Ignore CVEs on fleetdm/fleetctl (#43240)

Fixes: https://github.com/fleetdm/fleet/actions/runs/24121419823/job/70444895796 Run: https://github.com/fleetdm/fleet/actions/runs/24142910735
2026-04-08 17:46:41 -03:00
parent 25641b78d4
commit 30f1719aca
4 changed files with 102 additions and 0 deletions
@@ -172,6 +172,22 @@ Following is the vulnerability report of Fleet and its dependencies.
 - **Justification:** `vulnerable_code_not_in_execute_path`
 - **Timestamp:** 2026-03-23 16:44:57

+### [CVE-2026-34875](https://nvd.nist.gov/vuln/detail/CVE-2026-34875)
+- **Author:** @lucasmrod
+- **Status:** `not_affected`
+- **Status notes:** fleetdm/fleetctl does not use Mbed TLS. The libmbedcrypto16 package is an unused transitive dependency in the container image.
+- **Products:**: `fleetctl`,`pkg:deb/debian/libmbedcrypto16`
+- **Justification:** `vulnerable_code_not_in_execute_path`
+- **Timestamp:** 2026-04-08 12:06:49
+
+### [CVE-2026-34873](https://nvd.nist.gov/vuln/detail/CVE-2026-34873)
+- **Author:** @lucasmrod
+- **Status:** `not_affected`
+- **Status notes:** fleetdm/fleetctl does not use Mbed TLS. The libmbedcrypto16 package is an unused transitive dependency in the container image.
+- **Products:**: `fleetctl`,`pkg:deb/debian/libmbedcrypto16`
+- **Justification:** `vulnerable_code_not_in_execute_path`
+- **Timestamp:** 2026-04-08 12:06:46
+
 ### [CVE-2026-33487](https://nvd.nist.gov/vuln/detail/CVE-2026-33487)
 - **Author:** @lucasmrod
 - **Status:** `not_affected`
@@ -228,6 +244,14 @@ Following is the vulnerability report of Fleet and its dependencies.
 - **Justification:** `component_not_present`
 - **Timestamp:** 2026-01-30 09:25:41

+### [CVE-2026-0968](https://nvd.nist.gov/vuln/detail/CVE-2026-0968)
+- **Author:** @lucasmrod
+- **Status:** `not_affected`
+- **Status notes:** fleetdm/fleetctl does not use libssh. The libssh-4 package is an unused transitive dependency in the container image.
+- **Products:**: `fleetctl`,`pkg:deb/debian/libssh-4`
+- **Justification:** `vulnerable_code_not_in_execute_path`
+- **Timestamp:** 2026-04-08 12:06:51
+
 ### [CVE-2025-69419](https://nvd.nist.gov/vuln/detail/CVE-2025-69419)
 - **Author:** @lucasmrod
 - **Status:** `not_affected`
@@ -0,0 +1,26 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-37b25bd9a968efce3f08b579d76ffa37ca3f758126188084423cb67b4b9fd478",
+  "author": "@lucasmrod",
+  "timestamp": "2026-04-08T12:06:51.309277-03:00",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2026-0968"
+      },
+      "timestamp": "2026-04-08T12:06:51.309277-03:00",
+      "products": [
+        {
+          "@id": "fleetctl"
+        },
+        {
+          "@id": "pkg:deb/debian/libssh-4"
+        }
+      ],
+      "status": "not_affected",
+      "status_notes": "fleetdm/fleetctl does not use libssh. The libssh-4 package is an unused transitive dependency in the container image.",
+      "justification": "vulnerable_code_not_in_execute_path"
+    }
+  ]
+}
@@ -0,0 +1,26 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-756a0db110c65dbac8702e2ac4659c66ac357d6a8b5a31664ba1cc57bafa51dd",
+  "author": "@lucasmrod",
+  "timestamp": "2026-04-08T12:06:46.615805-03:00",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2026-34873"
+      },
+      "timestamp": "2026-04-08T12:06:46.615805-03:00",
+      "products": [
+        {
+          "@id": "fleetctl"
+        },
+        {
+          "@id": "pkg:deb/debian/libmbedcrypto16"
+        }
+      ],
+      "status": "not_affected",
+      "status_notes": "fleetdm/fleetctl does not use Mbed TLS. The libmbedcrypto16 package is an unused transitive dependency in the container image.",
+      "justification": "vulnerable_code_not_in_execute_path"
+    }
+  ]
+}
@@ -0,0 +1,26 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-859603b049c3e908489f4cc4318759aa6ad0371dea550ba59daf9cf5a40827ed",
+  "author": "@lucasmrod",
+  "timestamp": "2026-04-08T12:06:49.058533-03:00",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2026-34875"
+      },
+      "timestamp": "2026-04-08T12:06:49.058534-03:00",
+      "products": [
+        {
+          "@id": "fleetctl"
+        },
+        {
+          "@id": "pkg:deb/debian/libmbedcrypto16"
+        }
+      ],
+      "status": "not_affected",
+      "status_notes": "fleetdm/fleetctl does not use Mbed TLS. The libmbedcrypto16 package is an unused transitive dependency in the container image.",
+      "justification": "vulnerable_code_not_in_execute_path"
+    }
+  ]
+}