnu-coreutils@9.7-3ubuntu2.1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "The final runtime replaces uniq with GNU coreutils 9.11 plus upstream fix commit d64e35a8a4c0e4608321433e0d84d917e4e36371 and runs a multibyte -w regression test during build and image validation." + }, + { + "vulnerability": { + "name": "CVE-2026-56392" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/gnu-coreutils@9.7-3ubuntu2.1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The affected unexpand executable is removed from the final runtime." + }, + { + "vulnerability": { + "name": "GO-2026-5932" + }, + "products": [ + { + "@id": "pkg:golang/golang.org/x/crypto@v0.55.0" + }, + { + "@id": "pkg:golang/golang.org/x/crypto@v0.56.0" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "GO-2026-5932 applies only to the unmaintained golang.org/x/crypto/openpgp packages. The committed source graph and govulncheck evidence contain no openpgp import or reachable symbol in authentication-service, compose-executor, or host-provisioner." + }, + { + "vulnerability": { + "name": "CVE-2026-32776" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-32777" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-32778" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-41080" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-45186" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-50219" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56131" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56132" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56403" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56404" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56405" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56406" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56407" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56408" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56409" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56410" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56411" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-56412" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-66046" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-72522" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-76641" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-76957" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libexpat1@2.7.4-1?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The final merged runtime removes libexpat.so.1, its implementation library and git-http-push. The image build and post-build validation check file absence and reject any libexpat entry in the dynamic linker cache. The remaining finding is package-database metadata, not an executable XML parser." + }, + { + "vulnerability": { + "name": "CVE-2026-57062" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/gpgv@2.4.8-4ubuntu3?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "The affected CMS parser is gpgsm. Both gpgsm and gpgv are removed and their absence is validated in the final runtime; no GnuPG CMS decryption entry point is shipped." + }, + { + "vulnerability": { + "name": "CVE-2026-56855" + }, + "products": [ + { + "@id": "pkg:golang/golang.org/x/crypto@v0.55.0" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "After upgrading Host Provisioner and Compose Executor to x/crypto v0.56.0, only the checksum-pinned authentication-service binary retains module v0.55.0. Its exact v0.4.42 source at 5589ef8fda68ae56e1afd64096965d452ee8a17e and vendored dependency graph import md4/ripemd160 but no golang.org/x/crypto/ssh package. These two advisories require SSH channel dispatch, which is absent from that binary. This statement must not be reused for an SSH-bearing v0.55.0 binary." + }, + { + "vulnerability": { + "name": "CVE-2026-78662" + }, + "products": [ + { + "@id": "pkg:golang/golang.org/x/crypto@v0.55.0" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "After upgrading Host Provisioner and Compose Executor to x/crypto v0.56.0, only the checksum-pinned authentication-service binary retains module v0.55.0. Its exact v0.4.42 source at 5589ef8fda68ae56e1afd64096965d452ee8a17e and vendored dependency graph import md4/ripemd160 but no golang.org/x/crypto/ssh package. These two advisories require SSH channel dispatch, which is absent from that binary. This statement must not be reused for an SSH-bearing v0.55.0 binary." + }, + { + "vulnerability": { + "name": "CVE-2026-18374" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "The issue requires a caller to pass an attacker-controlled fopen mode containing an empty ,ccs= conversion specification. The Server runtime does not accept or construct fopen mode strings from user input; the image gate scans the exact Java, Go, shell and service entrypoint set and rejects any ,ccs= use. Ubuntu still lists the Resolute package status as needs evaluation, so this is an execution-path determination rather than a claim that package version 2.43-2ubuntu2.4 fixes the defect." + }, + { + "vulnerability": { + "name": "CVE-2026-12087" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-12087. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." + }, + { + "vulnerability": { + "name": "CVE-2026-13221" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-13221. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." + }, + { + "vulnerability": { + "name": "CVE-2026-57432" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-57432. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." + }, + { + "vulnerability": { + "name": "CVE-2026-57433" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-57433. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." + } + ] +} diff --git a/server/security/vendor-pending.json b/server/security/vendor-pending.json index 594ac16253..baaef78ef1 100644 --- a/server/security/vendor-pending.json +++ b/server/security/vendor-pending.json @@ -1,61 +1,61 @@ -{ - "schemaVersion": 1, - "release": "v1.6.520", - "generatedAt": "2026-10-10T00:00:00Z", - "policy": { - "allowedSeverities": [ - "LOW", - "MEDIUM" - ], - "requiresEmptyFixedVersion": true, - "vendorStatus": "needs-evaluation", - "scanTarget": "merged-rootfs", - "trivyTarget": "/rootfs (ubuntu 26.04)" - }, - "findings": [ - { - "vulnerabilityId": "CVE-2026-85091", - "severity": "MEDIUM", - "vendorStatus": "needs-evaluation", - "source": "https://ubuntu.com/security/CVE-2026-85091", - "reviewAfter": "2026-10-20", - "packages": [ - { "name": "zlib1g", "installedVersion": "1:1.3.dfsg+really1.3.1-1ubuntu3.1" } - ] - }, - { - "vulnerabilityId": "CVE-2026-86145", - "severity": "MEDIUM", - "vendorStatus": "needs-evaluation", - "source": "https://ubuntu.com/security/CVE-2026-86145", - "reviewAfter": "2026-10-20", - "packages": [ - { "name": "libpcre2-8-0", "installedVersion": "10.46-1build1" }, - { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } - ] - }, - { - "vulnerabilityId": "CVE-2026-89092", - "severity": "MEDIUM", - "vendorStatus": "needs-evaluation", - "source": "https://ubuntu.com/security/CVE-2026-89092", - "reviewAfter": "2026-10-20", - "packages": [ - { "name": "libc-bin", "installedVersion": "2.43-2ubuntu2.4" }, - { "name": "libc-gconv-modules-extra", "installedVersion": "2.43-2ubuntu2.4" }, - { "name": "libc6", "installedVersion": "2.43-2ubuntu2.4" } - ] - }, - { - "vulnerabilityId": "CVE-2026-89161", - "severity": "MEDIUM", - "vendorStatus": "needs-evaluation", - "source": "https://ubuntu.com/security/CVE-2026-89161", - "reviewAfter": "2026-10-20", - "packages": [ - { "name": "libpcre2-8-0", "installedVersion": "10.46-1build1" }, - { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } - ] - } - ] -} +{ + "schemaVersion": 1, + "release": "v1.6.520", + "generatedAt": "2026-10-10T00:00:00Z", + "policy": { + "allowedSeverities": [ + "LOW", + "MEDIUM" + ], + "requiresEmptyFixedVersion": true, + "vendorStatus": "needs-evaluation", + "scanTarget": "merged-rootfs", + "trivyTarget": "/rootfs (ubuntu 26.04)" + }, + "findings": [ + { + "vulnerabilityId": "CVE-2026-85091", + "severity": "MEDIUM", + "vendorStatus": "needs-evaluation", + "source": "https://ubuntu.com/security/CVE-2026-85091", + "reviewAfter": "2026-10-20", + "packages": [ + { "name": "zlib1g", "installedVersion": "1:1.3.dfsg+really1.3.1-1ubuntu3.1" } + ] + }, + { + "vulnerabilityId": "CVE-2026-86145", + "severity": "MEDIUM", + "vendorStatus": "needs-evaluation", + "source": "https://ubuntu.com/security/CVE-2026-86145", + "reviewAfter": "2026-10-20", + "packages": [ + { "name": "libpcre2-8-0", "installedVersion": "10.46-1build1" }, + { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } + ] + }, + { + "vulnerabilityId": "CVE-2026-89092", + "severity": "MEDIUM", + "vendorStatus": "needs-evaluation", + "source": "https://ubuntu.com/security/CVE-2026-89092", + "reviewAfter": "2026-10-20", + "packages": [ + { "name": "libc-bin", "installedVersion": "2.43-2ubuntu2.4" }, + { "name": "libc-gconv-modules-extra", "installedVersion": "2.43-2ubuntu2.4" }, + { "name": "libc6", "installedVersion": "2.43-2ubuntu2.4" } + ] + }, + { + "vulnerabilityId": "CVE-2026-89161", + "severity": "MEDIUM", + "vendorStatus": "needs-evaluation", + "source": "https://ubuntu.com/security/CVE-2026-89161", + "reviewAfter": "2026-10-20", + "packages": [ + { "name": "libpcre2-8-0", "installedVersion": "10.46-1build1" }, + { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } + ] + } + ] +}