diff --git a/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml b/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml deleted file mode 100644 index 73f47fa6f9d5..000000000000 --- a/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml +++ /dev/null @@ -1,28 +0,0 @@ -schema_version: '1' -vulnerability: - id: CVE-2025-15367 - severity: MEDIUM -product: - consumer: stackstate-k8s-agent - image: quay.io/stackstate/stackstate-k8s-agent -component: - purl: pkg:generic/python@3.13.15 - paths: - - opt/stackstate-agent/embedded/bin/python3.13 -status: accepted_pending_upstream_fix -reason: no_upstream_fix_for_pinned_runtime_line -expires: '2026-09-04' -owner: "@StackVista/observability-team" -upstream_owner: python -upstream_reference: https://www.cve.org/CVERecord?id=CVE-2025-15367 -statement: | - No fix is published for the CPython 3.13 maintenance line. Upstream carries - the fix only in 3.15.0a6, a pre-release of a different minor version, so - there is no compatible patch we could apply without moving the embedded - interpreter to an unreleased runtime. Under the remediation SLA this falls - outside the patch commitment, so the date above is a short review deadline - rather than an acceptance. - - Re-checked on 2026-08-21 against the embedded 3.13.15 build: still no 3.13 - backport. Re-check again before renewing. Tracked in - StackVista/stackstate-agent#489. diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml deleted file mode 100644 index 57a32e85e92d..000000000000 --- a/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml +++ /dev/null @@ -1,39 +0,0 @@ -schema_version: '1' -vulnerability: - id: CVE-2026-4360 - severity: MEDIUM -product: - consumer: stackstate-k8s-agent - image: quay.io/stackstate/stackstate-k8s-agent -component: - purl: pkg:generic/python@3.13.15 - paths: - - opt/stackstate-agent/embedded/bin/python3.13 -status: under_investigation -reason: scanner_reports_no_fix_but_installed_build_carries_it -expires: '2026-09-04' -owner: "@StackVista/observability-team" -upstream_owner: python -upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-4360 -statement: | - The previous rationale here -- that upstream published no fixed CPython in any - release line -- is wrong, and the correction matters more than the suppression. - Upstream fixed this on every maintained branch in June/July 2026. The 3.13 - backport is python/cpython@eee3ddf0, and `git` reachability puts it inside the - v3.13.15 tag (comparing eee3ddf0...v3.13.15 gives behind_by: 0). The embedded - interpreter is 3.13.15, so this image already carries the fix. - - The row therefore reflects vulnerability-data quality, not exposure, and the - cause is traceable rather than merely odd. The PSF advisory expresses the fix - only as git commits with no version ranges. The first commit it lists, - python/cpython@c37a4fdf, is the 2012-04-06 "bump to 3.1.5 final" release commit - that the lightweight v3.1.5 tag points at, so a deriver resolving that commit to - its nearest tag yields "fixed in 3.1.5" -- roughly fourteen years before this - advisory was published, and the single `< 3.1.5` CPE range NVD now carries. A - matcher keying on versions has nothing usable to compare against and falls back - to reporting "no fixed version". - - Left as under_investigation deliberately: the disposition is not an agent's to - pick. Retiring this file outright turns the row unmanaged, and asserting - not_affected belongs in a reviewed vexhub statement. Verified 2026-09-06 while - triaging StackVista/stackstate-agent#509. diff --git a/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml b/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml index 7b91968678d3..03595995a1f2 100644 --- a/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml +++ b/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml @@ -10,18 +10,32 @@ component: paths: - opt/stackstate-agent/bin/agent/agent - opt/stackstate-agent/bin/installer/installer -status: accepted_with_compensating_control -reason: unpublished_image_vex_identity_bridge -expires: '2026-09-04' +status: not_affected +reason: vulnerable_package_absent_from_command_dependency_graph +expires: '2026-09-23' owner: "@StackVista/observability-team" upstream_owner: golang upstream_reference: https://pkg.go.dev/vuln/GO-2026-5932 statement: | - The affected openpgp and openpgp/clearsign packages are absent from this - binary's command dependency graph. StackVista/vexhub carries the reviewed - image-scoped not_affected statement, but Grype and Trivy match VEX products - by exact image digest or tag, and this gate scans a freshly built commit - image whose identity cannot exist in the VEX hub in advance. The same - bridge is already in place for stackstate-process-agent. Keep it only until - the scan pipeline can apply reviewed statements to unpublished images - without broadening them to every consumer of golang.org/x/crypto. + GO-2026-5932 declares golang.org/x/crypto/openpgp unmaintained and unsafe by + design. The advisory range is "introduced: 0" with no fixed event, so no + version of x/crypto clears it and there is no bump to wait for. The only + disposition available is reachability. + + Re-verified 2026-09-09 on 158e1098 with the release build tag set: neither + `go list -deps ./cmd/agent` nor `./cmd/installer` contains any + golang.org/x/crypto/openpgp package. The scanners flag it anyway because a Go + binary SBOM records modules, not the packages actually linked. + + The previous statement here claimed StackVista/vexhub carries a reviewed + image-scoped not_affected statement for this image and that the exception only + bridges a scan-time identity gap. That is wrong: vexhub carries GO-2026-5932 + only for stackstate-k8s-process-agent and sts-opentelemetry-collector, and has + no statement for either agent image. Until a reviewed vexhub statement exists + this file is the only record of the disposition, which is why it is + not_affected rather than a bridge. + + The gating chart scan in StackVista/cve-reporter does not surface this row -- + its dev profile filters severity UNKNOWN -- so this exception is read only by + the in-repo report-only scan of the freshly built CI image. Tracked in + StackVista/stackstate-agent#509. diff --git a/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml b/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml index c5c8c09a43b1..37c49fdc04f1 100644 --- a/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml +++ b/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml @@ -9,18 +9,31 @@ component: purl: pkg:golang/golang.org/x/crypto@v0.56.0 paths: - opt/stackstate-agent/bin/stackstate-cluster-agent/stackstate-cluster-agent -status: accepted_with_compensating_control -reason: unpublished_image_vex_identity_bridge -expires: '2026-09-04' +status: not_affected +reason: vulnerable_package_absent_from_command_dependency_graph +expires: '2026-09-23' owner: "@StackVista/observability-team" upstream_owner: golang upstream_reference: https://pkg.go.dev/vuln/GO-2026-5932 statement: | - The affected openpgp and openpgp/clearsign packages are absent from this - binary's command dependency graph. StackVista/vexhub carries the reviewed - image-scoped not_affected statement, but Grype and Trivy match VEX products - by exact image digest or tag, and this gate scans a freshly built commit - image whose identity cannot exist in the VEX hub in advance. The same - bridge is already in place for stackstate-process-agent. Keep it only until - the scan pipeline can apply reviewed statements to unpublished images - without broadening them to every consumer of golang.org/x/crypto. + GO-2026-5932 declares golang.org/x/crypto/openpgp unmaintained and unsafe by + design. The advisory range is "introduced: 0" with no fixed event, so no + version of x/crypto clears it and there is no bump to wait for. The only + disposition available is reachability. + + Re-verified 2026-09-09 on 158e1098 with the release build tag set: + `go list -deps ./cmd/cluster-agent` contains no golang.org/x/crypto/openpgp + package. The scanners flag it anyway because a Go binary SBOM records modules, + not the packages actually linked. + + The previous statement here claimed StackVista/vexhub carries a reviewed + image-scoped not_affected statement for this image. That is wrong: vexhub has + no document for stackstate-k8s-cluster-agent at all, and the 158e1098 Grype + report for this image contains no ignoredMatches, so no VEX applies to it. + Until a reviewed vexhub statement exists this file is the only record of the + disposition, which is why it is not_affected rather than an identity bridge. + + The gating chart scan in StackVista/cve-reporter does not surface this row -- + its dev profile filters severity UNKNOWN -- so this exception is read only by + the in-repo report-only scan of the freshly built CI image. Tracked in + StackVista/stackstate-agent#509.