Skip to content

UID2-7761: suppress CVE-2026-14456 in GCP/Azure private-operator images #2710

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BehnamMozafari merged 2 commits into from
Aug 28, 2026
Merged

UID2-7761: suppress CVE-2026-14456 in GCP/Azure private-operator images #2710

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f1e9690
UID2-7761: fix openssl CVE-2026-14456 in GCP/Azure private-operator D…
BehnamMozafari Aug 28, 2026
fc24f8b
UID2-7761: suppress CVE-2026-14456 instead of patching Dockerfiles
BehnamMozafari Aug 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,3 +29,14 @@ GHSA-r7wm-3cxj-wff9 exp:2026-09-27
# See: UID2-7662
CVE-2026-40984 exp:2026-11-11

# CVE-2026-14456 — libcrypto3/libssl3 (openssl, Alpine base image, transitive via
# eclipse-temurin:21-jre-alpine-3.23) (HIGH): DoS via unbounded memory growth in an OpenSSL
# QUIC server. Not exploitable: uid2-operator terminates TLS via JSSE over plain TCP and never
# runs an OpenSSL QUIC server. The bundled Amazon Corretto Crypto Provider (ACCP) only exposes
# JCA Cipher/Signature/MessageDigest/KeyAgreement via OpenSSL's EVP API — it never touches
# libssl's QUIC server implementation, so ACCP does not make this path reachable. Applies to the
# GCP OIDC and Azure CC private-operator images (scripts/gcp-oidc, scripts/azure-cc), which don't
# carry the apk upgrade applied to ./Dockerfile in #2708.
# See: UID2-7761
CVE-2026-14456 exp:2026-09-28