prowler/.trivyignore.yaml

# Trivy suppressions for the prowlercloud/prowler SDK and API container images.
#
# This file replaces the classic .trivyignore, which parsed only the CVE id: the
# `pkg:` selector written on each line was documentation and the entry suppressed
# its CVE across every package in the image. The `purls` field below is honoured,
# so each entry is scoped to the package it names. Verified against Trivy 0.71.2:
# an entry given the wrong purl leaves the finding reported, where the classic
# format suppressed it.
#
# `expired_at` forces re-review. Keep the dates staggered.
#
# The four entries below are currently redundant: the scan runs with ignore-unfixed,
# and none of them has a published fix, so they never reach the gate either way. They
# are kept because the reasoning is what justifies accepting them, and because they
# apply again the moment any of them gains a fix we do not take.
#
# perl-base is Debian "Essential: yes". Trivy spreads src:perl CVEs across every
# binary package built from that source, so perl-base is flagged for modules only
# perl-modules-* ships. Neither image installs those, and nothing in either
# invokes perl.
#
# Why these four are accepted rather than fixed (reviewed 2026-07-31):
#
#   1. No fix exists. All four report no fixed version on perl-base 5.40.1-6.
#      Debian marks CVE-2026-42496 "fix_deferred" and the other three "affected".
#      A newer base image, apt upgrade, or a newer Debian release changes nothing.
#   2. The package cannot be removed. "Essential: yes" means removal needs
#      dpkg --force-remove-essential, which breaks apt for anything built
#      downstream from these images.
#   3. Changing base distribution was evaluated and rejected. Alpine drops perl
#      entirely, but PowerShell publishes no linux-musl-arm64 build in any
#      release, so M365 scanning would break on arm64 -- which is what we run in
#      production. Wolfi keeps glibc and drops perl, but pinnable versioned tags
#      are a paid tier, so builds would not be reproducibly pinnable.
#
# Not-invoked claim verified by sweeping both images for files with a perl
# shebang, shell/python callers of perl, ELF binaries containing "perl", and
# .pl/.pm files or perl subprocess calls anywhere in site-packages. The only
# consumers found are dpkg/debconf/adduser/pam tooling, none of which runs at
# runtime, plus one build-time script inside the ExchangeOnlineManagement
# PowerShell module that is never invoked.

vulnerabilities:
  # Archive::Tar path traversal. Not installed: `perl -MArchive::Tar -e1` cannot locate it.
  - id: CVE-2026-42496
    purls:
      - "pkg:deb/debian/perl-base"
    expired_at: 2027-01-31

  # Storable integer overflow. Not installed: `perl -MStorable -e1` cannot locate it.
  - id: CVE-2026-57433
    purls:
      - "pkg:deb/debian/perl-base"
    expired_at: 2027-01-31

  # Regex heap overflow on 32-bit builds only; both published arches are 64-bit.
  - id: CVE-2026-8376
    purls:
      - "pkg:deb/debian/perl-base"
    expired_at: 2027-01-31

  # Regex trie bug giving silently wrong matches above 65535 alternation branches.
  # perl 5.40.1 is in range, so this rests on nothing invoking perl. Short expiry
  # to force a re-look. Ref: https://github.com/Perl/perl5/issues/23388
  - id: CVE-2026-13221
    purls:
      - "pkg:deb/debian/perl-base"
    expired_at: 2026-11-30

  # Declared in the SPDX manifest that ships inside PowerShell's MicrosoftTeams module
  # (Modules/MicrosoftTeams/7.9.0/_manifest/spdx_2.2/manifest.spdx.json). Trivy reads that
  # SBOM and reports what it declares, which is not the same as what the image contains:
  # there is no Node runtime and no node_modules anywhere in the image, and the .NET
  # assemblies target net472, a Windows-only framework. Nothing here is reachable, and none
  # of it is a dependency we declare -- only Microsoft can change the module's contents.
  - id: CVE-2020-0606
    purls:
      - "pkg:nuget/Microsoft.WindowsDesktop.App.Ref"
    expired_at: 2027-01-31
  - id: CVE-2019-0820
    purls:
      - "pkg:nuget/System.Text.RegularExpressions"
    expired_at: 2027-01-31
  - id: CVE-2026-47302
    purls:
      - "pkg:nuget/System.Security.Cryptography.Xml"
    expired_at: 2027-01-31
  - id: CVE-2026-47304
    purls:
      - "pkg:nuget/System.Security.Cryptography.Xml"
    expired_at: 2027-01-31
  - id: CVE-2026-50525
    purls:
      - "pkg:nuget/System.Security.Cryptography.Xml"
    expired_at: 2027-01-31
  - id: CVE-2026-50527
    purls:
      - "pkg:nuget/System.Security.Cryptography.Xml"
    expired_at: 2027-01-31
  - id: CVE-2026-50648
    purls:
      - "pkg:nuget/System.Security.Cryptography.Xml"
    expired_at: 2027-01-31
  - id: CVE-2026-13676
    purls:
      - "pkg:npm/fast-uri"
    expired_at: 2027-01-31
  - id: CVE-2026-16221
    purls:
      - "pkg:npm/fast-uri"
    expired_at: 2027-01-31
  - id: CVE-2026-18446
    purls:
      - "pkg:npm/fast-uri"
    expired_at: 2027-01-31
  - id: CVE-2026-69192
    purls:
      - "pkg:npm/ip-address"
    expired_at: 2027-01-31

  # Modules compiled into the Trivy binary the images ship. The binary is pinned by version
  # and verified by checksum in the Dockerfile; only a rebuild by its vendor moves these.
  # CVE-2026-71556 affects go-git worktree operations that can follow symlinks outside a
  # cloned repository. Trivy 0.72.0 contains go-git 5.19.1, and even the latest published
  # Trivy release, 0.73.0, still pins that vulnerable version:
  # https://github.com/aquasecurity/trivy/blob/v0.73.0/go.mod#L46
  # Trivy main already contains the 5.19.2 fix, but no published release includes it yet:
  # https://github.com/aquasecurity/trivy/commit/a2edba9a03987ba0d2ebc8212c1a9a1e6979497b
  # Prowler invokes Trivy only with `fs` on an existing local path or with `image`; it does
  # not ask Trivy to clone or mutate a Git worktree, so the affected path is not reachable.
  # Remove this temporary suppression as soon as a fixed Trivy release is available.
  - id: CVE-2026-71556
    purls:
      - "pkg:golang/github.com/go-git/go-git/v5"
    expired_at: 2026-09-15

  - id: CVE-2026-56852
    purls:
      - "pkg:golang/golang.org/x/text"
    expired_at: 2026-12-31
  - id: GHSA-hrxh-6v49-42gf
    purls:
      - "pkg:golang/google.golang.org/grpc"
    expired_at: 2026-12-31
  - id: CVE-2026-50151
    purls:
      - "pkg:golang/oras.land/oras-go/v2"
    expired_at: 2026-12-31
  - id: CVE-2026-50163
    purls:
      - "pkg:golang/oras.land/oras-go/v2"
    expired_at: 2026-12-31
  - id: CVE-2026-39822
    purls:
      - "pkg:golang/stdlib"
    expired_at: 2026-12-31