Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases Activity

fix: add Docker daemon-side vulns to allowlist

Browse source 
Add GO-2026-5617, GO-2026-5668, and GO-2026-5746 to .govulncheck-allow.
These are all daemon-side Docker/Moby vulnerabilities that don't affect
RedFlag because it uses the Docker client only for Ping, SecretList,
and container scanning — never for docker cp, archive operations, or
AuthZ paths.

Also update SECURITY.md to document all accepted exceptions in a table.
This commit is contained in:
Fimeg 2026-06-29 16:34:33 -04:00
commit b3d946b84f
2 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
.govulncheck-allow
View file

@ -13,3 +13,6 @@
GO-2026-4887 Moby AuthZ plugin bypass via oversized request bodies. Daemon-side. RedFlag links github.com/docker/docker only as a CLIENT (Ping / SecretList / container scan) and never runs the engine's AuthZ path. No fixed version published (Fixed: N/A).
GO-2026-4883 Moby off-by-one in plugin privilege validation. Daemon-side. Same client-only rationale as GO-2026-4887. No fixed version published (Fixed: N/A).
GO-2026-5617 Race condition in docker cp allows bind mount redirection to host path. Daemon-side. RedFlag never calls docker cp; it uses the client only for Ping / SecretList / container scan. No fixed version published (Fixed: N/A).
GO-2026-5668 Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap. Daemon-side. Same client-only rationale as GO-2026-5617. No fixed version published (Fixed: N/A).
GO-2026-5746 PUT /containers/{id}/archive executes container binary on the host. Daemon-side. RedFlag never calls the archive endpoint; it uses the client only for Ping / SecretList / container scan. No fixed version published (Fixed: N/A).

19
SECURITY.md
View file

@ -75,6 +75,25 @@ The build substrate itself is recorded on every run (toolchain and engine versio
"what built this" is never a mystery. Enforcing a minimum-patched floor on that
substrate is the next layer.
### Accepted Dependency Exceptions
The following vulnerabilities are known, accepted, and documented in the
machine-readable `.govulncheck-allow` register. All are daemon-side Docker/Moby
advisories that do not affect RedFlag because it uses the Docker client only for
`Ping`, `SecretList`, and container scanning — never for `docker cp`, archive
operations, or AuthZ paths.
| GO ID | Summary | Rationale |
|-------|---------|-----------|
| GO-2026-4883 | Moby off-by-one in plugin privilege validation | Daemon-side; client-only usage |
| GO-2026-4887 | Moby AuthZ plugin bypass via oversized request bodies | Daemon-side; client-only usage |
| GO-2026-5617 | Race condition in `docker cp` allows bind mount redirection | Daemon-side; RedFlag never calls `docker cp` |
| GO-2026-5668 | Race condition in `docker cp` allows arbitrary empty files via symlink swap | Daemon-side; RedFlag never calls `docker cp` |
| GO-2026-5746 | `PUT /containers/{id}/archive` executes container binary on host | Daemon-side; RedFlag never calls the archive endpoint |
None of these have published fixes. When upstream patches ship, the dependency
will be bumped and the entries removed.
---
## Visibility