7427174d99
CI found nine reachable Go issues and a high Axios advisory. Move to the published fixed floors and retire three stale Docker exceptions.
15 lines
1 KiB
Text
15 lines
1 KiB
Text
# RedFlag dependency vulnerability exceptions (govulncheck)
|
|
#
|
|
# Each line is a KNOWN, ACCEPTED *reachable* finding with a documented reason.
|
|
# This file is the machine-readable register; the same exceptions are PUBLISHED
|
|
# in SECURITY.md ("Accepted dependency exceptions"). This is honest disclosure,
|
|
# not a silent bypass: any vuln govulncheck reports as reachable and NOT listed
|
|
# here fails CI. Keep this list as short as the world allows.
|
|
#
|
|
# Format: <GO-id> <reason>
|
|
#
|
|
# Review trigger: when a listed module gets a fixed version, bump the dep and
|
|
# DELETE the line. The gate warns on stale entries that no longer fire.
|
|
|
|
GO-2026-4887 Moby AuthZ plugin bypass via oversized request bodies. Daemon-side. RedFlag links github.com/docker/docker only as a CLIENT (Ping / SecretList / container scan) and never runs the engine's AuthZ path. No fixed version published (Fixed: N/A).
|
|
GO-2026-4883 Moby off-by-one in plugin privilege validation. Daemon-side. Same client-only rationale as GO-2026-4887. No fixed version published (Fixed: N/A).
|