kgateway/osv-scanner.toml at main · ayushi-work/kgateway · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
# OSV-Scanner ignore list.
#
# Only entries that are unambiguous false positives belong here. Each entry
# must explain *why* it is a false positive so a future reader can re-verify.
#
# Format reference: https://google.github.io/osv-scanner/configuration/

# The following five CVEs are flagged against istio.io/istio, which we pin
# to the Go pseudo-version `v0.0.0-20260605182440-f18fd540c0e8`.
#
# OSV-Scanner sorts the pseudo-version's literal "0.0.0" prefix below the
# CVEs' fixed versions (Istio 1.x releases from 2019-2022) and concludes
# "0.0.0 < 1.x", firing a false positive. In reality that pinned commit is
# an Istio dev (main) build -its `VERSION` file reads "1.31" at the time
# this entry was added, which is many minor releases past every fix below.

[[IgnoredVulns]]
id = "CVE-2019-14993"
reason = "False positive: fixed in Istio 1.1.13 / 1.2.4. At the time this entry was added our pin v0.0.0-20260605182440-f18fd540c0e8 was an Istio 1.31-dev build"

[[IgnoredVulns]]
id = "CVE-2021-39155"
reason = "False positive: fixed in Istio 1.9.8 / 1.10.4 / 1.11.1. At the time this entry was added our pin v0.0.0-20260605182440-f18fd540c0e8 was an Istio 1.31-dev build"

[[IgnoredVulns]]
id = "CVE-2021-39156"
reason = "False positive: fixed in Istio 1.9.8 / 1.10.4 / 1.11.1. At the time this entry was added our pin v0.0.0-20260605182440-f18fd540c0e8 was an Istio 1.31-dev build"

[[IgnoredVulns]]
id = "CVE-2022-23635"
reason = "False positive: fixed in Istio 1.11.7 / 1.12.4 / 1.13.1. At the time this entry was added our pin v0.0.0-20260605182440-f18fd540c0e8 was an Istio 1.31-dev build"

[[IgnoredVulns]]
id = "CVE-2022-31045"
reason = "False positive: fixed in Istio 1.12.18 / 1.13.5 / 1.14.1. At the time this entry was added our pin v0.0.0-20260605182440-f18fd540c0e8 was an Istio 1.31-dev build"