From d9b05ffc1cccc60d3461b593b1ee665c469f5a4a Mon Sep 17 00:00:00 2001 From: Matt Collins Date: Thu, 23 Jul 2026 04:04:49 +0000 Subject: [PATCH 1/2] UID2-7557: suppress jackson-core GHSA-r7wm-3cxj-wff9 (async parser, not reachable) Trivy flagged jackson-core GHSA-r7wm-3cxj-wff9 (HIGH) - an async-parser maxNumberLength bypass, the incomplete-fix successor to GHSA-72hv-8253-57qq. Our services parse JSON only via the synchronous ObjectMapper API, never jackson-core's non-blocking/async parser, so the vulnerable path is not reachable (same rationale as the already-suppressed predecessor, UID2-6670). A jackson bump is also in flight via uid2-shared PR #631. Suppress in .trivyignore with expiry 2026-08-23. Co-Authored-By: Claude Opus 4.8 (1M context) --- .trivyignore | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.trivyignore b/.trivyignore index 938c77478..2c3e8628b 100644 --- a/.trivyignore +++ b/.trivyignore @@ -62,3 +62,9 @@ CVE-2026-2100 exp:2026-09-01 CVE-2026-56131 exp:2026-08-09 CVE-2026-56407 exp:2026-08-09 CVE-2026-56408 exp:2026-08-09 + +# jackson-core async parser maxNumberLength bypass (GHSA-r7wm-3cxj-wff9) - incomplete fix for +# GHSA-72hv-8253-57qq. Not exploitable: services only use the synchronous ObjectMapper API, not +# jackson-core's non-blocking/async parser. A jackson bump is also in flight via uid2-shared +# (PR #631) and will flow on the next release. See: UID2-7557 (predecessor UID2-6670) +GHSA-r7wm-3cxj-wff9 exp:2026-08-23 From 342115bd522aa2e03e8c27ec4aa87e873894a80d Mon Sep 17 00:00:00 2001 From: Matt Collins Date: Thu, 23 Jul 2026 04:45:13 +0000 Subject: [PATCH 2/2] UID2-7279: drop stale CVE-2026-45447 .trivyignore entry (expired 2026-07-11, fixed upstream) The libcrypto3 PKCS#7 CVE is no longer flagged by the current base-image scan (Alpine base rebuilt with the fix); the suppression expired 2026-07-11. Removing the dead entry. Co-Authored-By: Claude Opus 4.8 (1M context) --- .trivyignore | 6 ------ 1 file changed, 6 deletions(-) diff --git a/.trivyignore b/.trivyignore index 2c3e8628b..732e08b20 100644 --- a/.trivyignore +++ b/.trivyignore @@ -31,12 +31,6 @@ CVE-2026-22184 exp:2026-09-09 # Availability only (C:N/I:N/A:H). Tracking via UID2-7035; revisit on vert.x 5 migration. CVE-2026-42577 exp:2026-09-11 -# CVE-2026-45447 — libcrypto3 PKCS#7/S/MIME memory corruption in Alpine base image. -# uid2-operator is a pure Java service; the JVM uses JSSE for TLS, not the native -# libcrypto3 C library. No JNI or OpenSSL calls in source. Attack vector (malformed -# PKCS#7/S/MIME parsing) is not reachable from this service. See: UID2-7279 -CVE-2026-45447 exp:2026-07-11 - # jackson-databind data-binding vulnerability - no upstream fix released yet (fix targets: 2.18.8, 2.21.4, 3.1.4) # jackson-databind is pulled in transitively via uid2-shared; the version fix is tracked in # uid2-shared (https://github.com/IABTechLab/uid2-shared/pull/631) and will flow here on the