-
Notifications
You must be signed in to change notification settings - Fork 4
Expand file tree
/
Copy path.trivyignore
More file actions
36 lines (31 loc) · 2.09 KB
/
Copy path.trivyignore
File metadata and controls
36 lines (31 loc) · 2.09 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
# Trivy Ignore File for swiss-army-knife-v2
# This file contains CVEs and security advisories that are accepted risks for this container image
# =============================================================================
# kubectl Binary Vulnerabilities
# =============================================================================
# Using upstream kubectl stable version from dl.k8s.io/release/stable.txt
# These are Go dependencies in kubectl that we don't control
# Common kubectl/Go library vulnerabilities:
CVE-2025-47907 # database/sql: Postgres Scan Race Condition (stdlib)
CVE-2025-49140 # Pion Interceptor's improper RTP padding handling
CVE-2024-45337 # golang.org/x/crypto/ssh authorization bypass (CRITICAL - in older versions)
CVE-2025-22869 # golang.org/x/crypto/ssh: DoS in Key Exchange
CVE-2024-32148 # golang.org/x/net/http2: potential Denial of Service
CVE-2025-22865 # golang.org/x/net: DoS in HTTP/2 server
CVE-2023-47108 # opentelemetry-go-contrib: DoS vulnerability in otelgrpc
# Go stdlib vulnerabilities in kubectl (requires Go 1.24.8+ or 1.25.2+)
# No patched kubectl versions available yet - waiting for Kubernetes patch releases
CVE-2025-47912 # stdlib: net/url insufficient validation of IPv6 addresses
CVE-2025-58183 # stdlib: archive/tar resource exhaustion via sparse entries
CVE-2025-58186 # stdlib: net/http excessive header count DoS
CVE-2025-58187 # stdlib: crypto/x509 name constraint checking performance issue
CVE-2025-58188 # stdlib: crypto/x509 DSA public key validation DoS
CVE-2025-61724 # stdlib: net/textproto response construction issue
# =============================================================================
# SUSE Base Image (BCI 15.7) Package Vulnerabilities
# =============================================================================
# Note: Most OS vulnerabilities are now fixed via `zypper update` in Dockerfile
# Only remaining vulnerability that requires ignoring:
# BIND utilities (DNS tools - used for debugging only)
# Waiting for bind 9.20.15 to be available in SUSE repositories
SUSE-SU-2025:3903-1 # bind-utils: Security update for bind (HIGH)