Remediate compress and cryptography CVEs in agent images - #493
Merged
Conversation
GO-2026-5841 is an out-of-bounds read in github.com/klauspost/compress/s2, introduced in 1.16.0 and fixed in 1.18.7. The agent and cluster-agent images both still carried v1.18.5, and the exception covering it expired 2026-08-20. Bumped in the 19 workspace modules that pinned v1.18.5, then re-synced with go work sync and per-module go mod tidy; go work sync added the indirect requirement to two more modules. datadogconnector (v1.18.0) and test/integration/serverless/src (v1.17.11) are outside go.work and ship in neither image, so they are left for separate review. The GO-2026-5841 exceptions are dropped rather than renewed: with the fix in source they would suppress a regression instead of documenting a gap. Verified that the rebuilt cluster-agent and process-agent binaries embed compress v1.18.7 via go version -m, and that a cluster-agent image carrying the rebuilt binary reports zero Trivy and zero Grype findings, down from 9 and 6 on the published tag. Refs: StackVista/cve-reporter#29 Tracking: #492 Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
Every stackstate-k8s-agent and stackstate-k8s-cluster-agent exception expired on 2026-08-20. The SLA requires re-checking upstream at each renewal rather than extending the date, and that re-check changes the answer for most of them. Seven python entries are obsolete. They were written against the embedded 3.13.13 runtime, and the 3.13.15 bump in #463 already carries the fix: Grype now lists 3.13.15 among the fixed versions for CVE-2025-15366, CVE-2026-0864, CVE-2026-11940, CVE-2026-11972, CVE-2026-12003, CVE-2026-15308 and CVE-2026-6879. Renewing them would have asserted an upstream gap that no longer exists, and keeping them would suppress the findings if the interpreter ever moved back. CVE-2025-15367 and CVE-2026-4360 survive the re-check -- the first is fixed only in the 3.15.0a6 pre-release, the second has no fixed version at all -- so they keep a short review deadline and their purl moves to 3.13.15 to match what the image will contain. CVE-2026-14456 is new, and is not a version bump. Scanners name 3.5.8, 3.6.4 and 4.0.2 as fixed, but none of those are released: the newest tags are 3.5.7, 3.6.3 and 4.0.1, and OSV enumerates all three as affected. 3.5.7 is already what we pin. The vulnerable path is the QUIC server listener, which the agent does not run. Without an entry the finding publishes unmanaged. The cryptography entries keep a deadline on the SLA date and now name the actual blocker: the version is pinned in stackstate-agent-integrations at the tag STACKSTATE_INTEGRATIONS_VERSION selects, so it cannot be changed here. Refs: StackVista/cve-reporter#29 Tracking: #492, #489, #484 Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
LouisLotter
changed the title
There was a problem hiding this comment.
Pull request overview
Remediates Go compression and Python cryptography vulnerabilities in shipped agent images while refreshing scanner exceptions.
Changes:
- Upgrades
klauspost/compresstov1.18.7across the workspace. - Consumes integrations
7.78.2-5, bundlingcryptography 50.0.0. - Removes resolved CVE exceptions and refreshes remaining temporary exceptions.
Reviewed changes
Copilot reviewed 40 out of 86 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
go.mod |
Pins compress v1.18.7. |
go.sum |
Updates dependency checksums. |
stackstate-deps.json |
Bumps integrations to 7.78.2-5. |
releasenotes/notes/issue-492-klauspost-compress-cve-remediation-7c4e19b06d2f83a1.yaml |
Documents security remediations. |
tools/build-ddot-byoc/go.mod |
Pins compress v1.18.7. |
tools/build-ddot-byoc/go.sum |
Updates checksums. |
internal/tools/gotest-custom/go.mod |
Pins compress v1.18.7. |
internal/tools/gotest-custom/go.sum |
Updates checksums. |
test/otel/go.mod |
Updates transitive dependency. |
test/otel/go.sum |
Updates checksums. |
test/new-e2e/go.mod |
Updates transitive dependency. |
test/new-e2e/go.sum |
Updates checksums. |
test/fakeintake/go.mod |
Updates transitive dependency. |
test/fakeintake/go.sum |
Updates checksums. |
test/e2e-framework/go.mod |
Updates transitive dependency. |
test/e2e-framework/go.sum |
Updates checksums. |
pkg/util/prometheus/go.mod |
Records updated transitive dependency. |
pkg/util/prometheus/go.sum |
Updates checksums. |
pkg/util/grpc/go.sum |
Updates checksums. |
pkg/util/compression/go.mod |
Pins compress v1.18.7. |
pkg/util/compression/go.sum |
Updates checksums. |
pkg/trace/otel/go.sum |
Updates checksums. |
pkg/telemetry/go.sum |
Updates checksums. |
pkg/serializer/go.mod |
Updates transitive dependency. |
pkg/serializer/go.sum |
Updates checksums. |
pkg/process/util/api/go.mod |
Updates transitive dependency. |
pkg/process/util/api/go.sum |
Updates checksums. |
pkg/opentelemetry-mapping-go/otlp/logs/go.mod |
Updates transitive dependency. |
pkg/opentelemetry-mapping-go/otlp/logs/go.sum |
Updates checksums. |
pkg/network/driver/go.sum |
Updates checksums. |
pkg/metrics/go.sum |
Updates checksums. |
pkg/logs/sender/go.sum |
Updates checksums. |
pkg/logs/processor/go.sum |
Updates checksums. |
pkg/logs/pipeline/go.sum |
Updates checksums. |
pkg/logs/metrics/go.sum |
Updates checksums. |
pkg/logs/client/go.sum |
Updates checksums. |
pkg/fleet/installer/go.mod |
Updates transitive dependency. |
pkg/fleet/installer/go.sum |
Updates checksums. |
pkg/config/remote/go.sum |
Updates checksums. |
comp/serializer/metricscompression/go.sum |
Updates checksums. |
comp/serializer/logscompression/go.sum |
Updates checksums. |
comp/otelcol/status/impl/go.sum |
Updates checksums. |
comp/otelcol/otlp/components/processor/infraattributesprocessor/go.sum |
Updates checksums. |
comp/otelcol/otlp/components/exporter/serializerexporter/go.mod |
Updates transitive dependency. |
comp/otelcol/otlp/components/exporter/serializerexporter/go.sum |
Updates checksums. |
comp/otelcol/otlp/components/exporter/logsagentexporter/go.mod |
Updates transitive dependency. |
comp/otelcol/otlp/components/exporter/logsagentexporter/go.sum |
Updates checksums. |
comp/otelcol/otlp/components/exporter/datadogexporter/go.mod |
Updates transitive dependency. |
comp/otelcol/otlp/components/exporter/datadogexporter/go.sum |
Updates checksums. |
comp/otelcol/logsagentpipeline/logsagentpipelineimpl/go.sum |
Updates checksums. |
comp/otelcol/logsagentpipeline/go.sum |
Updates checksums. |
comp/otelcol/ddprofilingextension/impl/go.mod |
Updates transitive dependency. |
comp/otelcol/ddprofilingextension/impl/go.sum |
Updates checksums. |
comp/otelcol/ddflareextension/impl/go.mod |
Updates transitive dependency. |
comp/otelcol/ddflareextension/impl/go.sum |
Updates checksums. |
comp/otelcol/collector-contrib/impl/go.mod |
Updates transitive dependency. |
comp/otelcol/collector-contrib/impl/go.sum |
Updates checksums. |
comp/otelcol/collector-contrib/def/go.mod |
Records updated transitive dependency. |
comp/otelcol/collector-contrib/def/go.sum |
Updates checksums. |
comp/forwarder/orchestrator/orchestratorinterface/go.sum |
Updates checksums. |
comp/forwarder/defaultforwarder/go.sum |
Updates checksums. |
comp/core/telemetry/go.mod |
Updates transitive dependency. |
comp/core/telemetry/go.sum |
Updates checksums. |
comp/core/tagger/subscriber/go.sum |
Updates checksums. |
comp/core/tagger/impl-remote/go.sum |
Updates checksums. |
comp/core/tagger/fx-remote/go.sum |
Updates checksums. |
comp/core/secrets/impl/go.sum |
Updates checksums. |
comp/core/configsync/go.sum |
Updates checksums. |
comp/core/agenttelemetry/impl/go.sum |
Updates checksums. |
exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml |
Extends reviewed exception. |
exceptions/stackstate-k8s-cluster-agent/GO-2026-5841.yaml |
Removes resolved exception. |
exceptions/stackstate-k8s-agent/GO-2026-5932.yaml |
Extends reviewed exception. |
exceptions/stackstate-k8s-agent/GO-2026-5841.yaml |
Removes resolved exception. |
exceptions/stackstate-k8s-agent/CVE-2026-69249.yaml |
Removes resolved exception. |
exceptions/stackstate-k8s-agent/CVE-2026-69248.yaml |
Removes resolved exception. |
exceptions/stackstate-k8s-agent/CVE-2026-69247.yaml |
Removes resolved exception. |
exceptions/stackstate-k8s-agent/CVE-2026-6879.yaml |
Removes obsolete Python exception. |
exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml |
Refreshes Python exception. |
exceptions/stackstate-k8s-agent/CVE-2026-15308.yaml |
Removes obsolete Python exception. |
exceptions/stackstate-k8s-agent/CVE-2026-14456.yaml |
Adds tracked OpenSSL exception. |
exceptions/stackstate-k8s-agent/CVE-2026-12003.yaml |
Removes obsolete Python exception. |
exceptions/stackstate-k8s-agent/CVE-2026-11972.yaml |
Removes obsolete Python exception. |
exceptions/stackstate-k8s-agent/CVE-2026-11940.yaml |
Removes obsolete Python exception. |
exceptions/stackstate-k8s-agent/CVE-2026-0864.yaml |
Removes obsolete Python exception. |
exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml |
Refreshes Python exception. |
exceptions/stackstate-k8s-agent/CVE-2025-15366.yaml |
Removes obsolete Python exception. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
LouisParkin
approved these changes
Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates github.com/klauspost/compress from v1.18.5 to v1.18.7 across the 19 workspace modules that ship in the agent images, fixing GO-2026-5841. It also consumes integrations 7.78.2-5, which bundles cryptography 50.0.0 and fixes CVE-2026-69247, CVE-2026-69248, and CVE-2026-69249.
Removes the exceptions for those fixed findings and refreshes the remaining agent exception set. The datadogconnector and test/integration/serverless/src modules remain unchanged because they are outside go.work and ship in neither image.
Validation: binary, lint/unit, and DEB workflows pass. The built DEB metadata and generated requirements show cryptography 50.0.0. VEX-aware Trivy/Grype scans on amd64 and arm64 contain none of the three target CVEs; their exceptions are deleted, so they are absent rather than suppressed. Separate Trivy secret scans found no secrets. The scans also expose two unmanaged MEDIUM findings in the unchanged Python 3.13.15 runtime (CVE-2026-15806 and CVE-2026-17084), outside this dependency bump.
Release and chart propagation remains tracked in #484.
Batch: https://github.com/StackVista/cve-reporter/issues/29
Fixes #492