mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-08-19 09:30:21 +00:00
59 lines
3.4 KiB
Plaintext
59 lines
3.4 KiB
Plaintext
# Trivy ignore file for the prowlercloud/prowler SDK and API container images.
|
|
# Each entry below documents (a) the affected package and why it ships in the
|
|
# image, (b) why the CVE is not exploitable in Prowler's runtime, and (c) the
|
|
# upstream fix status. Entries carry an expiry so they auto-force re-review.
|
|
# The `pkg:` selector on each line is documentation only. Trivy's classic
|
|
# .trivyignore format parses the CVE ID and ignores the rest, so each entry
|
|
# suppresses its CVE across every package in the image, not just the one named.
|
|
# Verified against Trivy 0.65.0: an entry written `pkg:zlib1g` still suppressed
|
|
# the finding on perl-base. Real per-package scoping needs .trivyignore.yaml
|
|
# with purls — tracked in PROWLER-2327.
|
|
# `exp:` IS honoured: an entry dated in the past correctly lapses.
|
|
#
|
|
# Keep expiries staggered, and only suppress packages the images actually install.
|
|
#
|
|
# Scanned by: .github/actions/trivy-scan via .github/workflows/sdk-container-checks.yml
|
|
# and .github/workflows/api-container-checks.yml
|
|
|
|
# perl-base is Debian "Essential: yes". Trivy spreads src:perl CVEs across every
|
|
# binary package, so perl-base gets flagged for modules only perl-modules-5.40 ships.
|
|
# Neither image installs perl-modules-5.40, and nothing in either invokes perl.
|
|
#
|
|
# Why these four cannot be fixed rather than accepted (reviewed 2026-07-31):
|
|
#
|
|
# 1. No fix exists. All four report no fixed version on perl-base 5.40.1-6.
|
|
# Debian's tracker marks CVE-2026-42496 "fix_deferred" and the other three
|
|
# "affected". Updating the base image, apt upgrade, or moving to a newer
|
|
# Debian release changes nothing, because Debian has not shipped a fix.
|
|
# 2. The package cannot be removed. "Essential: yes" means removal needs
|
|
# dpkg --force-remove-essential, which also breaks apt for anything built
|
|
# downstream from these images.
|
|
# 3. Changing base distribution was evaluated and rejected. Alpine removes
|
|
# perl entirely, but PowerShell publishes no linux-musl-arm64 build in any
|
|
# release, so M365 scanning would break on arm64 — which is what we run in
|
|
# production. Wolfi keeps glibc and drops perl, but pinnable versioned tags
|
|
# are a paid tier, so builds would not be reproducibly pinnable.
|
|
#
|
|
# Not-invoked claim verified by sweeping both images for: files with a perl
|
|
# shebang, shell/python callers of perl, ELF binaries containing "perl", and
|
|
# .pl/.pm files or perl subprocess calls anywhere in site-packages. The only
|
|
# consumers found are dpkg/debconf/adduser/pam tooling, none of which runs at
|
|
# runtime, plus one build-time script inside the ExchangeOnlineManagement
|
|
# PowerShell module that is never invoked (it generates that module's manifest,
|
|
# and lives in its netFramework/ path, while Linux loads netCore/).
|
|
|
|
# Archive::Tar path traversal. Not installed: `perl -MArchive::Tar -e1` cannot locate it.
|
|
CVE-2026-42496 pkg:perl-base exp:2027-01-31
|
|
|
|
# Storable integer overflow. Not installed: `perl -MStorable -e1` cannot locate it.
|
|
CVE-2026-57433 pkg:perl-base exp:2027-01-31
|
|
|
|
# Regex heap overflow on 32-bit builds only; both published arches are 64-bit.
|
|
CVE-2026-8376 pkg:perl-base exp:2027-01-31
|
|
|
|
# Regex trie bug giving silently wrong matches above 65535 alternation branches. Now on
|
|
# perl 5.40.1, which is in range (the 5.36-predates-it argument no longer applies), so this
|
|
# rests on nothing invoking perl. Short expiry to force a re-look.
|
|
# Ref: https://github.com/Perl/perl5/issues/23388
|
|
CVE-2026-13221 pkg:perl-base exp:2026-11-30
|