gh-aw-firewall/.grype.yaml at main · github/gh-aw-firewall · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
# Grype vulnerability scanner configuration for gh-aw-firewall container images.
#
# This file is mounted into the grype container by the supply-chain-scan workflow
# so that known-accepted / unresolvable findings do not block every PR.
#
# Each entry must include a justification comment explaining:
#   1. Why the finding cannot be fixed in the image layer we control.
#   2. What the risk acceptance decision is and who should revisit it.
#
# Format reference: https://github.com/anchore/grype?tab=readme-ov-file#configuration

ignore:
  # ── grpc v1.81.1 embedded in gh CLI binary ───────────────────────────────────
  #
  # GHSA-hrxh-6v49-42gf (google.golang.org/grpc v1.81.1 -> 1.82.1, CRITICAL,
  # CVSS 9.1):
  #   Three server-side grpc-go issues: an xDS RBAC authorization bypass
  #   (fail-open on unsupported matchers), an HTTP/2 rapid-reset mitigation
  #   bypass (DoS), and a panic on crafted xDS RBAC policies.
  #
  #   Risk acceptance — NOT REACHABLE in our usage:
  #     grpc v1.81.1 is a transitive dependency compiled into the `gh` CLI
  #     binary. `gh` is a client: it does not run a gRPC server, use xDS RBAC,
  #     or accept HTTP/2 from untrusted peers, so none of the vulnerable code
  #     paths are exercised. The finding is present but not exploitable here.
  #   Present in the agent image (gh via the GitHub CLI apt repo) and the
  #   cli-proxy image (gh from the official release tarball).
  #
  #   No fix is shippable today: gh 2.96.0 (latest release as of 2026-07-23)
  #   still pins grpc v1.81.1, and building gh from unreleased trunk would ship
  #   an untagged, non-official binary (worse supply-chain risk than a
  #   non-reachable finding). The fix (grpc v1.82.1) is already merged on gh
  #   trunk, so the next tagged gh release will carry it.
  #   Revisit: once gh CLI >= v2.97.0 (grpc >= 1.82.1) is released, bump the
  #   `gh=` pin in agent/Dockerfile and cli-proxy/Dockerfile and DELETE this
  #   entry. Tracked in github/gh-aw-firewall.
  - vulnerability: GHSA-hrxh-6v49-42gf
    package:
      name: google.golang.org/grpc
      version: "v1.81.1"
      type: go-module

  # ── golang.org/x/text v0.38.0 embedded in gh CLI binary (agent image) ────────
  #
  # GO-2026-5970 / CVE-2026-56852 (golang.org/x/text v0.38.0 -> 0.39.0, HIGH):
  #   A norm.Iter can enter an infinite loop when handling input containing
  #   invalid UTF-8 bytes (denial of service).
  #
  #   Risk acceptance — BOUNDED DoS only, no other impact:
  #     x/text v0.38.0 is compiled into the `gh` CLI binary. In the agent image,
  #     `gh` is a client tool invoked by the agent; the worst-case outcome if
  #     invalid UTF-8 reaches gh's text-normalization path is a hang of that gh
  #     process — no privilege escalation, data exfiltration, or RCE vector.
  #   Scoped to /usr/bin/gh (agent image, installed via apt repo, gh=2.96.0).
  #
  #   No fix is shippable today: gh 2.96.0 (latest release as of 2026-07-24)
  #   still bundles x/text v0.38.0, and building gh from unreleased trunk would
  #   ship an untagged, non-official binary (worse supply-chain risk).
  #   Revisit: once a gh CLI release bundling x/text >= v0.39.0 is available,
  #   bump the `gh=` pin in agent/Dockerfile and DELETE this entry. Tracked in
  #   github/gh-aw-firewall.
  - vulnerability: GO-2026-5970
    package:
      name: golang.org/x/text
      version: "v0.38.0"
      type: go-module
      location: "/usr/bin/gh"

  # ── golang.org/x/text v0.38.0 embedded in gh CLI binary (cli-proxy image) ────
  #
  # GO-2026-5970 / CVE-2026-56852 (golang.org/x/text v0.38.0 -> 0.39.0, HIGH):
  #   A norm.Iter can enter an infinite loop when handling input containing
  #   invalid UTF-8 bytes (denial of service).
  #
  #   Risk acceptance — BOUNDED DoS only, mitigated by process timeout:
  #     x/text v0.38.0 is compiled into the `gh` CLI binary in the cli-proxy
  #     image. The cli-proxy server forwards agent-supplied args and
  #     base64-decoded stdin directly to `gh` (containers/cli-proxy/server.js,
  #     gh-runner.js). Any norm.Iter loop triggered by invalid UTF-8 in those
  #     inputs would be killed by the COMMAND_TIMEOUT_MS guard (default 30 s,
  #     gh-runner.js:5), bounding the impact to a single timed-out request.
  #     There is no privilege escalation, data exfiltration, or RCE vector —
  #     the vulnerability is DoS only.
  #   Scoped to /usr/local/bin/gh (cli-proxy image, installed from release
  #   tarball, gh=2.96.0).
  #
  #   No fix is shippable today: gh 2.96.0 (latest release as of 2026-07-24)
  #   still bundles x/text v0.38.0, and building gh from unreleased trunk would
  #   ship an untagged, non-official binary (worse supply-chain risk).
  #   Revisit: once a gh CLI release bundling x/text >= v0.39.0 is available,
  #   bump the GH_VERSION in cli-proxy/Dockerfile and DELETE this entry.
  #   Tracked in github/gh-aw-firewall.
  - vulnerability: GO-2026-5970
    package:
      name: golang.org/x/text
      version: "v0.38.0"
      type: go-module
      location: "/usr/local/bin/gh"

  # ── brace-expansion bundled inside the vendored npm CLI ──────────────────────
  #
  # GHSA-mh99-v99m-4gvg (brace-expansion <=5.0.7 -> 5.0.8, HIGH):
  #   DoS via unbounded brace expansion length causing an out-of-memory crash.
  #
  #   Risk acceptance — BOUNDED DoS in a build-time CLI tool, no other impact:
  #     This brace-expansion is NOT an application dependency. The agent,
  #     api-proxy, and cli-proxy images all vendor the npm CLI (pinned
  #     npm@11.18.0, extracted into /usr/local/lib/node_modules/npm), and npm
  #     bundles brace-expansion inside its own node_modules. The sidecars build
  #     with `npm ci --omit=dev`, which prunes their app-level dev copies, so the
  #     only brace-expansion left in the runtime images is npm's bundled one.
  #     The worst case is that an `npm` invocation over a hostile brace pattern
  #     hangs/OOMs that npm process — no privilege escalation, data exfiltration,
  #     or RCE. npm is a trusted build tool here, not exposed to untrusted input.
  #
  #   No fix is shippable today: npm 11.18.0 is the latest npm release and still
  #   bundles brace-expansion <=5.0.7. brace-expansion 5.0.8 (the patched
  #   version) exists on the registry but no npm release ships it yet, and
  #   hand-patching npm's internal bundle would produce a non-official npm.
  #   Revisit: once an npm release bundling brace-expansion >= 5.0.8 is
  #   available, bump the npm pin (NPM_TGZ_URL / sha256) in agent/Dockerfile,
  #   api-proxy/Dockerfile, and cli-proxy/Dockerfile and DELETE this entry.
  #   Tracked in github/gh-aw-firewall.
  - vulnerability: GHSA-mh99-v99m-4gvg
    package:
      name: brace-expansion
      type: npm