Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

.trivyignore: ignore cve #10393

Merged
merged 5 commits into from
Nov 22, 2024
Merged

.trivyignore: ignore cve #10393

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
252c8a2
update trivyignore
sam-heilbron Nov 22, 2024
218da26
skipCI
sam-heilbron Nov 22, 2024
5c2eea5
Update .trivyignore
sam-heilbron Nov 22, 2024
c21bc6c
Merge branch 'main' into sh/trivy-ignore
sam-heilbron Nov 22, 2024
b24727e
Merge branch 'main' into sh/trivy-ignore
sam-heilbron Nov 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,3 +62,9 @@ CVE-2024-45258
# Therefore we include this entry for now and should remove it once 1.14 is no longer an LTS branch
CVE-2024-27289
CVE-2024-27304

# https://github.com/advisories/GHSA-5fhx-39r8-3jwh
# This is resolved in versions of Gloo Gateway that rely on Go1.22 and above (1.17, 1.18)
# For earlier versions of Gloo Gateway, we confirmed that the vulnerability is not exploitable
# and captured our findings here: https://github.com/solo-io/solo-projects/issues/7157#issuecomment-2463252858
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: ideally shouldn't link to a private repo

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree, though it holds all the details so I wanted to make sure it was discoverable. Do you think we have an alternative?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe if we had a public GH issue. but i'm fine with this for now

CVE-2022-30635
9 changes: 9 additions & 0 deletions changelog/v1.18.0-rc2/trivy-ignore.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
changelog:
- type: NON_USER_FACING
issueLink: https://github.com/solo-io/solo-projects/issues/7157
resolvesIssue: false
description: >-
Update trivyignore contents

skipCI-kube-tests:true
skipCI-docs-build:true
Loading