From 746309ca47593db5c75d4e953785094be2fc9cd9 Mon Sep 17 00:00:00 2001 From: Victor Lyuboslavsky Date: Wed, 3 Apr 2024 16:04:01 -0500 Subject: [PATCH] Waive 3 Go code scanning vulnerability alerts. (#18007) Waiving 3 Go code scanning alerts flagged by osv-scanner. --- osv-scanner.toml | 10 ++++++++++ terraform/addons/monitoring/lambda/osv-scanner.toml | 6 ++++++ tools/blackhat-mdm/mdm_server_poc/osv-scanner.toml | 6 ++++++ 3 files changed, 22 insertions(+) create mode 100644 osv-scanner.toml create mode 100644 terraform/addons/monitoring/lambda/osv-scanner.toml create mode 100644 tools/blackhat-mdm/mdm_server_poc/osv-scanner.toml diff --git a/osv-scanner.toml b/osv-scanner.toml new file mode 100644 index 0000000000..a8f2449ff7 --- /dev/null +++ b/osv-scanner.toml @@ -0,0 +1,10 @@ +# Configure OSV-Scanner +# https://google.github.io/osv-scanner/configuration/ + +[[IgnoredVulns]] +id = "GO-2022-0646" +reason = "2024/04/02 - This project does not use github.com/aws/aws-sdk-go/service/s3/s3crypto. Reference: https://osv.dev/vulnerability/GO-2022-0646" + +[[IgnoredVulns]] +id = "GO-2023-1788" +reason = "2024/04/02 - When packaging linux files, we do not use global permissions. Manually verified that packed fleet-osquery files do not have group/global write permissions. Reference: https://osv.dev/vulnerability/GO-2023-1788" diff --git a/terraform/addons/monitoring/lambda/osv-scanner.toml b/terraform/addons/monitoring/lambda/osv-scanner.toml new file mode 100644 index 0000000000..e1bce5d2de --- /dev/null +++ b/terraform/addons/monitoring/lambda/osv-scanner.toml @@ -0,0 +1,6 @@ +# Configure OSV-Scanner +# https://google.github.io/osv-scanner/configuration/ + +[[IgnoredVulns]] +id = "GO-2022-0646" +reason = "2024/04/02 - This project does not use github.com/aws/aws-sdk-go/service/s3/s3crypto. Reference: https://osv.dev/vulnerability/GO-2022-0646" diff --git a/tools/blackhat-mdm/mdm_server_poc/osv-scanner.toml b/tools/blackhat-mdm/mdm_server_poc/osv-scanner.toml new file mode 100644 index 0000000000..0ece8d3378 --- /dev/null +++ b/tools/blackhat-mdm/mdm_server_poc/osv-scanner.toml @@ -0,0 +1,6 @@ +# Configure OSV-Scanner +# https://google.github.io/osv-scanner/configuration/ + +[[IgnoredVulns]] +id = "GO-2023-2402" +reason = "2024/04/02 - This is not production code."