STAC-25158 VEX agent Python CVEs

[LouisLotter]

Summary

Adds OpenVEX statements for the three non-VEXed CPython findings reported by the dev chart scan for quay.io/stackstate/stackstate-k8s-agent:cef227ab:

• CVE-2026-0864 — CPython configparser write injection via carriage returns
• CVE-2026-11940 — CPython tarfile hardlink/symlink extraction filter bypass
• CVE-2026-11972 — CPython tarfile streaming mode EOF parsing DoS

Parent scan/ticket context: STAC-25158

Evidence

The failed cve-reporter run reported all three as Grype-only findings against:

• image: quay.io/stackstate/stackstate-k8s-agent:cef227ab
• package: pkg:generic/[email protected]
• paths: /opt/stackstate-agent/embedded/bin/python3.13, /opt/stackstate-agent/embedded/lib/libpython3.13.so.1.0

Source/runtime review of stackstate-agent commit cef227ab38d4fc248f608955c4a3556abd417342:

• omnibus/config/software/python3.rb embeds CPython 3.13.13.
• The runtime image extracts the packaged agent payload and exposes DogStatsD 8125/udp plus trace-agent 8126/tcp; neither path accepts tar archives or configparser data.
• The shipped Python surface under cmd/agent/dist/checks, Dockerfiles/agent/secrets-helper/readsecret.py, and omnibus/python-scripts does not import tarfile or configparser.
• ConfigParser hits are limited to legacy tests under pkg/config/legacy/tests/config.py.
• tarfile / archive extraction hits are developer/test tooling, not the supported Kubernetes agent runtime.

Validation

• python3 -m json.tool pkg/oci/stackstate-k8s-agent/scan.openvex.json
• python3 tools/build_index.py
• python3 tools/build_index.py --check
• git diff --check
• Focused Grype verification with the local VEX file:
  • grype registry:quay.io/stackstate/stackstate-k8s-agent:cef227ab --vex pkg/oci/stackstate-k8s-agent/scan.openvex.json --by-cve -o json
  • Result: 0 active matches; the three Python CVEs are present only in ignoredMatches with VEX not_affected.