From 91b3dd697caf583248dcb2aa56a8c054580de774 Mon Sep 17 00:00:00 2001
From: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Date: Tue, 19 May 2026 11:49:12 -0300
Subject: [PATCH] Ignore bomutils CVEs (#45800)

Fixes:
https://github.com/fleetdm/fleet/actions/runs/26082608768/job/76687709248.

Run: https://github.com/fleetdm/fleet/actions/runs/26104309524.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Added vulnerability assessment documents for CVE-2026-29111 and
CVE-2026-4878 indicating these vulnerabilities do not affect the
product.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45800?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 security/status.md                            | 16 ++++++++++
 security/vex/bomutils/CVE-2026-29111.vex.json | 29 +++++++++++++++++++
 security/vex/bomutils/CVE-2026-4878.vex.json  | 29 +++++++++++++++++++
 3 files changed, 74 insertions(+)
 create mode 100644 security/vex/bomutils/CVE-2026-29111.vex.json
 create mode 100644 security/vex/bomutils/CVE-2026-4878.vex.json

diff --git a/security/status.md b/security/status.md
index 632306fd62..a4f8657bcc 100644
--- a/security/status.md
+++ b/security/status.md
@@ -765,6 +765,14 @@ Following is the vulnerability report of Fleet and its dependencies.
 
 ## `fleetdm/bomutils` docker image
 
+### [CVE-2026-4878](https://nvd.nist.gov/vuln/detail/CVE-2026-4878)
+- **Author:** @lucasmrod
+- **Status:** `not_affected`
+- **Status notes:** mkbom and xar from fleetdm/bomutils do not call cap_set_file().
+- **Products:** `bomutils`,`pkg:deb/debian/libcap2`,`pkg:deb/debian/libcap2-bin`
+- **Justification:** `vulnerable_code_not_in_execute_path`
+- **Timestamp:** 2026-05-19 10:25:00
+
 ### [CVE-2026-31789](https://nvd.nist.gov/vuln/detail/CVE-2026-31789)
 - **Author:** @lucasmrod
 - **Status:** `not_affected`
@@ -773,6 +781,14 @@ Following is the vulnerability report of Fleet and its dependencies.
 - **Justification:** `vulnerable_code_not_in_execute_path`
 - **Timestamp:** 2026-04-27 14:28:25
 
+### [CVE-2026-29111](https://nvd.nist.gov/vuln/detail/CVE-2026-29111)
+- **Author:** @lucasmrod
+- **Status:** `not_affected`
+- **Status notes:** mkbom and xar from fleetdm/bomutils do not use systemd IPC APIs.
+- **Products:** `bomutils`,`pkg:deb/debian/libsystemd0`,`pkg:deb/debian/libudev1`
+- **Justification:** `vulnerable_code_not_in_execute_path`
+- **Timestamp:** 2026-05-19 10:25:00
+
 ### [CVE-2026-28390](https://nvd.nist.gov/vuln/detail/CVE-2026-28390)
 - **Author:** @lucasmrod
 - **Status:** `not_affected`
diff --git a/security/vex/bomutils/CVE-2026-29111.vex.json b/security/vex/bomutils/CVE-2026-29111.vex.json
new file mode 100644
index 0000000000..40b7cb1a12
--- /dev/null
+++ b/security/vex/bomutils/CVE-2026-29111.vex.json
@@ -0,0 +1,29 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-1a423d64a3cd480f2dfc14f1239d3c07765a885b166eeb4d0e3195e17301eb97",
+  "author": "@lucasmrod",
+  "timestamp": "2026-05-19T10:25:00.000000-03:00",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2026-29111"
+      },
+      "timestamp": "2026-05-19T10:25:00.000000-03:00",
+      "products": [
+        {
+          "@id": "bomutils"
+        },
+        {
+          "@id": "pkg:deb/debian/libsystemd0"
+        },
+        {
+          "@id": "pkg:deb/debian/libudev1"
+        }
+      ],
+      "status": "not_affected",
+      "status_notes": "mkbom and xar from fleetdm/bomutils do not use systemd IPC APIs",
+      "justification": "vulnerable_code_not_in_execute_path"
+    }
+  ]
+}
diff --git a/security/vex/bomutils/CVE-2026-4878.vex.json b/security/vex/bomutils/CVE-2026-4878.vex.json
new file mode 100644
index 0000000000..6311a9bdfa
--- /dev/null
+++ b/security/vex/bomutils/CVE-2026-4878.vex.json
@@ -0,0 +1,29 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-8c9c9f5a907de09127f39bed428cf3e4cc9af921abccf73926fa1d36405b89c8",
+  "author": "@lucasmrod",
+  "timestamp": "2026-05-19T10:25:00.000000-03:00",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2026-4878"
+      },
+      "timestamp": "2026-05-19T10:25:00.000000-03:00",
+      "products": [
+        {
+          "@id": "bomutils"
+        },
+        {
+          "@id": "pkg:deb/debian/libcap2"
+        },
+        {
+          "@id": "pkg:deb/debian/libcap2-bin"
+        }
+      ],
+      "status": "not_affected",
+      "status_notes": "mkbom and xar from fleetdm/bomutils do not call cap_set_file()",
+      "justification": "vulnerable_code_not_in_execute_path"
+    }
+  ]
+}