From 117e1ce6622a73f08381383a50ce157eaa125fb3 Mon Sep 17 00:00:00 2001 From: sean wibisono Date: Tue, 11 Aug 2026 11:08:38 +1000 Subject: [PATCH] UID2-7662, UID2-7656: suppress 2 CVEs in .trivyignore (exp 2026-11-11) - CVE-2026-40984 (UID2-7662) - CVE-2026-56408 (UID2-7656) Each is present but not reachable from this service; see the linked tickets for the per-CVE impact assessments. Reachability alone determines suppress-vs-fix. --- .trivyignore | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/.trivyignore b/.trivyignore index 303b8e8..66b33d1 100644 --- a/.trivyignore +++ b/.trivyignore @@ -31,10 +31,23 @@ CVE-2026-2100 exp:2026-09-01 # See: UID2-7456 CVE-2026-56131 exp:2026-08-09 CVE-2026-56407 exp:2026-08-09 -CVE-2026-56408 exp:2026-08-09 +# CVE-2026-56408 — libexpat (Alpine base image, transitive via eclipse-temurin:21-jre- +# alpine-3.23) (HIGH). +# Not exploitable here: Same alpine base; libexpat not explicitly installed. No expat/JNI refs; +# JVM parses config/logback XML, not libexpat. +# See: UID2-7656 +CVE-2026-56408 exp:2026-11-11 # jackson-core async parser maxNumberLength bypass (GHSA-r7wm-3cxj-wff9) - incomplete fix for # GHSA-72hv-8253-57qq. Not exploitable: services only use the synchronous ObjectMapper API, not # jackson-core's non-blocking/async parser. A jackson bump is also in flight via uid2-shared # (PR #631) and will flow on the next release. See: UID2-7557 (predecessor UID2-6670) GHSA-r7wm-3cxj-wff9 exp:2026-08-23 + +# CVE-2026-40984 — io.micrometer:micrometer-core (transitive via micrometer-registry- +# prometheus/-jmx); micrometer-jetty11/12 not present (HIGH). +# Not exploitable here: pom.xml:99/146/151 vertx-micrometer + registry 1.1.0; Main.java:176 +# VertxPrometheusOptions; only io.micrometer core Counter/Gauge/Metrics used; no Jetty, no HTTP +# binder +# See: UID2-7662 +CVE-2026-40984 exp:2026-11-11