{ "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.2/schema/csaf.json", "document": { "category": "csaf_security_advisory", "csaf_version": "2.2", "distribution": { "tlp": { "label": "CLEAR" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Generated from an analysis of SBOM trivy_bom.json (cyclonedx-json, sha256 c9f7545b5b67a708d9951870db5feab936948071abe999f5958c770ad154c47c)." }, { "category": "general", "text": "This advisory is based on an INCOMPLETE analysis. The following analyzers did not produce results, so components they would have covered may carry vulnerabilities not listed here: inspektr_cli (fail), shieldbom (fail).", "title": "Analysis coverage" } ], "publisher": { "category": "vendor", "contact_details": "security@ndaal.eu", "name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG", "namespace": "https://ndaal.eu/csaf" }, "references": [ { "category": "self", "summary": "This advisory", "url": "https://ndaal.eu/csaf/ndaal-sba-0003" } ], "title": "Vulnerabilities found in SBOM trivy_bom.json", "tracking": { "current_release_date": "2026-08-24T14:26:22Z", "generator": { "engine": { "name": "ndaal SBOM Auditor", "version": "1.4.16" } }, "id": "ndaal-sba-0003", "initial_release_date": "2026-08-24T14:26:22Z", "revision_history": [ { "date": "2026-08-24T14:26:22Z", "number": "1.0.0", "summary": "Initial advisory generated from an SBOM analysis." } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "full_product_names": [ { "name": "github.com/moby/go-archive@v0.2.1", "product_id": "CSAFPID-0001", "product_identification_helper": { "purls": [ "pkg:golang/github.com/moby/go-archive@v0.2.1?goarch=amd64&goos=linux&type=module" ] } }, { "name": "golang.org/x/crypto@v0.55.0", "product_id": "CSAFPID-0002", "product_identification_helper": { "purls": [ "pkg:golang/golang.org/x/crypto@v0.55.0?goarch=amd64&goos=linux&type=module" ] } }, { "name": "unknown", "product_id": "CSAFPID-0003", "product_identification_helper": { "purls": [ "pkg:golang/github.com/moby/go-archive@v0.2.1?goarch=amd64&goos=linux&type=module" ] } }, { "name": "unknown@v0.0.0-20200609155635-041fdbb8563f", "product_id": "CSAFPID-0007", "product_identification_helper": { "purls": [ "pkg:golang/github.com/knqyf263/go-apk-version@v0.0.0-20200609155635-041fdbb8563f?goarch=amd64&goos=linux&type=module" ] } }, { "name": "unknown@v0.0.0-20240903120638-7835f813f4da", "product_id": "CSAFPID-0011", "product_identification_helper": { "purls": [ "pkg:golang/golang.org/x/xerrors@v0.0.0-20240903120638-7835f813f4da?goarch=amd64&goos=linux&type=module" ] } }, { "name": "unknown@v0.0.0-20250730193827-2d320260d730", "product_id": "CSAFPID-0012", "product_identification_helper": { "purls": [ "pkg:golang/sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730?goarch=amd64&goos=linux&type=module" ] } }, { "name": "unknown@v0.21.1", "product_id": "CSAFPID-0013", "product_identification_helper": { "purls": [ "pkg:golang/sigs.k8s.io/kustomize/kyaml@v0.21.1?goarch=amd64&goos=linux&type=module" ] } }, { "name": "unknown@v0.25.2", "product_id": "CSAFPID-0004", "product_identification_helper": { "purls": [ "pkg:golang/cel.dev/expr@v0.25.2?goarch=amd64&goos=linux&type=module" ] } }, { "name": "unknown@v0.5.1", "product_id": "CSAFPID-0009", "product_identification_helper": { "purls": [ "pkg:golang/github.com/moby/moby/client@v0.5.1?goarch=amd64&goos=linux&type=module" ] } }, { "name": "unknown@v0.6.1", "product_id": "CSAFPID-0005", "product_identification_helper": { "purls": [ "pkg:golang/github.com/aquasecurity/tml@v0.6.1?goarch=amd64&goos=linux&type=module" ] } }, { "name": "unknown@v1.3.1", "product_id": "CSAFPID-0008", "product_identification_helper": { "purls": [ "pkg:golang/github.com/moby/docker-image-spec@v1.3.1?goarch=amd64&goos=linux&type=module" ] } }, { "name": "unknown@v1.4.4", "product_id": "CSAFPID-0006", "product_identification_helper": { "purls": [ "pkg:golang/github.com/go-logr/logr@v1.4.4?goarch=amd64&goos=linux&type=module" ] } }, { "name": "unknown@v1.44.0", "product_id": "CSAFPID-0010", "product_identification_helper": { "purls": [ "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.44.0?goarch=amd64&goos=linux&type=module" ] } } ] }, "vulnerabilities": [ { "cve": "CVE-2026-17106", "notes": [ { "category": "description", "text": "moby/go-archive: Crafted tar archive can write outside the extraction directory" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "metrics": [ { "content": { "cvss_v4": { "version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE" } }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "title": "GHSA-hfg8-hc9c-6c3h", "remediations": [ { "category": "vendor_fix", "details": "Upgrade to 0.3.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ] }, { "cve": "CVE-2026-33634", "notes": [ { "category": "description", "text": "Trivy ecosystem supply chain was briefly compromised in github.com/aquasecurity/trivy" } ], "product_status": { "known_affected": [ "CSAFPID-0003" ] }, "title": "CVE-2026-33634" }, { "notes": [ { "category": "description", "text": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package." } ], "product_status": { "known_affected": [ "CSAFPID-0002", "CSAFPID-0003" ] }, "title": "GO-2026-5932" }, { "notes": [ { "category": "description", "text": "GHSA-hfg8-hc9c-6c3h (HIGH) affects pkg:golang/github.com/moby/go-archive@v0.2.1?goarch=amd64&goos=linux&type=module. Review the advisory and update or pin a patched version." } ], "product_status": { "known_affected": [ "CSAFPID-0003" ] }, "title": "bomdrift.cve" }, { "notes": [ { "category": "description", "text": "`cel.dev/expr` is similar to popular package `golang.org/x/exp` (similarity 0.94). Verify the package source before merging." } ], "product_status": { "known_affected": [ "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0010", "CSAFPID-0011", "CSAFPID-0012", "CSAFPID-0013" ] }, "title": "bomdrift.typosquat" } ] }