From d45226613b24a1de83dc90eb56fab312deecf7f0 Mon Sep 17 00:00:00 2001 From: Behnam Mozafari Date: Wed, 26 Aug 2026 14:43:36 +1000 Subject: [PATCH 1/2] UID2-7748: suppress sqlite-libs CVE-2026-11822/11824 in .trivyignore (exp 2026-11-26) --- .trivyignore | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.trivyignore b/.trivyignore index fc454ef7..07131b70 100644 --- a/.trivyignore +++ b/.trivyignore @@ -60,3 +60,12 @@ GHSA-r7wm-3cxj-wff9 exp:2026-08-23 # /metrics; HTTP instrumentation via Vert.x, not micrometer-jetty/servlet binders # See: UID2-7662 CVE-2026-40984 exp:2026-11-11 + +# CVE-2026-11822 / CVE-2026-11824 — sqlite-libs arbitrary code execution/crash via crafted +# FTS5 input, in the Alpine base image (transitive via eclipse-temurin:21-jre-alpine-3.23). +# Not exploitable here: sqlite-libs is not apk-added in the Dockerfile (only libpng/libcrypto3/ +# libssl3/musl/musl-utils/gnutls are); uid2-admin is a pure Java/Vert.x service with no SQLite/ +# JDBC dependency and no JNI bindings, so the FTS5 query engine is never invoked. +# See: UID2-7748 +CVE-2026-11822 exp:2026-11-26 +CVE-2026-11824 exp:2026-11-26 From c15d2bfa0a0c3bf41823a13c84fd11ed6bbc8b17 Mon Sep 17 00:00:00 2001 From: Behnam Mozafari Date: Wed, 26 Aug 2026 14:49:05 +1000 Subject: [PATCH 2/2] UID2-7748: trivyignore cleanup - remove 3 expired entries fixed upstream CVE-2026-56131, CVE-2026-56407 (libexpat) and GHSA-r7wm-3cxj-wff9 (jackson-core, fixed by the 2.21.4 bump) no longer appear in the latest Trivy scan, confirming they are fixed upstream. --- .trivyignore | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/.trivyignore b/.trivyignore index 07131b70..d0bc5f85 100644 --- a/.trivyignore +++ b/.trivyignore @@ -31,14 +31,6 @@ CVE-2026-42577 exp:2026-09-11 # See: UID2-7376 CVE-2026-2100 exp:2026-09-01 -# CVE-2026-56131 / CVE-2026-56407 / CVE-2026-56408 — libexpat stack exhaustion / integer overflows -# in the Alpine base image. uid2-admin is a pure Java service; the JVM parses XML via the built-in -# JAXP/Xerces implementation, not the native libexpat C library, and there are no JNI bindings or -# native deps that call into libexpat, so the crafted-XML attack path is not reachable. Fixed in -# Alpine v3.23 libexpat >= 2.8.2-r0; the pinned eclipse-temurin base image has not yet been rebuilt with it. -# See: UID2-7456 -CVE-2026-56131 exp:2026-08-09 -CVE-2026-56407 exp:2026-08-09 # CVE-2026-56408 — libexpat (Alpine base image, transitive via eclipse-temurin:21-jre- # alpine-3.23) (HIGH). # Not exploitable here: Dockerfile FROM eclipse-temurin:21-jre-alpine-3.23; libexpat not apk- @@ -47,12 +39,6 @@ CVE-2026-56407 exp:2026-08-09 # See: UID2-7656 CVE-2026-56408 exp:2026-11-11 -# jackson-core async parser maxNumberLength bypass (GHSA-r7wm-3cxj-wff9) - incomplete fix for -# GHSA-72hv-8253-57qq. Not exploitable: services only use the synchronous ObjectMapper API, not -# jackson-core's non-blocking/async parser. A jackson bump is also in flight via uid2-shared -# (PR #631) and will flow on the next release. See: UID2-7557 (predecessor UID2-6670) -GHSA-r7wm-3cxj-wff9 exp:2026-08-23 - # CVE-2026-40984 — io.micrometer:micrometer-core (transitive via micrometer-registry- # prometheus/-jmx); micrometer-jetty11/12 not present (HIGH). # Not exploitable here: pom.xml:112/126/132 vertx-micrometer + micrometer-registry-