Skip to content

Commit 44d9e78

Browse files
LouisLotterLouisLotter
authored
STAC-25318 VEX containerd v2 false positives (#26)
1 parent a2844a7 commit 44d9e78

4 files changed

Lines changed: 331 additions & 6 deletions

File tree

‎CONTRIBUTING.md‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,9 +76,12 @@ package across our portfolio.
7676
`subcomponents`. Because OCI PURLs are registry-coupled, list one
7777
product entry per distribution registry — typically both
7878
`quay.io/stackstate/<image>` and the Rancher-registry copy
79-
`registry.rancher.com/suse-observability/<image>`. The
80-
`repository_url` value must be percent-encoded (every `/` as `%2F`)
81-
per the PURL spec; `build_index.py` rejects unencoded values.
79+
`registry.rancher.com/suse-observability/<image>`. Also list the bare
80+
`pkg:oci/<image>` product with the same subcomponent: Grype generates
81+
a bare image PURL and needs that entry to match the statement. For
82+
readability, `repository_url` values may contain literal `/`
83+
characters; `build_index.py` canonicalizes them to percent-encoded
84+
values in `index.json` for Trivy's repository lookup.
8285

8386
### Steps
8487

‎index.json‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"updated_at": "2026-07-20T07:28:21Z",
2+
"updated_at": "2026-07-21T11:26:34Z",
33
"packages": [
44
{
55
"id": "pkg:maven/org.eclipse.jetty/jetty-http",
@@ -186,6 +186,31 @@
186186
"location": "pkg/oci/stackstate-k8s-agent/scan.openvex.json",
187187
"format": "openvex"
188188
},
189+
{
190+
"id": "pkg:oci/stackstate-k8s-agent?repository_url=registry.suse.com%2Fsuse-observability%2Fstackstate-k8s-agent",
191+
"location": "pkg/oci/stackstate-k8s-agent/scan.openvex.json",
192+
"format": "openvex"
193+
},
194+
{
195+
"id": "pkg:oci/stackstate-k8s-process-agent",
196+
"location": "pkg/oci/stackstate-k8s-process-agent/scan.openvex.json",
197+
"format": "openvex"
198+
},
199+
{
200+
"id": "pkg:oci/stackstate-k8s-process-agent?repository_url=quay.io%2Fstackstate%2Fstackstate-k8s-process-agent",
201+
"location": "pkg/oci/stackstate-k8s-process-agent/scan.openvex.json",
202+
"format": "openvex"
203+
},
204+
{
205+
"id": "pkg:oci/stackstate-k8s-process-agent?repository_url=registry.rancher.com%2Fsuse-observability%2Fstackstate-k8s-process-agent",
206+
"location": "pkg/oci/stackstate-k8s-process-agent/scan.openvex.json",
207+
"format": "openvex"
208+
},
209+
{
210+
"id": "pkg:oci/stackstate-k8s-process-agent?repository_url=registry.suse.com%2Fsuse-observability%2Fstackstate-k8s-process-agent",
211+
"location": "pkg/oci/stackstate-k8s-process-agent/scan.openvex.json",
212+
"format": "openvex"
213+
},
189214
{
190215
"id": "pkg:oci/stackstate-kafka-to-es",
191216
"location": "pkg/oci/sts-toolbox/scan.openvex.json",

‎pkg/oci/stackstate-k8s-agent/scan.openvex.json‎

Lines changed: 146 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"@context": "https://openvex.dev/ns/v0.2.0",
33
"@id": "https://github.com/StackVista/vexhub/pkg/oci/stackstate-k8s-agent/CVE-2026-6100",
44
"author": "SUSE Observability Security Team",
5-
"version": 1,
5+
"version": 2,
66
"statements": [
77
{
88
"vulnerability": {
@@ -825,7 +825,151 @@
825825
"impact_statement": "CVE-2026-4360 affects tarfile.extract() handling of hardlinks. The sole shipped runtime extraction path iterates archive members, accepts only a member for which TarInfo.isfile() is true, renames the selected regular file to the fixed basename bpftool, and extracts only that member. Tar hardlinks have LNKTYPE and do not satisfy isfile(), so the vulnerable hardlink branch cannot be reached. Other repository extraction calls are build or test tooling and are not part of the agent runtime image.",
826826
"action_statement": "Upgrade the embedded CPython runtime when a compatible 3.13.x patch release fixes CVE-2026-4360, then retire this statement. Re-review if shipped agent code adds another tar extraction path or permits hardlink members.",
827827
"timestamp": "2026-07-20T07:19:56Z"
828+
},
829+
{
830+
"vulnerability": {
831+
"name": "CVE-2026-50195",
832+
"aliases": [
833+
"GHSA-cvxm-645q-p574"
834+
]
835+
},
836+
"products": [
837+
{
838+
"@id": "pkg:oci/stackstate-k8s-agent?repository_url=quay.io/stackstate/stackstate-k8s-agent",
839+
"subcomponents": [
840+
{
841+
"@id": "pkg:golang/github.com/containerd/[email protected]"
842+
}
843+
]
844+
},
845+
{
846+
"@id": "pkg:oci/stackstate-k8s-agent?repository_url=registry.rancher.com/suse-observability/stackstate-k8s-agent",
847+
"subcomponents": [
848+
{
849+
"@id": "pkg:golang/github.com/containerd/[email protected]"
850+
}
851+
]
852+
},
853+
{
854+
"@id": "pkg:oci/stackstate-k8s-agent?repository_url=registry.suse.com/suse-observability/stackstate-k8s-agent",
855+
"subcomponents": [
856+
{
857+
"@id": "pkg:golang/github.com/containerd/[email protected]"
858+
}
859+
]
860+
},
861+
{
862+
"@id": "pkg:oci/stackstate-k8s-agent",
863+
"subcomponents": [
864+
{
865+
"@id": "pkg:golang/github.com/containerd/[email protected]"
866+
}
867+
]
868+
}
869+
],
870+
"status": "not_affected",
871+
"status_notes": "Reviewed quay.io/stackstate/stackstate-k8s-agent:3ce0270e and source commit 3ce0270ebe on 2026-07-21. Grype 0.112.0 reports the advisory against github.com/containerd/containerd v1.7.33 in /opt/stackstate-agent/bin/agent/agent, but the upstream affected package is the distinct github.com/containerd/containerd/v2 module.",
872+
"justification": "vulnerable_code_not_present",
873+
"impact_statement": "CVE-2026-50195 affects only github.com/containerd/containerd/v2 versions in the 2.1, 2.2, and 2.3 release lines. The agent binary links github.com/containerd/containerd v1.7.33, whose Go module path does not contain the /v2 major-version suffix. Go major versions two and later use distinct module paths, and the affected /v2 component is not linked into this binary. The Grype finding results from matching the /v2 advisory to the major-v1 module after module-path normalization.",
874+
"action_statement": "Retire this statement when scanner matching no longer maps github.com/containerd/containerd/v2 advisories to the major-v1 module. Re-review if the agent starts linking github.com/containerd/containerd/v2 in an affected release line.",
875+
"timestamp": "2026-07-21T11:16:37Z"
876+
},
877+
{
878+
"vulnerability": {
879+
"name": "CVE-2026-53492",
880+
"aliases": [
881+
"GHSA-33vj-92qq-66hc"
882+
]
883+
},
884+
"products": [
885+
{
886+
"@id": "pkg:oci/stackstate-k8s-agent?repository_url=quay.io/stackstate/stackstate-k8s-agent",
887+
"subcomponents": [
888+
{
889+
"@id": "pkg:golang/github.com/containerd/[email protected]"
890+
}
891+
]
892+
},
893+
{
894+
"@id": "pkg:oci/stackstate-k8s-agent?repository_url=registry.rancher.com/suse-observability/stackstate-k8s-agent",
895+
"subcomponents": [
896+
{
897+
"@id": "pkg:golang/github.com/containerd/[email protected]"
898+
}
899+
]
900+
},
901+
{
902+
"@id": "pkg:oci/stackstate-k8s-agent?repository_url=registry.suse.com/suse-observability/stackstate-k8s-agent",
903+
"subcomponents": [
904+
{
905+
"@id": "pkg:golang/github.com/containerd/[email protected]"
906+
}
907+
]
908+
},
909+
{
910+
"@id": "pkg:oci/stackstate-k8s-agent",
911+
"subcomponents": [
912+
{
913+
"@id": "pkg:golang/github.com/containerd/[email protected]"
914+
}
915+
]
916+
}
917+
],
918+
"status": "not_affected",
919+
"status_notes": "Reviewed quay.io/stackstate/stackstate-k8s-agent:3ce0270e and source commit 3ce0270ebe on 2026-07-21. Grype 0.112.0 reports the advisory against github.com/containerd/containerd v1.7.33 in /opt/stackstate-agent/bin/agent/agent, but the upstream affected package is the distinct github.com/containerd/containerd/v2 module.",
920+
"justification": "vulnerable_code_not_present",
921+
"impact_statement": "CVE-2026-53492 affects only github.com/containerd/containerd/v2 versions in the 2.1, 2.2, and 2.3 release lines. The agent binary links github.com/containerd/containerd v1.7.33, whose Go module path does not contain the /v2 major-version suffix. Go major versions two and later use distinct module paths, and the affected /v2 component is not linked into this binary. The Grype finding results from matching the /v2 advisory to the major-v1 module after module-path normalization.",
922+
"action_statement": "Retire this statement when scanner matching no longer maps github.com/containerd/containerd/v2 advisories to the major-v1 module. Re-review if the agent starts linking github.com/containerd/containerd/v2 in an affected release line.",
923+
"timestamp": "2026-07-21T11:16:37Z"
924+
},
925+
{
926+
"vulnerability": {
927+
"name": "CVE-2026-53489",
928+
"aliases": [
929+
"GHSA-rgh6-rfwx-v388"
930+
]
931+
},
932+
"products": [
933+
{
934+
"@id": "pkg:oci/stackstate-k8s-agent?repository_url=quay.io/stackstate/stackstate-k8s-agent",
935+
"subcomponents": [
936+
{
937+
"@id": "pkg:golang/github.com/containerd/[email protected]"
938+
}
939+
]
940+
},
941+
{
942+
"@id": "pkg:oci/stackstate-k8s-agent?repository_url=registry.rancher.com/suse-observability/stackstate-k8s-agent",
943+
"subcomponents": [
944+
{
945+
"@id": "pkg:golang/github.com/containerd/[email protected]"
946+
}
947+
]
948+
},
949+
{
950+
"@id": "pkg:oci/stackstate-k8s-agent?repository_url=registry.suse.com/suse-observability/stackstate-k8s-agent",
951+
"subcomponents": [
952+
{
953+
"@id": "pkg:golang/github.com/containerd/[email protected]"
954+
}
955+
]
956+
},
957+
{
958+
"@id": "pkg:oci/stackstate-k8s-agent",
959+
"subcomponents": [
960+
{
961+
"@id": "pkg:golang/github.com/containerd/[email protected]"
962+
}
963+
]
964+
}
965+
],
966+
"status": "not_affected",
967+
"status_notes": "Reviewed quay.io/stackstate/stackstate-k8s-agent:3ce0270e and source commit 3ce0270ebe on 2026-07-21. Grype 0.112.0 reports the advisory against github.com/containerd/containerd v1.7.33 in /opt/stackstate-agent/bin/agent/agent, but the upstream affected package is the distinct github.com/containerd/containerd/v2 module.",
968+
"justification": "vulnerable_code_not_present",
969+
"impact_statement": "CVE-2026-53489 affects only github.com/containerd/containerd/v2 versions in the 2.1, 2.2, and 2.3 release lines. The agent binary links github.com/containerd/containerd v1.7.33, whose Go module path does not contain the /v2 major-version suffix. Go major versions two and later use distinct module paths, and the affected /v2 component is not linked into this binary. The Grype finding results from matching the /v2 advisory to the major-v1 module after module-path normalization.",
970+
"action_statement": "Retire this statement when scanner matching no longer maps github.com/containerd/containerd/v2 advisories to the major-v1 module. Re-review if the agent starts linking github.com/containerd/containerd/v2 in an affected release line.",
971+
"timestamp": "2026-07-21T11:16:37Z"
828972
}
829973
],
830-
"timestamp": "2026-07-20T07:19:56Z"
974+
"timestamp": "2026-07-21T11:16:37Z"
831975
}

‎pkg/oci/stackstate-k8s-process-agent/scan.openvex.json‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
{
2+
"@context": "https://openvex.dev/ns/v0.2.0",
3+
"@id": "https://github.com/StackVista/vexhub/pkg/oci/stackstate-k8s-process-agent/CVE-2026-50195",
4+
"author": "SUSE Observability Security Team",
5+
"version": 1,
6+
"statements": [
7+
{
8+
"vulnerability": {
9+
"name": "CVE-2026-50195",
10+
"aliases": [
11+
"GHSA-cvxm-645q-p574"
12+
]
13+
},
14+
"products": [
15+
{
16+
"@id": "pkg:oci/stackstate-k8s-process-agent?repository_url=quay.io/stackstate/stackstate-k8s-process-agent",
17+
"subcomponents": [
18+
{
19+
"@id": "pkg:golang/github.com/containerd/[email protected]"
20+
}
21+
]
22+
},
23+
{
24+
"@id": "pkg:oci/stackstate-k8s-process-agent?repository_url=registry.rancher.com/suse-observability/stackstate-k8s-process-agent",
25+
"subcomponents": [
26+
{
27+
"@id": "pkg:golang/github.com/containerd/[email protected]"
28+
}
29+
]
30+
},
31+
{
32+
"@id": "pkg:oci/stackstate-k8s-process-agent?repository_url=registry.suse.com/suse-observability/stackstate-k8s-process-agent",
33+
"subcomponents": [
34+
{
35+
"@id": "pkg:golang/github.com/containerd/[email protected]"
36+
}
37+
]
38+
},
39+
{
40+
"@id": "pkg:oci/stackstate-k8s-process-agent",
41+
"subcomponents": [
42+
{
43+
"@id": "pkg:golang/github.com/containerd/[email protected]"
44+
}
45+
]
46+
}
47+
],
48+
"status": "not_affected",
49+
"status_notes": "Reviewed quay.io/stackstate/stackstate-k8s-process-agent:c570527c on 2026-07-21. Grype 0.112.0 reports the advisory against github.com/containerd/containerd v1.7.33 in /opt/stackstate-agent/bin/agent/process-agent, but the upstream affected package is the distinct github.com/containerd/containerd/v2 module.",
50+
"justification": "vulnerable_code_not_present",
51+
"impact_statement": "CVE-2026-50195 affects only github.com/containerd/containerd/v2 versions in the 2.1, 2.2, and 2.3 release lines. The process-agent binary links github.com/containerd/containerd v1.7.33, whose Go module path does not contain the /v2 major-version suffix. Go major versions two and later use distinct module paths, and the affected /v2 component is not linked into this binary. The Grype finding results from matching the /v2 advisory to the major-v1 module after module-path normalization.",
52+
"action_statement": "Retire this statement when scanner matching no longer maps github.com/containerd/containerd/v2 advisories to the major-v1 module. Re-review if process-agent starts linking github.com/containerd/containerd/v2 in an affected release line.",
53+
"timestamp": "2026-07-21T11:16:37Z"
54+
},
55+
{
56+
"vulnerability": {
57+
"name": "CVE-2026-53492",
58+
"aliases": [
59+
"GHSA-33vj-92qq-66hc"
60+
]
61+
},
62+
"products": [
63+
{
64+
"@id": "pkg:oci/stackstate-k8s-process-agent?repository_url=quay.io/stackstate/stackstate-k8s-process-agent",
65+
"subcomponents": [
66+
{
67+
"@id": "pkg:golang/github.com/containerd/[email protected]"
68+
}
69+
]
70+
},
71+
{
72+
"@id": "pkg:oci/stackstate-k8s-process-agent?repository_url=registry.rancher.com/suse-observability/stackstate-k8s-process-agent",
73+
"subcomponents": [
74+
{
75+
"@id": "pkg:golang/github.com/containerd/[email protected]"
76+
}
77+
]
78+
},
79+
{
80+
"@id": "pkg:oci/stackstate-k8s-process-agent?repository_url=registry.suse.com/suse-observability/stackstate-k8s-process-agent",
81+
"subcomponents": [
82+
{
83+
"@id": "pkg:golang/github.com/containerd/[email protected]"
84+
}
85+
]
86+
},
87+
{
88+
"@id": "pkg:oci/stackstate-k8s-process-agent",
89+
"subcomponents": [
90+
{
91+
"@id": "pkg:golang/github.com/containerd/[email protected]"
92+
}
93+
]
94+
}
95+
],
96+
"status": "not_affected",
97+
"status_notes": "Reviewed quay.io/stackstate/stackstate-k8s-process-agent:c570527c on 2026-07-21. Grype 0.112.0 reports the advisory against github.com/containerd/containerd v1.7.33 in /opt/stackstate-agent/bin/agent/process-agent, but the upstream affected package is the distinct github.com/containerd/containerd/v2 module.",
98+
"justification": "vulnerable_code_not_present",
99+
"impact_statement": "CVE-2026-53492 affects only github.com/containerd/containerd/v2 versions in the 2.1, 2.2, and 2.3 release lines. The process-agent binary links github.com/containerd/containerd v1.7.33, whose Go module path does not contain the /v2 major-version suffix. Go major versions two and later use distinct module paths, and the affected /v2 component is not linked into this binary. The Grype finding results from matching the /v2 advisory to the major-v1 module after module-path normalization.",
100+
"action_statement": "Retire this statement when scanner matching no longer maps github.com/containerd/containerd/v2 advisories to the major-v1 module. Re-review if process-agent starts linking github.com/containerd/containerd/v2 in an affected release line.",
101+
"timestamp": "2026-07-21T11:16:37Z"
102+
},
103+
{
104+
"vulnerability": {
105+
"name": "CVE-2026-53489",
106+
"aliases": [
107+
"GHSA-rgh6-rfwx-v388"
108+
]
109+
},
110+
"products": [
111+
{
112+
"@id": "pkg:oci/stackstate-k8s-process-agent?repository_url=quay.io/stackstate/stackstate-k8s-process-agent",
113+
"subcomponents": [
114+
{
115+
"@id": "pkg:golang/github.com/containerd/[email protected]"
116+
}
117+
]
118+
},
119+
{
120+
"@id": "pkg:oci/stackstate-k8s-process-agent?repository_url=registry.rancher.com/suse-observability/stackstate-k8s-process-agent",
121+
"subcomponents": [
122+
{
123+
"@id": "pkg:golang/github.com/containerd/[email protected]"
124+
}
125+
]
126+
},
127+
{
128+
"@id": "pkg:oci/stackstate-k8s-process-agent?repository_url=registry.suse.com/suse-observability/stackstate-k8s-process-agent",
129+
"subcomponents": [
130+
{
131+
"@id": "pkg:golang/github.com/containerd/[email protected]"
132+
}
133+
]
134+
},
135+
{
136+
"@id": "pkg:oci/stackstate-k8s-process-agent",
137+
"subcomponents": [
138+
{
139+
"@id": "pkg:golang/github.com/containerd/[email protected]"
140+
}
141+
]
142+
}
143+
],
144+
"status": "not_affected",
145+
"status_notes": "Reviewed quay.io/stackstate/stackstate-k8s-process-agent:c570527c on 2026-07-21. Grype 0.112.0 reports the advisory against github.com/containerd/containerd v1.7.33 in /opt/stackstate-agent/bin/agent/process-agent, but the upstream affected package is the distinct github.com/containerd/containerd/v2 module.",
146+
"justification": "vulnerable_code_not_present",
147+
"impact_statement": "CVE-2026-53489 affects only github.com/containerd/containerd/v2 versions in the 2.1, 2.2, and 2.3 release lines. The process-agent binary links github.com/containerd/containerd v1.7.33, whose Go module path does not contain the /v2 major-version suffix. Go major versions two and later use distinct module paths, and the affected /v2 component is not linked into this binary. The Grype finding results from matching the /v2 advisory to the major-v1 module after module-path normalization.",
148+
"action_statement": "Retire this statement when scanner matching no longer maps github.com/containerd/containerd/v2 advisories to the major-v1 module. Re-review if process-agent starts linking github.com/containerd/containerd/v2 in an affected release line.",
149+
"timestamp": "2026-07-21T11:16:37Z"
150+
}
151+
],
152+
"timestamp": "2026-07-21T11:16:37Z"
153+
}

0 commit comments

Comments
 (0)