Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases Activity

fix: add Docker daemon-side vulns to allowlist

Browse source 
Add GO-2026-5617, GO-2026-5668, and GO-2026-5746 to .govulncheck-allow.
These are all daemon-side Docker/Moby vulnerabilities that don't affect
RedFlag because it uses the Docker client only for Ping, SecretList,
and container scanning — never for docker cp, archive operations, or
AuthZ paths.

Also update SECURITY.md to document all accepted exceptions in a table.
This commit is contained in:
Fimeg 2026-06-29 16:34:33 -04:00
commit b3d946b84f
2 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

19
SECURITY.md
View file

@ -75,6 +75,25 @@ The build substrate itself is recorded on every run (toolchain and engine versio
"what built this" is never a mystery. Enforcing a minimum-patched floor on that
substrate is the next layer.
### Accepted Dependency Exceptions
The following vulnerabilities are known, accepted, and documented in the
machine-readable `.govulncheck-allow` register. All are daemon-side Docker/Moby
advisories that do not affect RedFlag because it uses the Docker client only for
`Ping`, `SecretList`, and container scanning — never for `docker cp`, archive
operations, or AuthZ paths.
| GO ID | Summary | Rationale |
|-------|---------|-----------|
| GO-2026-4883 | Moby off-by-one in plugin privilege validation | Daemon-side; client-only usage |
| GO-2026-4887 | Moby AuthZ plugin bypass via oversized request bodies | Daemon-side; client-only usage |
| GO-2026-5617 | Race condition in `docker cp` allows bind mount redirection | Daemon-side; RedFlag never calls `docker cp` |
| GO-2026-5668 | Race condition in `docker cp` allows arbitrary empty files via symlink swap | Daemon-side; RedFlag never calls `docker cp` |
| GO-2026-5746 | `PUT /containers/{id}/archive` executes container binary on host | Daemon-side; RedFlag never calls the archive endpoint |
None of these have published fixes. When upstream patches ship, the dependency
will be bumped and the entries removed.
---
## Visibility