Skip to content

AST-108828 - Fix 10 security vulnerabilities (AST-108828,AST-116271,AST-120967,AST-123298,AST-123300,AST-123302,AST-123980,AST-123981,AST-132239,AST-134898)#41

Merged
cx-adar-zandberg merged 1 commit intomainfrom
adar/fix-security-vulns-batch-2
Mar 8, 2026
Merged

AST-108828 - Fix 10 security vulnerabilities (AST-108828,AST-116271,AST-120967,AST-123298,AST-123300,AST-123302,AST-123980,AST-123981,AST-132239,AST-134898)#41
cx-adar-zandberg merged 1 commit intomainfrom
adar/fix-security-vulns-batch-2

Conversation

@cx-adar-zandberg
Copy link
Contributor

@cx-adar-zandberg cx-adar-zandberg commented Mar 8, 2026

Summary

Addresses 10 security vulnerability tickets by updating transitive dependencies via replace directives and adding scanner exclusions for unfixable CVEs.

Fixed via replace directives (8 CVEs):

Ticket CVE Package Version Change
AST-120967 CVE-2024-25621 containerd/v2 v2.1.4 → v2.1.5
AST-123980 CVE-2025-64329 containerd/v2 v2.1.4 → v2.1.5
AST-123298 CVE-2025-52881 runc v1.2.3 → v1.3.3 (existing)
AST-123300 CVE-2025-52565 runc v1.2.3 → v1.3.3 (existing)
AST-123302 CVE-2025-31133 runc v1.2.3 → v1.3.3 (existing)
AST-108828 CVE-2025-46569 OPA v0.70.0 → v1.14.0
AST-134898 CVE-2026-25934 go-git/v5 v5.14.0 → v5.16.5
AST-132239 CVE-2026-24137 sigstore v1.8.15 → v1.10.4

Added to .trivyignore (2 CVEs):

Ticket CVE Package Reason
AST-123981 CVE-2019-25210 helm WONTFIX by upstream — we don't use --dry-run
AST-116271 CVE-2025-27144 go-jose v2 No v2 patch exists; transitive from k8s.io/apiserver

Notes

  • OPA, sigstore, and go-jose v2 are transitive dependencies not directly imported by this module
  • go-git/v5 is used transitively via anchore/syft
  • Build and tests pass locally

Test plan

  • go build ./... passes
  • go test ./... passes
  • go list -m all shows correct replacement versions
  • CI checks pass

Made with Cursor

@cx-adar-zandberg cx-adar-zandberg changed the title Fix 10 security vulnerabilities in containers-resolver Fix 10 security vulnerabilities (AST-108828,AST-116271,AST-120967,AST-123298,AST-123300,AST-123302,AST-123980,AST-123981,AST-132239,AST-134898) Mar 8, 2026
@cx-adar-zandberg
Fix 10 security vulnerabilities (AST-108828, AST-116271, AST-120967, …
676e4f9 
…AST-123298, AST-123300, AST-123302, AST-123980, AST-123981, AST-132239, AST-134898)

Replace directives added/updated for 8 CVEs:
- containerd/v2 v2.1.4 → v2.1.5 (CVE-2024-25621, CVE-2025-64329)
- OPA v0.70.0 → v1.14.0 (CVE-2025-46569)
- go-git/v5 v5.14.0 → v5.16.5 (CVE-2026-25934)
- sigstore v1.8.15 → v1.10.4 (CVE-2026-24137)
- runc v1.2.3 → v1.3.3 (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) [existing]

.trivyignore added for 2 unfixable CVEs:
- CVE-2019-25210 (Helm WONTFIX - we don't use --dry-run)
- CVE-2025-27144 (go-jose v2 - no v2 patch, transitive from k8s)

Made-with: Cursor
@cx-adar-zandberg cx-adar-zandberg force-pushed the adar/fix-security-vulns-batch-2 branch from 1a0e348 to 676e4f9 Compare March 8, 2026 12:58
@cx-adar-zandberg cx-adar-zandberg merged commit 396f3bf into main Mar 8, 2026
2 checks passed
@cx-adar-zandberg cx-adar-zandberg changed the title Fix 10 security vulnerabilities (AST-108828,AST-116271,AST-120967,AST-123298,AST-123300,AST-123302,AST-123980,AST-123981,AST-132239,AST-134898) AST-108828 - Fix 10 security vulnerabilities (AST-108828,AST-116271,AST-120967,AST-123298,AST-123300,AST-123302,AST-123980,AST-123981,AST-132239,AST-134898) Mar 8, 2026
@cx-shaked-karta
Copy link
Contributor

cx-shaked-karta commented Mar 8, 2026 •
edited
Loading

Logo
Checkmarx One – Scan Summary & Details – 5a260e72-f650-457f-b5d1-6b532bb1967e

Great job! No new security vulnerabilities introduced in this pull request

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cx-david-kesoshvili cx-david-kesoshvili cx-david-kesoshvili approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@cx-adar-zandberg @cx-shaked-karta @cx-david-kesoshvili