From c557bcb7829f5a85b59ada47a55ce1e87dfe1a90 Mon Sep 17 00:00:00 2001 From: Lucas Manuel Rodriguez Date: Thu, 11 Dec 2025 10:42:50 -0300 Subject: [PATCH] Update security status (#37086) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Update our `security/status.md` file after analyzing currently reported vulnerabilities. https://github.com/fleetdm/fleet/actions/runs/20115346825 Screenshot 2025-12-10 at 7 41 00 PM --- orbit/changes/34052-fleet-desktop-icon-macos | 1 + orbit/changes/update-go-1.25.5 | 1 + security/README.md | 6 +- security/status.md | 62 +++++++++++++++++++ security/vex/fleet/CVE-2025-61729.vex.json | 58 +++++++++++++++++ security/vex/fleetctl/CVE-2025-61729.vex.json | 58 +++++++++++++++++ security/vex/fleetctl/CVE-2025-64720.vex.json | 26 ++++++++ security/vex/fleetctl/CVE-2025-65018.vex.json | 26 ++++++++ security/vex/fleetctl/CVE-2025-66293.vex.json | 26 ++++++++ security/vex/fleetctl/CVE-2025-66516.vex.json | 26 ++++++++ 10 files changed, 288 insertions(+), 2 deletions(-) create mode 100644 orbit/changes/34052-fleet-desktop-icon-macos create mode 100644 orbit/changes/update-go-1.25.5 create mode 100644 security/vex/fleet/CVE-2025-61729.vex.json create mode 100644 security/vex/fleetctl/CVE-2025-61729.vex.json create mode 100644 security/vex/fleetctl/CVE-2025-64720.vex.json create mode 100644 security/vex/fleetctl/CVE-2025-65018.vex.json create mode 100644 security/vex/fleetctl/CVE-2025-66293.vex.json create mode 100644 security/vex/fleetctl/CVE-2025-66516.vex.json diff --git a/orbit/changes/34052-fleet-desktop-icon-macos b/orbit/changes/34052-fleet-desktop-icon-macos new file mode 100644 index 0000000000..e1f382eec3 --- /dev/null +++ b/orbit/changes/34052-fleet-desktop-icon-macos @@ -0,0 +1 @@ +* Switched Fleet logo in macOS Desktop from a PNG to an SVG. diff --git a/orbit/changes/update-go-1.25.5 b/orbit/changes/update-go-1.25.5 new file mode 100644 index 0000000000..dc370065d2 --- /dev/null +++ b/orbit/changes/update-go-1.25.5 @@ -0,0 +1 @@ +* Updated go to 1.25.5. diff --git a/security/README.md b/security/README.md index 8c80803bc5..bd5cee0c07 100644 --- a/security/README.md +++ b/security/README.md @@ -11,8 +11,10 @@ The following Github CI actions perform daily vulnerability scanning on Fleet software components. - [trivy-scan.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/trivy-scan.yml): Scan source code for vulnerabilities. -- [build-and-check-fleetctl-docker-and-deps.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/build-and-check-fleetctl-docker-and-deps.yml): Scans for `HIGH` and `CRITICAL` vulnerabilities in `fleetctl` docker image dependencies (`fleetdm/fleetctl`, `fleetdm/wix`, and `fleetdm/bomutils`). -- [goreleaser-snapshot-fleet.yaml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/goreleaser-snapshot-fleet.yaml): Scans for HIGH and CRITICAL vulnerabilities in `fleetdm/fleet` docker image before pushing to the Docker registry (runs daily and is triggered for every change in Fleet's source code). +- [build-fleetdm-fleetctl-check-vulnerabilities.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/build-fleetdm-fleetctl-check-vulnerabilities.yml): Scans for `HIGH` and `CRITICAL` vulnerabilities in [fleetdm/fleetctl](https://hub.docker.com/r/fleetdm/fleetctl) docker image. +- [check-wix-vulnerabilities.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/check-wix-vulnerabilities.yml): Scans for `HIGH` and `CRITICAL` vulnerabilities in [fleetdm/wix](https://hub.docker.com/r/fleetdm/wix) docker image. This docker image is used by the `fleetctl` executable to generate MSI fleetd installers. +- [check-bomutils-vulnerabilities.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/check-bomutils-vulnerabilities.yml): Scans for `HIGH` and `CRITICAL` vulnerabilities in [fleetdm/bomutils](https://hub.docker.com/r/fleetdm/bomutils) docker image. This docker image is used by the `fleetctl` executable to generate PKG fleetd installers. +- [goreleaser-snapshot-fleet.yaml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/goreleaser-snapshot-fleet.yaml): Scans for `HIGH` and `CRITICAL` vulnerabilities in `fleetdm/fleet` docker image before pushing a new release to the Docker registry. - [check-vulnerabilities-in-released-docker-images.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/check-vulnerabilities-in-released-docker-images.yml): Scans for `CRITICAL` vulnerabilities in the last 5 minor released versions of the `fleetdm/fleet` and on the latest release of `fleetdm/fleetctl`. ## Process to run when a CVE is reported diff --git a/security/status.md b/security/status.md index 885e1b3943..d6f9552812 100644 --- a/security/status.md +++ b/security/status.md @@ -13,6 +13,21 @@ Following is the vulnerability report of Fleet and its dependencies. - **Justification:** `vulnerable_code_not_in_execute_path` - **Timestamp:** 2025-10-01 10:09:03 +### [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) +#### Statement: +- **Author:** @lucasmrod +- **Status:** `fixed` +- **Products:**: `fleet@v4.78.*` +- **Timestamp:** 2025-12-10 19:26:25 + +#### Statement: +- **Author:** @lucasmrod +- **Status:** `affected` +- **Status notes:** This is not a CRITICAL CVE, but we still recommend upgrading to 4.78.* when it's available. +- **Products:**: `fleet@v4.77.0`,`fleet@v4.76.0`,`fleet@v4.76.1`,`fleet@v4.75.0`,`fleet@v4.75.1`,`pkg:golang/stdlib@1.25.3` +- **Action statement:** `No action statement provided` +- **Timestamp:** 2025-12-10 19:26:10 + ### [CVE-2025-46569](https://nvd.nist.gov/vuln/detail/CVE-2025-46569) - **Author:** @lucasmrod - **Status:** `not_affected` @@ -101,6 +116,53 @@ Following is the vulnerability report of Fleet and its dependencies. ## `fleetdm/fleetctl` docker image +### [CVE-2025-66516](https://nvd.nist.gov/vuln/detail/CVE-2025-66516) +- **Author:** @lucasmrod +- **Status:** `not_affected` +- **Status notes:** fleetdm/fleetctl does not process end-user provided PDF files with Java when generating fleetd installers. The only PDF processing code is in Go for EULA documents. +- **Products:**: `fleetctl`,`pkg:maven/org.apache.tika/tika-core` +- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary` +- **Timestamp:** 2025-12-10 18:12:45 + +### [CVE-2025-66293](https://nvd.nist.gov/vuln/detail/CVE-2025-66293) +- **Author:** @lucasmrod +- **Status:** `not_affected` +- **Status notes:** fleetdm/fleetctl does not use libpng. Fleet components use the 'image/png' Go package for png processing. +- **Products:**: `fleetctl`,`pkg:deb/debian/libpng16-16` +- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary` +- **Timestamp:** 2025-12-10 19:04:58 + +### [CVE-2025-65018](https://nvd.nist.gov/vuln/detail/CVE-2025-65018) +- **Author:** @lucasmrod +- **Status:** `not_affected` +- **Status notes:** fleetdm/fleetctl does not use libpng. Fleet components use the 'image/png' Go package for png processing. +- **Products:**: `fleetctl`,`pkg:deb/debian/libpng16-16` +- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary` +- **Timestamp:** 2025-12-10 19:04:42 + +### [CVE-2025-64720](https://nvd.nist.gov/vuln/detail/CVE-2025-64720) +- **Author:** @lucasmrod +- **Status:** `not_affected` +- **Status notes:** fleetdm/fleetctl does not use libpng. Fleet components use the 'image/png' Go package for png processing. +- **Products:**: `fleetctl`,`pkg:deb/debian/libpng16-16` +- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary` +- **Timestamp:** 2025-12-10 19:04:07 + +### [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) +#### Statement: +- **Author:** @lucasmrod +- **Status:** `fixed` +- **Products:**: `fleetctl@v4.78.*` +- **Timestamp:** 2025-12-10 19:26:44 + +#### Statement: +- **Author:** @lucasmrod +- **Status:** `affected` +- **Status notes:** This is not a CRITICAL CVE, but we still recommend upgrading to 4.78.* when it's available. +- **Products:**: `fleetctl@v4.77.0`,`fleetctl@v4.76.0`,`fleetctl@v4.76.1`,`fleetctl@v4.75.0`,`fleetctl@v4.75.1`,`pkg:golang/stdlib@1.25.3` +- **Action statement:** `No action statement provided` +- **Timestamp:** 2025-12-10 19:26:35 + ### [CVE-2025-49796](https://nvd.nist.gov/vuln/detail/CVE-2025-49796) - **Author:** @sgress454 - **Status:** `not_affected` diff --git a/security/vex/fleet/CVE-2025-61729.vex.json b/security/vex/fleet/CVE-2025-61729.vex.json new file mode 100644 index 0000000000..6d745b6973 --- /dev/null +++ b/security/vex/fleet/CVE-2025-61729.vex.json @@ -0,0 +1,58 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-70a31e17085372696de6af69bd69d1fba9afeabb8a1d4f003aeb6b867fa98250", + "author": "@lucasmrod", + "timestamp": "2025-12-10T19:26:10.114603-03:00", + "last_updated": "2025-12-10T19:26:25.983491-03:00", + "version": 2, + "statements": [ + { + "vulnerability": { + "name": "CVE-2025-61729", + "aliases": [ + "https://pkg.go.dev/vuln/GO-2025-4155" + ] + }, + "timestamp": "2025-12-10T19:26:10.114604-03:00", + "products": [ + { + "@id": "fleet@v4.77.0" + }, + { + "@id": "fleet@v4.76.0" + }, + { + "@id": "fleet@v4.76.1" + }, + { + "@id": "fleet@v4.75.0" + }, + { + "@id": "fleet@v4.75.1" + }, + { + "@id": "pkg:golang/stdlib@1.25.3" + } + ], + "status": "affected", + "status_notes": "This is not a CRITICAL CVE, but we still recommend upgrading to 4.78.* when it's available", + "action_statement": "No action statement provided", + "action_statement_timestamp": "2025-12-10T19:26:10.114604-03:00" + }, + { + "vulnerability": { + "name": "CVE-2025-61729", + "aliases": [ + "https://pkg.go.dev/vuln/GO-2025-4155" + ] + }, + "timestamp": "2025-12-10T19:26:25.983491-03:00", + "products": [ + { + "@id": "fleet@v4.78.*" + } + ], + "status": "fixed" + } + ] +} diff --git a/security/vex/fleetctl/CVE-2025-61729.vex.json b/security/vex/fleetctl/CVE-2025-61729.vex.json new file mode 100644 index 0000000000..0e10686f58 --- /dev/null +++ b/security/vex/fleetctl/CVE-2025-61729.vex.json @@ -0,0 +1,58 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-f8c19c3ccf1d0a0d11064148d5f0b464260d62d948c23bd8034664a0a9dfa91d", + "author": "@lucasmrod", + "timestamp": "2025-12-10T19:26:35.526636-03:00", + "last_updated": "2025-12-10T19:26:44.598903-03:00", + "version": 2, + "statements": [ + { + "vulnerability": { + "name": "CVE-2025-61729", + "aliases": [ + "https://pkg.go.dev/vuln/GO-2025-4155" + ] + }, + "timestamp": "2025-12-10T19:26:35.526637-03:00", + "products": [ + { + "@id": "fleetctl@v4.77.0" + }, + { + "@id": "fleetctl@v4.76.0" + }, + { + "@id": "fleetctl@v4.76.1" + }, + { + "@id": "fleetctl@v4.75.0" + }, + { + "@id": "fleetctl@v4.75.1" + }, + { + "@id": "pkg:golang/stdlib@1.25.3" + } + ], + "status": "affected", + "status_notes": "This is not a CRITICAL CVE, but we still recommend upgrading to 4.78.* when it's available", + "action_statement": "No action statement provided", + "action_statement_timestamp": "2025-12-10T19:26:35.526637-03:00" + }, + { + "vulnerability": { + "name": "CVE-2025-61729", + "aliases": [ + "https://pkg.go.dev/vuln/GO-2025-4155" + ] + }, + "timestamp": "2025-12-10T19:26:44.598904-03:00", + "products": [ + { + "@id": "fleetctl@v4.78.*" + } + ], + "status": "fixed" + } + ] +} diff --git a/security/vex/fleetctl/CVE-2025-64720.vex.json b/security/vex/fleetctl/CVE-2025-64720.vex.json new file mode 100644 index 0000000000..fd5bce97ef --- /dev/null +++ b/security/vex/fleetctl/CVE-2025-64720.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-cf7a25c62203c07f3cc0f81ef456cc904ee3030738a7d79197db42c870f2348e", + "author": "@lucasmrod", + "timestamp": "2025-12-10T19:04:07.17996-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2025-64720" + }, + "timestamp": "2025-12-10T19:04:07.17996-03:00", + "products": [ + { + "@id": "fleetctl" + }, + { + "@id": "pkg:deb/debian/libpng16-16" + } + ], + "status": "not_affected", + "status_notes": "fleetdm/fleetctl does not use libpng. Fleet components use the 'image/png' Go package for png processing", + "justification": "vulnerable_code_cannot_be_controlled_by_adversary" + } + ] +} diff --git a/security/vex/fleetctl/CVE-2025-65018.vex.json b/security/vex/fleetctl/CVE-2025-65018.vex.json new file mode 100644 index 0000000000..d5e4590a1c --- /dev/null +++ b/security/vex/fleetctl/CVE-2025-65018.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-205287daa41f5f47e114aa1b974930f4188026e04e84d1d2009d64a6b30d7ef8", + "author": "@lucasmrod", + "timestamp": "2025-12-10T19:04:42.718401-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2025-65018" + }, + "timestamp": "2025-12-10T19:04:42.718402-03:00", + "products": [ + { + "@id": "fleetctl" + }, + { + "@id": "pkg:deb/debian/libpng16-16" + } + ], + "status": "not_affected", + "status_notes": "fleetdm/fleetctl does not use libpng. Fleet components use the 'image/png' Go package for png processing", + "justification": "vulnerable_code_cannot_be_controlled_by_adversary" + } + ] +} diff --git a/security/vex/fleetctl/CVE-2025-66293.vex.json b/security/vex/fleetctl/CVE-2025-66293.vex.json new file mode 100644 index 0000000000..7f1c7bd1fc --- /dev/null +++ b/security/vex/fleetctl/CVE-2025-66293.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-9cf22a6de776d8bf4b90f8177d5f22aa878a0e6ecd3616f5863b6739ceece84a", + "author": "@lucasmrod", + "timestamp": "2025-12-10T19:04:58.902397-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2025-66293" + }, + "timestamp": "2025-12-10T19:04:58.902398-03:00", + "products": [ + { + "@id": "fleetctl" + }, + { + "@id": "pkg:deb/debian/libpng16-16" + } + ], + "status": "not_affected", + "status_notes": "fleetdm/fleetctl does not use libpng. Fleet components use the 'image/png' Go package for png processing", + "justification": "vulnerable_code_cannot_be_controlled_by_adversary" + } + ] +} diff --git a/security/vex/fleetctl/CVE-2025-66516.vex.json b/security/vex/fleetctl/CVE-2025-66516.vex.json new file mode 100644 index 0000000000..0e3cb1b14b --- /dev/null +++ b/security/vex/fleetctl/CVE-2025-66516.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-e83a3bb89b00837be30b188bd3eed874867824a0e4496a329b4e0884beeccb9c", + "author": "@lucasmrod", + "timestamp": "2025-12-10T18:12:45.166362-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2025-66516" + }, + "timestamp": "2025-12-10T18:12:45.166363-03:00", + "products": [ + { + "@id": "fleetctl" + }, + { + "@id": "pkg:maven/org.apache.tika/tika-core" + } + ], + "status": "not_affected", + "status_notes": "fleetdm/fleetctl does not process end-user provided PDF files with Java when generating fleetd installers. The only PDF processing code is in Go for EULA documents.", + "justification": "vulnerable_code_cannot_be_controlled_by_adversary" + } + ] +}