67e26be2d9
The public tree and its history contain only the listed paths. Earlier projection history remains preserved internally. Source-Sha: 913fde029b935671833254797f0f20f1eb9fabba Policy-Sha: 913fde029b935671833254797f0f20f1eb9fabba Tree-Digest: 180ae530c1058a2a5c89837bdce2d323ae83e669e38590ca72e75b8d92b7262f
15 lines
1 KiB
Text
15 lines
1 KiB
Text
# RedFlag dependency vulnerability exceptions (govulncheck)
|
|
#
|
|
# Each line is a KNOWN, ACCEPTED *reachable* finding with a documented reason.
|
|
# This file is the machine-readable register; the same exceptions are PUBLISHED
|
|
# in SECURITY.md ("Accepted dependency exceptions"). This is honest disclosure,
|
|
# not a silent bypass: any vuln govulncheck reports as reachable and NOT listed
|
|
# here fails CI. Keep this list as short as the world allows.
|
|
#
|
|
# Format: <GO-id> <reason>
|
|
#
|
|
# Review trigger: when a listed module gets a fixed version, bump the dep and
|
|
# DELETE the line. The gate warns on stale entries that no longer fire.
|
|
|
|
GO-2026-4887 Moby AuthZ plugin bypass via oversized request bodies. Daemon-side. RedFlag links github.com/docker/docker only as a CLIENT (Ping / SecretList / container scan) and never runs the engine's AuthZ path. No fixed version published (Fixed: N/A).
|
|
GO-2026-4883 Moby off-by-one in plugin privilege validation. Daemon-side. Same client-only rationale as GO-2026-4887. No fixed version published (Fixed: N/A).
|