From a0e0026df0758dfa4ff8d53b1ba60509a72c925f Mon Sep 17 00:00:00 2001 From: Yuta Saito Date: Tue, 13 Jan 2026 10:09:23 +0900 Subject: [PATCH 1/3] chore: document temporary grype ignore for CVE-2019-1010022 --- ci_cd/.grype.yaml | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 ci_cd/.grype.yaml diff --git a/ci_cd/.grype.yaml b/ci_cd/.grype.yaml new file mode 100644 index 0000000000..e1068de8e3 --- /dev/null +++ b/ci_cd/.grype.yaml @@ -0,0 +1,3 @@ +ignore: + - vulnerability: CVE-2019-1010022 + reason: no fixed glibc package is available yet in the Wolfi repositories, so this is ignored temporarily until an upstream release exists From 54b21cabf7ab95189027bbe8ff23590c381d6f90 Mon Sep 17 00:00:00 2001 From: Yuta Saito Date: Tue, 13 Jan 2026 10:19:12 +0900 Subject: [PATCH 2/3] chore: add config option --- ci_cd/security_scans.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ci_cd/security_scans.sh b/ci_cd/security_scans.sh index be9167adda..eeaaddd3e1 100755 --- a/ci_cd/security_scans.sh +++ b/ci_cd/security_scans.sh @@ -101,12 +101,12 @@ run_grype_scans() { # Build and scan Dockerfile.database echo "Building and scanning Dockerfile.database..." docker build --no-cache -t litellm-database:latest -f ./docker/Dockerfile.database . - grype litellm-database:latest --fail-on critical + grype litellm-database:latest --config ci_cd/.grype.yaml --fail-on critical # Build and scan main Dockerfile echo "Building and scanning main Dockerfile..." docker build --no-cache -t litellm:latest . - grype litellm:latest --fail-on critical + grype litellm:latest --config ci_cd/.grype.yaml --fail-on critical # Restore original .dockerignore echo "Restoring original .dockerignore..." From 4daac9e3328a73135691b8fe6c454f588fe347e7 Mon Sep 17 00:00:00 2001 From: Yuta Saito Date: Tue, 13 Jan 2026 10:30:34 +0900 Subject: [PATCH 3/3] chore: add ALLOWED_CVES --- ci_cd/security_scans.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ci_cd/security_scans.sh b/ci_cd/security_scans.sh index eeaaddd3e1..17cf4c1817 100755 --- a/ci_cd/security_scans.sh +++ b/ci_cd/security_scans.sh @@ -129,6 +129,11 @@ run_grype_scans() { "CVE-2025-13836" # Python 3.13 HTTP response reading OOM/DoS - no fix available in base image "CVE-2025-12084" # Python 3.13 xml.dom.minidom quadratic algorithm - no fix available in base image "CVE-2025-60876" # BusyBox wget HTTP request splitting - no fix available in Chainguard Wolfi base image + "CVE-2010-4756" # glibc glob DoS - awaiting patched Wolfi glibc build + "CVE-2019-1010022" # glibc stack guard bypass - awaiting patched Wolfi glibc build + "CVE-2019-1010023" # glibc ldd remap issue - awaiting patched Wolfi glibc build + "CVE-2019-1010024" # glibc ASLR mitigation bypass - awaiting patched Wolfi glibc build + "CVE-2019-1010025" # glibc pthread heap address leak - awaiting patched Wolfi glibc build ) # Build JSON array of allowlisted CVE IDs for jq