From 83cfa1fb7fe6015f659931c063e41bc349f3cd2f Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Tue, 8 Sep 2026 21:18:38 +0000 Subject: [PATCH 1/2] Point the CVE-2025-15367 exception at the tracker that holds it The exception referred readers to #489, which tracks the OpenSSL CVE-2026-14456 row and is obsolete now that the 3.5.8 rebuild shipped, so anyone following it to re-verify this Python advisory would find nothing about it. #509 is the ticket that actually carries this row. Also record what the re-check actually established, so the next reviewer can confirm the no-backport claim without repeating the search. The expiry date is left alone deliberately: renewing or dropping a lapsed deferral is a disposition decision, not a correction. --- exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml b/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml index 73f47fa6f9d5..7a5f504ce20f 100644 --- a/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml +++ b/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml @@ -23,6 +23,8 @@ statement: | outside the patch commitment, so the date above is a short review deadline rather than an acceptance. - Re-checked on 2026-08-21 against the embedded 3.13.15 build: still no 3.13 - backport. Re-check again before renewing. Tracked in - StackVista/stackstate-agent#489. + Re-checked on 2026-09-08 against the embedded 3.13.15 build: still no 3.13 + backport. The only fix commit, b234a2b67539f787e191d2ef19a7cbdce32874e7, is + diverged from both v3.13.15 and the 3.13 branch head, and v3.13.15 is still + the newest released 3.13.x. Re-check again before renewing. Tracked in + StackVista/stackstate-agent#509. From f821d4528a7dd5eff7f5428ef24ccfcdf96a1d4e Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Wed, 9 Sep 2026 09:50:01 +0000 Subject: [PATCH 2/2] Retire the VEX-superseded agent exceptions and fix the two that remain check-cve-exception-policy --as-of 2026-09-09 failed on all four files in exceptions/: every one expired on 2026-09-04, and three carried dispositions outside the supported set. Issue #500 made expiry fail closed, so the tree has to satisfy the checker. CVE-2025-15367 and CVE-2026-4360 are deleted because vexhub#39 merged reviewed statements that now cover them. In the 34330594840 Grype report for quay.io/stackstate/stackstate-k8s-agent:158e1098 both appear in ignoredMatches with appliedIgnoreRules namespace "vex" -- not_affected for CVE-2025-15367, fixed for CVE-2026-4360 -- against pkg:generic/python@3.13.15, the exact subcomponent the statements pin. The uncovered CVE-2026-17084 python row is still reported in the same run, so the suppression is the VEX statement rather than a scanner filter. The CVE-2025-15367 statement records re-verification on both published architectures, amd64 and arm64. The CVE-2026-4360 file said its own exit condition was a reviewed vexhub statement; that statement now exists. Both GO-2026-5932 files stay, because the advisory has no fixed version at all -- the range is "introduced: 0" with no fixed event -- so reachability is the only available disposition and something has to record it. Their status becomes not_affected, which the checker accepts and which is what the evidence supports: go list -deps over ./cmd/agent, ./cmd/installer and ./cmd/cluster-agent with the release build tag set contains no golang.org/x/crypto/openpgp package, while other x/crypto packages do appear, so the absence is real and not an empty list. Their claim that vexhub already carries an image-scoped statement was wrong and is corrected: vexhub carries GO-2026-5932 only for stackstate-k8s-process-agent and sts-opentelemetry-collector, and has no document for either agent image. The cluster-agent Grype report has no ignoredMatches at all, confirming no VEX reaches that image. A reviewed vexhub statement is the better home for both, and the renewed expiry is a short review deadline for that decision. --- .../stackstate-k8s-agent/CVE-2025-15367.yaml | 30 -------------- .../stackstate-k8s-agent/CVE-2026-4360.yaml | 39 ------------------- .../stackstate-k8s-agent/GO-2026-5932.yaml | 36 +++++++++++------ .../GO-2026-5932.yaml | 35 +++++++++++------ 4 files changed, 49 insertions(+), 91 deletions(-) delete mode 100644 exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml delete mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml diff --git a/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml b/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml deleted file mode 100644 index 7a5f504ce20f..000000000000 --- a/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml +++ /dev/null @@ -1,30 +0,0 @@ -schema_version: '1' -vulnerability: - id: CVE-2025-15367 - severity: MEDIUM -product: - consumer: stackstate-k8s-agent - image: quay.io/stackstate/stackstate-k8s-agent -component: - purl: pkg:generic/python@3.13.15 - paths: - - opt/stackstate-agent/embedded/bin/python3.13 -status: accepted_pending_upstream_fix -reason: no_upstream_fix_for_pinned_runtime_line -expires: '2026-09-04' -owner: "@StackVista/observability-team" -upstream_owner: python -upstream_reference: https://www.cve.org/CVERecord?id=CVE-2025-15367 -statement: | - No fix is published for the CPython 3.13 maintenance line. Upstream carries - the fix only in 3.15.0a6, a pre-release of a different minor version, so - there is no compatible patch we could apply without moving the embedded - interpreter to an unreleased runtime. Under the remediation SLA this falls - outside the patch commitment, so the date above is a short review deadline - rather than an acceptance. - - Re-checked on 2026-09-08 against the embedded 3.13.15 build: still no 3.13 - backport. The only fix commit, b234a2b67539f787e191d2ef19a7cbdce32874e7, is - diverged from both v3.13.15 and the 3.13 branch head, and v3.13.15 is still - the newest released 3.13.x. Re-check again before renewing. Tracked in - StackVista/stackstate-agent#509. diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml deleted file mode 100644 index 57a32e85e92d..000000000000 --- a/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml +++ /dev/null @@ -1,39 +0,0 @@ -schema_version: '1' -vulnerability: - id: CVE-2026-4360 - severity: MEDIUM -product: - consumer: stackstate-k8s-agent - image: quay.io/stackstate/stackstate-k8s-agent -component: - purl: pkg:generic/python@3.13.15 - paths: - - opt/stackstate-agent/embedded/bin/python3.13 -status: under_investigation -reason: scanner_reports_no_fix_but_installed_build_carries_it -expires: '2026-09-04' -owner: "@StackVista/observability-team" -upstream_owner: python -upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-4360 -statement: | - The previous rationale here -- that upstream published no fixed CPython in any - release line -- is wrong, and the correction matters more than the suppression. - Upstream fixed this on every maintained branch in June/July 2026. The 3.13 - backport is python/cpython@eee3ddf0, and `git` reachability puts it inside the - v3.13.15 tag (comparing eee3ddf0...v3.13.15 gives behind_by: 0). The embedded - interpreter is 3.13.15, so this image already carries the fix. - - The row therefore reflects vulnerability-data quality, not exposure, and the - cause is traceable rather than merely odd. The PSF advisory expresses the fix - only as git commits with no version ranges. The first commit it lists, - python/cpython@c37a4fdf, is the 2012-04-06 "bump to 3.1.5 final" release commit - that the lightweight v3.1.5 tag points at, so a deriver resolving that commit to - its nearest tag yields "fixed in 3.1.5" -- roughly fourteen years before this - advisory was published, and the single `< 3.1.5` CPE range NVD now carries. A - matcher keying on versions has nothing usable to compare against and falls back - to reporting "no fixed version". - - Left as under_investigation deliberately: the disposition is not an agent's to - pick. Retiring this file outright turns the row unmanaged, and asserting - not_affected belongs in a reviewed vexhub statement. Verified 2026-09-06 while - triaging StackVista/stackstate-agent#509. diff --git a/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml b/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml index 7b91968678d3..03595995a1f2 100644 --- a/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml +++ b/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml @@ -10,18 +10,32 @@ component: paths: - opt/stackstate-agent/bin/agent/agent - opt/stackstate-agent/bin/installer/installer -status: accepted_with_compensating_control -reason: unpublished_image_vex_identity_bridge -expires: '2026-09-04' +status: not_affected +reason: vulnerable_package_absent_from_command_dependency_graph +expires: '2026-09-23' owner: "@StackVista/observability-team" upstream_owner: golang upstream_reference: https://pkg.go.dev/vuln/GO-2026-5932 statement: | - The affected openpgp and openpgp/clearsign packages are absent from this - binary's command dependency graph. StackVista/vexhub carries the reviewed - image-scoped not_affected statement, but Grype and Trivy match VEX products - by exact image digest or tag, and this gate scans a freshly built commit - image whose identity cannot exist in the VEX hub in advance. The same - bridge is already in place for stackstate-process-agent. Keep it only until - the scan pipeline can apply reviewed statements to unpublished images - without broadening them to every consumer of golang.org/x/crypto. + GO-2026-5932 declares golang.org/x/crypto/openpgp unmaintained and unsafe by + design. The advisory range is "introduced: 0" with no fixed event, so no + version of x/crypto clears it and there is no bump to wait for. The only + disposition available is reachability. + + Re-verified 2026-09-09 on 158e1098 with the release build tag set: neither + `go list -deps ./cmd/agent` nor `./cmd/installer` contains any + golang.org/x/crypto/openpgp package. The scanners flag it anyway because a Go + binary SBOM records modules, not the packages actually linked. + + The previous statement here claimed StackVista/vexhub carries a reviewed + image-scoped not_affected statement for this image and that the exception only + bridges a scan-time identity gap. That is wrong: vexhub carries GO-2026-5932 + only for stackstate-k8s-process-agent and sts-opentelemetry-collector, and has + no statement for either agent image. Until a reviewed vexhub statement exists + this file is the only record of the disposition, which is why it is + not_affected rather than a bridge. + + The gating chart scan in StackVista/cve-reporter does not surface this row -- + its dev profile filters severity UNKNOWN -- so this exception is read only by + the in-repo report-only scan of the freshly built CI image. Tracked in + StackVista/stackstate-agent#509. diff --git a/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml b/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml index c5c8c09a43b1..37c49fdc04f1 100644 --- a/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml +++ b/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml @@ -9,18 +9,31 @@ component: purl: pkg:golang/golang.org/x/crypto@v0.56.0 paths: - opt/stackstate-agent/bin/stackstate-cluster-agent/stackstate-cluster-agent -status: accepted_with_compensating_control -reason: unpublished_image_vex_identity_bridge -expires: '2026-09-04' +status: not_affected +reason: vulnerable_package_absent_from_command_dependency_graph +expires: '2026-09-23' owner: "@StackVista/observability-team" upstream_owner: golang upstream_reference: https://pkg.go.dev/vuln/GO-2026-5932 statement: | - The affected openpgp and openpgp/clearsign packages are absent from this - binary's command dependency graph. StackVista/vexhub carries the reviewed - image-scoped not_affected statement, but Grype and Trivy match VEX products - by exact image digest or tag, and this gate scans a freshly built commit - image whose identity cannot exist in the VEX hub in advance. The same - bridge is already in place for stackstate-process-agent. Keep it only until - the scan pipeline can apply reviewed statements to unpublished images - without broadening them to every consumer of golang.org/x/crypto. + GO-2026-5932 declares golang.org/x/crypto/openpgp unmaintained and unsafe by + design. The advisory range is "introduced: 0" with no fixed event, so no + version of x/crypto clears it and there is no bump to wait for. The only + disposition available is reachability. + + Re-verified 2026-09-09 on 158e1098 with the release build tag set: + `go list -deps ./cmd/cluster-agent` contains no golang.org/x/crypto/openpgp + package. The scanners flag it anyway because a Go binary SBOM records modules, + not the packages actually linked. + + The previous statement here claimed StackVista/vexhub carries a reviewed + image-scoped not_affected statement for this image. That is wrong: vexhub has + no document for stackstate-k8s-cluster-agent at all, and the 158e1098 Grype + report for this image contains no ignoredMatches, so no VEX applies to it. + Until a reviewed vexhub statement exists this file is the only record of the + disposition, which is why it is not_affected rather than an identity bridge. + + The gating chart scan in StackVista/cve-reporter does not surface this row -- + its dev profile filters severity UNKNOWN -- so this exception is read only by + the in-repo report-only scan of the freshly built CI image. Tracked in + StackVista/stackstate-agent#509.