From f8e25aa0166dcfdf2d47378b93943a2bb956d5be Mon Sep 17 00:00:00 2001 From: Yuta Saito Date: Fri, 16 Jan 2026 18:23:01 +0900 Subject: [PATCH] chore: add ALLOWED_CVES. Because Wolfi glibc still flagged even on 2.42-r5. --- ci_cd/security_scans.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/ci_cd/security_scans.sh b/ci_cd/security_scans.sh index 42ae25026d..9931730b7a 100755 --- a/ci_cd/security_scans.sh +++ b/ci_cd/security_scans.sh @@ -129,6 +129,7 @@ run_grype_scans() { "CVE-2025-13836" # Python 3.13 HTTP response reading OOM/DoS - no fix available in base image "CVE-2025-12084" # Python 3.13 xml.dom.minidom quadratic algorithm - no fix available in base image "CVE-2025-60876" # BusyBox wget HTTP request splitting - no fix available in Chainguard Wolfi base image + "CVE-2026-0861" # Wolfi glibc still flagged even on 2.42-r5; upstream patched build unavailable yet "CVE-2010-4756" # glibc glob DoS - awaiting patched Wolfi glibc build "CVE-2019-1010022" # glibc stack guard bypass - awaiting patched Wolfi glibc build "CVE-2019-1010023" # glibc ldd remap issue - awaiting patched Wolfi glibc build