Skip to content

chore(security): renew the caddy Trivy waivers after a re-scan #500

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
simonvanlierde merged 1 commit into from
Nov 1, 2026
Merged

chore(security): renew the caddy Trivy waivers after a re-scan #500

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
99 changes: 14 additions & 85 deletions .github/trivyignore.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
# `purls` (scripts/check_todo_dates.py): the file is shared by every image scan, and an
# unscoped id would also hide the finding in the backup and postgres images.
vulnerabilities:
# caddy:2-alpine is still built with Go 1.26.8 (checked 2026-10-27: the pinned digest is
# caddy:2-alpine is still built with Go 1.26.8 (checked 2026-11-01: the pinned digest is
# the latest). This flaw is in x509 chain verification, which runs only when caddy acts
# as a TLS client or server: the app image serves plain HTTP on :8081 behind the
# tunnel, with no TLS, no reverse_proxy, no ACME and the admin API off.
Expand All @@ -14,99 +14,28 @@ vulnerabilities:
expired_at: 2026-12-01
statement: Go crypto/x509 intermediate-certificate MITM; caddy here never verifies a certificate chain.

# The caddy:2-alpine binary is built against Go 1.26.3; these need 1.26.4+,
# which upstream had not shipped when reviewed on 2026-07-13, nor when re-checked
# on 2026-10-02 (caddy v2.11.4, the pinned digest is still the latest). Re-check
# whenever the caddy:2-alpine digest is bumped.
- id: CVE-2026-27145
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: Go stdlib DoS; fixed in Go 1.26.4, no caddy release built with it yet.
- id: CVE-2026-39822
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: Go os.Root symlink traversal; caddy serves a fixed static /srv root, no user-controlled paths.
- id: CVE-2026-42504
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: Go MIME header DoS; fixed in Go 1.26.4, no caddy release built with it yet.

# The same caddy:2-alpine binary, re-scanned on 2026-09-01: still Go 1.26.3 with
# golang.org/x/net v0.55.0, x/text v0.37.0 and grpc v1.81.0, and upstream has
# published no release built against the fixed toolchain or deps. Every entry below
# is a DoS or parser flaw in a code path this image does not expose: caddy serves a
# fixed static /srv root behind the edge, with no DNS resolver, no gRPC/xDS, no
# templates, and no XML or ASN.1 decoding. Re-check when the digest is bumped.
- id: CVE-2026-33818
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: Go encoding/asn1 recursion DoS; the static file server decodes no ASN.1.
- id: CVE-2026-39821
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: x/net/idna Punycode label handling; no IDNA-based authorization decisions here.
- id: CVE-2026-46600
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: x/net/dns/dnsmessage parser DoS; caddy runs no DNS resolver in this image.
- id: CVE-2026-56852
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: x/text invalid-UTF-8 DoS; fixed in x/text 0.39.0, no caddy build carries it yet.
- id: CVE-2026-56853
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: net/http cleartext HTTP/2 DoS; h2c is not enabled, TLS terminates at the edge.
- id: CVE-2026-56858
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: html/template XSS via pathological input; caddy renders no templates here.
- id: CVE-2026-56859
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: encoding/xml recursion DoS; the static file server decodes no XML.
- id: CVE-2026-56860
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: net/url quadratic path parsing DoS; fixed in Go 1.26.6, no caddy release built with it yet.
- id: CVE-2026-56862
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: crypto/tls KeyUpdate DoS; fixed in Go 1.26.6, no caddy release built with it yet.
- id: CVE-2026-56854
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: x/crypto/ssh source-address bypass; caddy runs no SSH server, and the image exposes only HTTP.
- id: GHSA-hrxh-6v49-42gf
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: gRPC-Go xDS RBAC and HTTP/2 flaws; caddy serves no gRPC and loads no xDS config.
- id: CVE-2026-84304
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: gRPC-Go HTTP/2 DATA-frame memory exhaustion; caddy runs no gRPC server in this image.
- id: CVE-2026-84445
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
statement: gRPC-Go xDS server crash DoS; caddy serves no gRPC and loads no xDS config.

# TODO(drop-by 2026-10-31): re-check the caddy digest for Go 1.26.9 / x/net 0.60.0, then drop these waivers or extend them
# The caddy:2-alpine binary re-scanned on 2026-10-13: Go 1.26.8 with golang.org/x/net
# v0.59.0. These need Go 1.26.9 or x/net 0.60.0, and caddy v2.11.7 (the latest
# release) does not carry them. Caddy receives plain HTTP/1.1 from the tunnel inside
# the Compose network: no TLS and no HTTP/2 reach it. Re-check when the digest is bumped.
# TODO(drop-by 2026-11-30): re-check the caddy digest for Go 1.26.9 / x/net 0.60.0 / go-jose 4.1.6, then drop these waivers or extend them
# The caddy:2-alpine binary re-scanned on 2026-11-01: Go 1.26.8, golang.org/x/net
# v0.59.0 and go-jose v4.1.5, and the pinned digest matches the latest. caddy v2.11.7
# (the latest release) carries none of the fixes. Caddy receives plain HTTP/1.1 from
# the tunnel inside the Compose network: no TLS and no HTTP/2 reach it. Re-check when
# the digest is bumped.
- id: CVE-2026-78667
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
expired_at: 2026-12-01
statement: net/http Range header DoS, reachable; file_server answers Range requests and the edge forwards them for the uncached paths (index.html, no-store files). The worst case is CPU load in the app container, which serves only static files; the API runs in its own container. Fixed in Go 1.26.9 (2026-10-08), no caddy release built with it yet.
- id: CVE-2026-78669
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
expired_at: 2026-12-01
statement: HTTP/2 SETTINGS flood DoS in net/http and x/net; caddy is reached over HTTP/1.1 only.
- id: CVE-2026-97031
paths: ["usr/bin/caddy"]
expired_at: 2026-11-01
expired_at: 2026-12-01
statement: crypto/tls ECH extension DoS; caddy terminates no TLS, the edge does.
- id: CVE-2026-116587
paths: ["usr/bin/caddy"]
expired_at: 2026-12-01
statement: go-jose JWK RSA-parameter DoS; caddy parses no JWKs here, with the admin API off, a bare :8081 site (no ACME) and no JWT auth.

misconfigurations: []
secrets: []
Expand Down
Loading