Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases Activity

deps: lift patched public floors

Browse source 
CI found nine reachable Go issues and a high Axios advisory. Move to the published fixed floors and retire three stale Docker exceptions.
This commit is contained in:
Fimeg 2026-08-20 13:14:28 -04:00
commit 7427174d99
8 changed files with 106 additions and 620 deletions
Download patch file Download diff file Expand all files Collapse all files

7
SECURITY.md
View file

@ -80,16 +80,13 @@ substrate is the next layer.
The following vulnerabilities are known, accepted, and documented in the
machine-readable `.govulncheck-allow` register. All are daemon-side Docker/Moby
advisories that do not affect RedFlag because it uses the Docker client only for
`Ping`, `SecretList`, and container scanning — never for `docker cp`, archive
operations, or AuthZ paths.
`Ping`, `SecretList`, and container scanning — never for the daemon's plugin
privilege or AuthZ paths.
| GO ID | Summary | Rationale |
|-------|---------|-----------|
| GO-2026-4883 | Moby off-by-one in plugin privilege validation | Daemon-side; client-only usage |
| GO-2026-4887 | Moby AuthZ plugin bypass via oversized request bodies | Daemon-side; client-only usage |
| GO-2026-5617 | Race condition in `docker cp` allows bind mount redirection | Daemon-side; RedFlag never calls `docker cp` |
| GO-2026-5668 | Race condition in `docker cp` allows arbitrary empty files via symlink swap | Daemon-side; RedFlag never calls `docker cp` |
| GO-2026-5746 | `PUT /containers/{id}/archive` executes container binary on host | Daemon-side; RedFlag never calls the archive endpoint |
None of these have published fixes. When upstream patches ship, the dependency
will be bumped and the entries removed.