Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 22 Packages Projects Releases Wiki Activity

Skip openssl vulns in Fleet (#39098)

Browse Source 
Run: https://github.com/fleetdm/fleet/actions/runs/21532057134
This commit is contained in:
Lucas Manuel Rodriguez
2026-02-02 11:56:39 -03:00
committed by GitHub
parent 84aee59016
commit 3957fc990c
6 changed files with 182 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/status.md
+40
View File
@@ -13,6 +13,14 @@ Following is the vulnerability report of Fleet and its dependencies.
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2025-10-01 10:09:03
### [CVE-2025-69419](https://nvd.nist.gov/vuln/detail/CVE-2025-69419)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleet uses Go's crypto and TLS implementation.
- **Products:**: `fleet`,`pkg:apk/alpine/libcrypto3`,`pkg:apk/alpine/libssl3`
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-01-03 15:15:53
### [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729)
#### Statement:
- **Author:** @lucasmrod
@@ -90,6 +98,14 @@ Following is the vulnerability report of Fleet and its dependencies.
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2025-04-10 15:42:55
### [CVE-2025-15467](https://nvd.nist.gov/vuln/detail/CVE-2025-15467)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleet uses Go's crypto and TLS implementation.
- **Products:**: `fleet`,`pkg:apk/alpine/libcrypto3`,`pkg:apk/alpine/libssl3`
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-01-03 15:15:53
### [CVE-2024-8260](https://nvd.nist.gov/vuln/detail/CVE-2024-8260)
- **Author:** @lucasmrod
- **Status:** `not_affected`
@@ -116,6 +132,22 @@ Following is the vulnerability report of Fleet and its dependencies.
## `fleetdm/fleetctl` docker image
### [CVE-2026-24515](https://nvd.nist.gov/vuln/detail/CVE-2026-24515)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetctl does not process XML using libexpat1, and when genrating packages the XMLs are defined.
- **Products:**: `fleetctl`,`pkg:deb/debian/libexpat1`
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-01-03 15:15:53
### [CVE-2025-69419](https://nvd.nist.gov/vuln/detail/CVE-2025-69419)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleet uses Go's crypto and TLS implementation.
- **Products:**: `fleetctl`,`pkg:deb/debian/libssl3`,`pkg:deb/debian/openssl`
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-01-03 15:15:53
### [CVE-2025-66516](https://nvd.nist.gov/vuln/detail/CVE-2025-66516)
- **Author:** @lucasmrod
- **Status:** `not_affected`
@@ -227,6 +259,14 @@ Following is the vulnerability report of Fleet and its dependencies.
- **Justification:** `component_not_present`
- **Timestamp:** 2025-09-12 09:25:41
### [CVE-2025-15467](https://nvd.nist.gov/vuln/detail/CVE-2025-15467)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetctl uses Go's crypto and TLS implementation.
- **Products:**: `fleetctl`,`pkg:deb/debian/openssl`,`pkg:deb/debian/libssl3`
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-01-03 15:15:53
### [CVE-2024-7254](https://nvd.nist.gov/vuln/detail/CVE-2024-7254)
- **Author:** @lucasmrod
- **Status:** `not_affected`
security/vex/fleet/CVE-2025-15467.vex.json
+29
View File
@@ -0,0 +1,29 @@
{
"@context": "https://openvex.dev/ns/v0.2.0",
"@id": "https://openvex.dev/docs/public/vex-fdaba329936f0fd22015a46e3ec50795935a124977a1b1f1b5f16b76793bcdad",
"author": "@lucasmrod",
"timestamp": "2026-01-30T15:15:53.847361-03:00",
"version": 1,
"statements": [
{
"vulnerability": {
"name": "CVE-2025-15467"
},
"timestamp": "2026-01-03T15:15:53.847365-03:00",
"products": [
{
"@id": "fleet"
},
{
"@id": "pkg:apk/alpine/libcrypto3"
},
{
"@id": "pkg:apk/alpine/libssl3"
}
],
"status": "not_affected",
"status_notes": "fleet uses Go's crypto and TLS implementation",
"justification": "vulnerable_code_not_in_execute_path"
}
]
}
security/vex/fleet/CVE-2025-69419.vex.json
+29
View File
@@ -0,0 +1,29 @@
{
"@context": "https://openvex.dev/ns/v0.2.0",
"@id": "https://openvex.dev/docs/public/vex-fdaba329936f0fd22015a46e3ec50795935a124977a1b1f1b5f16b76793bcdad",
"author": "@lucasmrod",
"timestamp": "2026-01-30T15:15:53.847361-03:00",
"version": 1,
"statements": [
{
"vulnerability": {
"name": "CVE-2025-69419"
},
"timestamp": "2026-01-03T15:15:53.847365-03:00",
"products": [
{
"@id": "fleet"
},
{
"@id": "pkg:apk/alpine/libcrypto3"
},
{
"@id": "pkg:apk/alpine/libssl3"
}
],
"status": "not_affected",
"status_notes": "fleet uses Go's crypto and TLS implementation",
"justification": "vulnerable_code_not_in_execute_path"
}
]
}
security/vex/fleetctl/CVE-2025-15467.vex.json
+29
View File
@@ -0,0 +1,29 @@
{
"@context": "https://openvex.dev/ns/v0.2.0",
"@id": "https://openvex.dev/docs/public/vex-fdaba329936f0fd22015a46e3ec50795935a124977a1b1f1b5f16b76793bcdad",
"author": "@lucasmrod",
"timestamp": "2026-01-30T15:15:53.847361-03:00",
"version": 1,
"statements": [
{
"vulnerability": {
"name": "CVE-2025-15467"
},
"timestamp": "2026-01-03T15:15:53.847365-03:00",
"products": [
{
"@id": "fleetctl"
},
{
"@id": "pkg:deb/debian/openssl"
},
{
"@id": "pkg:deb/debian/libssl3"
}
],
"status": "not_affected",
"status_notes": "fleetctl uses Go's crypto and TLS implementation",
"justification": "vulnerable_code_not_in_execute_path"
}
]
}
security/vex/fleetctl/CVE-2025-69419.vex.json
+29
View File
@@ -0,0 +1,29 @@
{
"@context": "https://openvex.dev/ns/v0.2.0",
"@id": "https://openvex.dev/docs/public/vex-fdaba329936f0fd22015a46e3ec50795935a124977a1b1f1b5f16b76793bcdad",
"author": "@lucasmrod",
"timestamp": "2026-01-30T15:15:53.847361-03:00",
"version": 1,
"statements": [
{
"vulnerability": {
"name": "CVE-2025-69419"
},
"timestamp": "2026-01-03T15:15:53.847365-03:00",
"products": [
{
"@id": "fleetctl"
},
{
"@id": "pkg:deb/debian/libssl3"
},
{
"@id": "pkg:deb/debian/openssl"
}
],
"status": "not_affected",
"status_notes": "fleet uses Go's crypto and TLS implementation",
"justification": "vulnerable_code_not_in_execute_path"
}
]
}
security/vex/fleetctl/CVE-2026-24515.vex.json
+26
View File
@@ -0,0 +1,26 @@
{
"@context": "https://openvex.dev/ns/v0.2.0",
"@id": "https://openvex.dev/docs/public/vex-fdaba329936f0fd22015a46e3ec50795935a124977a1b1f1b5f16b76793bcdad",
"author": "@lucasmrod",
"timestamp": "2026-01-30T15:15:53.847361-03:00",
"version": 1,
"statements": [
{
"vulnerability": {
"name": "CVE-2026-24515"
},
"timestamp": "2026-01-03T15:15:53.847365-03:00",
"products": [
{
"@id": "fleetctl"
},
{
"@id": "pkg:deb/debian/libexpat1"
}
],
"status": "not_affected",
"status_notes": "fleetctl does not process XML using libexpat1, and when genrating packages the XMLs are defined",
"justification": "vulnerable_code_not_in_execute_path"
}
]
}