Skip to content

Commit 0ac0819

Browse files
kimetakimeta
authored
Ignore gosu Go-stdlib false positives in docker scan (#8984)
* Ignore gosu Go-stdlib false positives in docker scan * Scope gosu ignore to specific CVEs per review
1 parent e832e19 commit 0ac0819

1 file changed

Lines changed: 186 additions & 0 deletions

File tree

‎.grype.yaml‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
# grype configuration for the docker-image vulnerability gate (§CI-scan-docker-images).
2+
#
3+
# grype auto-loads this file from the repository root, so it applies to the
4+
# `checkAllowedDockerImages` / `GrypeTask` scan both on PRs (changed images) and
5+
# on the weekly all-images run.
6+
#
7+
# Every rule below suppresses ONE confirmed false-positive High/Critical finding
8+
# in the Go stdlib statically linked into `/usr/sbin/gosu`. gosu is a ~200-line
9+
# setuid shim that only calls setuid/setgid/execve to drop privileges and exec
10+
# the container entrypoint; it does not invoke any of the affected stdlib
11+
# subsystems (net/http, crypto/tls, crypto/x509, net/url, encoding/gob,
12+
# archive/*), so none of these CVEs are reachable through it. gosu ships this
13+
# stdlib upstream, so there is nothing for us to patch.
14+
#
15+
# Each rule is pinned to vulnerability id + package stdlib + version go1.22.2 +
16+
# location /usr/sbin/gosu. Consequences of this narrow scope:
17+
# - a NEW go1.22.2 stdlib CVE (an id not listed here) is still reported;
18+
# - the same CVE in any OTHER binary/path is still reported;
19+
# - once gosu is rebuilt against a newer Go, the version pin no longer matches
20+
# and every finding re-surfaces for re-evaluation (acts as an implicit expiry).
21+
ignore:
22+
- vulnerability: CVE-2024-24790
23+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
24+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
25+
- vulnerability: CVE-2024-24791
26+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
27+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
28+
- vulnerability: CVE-2024-34156
29+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
30+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
31+
- vulnerability: CVE-2024-34158
32+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
33+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
34+
- vulnerability: CVE-2025-22871
35+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
36+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
37+
- vulnerability: CVE-2025-4674
38+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
39+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
40+
- vulnerability: CVE-2025-47907
41+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
42+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
43+
- vulnerability: CVE-2025-58187
44+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
45+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
46+
- vulnerability: CVE-2025-58188
47+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
48+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
49+
- vulnerability: CVE-2025-61723
50+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
51+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
52+
- vulnerability: CVE-2025-61725
53+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
54+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
55+
- vulnerability: CVE-2025-61726
56+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
57+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
58+
- vulnerability: CVE-2025-61729
59+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
60+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
61+
- vulnerability: CVE-2025-61731
62+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
63+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
64+
- vulnerability: CVE-2025-61732
65+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
66+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
67+
- vulnerability: CVE-2025-68121
68+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
69+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
70+
- vulnerability: CVE-2026-25679
71+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
72+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
73+
- vulnerability: CVE-2026-27140
74+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
75+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
76+
- vulnerability: CVE-2026-27143
77+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
78+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
79+
- vulnerability: CVE-2026-27144
80+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
81+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
82+
- vulnerability: CVE-2026-27145
83+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
84+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
85+
- vulnerability: CVE-2026-32280
86+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
87+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
88+
- vulnerability: CVE-2026-32281
89+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
90+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
91+
- vulnerability: CVE-2026-32283
92+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
93+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
94+
- vulnerability: CVE-2026-33811
95+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
96+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
97+
- vulnerability: CVE-2026-33814
98+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
99+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
100+
- vulnerability: CVE-2026-39820
101+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
102+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
103+
- vulnerability: CVE-2026-39836
104+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
105+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
106+
- vulnerability: CVE-2026-42499
107+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
108+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
109+
- vulnerability: CVE-2026-42501
110+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
111+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
112+
- vulnerability: CVE-2026-42504
113+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
114+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
115+
- vulnerability: GO-2024-2887
116+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
117+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
118+
- vulnerability: GO-2024-2963
119+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
120+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
121+
- vulnerability: GO-2024-3106
122+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
123+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
124+
- vulnerability: GO-2024-3107
125+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
126+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
127+
- vulnerability: GO-2025-3563
128+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
129+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
130+
- vulnerability: GO-2025-3849
131+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
132+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
133+
- vulnerability: GO-2025-4006
134+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
135+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
136+
- vulnerability: GO-2025-4007
137+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
138+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
139+
- vulnerability: GO-2025-4009
140+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
141+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
142+
- vulnerability: GO-2025-4013
143+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
144+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
145+
- vulnerability: GO-2025-4155
146+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
147+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
148+
- vulnerability: GO-2026-4337
149+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
150+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
151+
- vulnerability: GO-2026-4341
152+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
153+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
154+
- vulnerability: GO-2026-4601
155+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
156+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
157+
- vulnerability: GO-2026-4870
158+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
159+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
160+
- vulnerability: GO-2026-4918
161+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
162+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
163+
- vulnerability: GO-2026-4946
164+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
165+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
166+
- vulnerability: GO-2026-4947
167+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
168+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
169+
- vulnerability: GO-2026-4971
170+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
171+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
172+
- vulnerability: GO-2026-4977
173+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
174+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
175+
- vulnerability: GO-2026-4981
176+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
177+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
178+
- vulnerability: GO-2026-4986
179+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
180+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
181+
- vulnerability: GO-2026-5037
182+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
183+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."
184+
- vulnerability: GO-2026-5038
185+
package: { name: stdlib, version: go1.22.2, location: "/usr/sbin/gosu" }
186+
reason: "vulnerable_code_not_in_execute_path: gosu (setuid exec shim) never calls the affected go1.22.2 stdlib subsystem; re-surfaces if gosu is rebuilt on a newer Go."

0 commit comments

Comments
 (0)