From d7a4fc29bc1ff7dc942a4c1e95e3c657c05b9667 Mon Sep 17 00:00:00 2001 From: Simon van Lierde Date: Sun, 1 Nov 2026 07:22:32 +0100 Subject: [PATCH] chore(security): renew the caddy Trivy waivers after a re-scan The waivers expired on 2026-11-01 and their re-check date had passed, which fails `just check-root` on every PR. - Re-scanned caddy:2-alpine: still Go 1.26.8 and x/net 0.59.0, and the pinned digest is the latest. Extend the three findings that still show to 2026-12-01. - Waive CVE-2026-116587 (go-jose JWK DoS): caddy here parses no JWKs, with the admin API off, no ACME and no JWT auth. - Drop 16 waivers for findings the scan no longer reports. Signed-off-by: Simon van Lierde --- .github/trivyignore.yaml | 99 ++++++---------------------------------- 1 file changed, 14 insertions(+), 85 deletions(-) diff --git a/.github/trivyignore.yaml b/.github/trivyignore.yaml index f60857143..40407e670 100644 --- a/.github/trivyignore.yaml +++ b/.github/trivyignore.yaml @@ -5,7 +5,7 @@ # `purls` (scripts/check_todo_dates.py): the file is shared by every image scan, and an # unscoped id would also hide the finding in the backup and postgres images. vulnerabilities: - # caddy:2-alpine is still built with Go 1.26.8 (checked 2026-10-27: the pinned digest is + # caddy:2-alpine is still built with Go 1.26.8 (checked 2026-11-01: the pinned digest is # the latest). This flaw is in x509 chain verification, which runs only when caddy acts # as a TLS client or server: the app image serves plain HTTP on :8081 behind the # tunnel, with no TLS, no reverse_proxy, no ACME and the admin API off. @@ -14,99 +14,28 @@ vulnerabilities: expired_at: 2026-12-01 statement: Go crypto/x509 intermediate-certificate MITM; caddy here never verifies a certificate chain. - # The caddy:2-alpine binary is built against Go 1.26.3; these need 1.26.4+, - # which upstream had not shipped when reviewed on 2026-07-13, nor when re-checked - # on 2026-10-02 (caddy v2.11.4, the pinned digest is still the latest). Re-check - # whenever the caddy:2-alpine digest is bumped. - - id: CVE-2026-27145 - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: Go stdlib DoS; fixed in Go 1.26.4, no caddy release built with it yet. - - id: CVE-2026-39822 - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: Go os.Root symlink traversal; caddy serves a fixed static /srv root, no user-controlled paths. - - id: CVE-2026-42504 - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: Go MIME header DoS; fixed in Go 1.26.4, no caddy release built with it yet. - - # The same caddy:2-alpine binary, re-scanned on 2026-09-01: still Go 1.26.3 with - # golang.org/x/net v0.55.0, x/text v0.37.0 and grpc v1.81.0, and upstream has - # published no release built against the fixed toolchain or deps. Every entry below - # is a DoS or parser flaw in a code path this image does not expose: caddy serves a - # fixed static /srv root behind the edge, with no DNS resolver, no gRPC/xDS, no - # templates, and no XML or ASN.1 decoding. Re-check when the digest is bumped. - - id: CVE-2026-33818 - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: Go encoding/asn1 recursion DoS; the static file server decodes no ASN.1. - - id: CVE-2026-39821 - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: x/net/idna Punycode label handling; no IDNA-based authorization decisions here. - - id: CVE-2026-46600 - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: x/net/dns/dnsmessage parser DoS; caddy runs no DNS resolver in this image. - - id: CVE-2026-56852 - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: x/text invalid-UTF-8 DoS; fixed in x/text 0.39.0, no caddy build carries it yet. - - id: CVE-2026-56853 - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: net/http cleartext HTTP/2 DoS; h2c is not enabled, TLS terminates at the edge. - - id: CVE-2026-56858 - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: html/template XSS via pathological input; caddy renders no templates here. - - id: CVE-2026-56859 - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: encoding/xml recursion DoS; the static file server decodes no XML. - - id: CVE-2026-56860 - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: net/url quadratic path parsing DoS; fixed in Go 1.26.6, no caddy release built with it yet. - - id: CVE-2026-56862 - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: crypto/tls KeyUpdate DoS; fixed in Go 1.26.6, no caddy release built with it yet. - - id: CVE-2026-56854 - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: x/crypto/ssh source-address bypass; caddy runs no SSH server, and the image exposes only HTTP. - - id: GHSA-hrxh-6v49-42gf - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: gRPC-Go xDS RBAC and HTTP/2 flaws; caddy serves no gRPC and loads no xDS config. - - id: CVE-2026-84304 - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: gRPC-Go HTTP/2 DATA-frame memory exhaustion; caddy runs no gRPC server in this image. - - id: CVE-2026-84445 - paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 - statement: gRPC-Go xDS server crash DoS; caddy serves no gRPC and loads no xDS config. - - # TODO(drop-by 2026-10-31): re-check the caddy digest for Go 1.26.9 / x/net 0.60.0, then drop these waivers or extend them - # The caddy:2-alpine binary re-scanned on 2026-10-13: Go 1.26.8 with golang.org/x/net - # v0.59.0. These need Go 1.26.9 or x/net 0.60.0, and caddy v2.11.7 (the latest - # release) does not carry them. Caddy receives plain HTTP/1.1 from the tunnel inside - # the Compose network: no TLS and no HTTP/2 reach it. Re-check when the digest is bumped. + # TODO(drop-by 2026-11-30): re-check the caddy digest for Go 1.26.9 / x/net 0.60.0 / go-jose 4.1.6, then drop these waivers or extend them + # The caddy:2-alpine binary re-scanned on 2026-11-01: Go 1.26.8, golang.org/x/net + # v0.59.0 and go-jose v4.1.5, and the pinned digest matches the latest. caddy v2.11.7 + # (the latest release) carries none of the fixes. Caddy receives plain HTTP/1.1 from + # the tunnel inside the Compose network: no TLS and no HTTP/2 reach it. Re-check when + # the digest is bumped. - id: CVE-2026-78667 paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 + expired_at: 2026-12-01 statement: net/http Range header DoS, reachable; file_server answers Range requests and the edge forwards them for the uncached paths (index.html, no-store files). The worst case is CPU load in the app container, which serves only static files; the API runs in its own container. Fixed in Go 1.26.9 (2026-10-08), no caddy release built with it yet. - id: CVE-2026-78669 paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 + expired_at: 2026-12-01 statement: HTTP/2 SETTINGS flood DoS in net/http and x/net; caddy is reached over HTTP/1.1 only. - id: CVE-2026-97031 paths: ["usr/bin/caddy"] - expired_at: 2026-11-01 + expired_at: 2026-12-01 statement: crypto/tls ECH extension DoS; caddy terminates no TLS, the edge does. + - id: CVE-2026-116587 + paths: ["usr/bin/caddy"] + expired_at: 2026-12-01 + statement: go-jose JWK RSA-parameter DoS; caddy parses no JWKs here, with the admin API off, a bare :8081 site (no ACME) and no JWT auth. misconfigurations: [] secrets: []