Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

Add scanning to released images and process to track vulnerabilities (#28087)

Browse Source 
For #25902.

---------

Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
This commit is contained in:
Lucas Manuel Rodriguez
2025-04-16 11:50:10 -03:00
committed by GitHub
co-authored by Sharon Katz
parent 83a358f588
commit 895194d63b
27 changed files with 980 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/code/.trivyignore
+19
View File
@@ -0,0 +1,19 @@
# These AWS SDK CVEs do not impact Fleet as we do not use S3 client-side crypto features
CVE-2020-8911
CVE-2020-8912
GHSA-7f33-f4f5-xwgw
GHSA-f5pg-7wfw-84q9
# Vulnerable code in trim is not used in Fleet
CVE-2020-7753
# We feel like the risk of DoS using this technique, which requires being logged in, is low probability and low impact, as such we will not update glob-parent only for this CVE
CVE-2020-28469
# 2024/04/04 (github.com/goreleaser/nfpm/v2 should be updated)
# When packaging linux files, we do not use global permissions. Manually verified that packed fleet-osquery files do not have group/global write permissions.
CVE-2023-32698