Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-04-21 13:37:30 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 91
fleet/security/status.md

568 lines
39 KiB
Markdown
Raw Normal View History

Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
<!-- DO NOT EDIT. This document is automatically generated by running `make vex-report`. -->
# Vulnerability Report
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
Following is the vulnerability report of Fleet and its dependencies.
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
## `fleetdm/fleet` docker image
Fix CVE fleetdm/fleet alerts (#42314) Fixes https://github.com/fleetdm/fleet/actions/runs/23476076250/job/68309012488. Runs: - https://github.com/fleetdm/fleet/actions/runs/23498265614
2026-03-24 20:38:46 +00:00
### [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** There are no path-based authorization interceptors. The only interceptors are grpc_recovery (panic handlers). CVE-2026-33186 specifically requires path-based authz rules (like grpc/authz RBAC policies) that compare against info.FullMethod — Fleet doesn't use any.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet`,`pkg:golang/google.golang.org/grpc`
Fix CVE fleetdm/fleet alerts (#42314) Fixes https://github.com/fleetdm/fleet/actions/runs/23476076250/job/68309012488. Runs: - https://github.com/fleetdm/fleet/actions/runs/23498265614
2026-03-24 20:38:46 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2026-03-24 12:38:53
Ignore false positive CVE in fleet (#41643) Fixes: https://github.com/fleetdm/fleet/actions/runs/23038788027/job/66912481418 Run with this branch: https://github.com/fleetdm/fleet/actions/runs/23060265057
2026-03-16 13:36:50 +00:00
### [CVE-2026-22184](https://nvd.nist.gov/vuln/detail/CVE-2026-22184)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** The vulnerability is in zlib's contrib/untgz standalone demo utility, not in the core zlib library.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet`,`pkg:apk/alpine/zlib@1.3.1-r2`
Ignore false positive CVE in fleet (#41643) Fixes: https://github.com/fleetdm/fleet/actions/runs/23038788027/job/66912481418 Run with this branch: https://github.com/fleetdm/fleet/actions/runs/23060265057
2026-03-16 13:36:50 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-03-13 12:01:11
Fix docker publish failures (#33690) Fixing https://github.com/fleetdm/fleet/actions/runs/18150944735. - It seems that when not using the RC versions it cannot determine the version of the github.com/fleetdm/fleet/v4 package , so it assumes it's using `v4.0.0` thus causing alerts around our recent SAML vulnerability (already fixed). So I'm changing it to only run on RC cuts, not every day. - Also adding a skip rule for a new CVE that we are not affected by.
2025-10-02 16:12:13 +00:00
### [CVE-2025-9230](https://nvd.nist.gov/vuln/detail/CVE-2025-9230)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** Fleet uses Go cryptography packages.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet`,`pkg:apk/alpine/openssl@3.3.3-r0?os_name=alpine&os_version=3.21`
Fix docker publish failures (#33690) Fixing https://github.com/fleetdm/fleet/actions/runs/18150944735. - It seems that when not using the RC versions it cannot determine the version of the github.com/fleetdm/fleet/v4 package , so it assumes it's using `v4.0.0` thus causing alerts around our recent SAML vulnerability (already fixed). So I'm changing it to only run on RC cuts, not every day. - Also adding a skip rule for a new CVE that we are not affected by.
2025-10-02 16:12:13 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2025-10-01 10:09:03
Skip openssl vulns in Fleet (#39098) Run: https://github.com/fleetdm/fleet/actions/runs/21532057134
2026-02-02 14:56:39 +00:00
### [CVE-2025-69419](https://nvd.nist.gov/vuln/detail/CVE-2025-69419)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleet uses Go's crypto and TLS implementation.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet`,`pkg:apk/alpine/libcrypto3`,`pkg:apk/alpine/libssl3`
Skip openssl vulns in Fleet (#39098) Run: https://github.com/fleetdm/fleet/actions/runs/21532057134
2026-02-02 14:56:39 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-01-03 15:15:53
Ignore false positive CVE in fleet (#41643) Fixes: https://github.com/fleetdm/fleet/actions/runs/23038788027/job/66912481418 Run with this branch: https://github.com/fleetdm/fleet/actions/runs/23060265057
2026-03-16 13:36:50 +00:00
### [CVE-2025-68121](https://nvd.nist.gov/vuln/detail/CVE-2025-68121)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** Fleet does not mutate CA pool store between TLS sessions.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet`,`pkg:golang/stdlib`
Ignore false positive CVE in fleet (#41643) Fixes: https://github.com/fleetdm/fleet/actions/runs/23038788027/job/66912481418 Run with this branch: https://github.com/fleetdm/fleet/actions/runs/23060265057
2026-03-16 13:36:50 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-03-13 13:23:41
Update security status (#37086) Update our `security/status.md` file after analyzing currently reported vulnerabilities. https://github.com/fleetdm/fleet/actions/runs/20115346825 <img width="1711" height="645" alt="Screenshot 2025-12-10 at 7 41 00 PM" src="https://github.com/user-attachments/assets/97e17b58-50a8-4556-9ceb-bcb6701d7d61" />
2025-12-11 13:42:50 +00:00
### [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729)
#### Statement:
- **Author:** @lucasmrod
- **Status:** `fixed`
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet@v4.78.*`
Update security status (#37086) Update our `security/status.md` file after analyzing currently reported vulnerabilities. https://github.com/fleetdm/fleet/actions/runs/20115346825 <img width="1711" height="645" alt="Screenshot 2025-12-10 at 7 41 00 PM" src="https://github.com/user-attachments/assets/97e17b58-50a8-4556-9ceb-bcb6701d7d61" />
2025-12-11 13:42:50 +00:00
- **Timestamp:** 2025-12-10 19:26:25
#### Statement:
- **Author:** @lucasmrod
- **Status:** `affected`
- **Status notes:** This is not a CRITICAL CVE, but we still recommend upgrading to 4.78.* when it's available.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet@v4.77.0`,`fleet@v4.76.0`,`fleet@v4.76.1`,`fleet@v4.75.0`,`fleet@v4.75.1`,`pkg:golang/stdlib@1.25.3`
Update security status (#37086) Update our `security/status.md` file after analyzing currently reported vulnerabilities. https://github.com/fleetdm/fleet/actions/runs/20115346825 <img width="1711" height="645" alt="Screenshot 2025-12-10 at 7 41 00 PM" src="https://github.com/user-attachments/assets/97e17b58-50a8-4556-9ceb-bcb6701d7d61" />
2025-12-11 13:42:50 +00:00
- **Action statement:** `No action statement provided`
- **Timestamp:** 2025-12-10 19:26:10
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2025-46569](https://nvd.nist.gov/vuln/detail/CVE-2025-46569)
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Author:** @lucasmrod
- **Status:** `not_affected`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Status notes:** fleet does not use OPA in server mode, it uses it as a library.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet`,`pkg:golang/github.com/open-policy-agent/opa@v0.44.0`,`pkg:golang/github.com/open-policy-agent/opa@0.44.0`
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-05-05 20:29:07
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2025-30204](https://nvd.nist.gov/vuln/detail/CVE-2025-30204)
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Author:** @lucasmrod
- **Status:** `not_affected`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Status notes:** The token format being validated before the call to ParseUnverified.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet`,`pkg:golang/github.com/golang-jwt/jwt/v4`
Fix detected CVEs and docker scout exit code to fail the Github Action (#28836) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.
2025-05-06 16:35:27 +00:00
- **Justification:** `inline_mitigations_already_exist`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-04-10 15:23:54
Fix detected CVEs and docker scout exit code to fail the Github Action (#28836) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.
2025-05-06 16:35:27 +00:00
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2025-27509](https://nvd.nist.gov/vuln/detail/CVE-2025-27509)
#### Statement:
- **Author:** @lucasmrod
- **Status:** `fixed`
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `pkg:golang/github.com/fleetdm/fleet/v4`,`cpe:2.3:a:fleetdm:fleet:v4.64.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.63.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.62.4:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.58.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.53.2:*:*:*:*:*:*:*`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-05-12 16:30:30
#### Statement:
- **Author:** @lucasmrod
- **Status:** `affected`
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `cpe:2.3:a:fleetdm:fleet:v4.64.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.64.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.63.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.63.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.62.3:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.62.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.62.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.62.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.61.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.60.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.60.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.59.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.59.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.58.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.57.3:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.57.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.57.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.57.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.56.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.55.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.55.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.55.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.54.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.54.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.54.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.53.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.53.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.52.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.51.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.51.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.50.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.50.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.50.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.49.4:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.49.3:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.49.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.49.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.49.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.48.3:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.48.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.48.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.48.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.47.3:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.47.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.47.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.47.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.46.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.46.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.46.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.45.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.45.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.44.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.44.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.43.3:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.43.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.43.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.43.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.42.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.41.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.41.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.40.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.39.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.38.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.38.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.37.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.36.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.35.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.35.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.35.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.34.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.34.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.33.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.33.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.32.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.31.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.31.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.30.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.30.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.29.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.29.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.28.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.28.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.27.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.27.0:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.26.0:*:*:*:*:*:*:*`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Action statement:** `Disable SAML SSO authentication.`
- **Timestamp:** 2025-05-12 16:13:23
### [CVE-2025-26519](https://nvd.nist.gov/vuln/detail/CVE-2025-26519)
Fix detected CVEs and docker scout exit code to fail the Github Action (#28836) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.
2025-05-06 16:35:27 +00:00
- **Author:** @lucasmrod
- **Status:** `not_affected`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Status notes:** fleet does not perform any EUC-KR to UTF-8 translation by libc.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet`,`pkg:apk/alpine/musl@1.2.5-r8?os_name=alpine&os_version=3.21`
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-04-14 16:30:01
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
Add VEX for CVE-2025-22874 and generate report (#30258) We missed to add this when we upgraded Go to 1.24.4. Report https://github.com/fleetdm/fleet/actions/runs/15626203997/job/44020838145 How to test (with and without the new VEX file): ``` docker scout cves --only-fixed --vex-location=./security/vex/fleet --only-vex-affected --only-severity high,critical fleetdm/fleet:v4.69.0 ```
2025-06-25 18:13:34 +00:00
### [CVE-2025-22874](https://nvd.nist.gov/vuln/detail/CVE-2025-22874)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** Fleet does not perform any verification of policies in client certificates (CertificatePolicies not set in VerifyOptions).
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet`,`pkg:golang/stdlib@1.24.2`
Add VEX for CVE-2025-22874 and generate report (#30258) We missed to add this when we upgraded Go to 1.24.4. Report https://github.com/fleetdm/fleet/actions/runs/15626203997/job/44020838145 How to test (with and without the new VEX file): ``` docker scout cves --only-fixed --vex-location=./security/vex/fleet --only-vex-affected --only-severity high,critical fleetdm/fleet:v4.69.0 ```
2025-06-25 18:13:34 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2025-06-23 16:48:42
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2025-21614](https://nvd.nist.gov/vuln/detail/CVE-2025-21614)
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** The fleetctl executable is unused in the fleetdm/fleet docker image. The executable was removed in v4.64.0.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet`,`pkg:golang/github.com/go-git/go-git/v5`
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-04-10 15:43:15
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2025-21613](https://nvd.nist.gov/vuln/detail/CVE-2025-21613)
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** The fleetctl executable is unused in the fleetdm/fleet docker image. The executable was removed in v4.64.0.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet`,`pkg:golang/github.com/go-git/go-git/v5`
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-04-10 15:42:55
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
Skip openssl vulns in Fleet (#39098) Run: https://github.com/fleetdm/fleet/actions/runs/21532057134
2026-02-02 14:56:39 +00:00
### [CVE-2025-15467](https://nvd.nist.gov/vuln/detail/CVE-2025-15467)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleet uses Go's crypto and TLS implementation.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet`,`pkg:apk/alpine/libcrypto3`,`pkg:apk/alpine/libssl3`
Skip openssl vulns in Fleet (#39098) Run: https://github.com/fleetdm/fleet/actions/runs/21532057134
2026-02-02 14:56:39 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-01-03 15:15:53
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2024-8260](https://nvd.nist.gov/vuln/detail/CVE-2024-8260)
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Author:** @lucasmrod
- **Status:** `not_affected`
Fix detected CVEs and docker scout exit code to fail the Github Action (#28836) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.
2025-05-06 16:35:27 +00:00
- **Status notes:** Fleet doesn't run on Windows, so it's not affected by this vulnerability.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet`,`pkg:golang/github.com/open-policy-agent/opa`
Fix detected CVEs and docker scout exit code to fail the Github Action (#28836) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.
2025-05-06 16:35:27 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-05-05 20:54:14
Fix detected CVEs and docker scout exit code to fail the Github Action (#28836) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.
2025-05-06 16:35:27 +00:00
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2024-12797](https://nvd.nist.gov/vuln/detail/CVE-2024-12797)
Fix detected CVEs and docker scout exit code to fail the Github Action (#28836) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.
2025-05-06 16:35:27 +00:00
- **Author:** @lucasmrod
- **Status:** `not_affected`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Status notes:** fleet uses Go TLS implementation.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet`,`pkg:apk/alpine/libcrypto3`,`pkg:apk/alpine/libssl3`
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-04-10 15:15:53
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2023-32698](https://nvd.nist.gov/vuln/detail/CVE-2023-32698)
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Author:** @lucasmrod
- **Status:** `not_affected`
Fix detected CVEs and docker scout exit code to fail the Github Action (#28836) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.
2025-05-06 16:35:27 +00:00
- **Status notes:** The fleetctl executable is unused in the fleetdm/fleet docker image. The executable was removed in v4.64.0.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleet`,`pkg:golang/github.com/goreleaser/nfpm/v2`
Fix detected CVEs and docker scout exit code to fail the Github Action (#28836) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.
2025-05-06 16:35:27 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-04-10 15:28:30
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
## `fleetdm/fleetctl` docker image
Ignore vulnerabilities in fleetdm/fleetctl (#41647) Fixes https://github.com/fleetdm/fleet/actions/runs/23038854478/job/66912680981. Run with this branch: https://github.com/fleetdm/fleet/actions/runs/23058249026
2026-03-13 17:22:40 +00:00
### [GHSA-72hv-8253-57qq](https://nvd.nist.gov/vuln/detail/GHSA-72hv-8253-57qq)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** Vulnerability only affects Java/JVM web applications that use Jackson's asynchronous (non-blocking) JSON parser.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0`
Ignore vulnerabilities in fleetdm/fleetctl (#41647) Fixes https://github.com/fleetdm/fleet/actions/runs/23038854478/job/66912680981. Run with this branch: https://github.com/fleetdm/fleet/actions/runs/23058249026
2026-03-13 17:22:40 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-03-13 12:30:33
Fix security warnings on `fleetdm/fleetctl` (#42276) Fixes: https://github.com/fleetdm/fleet/actions/runs/23424438962 New runs: - Local: https://github.com/fleetdm/fleet/actions/runs/23463124995. - Remote: https://github.com/fleetdm/fleet/actions/runs/23463145956.
2026-03-24 15:10:29 +00:00
### [GHSA-479m-364c-43vc](https://nvd.nist.gov/vuln/detail/GHSA-479m-364c-43vc)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetctl does not validate any XML signatures.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:golang/github.com/russellhaering/goxmldsig`
Fix security warnings on `fleetdm/fleetctl` (#42276) Fixes: https://github.com/fleetdm/fleet/actions/runs/23424438962 New runs: - Local: https://github.com/fleetdm/fleet/actions/runs/23463124995. - Remote: https://github.com/fleetdm/fleet/actions/runs/23463145956.
2026-03-24 15:10:29 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-03-23 16:44:57
Ignore CVEs on fleetdm/fleetctl (#43240) Fixes: https://github.com/fleetdm/fleet/actions/runs/24121419823/job/70444895796 Run: https://github.com/fleetdm/fleet/actions/runs/24142910735
2026-04-08 20:46:41 +00:00
### [CVE-2026-34875](https://nvd.nist.gov/vuln/detail/CVE-2026-34875)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetdm/fleetctl does not use Mbed TLS. The libmbedcrypto16 package is an unused transitive dependency in the container image.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:deb/debian/libmbedcrypto16`
Ignore CVEs on fleetdm/fleetctl (#43240) Fixes: https://github.com/fleetdm/fleet/actions/runs/24121419823/job/70444895796 Run: https://github.com/fleetdm/fleet/actions/runs/24142910735
2026-04-08 20:46:41 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-04-08 12:06:49
### [CVE-2026-34873](https://nvd.nist.gov/vuln/detail/CVE-2026-34873)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetdm/fleetctl does not use Mbed TLS. The libmbedcrypto16 package is an unused transitive dependency in the container image.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:deb/debian/libmbedcrypto16`
Ignore CVEs on fleetdm/fleetctl (#43240) Fixes: https://github.com/fleetdm/fleet/actions/runs/24121419823/job/70444895796 Run: https://github.com/fleetdm/fleet/actions/runs/24142910735
2026-04-08 20:46:41 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-04-08 12:06:46
Flag fleetdm/fleetctl vulnerabilities (#43785) Run: https://github.com/fleetdm/fleet/actions/runs/24681592163. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added vulnerability disclosures for three CVEs. * CVE-2026-27806: marked as not affecting fleetctl. * CVE-2026-32280: denial-of-service affecting many fleetctl versions; recommend upgrading to a fleetctl build using Go ≥1.26.2 when available. * CVE-2026-33810: affects fleetctl v4.84.0; recommend upgrading to a fleetctl build using Go ≥1.26.2 when available. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:01:03 +00:00
### [CVE-2026-33810](https://nvd.nist.gov/vuln/detail/CVE-2026-33810)
- **Author:** @lucasmrod
- **Status:** `affected`
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl@v4.84.0`,`pkg:golang/stdlib@1.26.1`
Flag fleetdm/fleetctl vulnerabilities (#43785) Run: https://github.com/fleetdm/fleet/actions/runs/24681592163. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added vulnerability disclosures for three CVEs. * CVE-2026-27806: marked as not affecting fleetctl. * CVE-2026-32280: denial-of-service affecting many fleetctl versions; recommend upgrading to a fleetctl build using Go ≥1.26.2 when available. * CVE-2026-33810: affects fleetctl v4.84.0; recommend upgrading to a fleetctl build using Go ≥1.26.2 when available. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:01:03 +00:00
- **Action statement:** `Low probability of exploit: requires the fleetctl admin to (1) trust a private/enterprise CA that uses excluded DNS name constraints, (2) an attacker able to obtain a cert under that CA with a wildcard SAN whose case differs from the excluded constraint, and (3) a MITM or DNS-hijack position between the admin's workstation and the Fleet server. If all conditions are met, the attacker can impersonate the Fleet server over TLS and capture the admin's API token. The Fleet server itself is unaffected. Upgrade to a fleetctl build using Go >= 1.26.2 when available.`
- **Timestamp:** 2026-04-20 14:07:42
Add ignore to CVE found in fleetdm/fleetctl (#42711) Fixes: https://github.com/fleetdm/fleet/actions/runs/23783786066/job/69302104997 Test runs: - https://github.com/fleetdm/fleet/actions/runs/23798426124 - https://github.com/fleetdm/fleet/actions/runs/23798449109
2026-03-31 13:27:07 +00:00
### [CVE-2026-33487](https://nvd.nist.gov/vuln/detail/CVE-2026-33487)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** Possible vulnerability in SSO service providers, not in fleetctl command line tool.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:golang/github.com/russellhaering/goxmldsig`
Add ignore to CVE found in fleetdm/fleetctl (#42711) Fixes: https://github.com/fleetdm/fleet/actions/runs/23783786066/job/69302104997 Test runs: - https://github.com/fleetdm/fleet/actions/runs/23798426124 - https://github.com/fleetdm/fleet/actions/runs/23798449109
2026-03-31 13:27:07 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-03-31 09:54:45
Fix security warnings on `fleetdm/fleetctl` (#42276) Fixes: https://github.com/fleetdm/fleet/actions/runs/23424438962 New runs: - Local: https://github.com/fleetdm/fleet/actions/runs/23463124995. - Remote: https://github.com/fleetdm/fleet/actions/runs/23463145956.
2026-03-24 15:10:29 +00:00
### [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetctl uses admin controlled URLs to manage Fleet. The primary attack vector is social engineering an admin into using a crafted URL.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:golang/google.golang.org/grpc`
Fix security warnings on `fleetdm/fleetctl` (#42276) Fixes: https://github.com/fleetdm/fleet/actions/runs/23424438962 New runs: - Local: https://github.com/fleetdm/fleet/actions/runs/23463124995. - Remote: https://github.com/fleetdm/fleet/actions/runs/23463145956.
2026-03-24 15:10:29 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-03-23 19:20:41
Flag fleetdm/fleetctl vulnerabilities (#43785) Run: https://github.com/fleetdm/fleet/actions/runs/24681592163. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added vulnerability disclosures for three CVEs. * CVE-2026-27806: marked as not affecting fleetctl. * CVE-2026-32280: denial-of-service affecting many fleetctl versions; recommend upgrading to a fleetctl build using Go ≥1.26.2 when available. * CVE-2026-33810: affects fleetctl v4.84.0; recommend upgrading to a fleetctl build using Go ≥1.26.2 when available. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:01:03 +00:00
### [CVE-2026-32280](https://nvd.nist.gov/vuln/detail/CVE-2026-32280)
- **Author:** @lucasmrod
- **Status:** `affected`
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl@v4.83.2`,`fleetctl@v4.83.1`,`fleetctl@v4.83.0`,`fleetctl@v4.82.2`,`fleetctl@v4.82.1`,`fleetctl@v4.82.0`,`fleetctl@v4.81.3`,`fleetctl@v4.81.2`,`fleetctl@v4.81.1`,`fleetctl@v4.81.0`,`fleetctl@v4.80.3`,`fleetctl@v4.80.2`,`fleetctl@v4.80.1`,`fleetctl@v4.80.0`,`fleetctl@v4.79.1`,`fleetctl@v4.79.0`,`fleetctl@v4.78.3`,`fleetctl@v4.78.2`,`fleetctl@v4.78.1`,`fleetctl@v4.78.0`,`fleetctl@v4.77.1`,`fleetctl@v4.77.0`,`fleetctl@v4.76.2`,`fleetctl@v4.76.1`,`fleetctl@v4.76.0`,`fleetctl@v4.75.2`,`fleetctl@v4.75.1`,`fleetctl@v4.75.0`,`fleetctl@v4.74.0`,`fleetctl@v4.73.5`,`fleetctl@v4.73.4`,`fleetctl@v4.73.3`,`fleetctl@v4.73.2`,`fleetctl@v4.73.1`,`fleetctl@v4.73.0`,`fleetctl@v4.72.1`,`fleetctl@v4.72.0`,`fleetctl@v4.71.1`,`fleetctl@v4.71.0`,`fleetctl@v4.70.1`,`fleetctl@v4.70.0`,`fleetctl@v4.69.0`,`fleetctl@v4.68.1`,`fleetctl@v4.68.0`,`fleetctl@v4.67.3`,`fleetctl@v4.67.2`,`fleetctl@v4.67.1`,`fleetctl@v4.67.0`,`fleetctl@v4.66.0`,`fleetctl@v4.65.0`,`fleetctl@v4.64.2`,`fleetctl@v4.64.1`,`fleetctl@v4.64.0`,`fleetctl@v4.63.2`,`fleetctl@v4.63.1`,`fleetctl@v4.63.0`,`fleetctl@v4.62.4`,`fleetctl@v4.62.3`,`fleetctl@v4.62.2`,`fleetctl@v4.62.1`,`fleetctl@v4.62.0`,`fleetctl@v4.61.0`,`fleetctl@v4.60.1`,`fleetctl@v4.60.0`,`fleetctl@v4.59.1`,`fleetctl@v4.59.0`,`fleetctl@v4.58.1`,`fleetctl@v4.58.0`,`fleetctl@v4.57.3`,`fleetctl@v4.57.2`,`fleetctl@v4.57.1`,`fleetctl@v4.57.0`,`fleetctl@v4.56.0`,`fleetctl@v4.55.2`,`fleetctl@v4.55.1`,`fleetctl@v4.55.0`,`fleetctl@v4.54.2`,`fleetctl@v4.54.1`,`fleetctl@v4.54.0`,`fleetctl@v4.53.2`,`fleetctl@v4.53.1`,`fleetctl@v4.53.0`,`fleetctl@v4.52.0`,`fleetctl@v4.51.1`,`fleetctl@v4.51.0`,`fleetctl@v4.50.2`,`fleetctl@v4.50.1`,`fleetctl@v4.50.0`,`fleetctl@v4.49.4`,`fleetctl@v4.49.3`,`fleetctl@v4.49.2`,`fleetctl@v4.49.1`,`fleetctl@v4.49.0`,`fleetctl@v4.48.3`,`fleetctl@v4.48.2`,`fleetctl@v4.48.1`,`fleetctl@v4.48.0`,`fleetctl@v4.47.3`,`fleetctl@v4.47.2`,`fleetctl@v4.47.1`,`fleetctl@v4.47.0`,`fleetctl@v4.46.2`,`fleetctl@v4.46.1`,`fleetctl@v4.46.0`,`fleetctl@v4.45.1`,`fleetctl@v4.45.0`,`fleetctl@v4.44.1`,`fleetctl@v4.44.0`,`fleetctl@v4.43.3`,`fleetctl@v4.43.2`,`fleetctl@v4.43.1`,`fleetctl@v4.43.0`,`fleetctl@v4.42.0`,`fleetctl@v4.41.1`,`fleetctl@v4.41.0`,`fleetctl@v4.40.0`,`fleetctl@v4.39.0`,`fleetctl@v4.38.1`,`fleetctl@v4.38.0`,`fleetctl@v4.37.0`,`fleetctl@v4.36.0`,`fleetctl@v4.35.2`,`fleetctl@v4.35.1`,`fleetctl@v4.35.0`,`fleetctl@v4.34.1`,`fleetctl@v4.34.0`,`fleetctl@v4.33.1`,`fleetctl@v4.33.0`,`fleetctl@v4.32.0`,`fleetctl@v4.31.1`,`fleetctl@v4.31.0`,`fleetctl@v4.30.1`,`fleetctl@v4.30.0`,`fleetctl@v4.29.1`,`fleetctl@v4.29.0`,`fleetctl@v4.28.1`,`fleetctl@v4.28.0`,`fleetctl@v4.27.1`,`fleetctl@v4.27.0`,`fleetctl@v4.26.0`,`fleetctl@v4.25.0`,`fleetctl@v4.24.1`,`fleetctl@v4.24.0`,`fleetctl@v4.23.0`,`fleetctl@v4.22.1`,`fleetctl@v4.22.0`,`fleetctl@v4.21.0`,`fleetctl@v4.20.1`,`fleetctl@v4.20.0`,`fleetctl@v4.19.1`,`fleetctl@v4.19.0`,`fleetctl@v4.18.0`,`fleetctl@v4.17.1`,`fleetctl@v4.17.0`,`fleetctl@v4.16.0`,`fleetctl@v4.15.0`,`fleetctl@v4.14.0`,`fleetctl@v4.13.2`,`fleetctl@v4.13.1`,`fleetctl@v4.13.0`,`fleetctl@v4.12.1`,`fleetctl@v4.12.0`,`fleetctl@v4.11.0`,`fleetctl@v4.10.0`,`fleetctl@v4.9.1`,`fleetctl@v4.9.0`,`fleetctl@v4.8.0`,`fleetctl@v4.7.0`,`fleetctl@v4.6.2`,`fleetctl@v4.6.1`,`fleetctl@v4.6.0`,`fleetctl@v4.5.1`,`fleetctl@v4.5.0`,`fleetctl@v4.4.3`,`fleetctl@v4.4.2`,`fleetctl@v4.4.1`,`fleetctl@v4.4.0`,`fleetctl@v4.3.2`,`fleetctl@v4.3.1`,`fleetctl@v4.3.0`,`fleetctl@v4.2.4`,`fleetctl@v4.2.3`,`fleetctl@v4.2.2`,`fleetctl@v4.2.1`,`fleetctl@v4.2.0`,`fleetctl@v4.1.0`,`fleetctl@v4.0.1`,`fleetctl@v4.0.0`,`fleetctl@v3.13.0`,`fleetctl@v3.12.0`,`fleetctl@v3.11.0`,`fleetctl@v3.10.1`,`fleetctl@v3.10.0`,`fleetctl@v3.9.0`,`fleetctl@v3.8.0`,`fleetctl@v3.7.4`,`fleetctl@v3.7.1`,`fleetctl@v3.7.0`,`fleetctl@v3.6.0`,`fleetctl@v3.5.1`,`fleetctl@v3.5.0`,`fleetctl@v3.4.0`,`fleetctl@v3.3.0`,`pkg:golang/stdlib@1.25.7`
Flag fleetdm/fleetctl vulnerabilities (#43785) Run: https://github.com/fleetdm/fleet/actions/runs/24681592163. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added vulnerability disclosures for three CVEs. * CVE-2026-27806: marked as not affecting fleetctl. * CVE-2026-32280: denial-of-service affecting many fleetctl versions; recommend upgrading to a fleetctl build using Go ≥1.26.2 when available. * CVE-2026-33810: affects fleetctl v4.84.0; recommend upgrading to a fleetctl build using Go ≥1.26.2 when available. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:01:03 +00:00
- **Action statement:** `Low impact: denial-of-service (high CPU) on the host running fleetctl if it connects to a hostile TLS peer (malicious/compromised Fleet server, or MITM presenting a valid-looking cert) that sends many intermediate certificates. No code execution or data disclosure, and the Fleet server itself is unaffected. Upgrade to a fleetctl build using Go >= 1.26.2 when available.`
- **Timestamp:** 2026-04-20 14:00:03
### [CVE-2026-27806](https://nvd.nist.gov/vuln/detail/CVE-2026-27806)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** Vulnerability in orbit not fleetctl.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:golang/github.com/fleetdm/fleet/v4`
Flag fleetdm/fleetctl vulnerabilities (#43785) Run: https://github.com/fleetdm/fleet/actions/runs/24681592163. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added vulnerability disclosures for three CVEs. * CVE-2026-27806: marked as not affecting fleetctl. * CVE-2026-32280: denial-of-service affecting many fleetctl versions; recommend upgrading to a fleetctl build using Go ≥1.26.2 when available. * CVE-2026-33810: affects fleetctl v4.84.0; recommend upgrading to a fleetctl build using Go ≥1.26.2 when available. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:01:03 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-04-20 13:46:50
Ignore vulnerabilities in fleetdm/fleetctl (#41647) Fixes https://github.com/fleetdm/fleet/actions/runs/23038854478/job/66912680981. Run with this branch: https://github.com/fleetdm/fleet/actions/runs/23058249026
2026-03-13 17:22:40 +00:00
### [CVE-2026-27465](https://nvd.nist.gov/vuln/detail/CVE-2026-27465)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** This is a vulnerability in Fleet, not fleetctl.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:golang/github.com/fleetdm/fleet/v4`
Ignore vulnerabilities in fleetdm/fleetctl (#41647) Fixes https://github.com/fleetdm/fleet/actions/runs/23038854478/job/66912680981. Run with this branch: https://github.com/fleetdm/fleet/actions/runs/23058249026
2026-03-13 17:22:40 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-03-13 12:33:34
Add ignore to CVE found in fleetdm/fleetctl (#42711) Fixes: https://github.com/fleetdm/fleet/actions/runs/23783786066/job/69302104997 Test runs: - https://github.com/fleetdm/fleet/actions/runs/23798426124 - https://github.com/fleetdm/fleet/actions/runs/23798449109
2026-03-31 13:27:07 +00:00
### [CVE-2026-26061](https://nvd.nist.gov/vuln/detail/CVE-2026-26061)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** Vulnerability in fleet server, not fleetctl.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:golang/github.com/fleetdm/fleet/v4`
Add ignore to CVE found in fleetdm/fleetctl (#42711) Fixes: https://github.com/fleetdm/fleet/actions/runs/23783786066/job/69302104997 Test runs: - https://github.com/fleetdm/fleet/actions/runs/23798426124 - https://github.com/fleetdm/fleet/actions/runs/23798449109
2026-03-31 13:27:07 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-03-31 09:36:31
Fix security warnings on `fleetdm/fleetctl` (#42276) Fixes: https://github.com/fleetdm/fleet/actions/runs/23424438962 New runs: - Local: https://github.com/fleetdm/fleet/actions/runs/23463124995. - Remote: https://github.com/fleetdm/fleet/actions/runs/23463145956.
2026-03-24 15:10:29 +00:00
### [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetctl uses admin controlled URLs to manage Fleet. The primary attack vector is social engineering an admin into using a crafted URL.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:golang/stdlib`
Fix security warnings on `fleetdm/fleetctl` (#42276) Fixes: https://github.com/fleetdm/fleet/actions/runs/23424438962 New runs: - Local: https://github.com/fleetdm/fleet/actions/runs/23463124995. - Remote: https://github.com/fleetdm/fleet/actions/runs/23463145956.
2026-03-24 15:10:29 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2026-03-23 19:12:15
Skip openssl vulns in Fleet (#39098) Run: https://github.com/fleetdm/fleet/actions/runs/21532057134
2026-02-02 14:56:39 +00:00
### [CVE-2026-24515](https://nvd.nist.gov/vuln/detail/CVE-2026-24515)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetctl does not process XML using libexpat1, and when genrating packages the XMLs are defined.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:deb/debian/libexpat1`
Skip openssl vulns in Fleet (#39098) Run: https://github.com/fleetdm/fleet/actions/runs/21532057134
2026-02-02 14:56:39 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-01-03 15:15:53
Add rule to exclude CVE-2026-23517 from fleetctl (#39097) Run: https://github.com/fleetdm/fleet/actions/runs/21530332523.
2026-02-02 16:15:41 +00:00
### [CVE-2026-23517](https://nvd.nist.gov/vuln/detail/CVE-2026-23517)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** This vulnerability affected fleet, not fleetctl, adding it here to avoid false positives.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:golang/github.com/fleetdm/fleet/v4`
Add rule to exclude CVE-2026-23517 from fleetctl (#39097) Run: https://github.com/fleetdm/fleet/actions/runs/21530332523.
2026-02-02 16:15:41 +00:00
- **Justification:** `component_not_present`
- **Timestamp:** 2026-01-30 09:25:41
Ignore CVEs on fleetdm/fleetctl (#43240) Fixes: https://github.com/fleetdm/fleet/actions/runs/24121419823/job/70444895796 Run: https://github.com/fleetdm/fleet/actions/runs/24142910735
2026-04-08 20:46:41 +00:00
### [CVE-2026-0968](https://nvd.nist.gov/vuln/detail/CVE-2026-0968)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetdm/fleetctl does not use libssh. The libssh-4 package is an unused transitive dependency in the container image.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:deb/debian/libssh-4`
Ignore CVEs on fleetdm/fleetctl (#43240) Fixes: https://github.com/fleetdm/fleet/actions/runs/24121419823/job/70444895796 Run: https://github.com/fleetdm/fleet/actions/runs/24142910735
2026-04-08 20:46:41 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-04-08 12:06:51
Skip openssl vulns in Fleet (#39098) Run: https://github.com/fleetdm/fleet/actions/runs/21532057134
2026-02-02 14:56:39 +00:00
### [CVE-2025-69419](https://nvd.nist.gov/vuln/detail/CVE-2025-69419)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleet uses Go's crypto and TLS implementation.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:deb/debian/libssl3`,`pkg:deb/debian/openssl`
Skip openssl vulns in Fleet (#39098) Run: https://github.com/fleetdm/fleet/actions/runs/21532057134
2026-02-02 14:56:39 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-01-03 15:15:53
Update security status (#37086) Update our `security/status.md` file after analyzing currently reported vulnerabilities. https://github.com/fleetdm/fleet/actions/runs/20115346825 <img width="1711" height="645" alt="Screenshot 2025-12-10 at 7 41 00 PM" src="https://github.com/user-attachments/assets/97e17b58-50a8-4556-9ceb-bcb6701d7d61" />
2025-12-11 13:42:50 +00:00
### [CVE-2025-66516](https://nvd.nist.gov/vuln/detail/CVE-2025-66516)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetdm/fleetctl does not process end-user provided PDF files with Java when generating fleetd installers. The only PDF processing code is in Go for EULA documents.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:maven/org.apache.tika/tika-core`
Update security status (#37086) Update our `security/status.md` file after analyzing currently reported vulnerabilities. https://github.com/fleetdm/fleet/actions/runs/20115346825 <img width="1711" height="645" alt="Screenshot 2025-12-10 at 7 41 00 PM" src="https://github.com/user-attachments/assets/97e17b58-50a8-4556-9ceb-bcb6701d7d61" />
2025-12-11 13:42:50 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2025-12-10 18:12:45
### [CVE-2025-66293](https://nvd.nist.gov/vuln/detail/CVE-2025-66293)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetdm/fleetctl does not use libpng. Fleet components use the 'image/png' Go package for png processing.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:deb/debian/libpng16-16`
Update security status (#37086) Update our `security/status.md` file after analyzing currently reported vulnerabilities. https://github.com/fleetdm/fleet/actions/runs/20115346825 <img width="1711" height="645" alt="Screenshot 2025-12-10 at 7 41 00 PM" src="https://github.com/user-attachments/assets/97e17b58-50a8-4556-9ceb-bcb6701d7d61" />
2025-12-11 13:42:50 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2025-12-10 19:04:58
### [CVE-2025-65018](https://nvd.nist.gov/vuln/detail/CVE-2025-65018)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetdm/fleetctl does not use libpng. Fleet components use the 'image/png' Go package for png processing.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:deb/debian/libpng16-16`
Update security status (#37086) Update our `security/status.md` file after analyzing currently reported vulnerabilities. https://github.com/fleetdm/fleet/actions/runs/20115346825 <img width="1711" height="645" alt="Screenshot 2025-12-10 at 7 41 00 PM" src="https://github.com/user-attachments/assets/97e17b58-50a8-4556-9ceb-bcb6701d7d61" />
2025-12-11 13:42:50 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2025-12-10 19:04:42
### [CVE-2025-64720](https://nvd.nist.gov/vuln/detail/CVE-2025-64720)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetdm/fleetctl does not use libpng. Fleet components use the 'image/png' Go package for png processing.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:deb/debian/libpng16-16`
Update security status (#37086) Update our `security/status.md` file after analyzing currently reported vulnerabilities. https://github.com/fleetdm/fleet/actions/runs/20115346825 <img width="1711" height="645" alt="Screenshot 2025-12-10 at 7 41 00 PM" src="https://github.com/user-attachments/assets/97e17b58-50a8-4556-9ceb-bcb6701d7d61" />
2025-12-11 13:42:50 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2025-12-10 19:04:07
### [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729)
#### Statement:
- **Author:** @lucasmrod
- **Status:** `fixed`
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl@v4.78.*`
Update security status (#37086) Update our `security/status.md` file after analyzing currently reported vulnerabilities. https://github.com/fleetdm/fleet/actions/runs/20115346825 <img width="1711" height="645" alt="Screenshot 2025-12-10 at 7 41 00 PM" src="https://github.com/user-attachments/assets/97e17b58-50a8-4556-9ceb-bcb6701d7d61" />
2025-12-11 13:42:50 +00:00
- **Timestamp:** 2025-12-10 19:26:44
#### Statement:
- **Author:** @lucasmrod
- **Status:** `affected`
- **Status notes:** This is not a CRITICAL CVE, but we still recommend upgrading to 4.78.* when it's available.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl@v4.77.0`,`fleetctl@v4.76.0`,`fleetctl@v4.76.1`,`fleetctl@v4.75.0`,`fleetctl@v4.75.1`,`pkg:golang/stdlib@1.25.3`
Update security status (#37086) Update our `security/status.md` file after analyzing currently reported vulnerabilities. https://github.com/fleetdm/fleet/actions/runs/20115346825 <img width="1711" height="645" alt="Screenshot 2025-12-10 at 7 41 00 PM" src="https://github.com/user-attachments/assets/97e17b58-50a8-4556-9ceb-bcb6701d7d61" />
2025-12-11 13:42:50 +00:00
- **Action statement:** `No action statement provided`
- **Timestamp:** 2025-12-10 19:26:35
Add VEX statements for libxml2 CVEs (#30011) This PR adds VEX statement files for three vulverabilities: ``` ┌─────────┬────────────────┬──────────┬──────────┬─────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ ├─────────┼────────────────┼──────────┼──────────┼─────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤ │ libxml2 │ CVE-2025-49794 │ CRITICAL │ affected │ 2.9.14+dfsg-1.3~deb12u1 │ │ libxml: Heap use after free (UAF) leads to Denial of service │ │ │ │ │ │ │ │ (DoS)... │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-49794 │ │ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ │ CVE-2025-49795 │ │ │ │ │ libxml: Null pointer dereference leads to Denial of service │ │ │ │ │ │ │ │ (DoS) │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-49795 │ │ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ │ CVE-2025-49796 │ │ │ │ │ libxml: Type confusion leads to Denial of service (DoS) │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-49796 │ └─────────┴────────────────┴──────────┴──────────┴─────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘ ``` the vulnerabilities in libxml2 do not affect fleetctl, since the attack vector is DoS and fleetctl is not a server tool. Additionally the libxml2 package isn't used by fleetctl directly, but by the tools it uses for code signing, which don't parse untrusted XML.
2025-06-13 22:00:49 +00:00
### [CVE-2025-49796](https://nvd.nist.gov/vuln/detail/CVE-2025-49796)
- **Author:** @sgress454
- **Status:** `not_affected`
- **Status notes:** The affected dependency (libxml2) is not utilized by fleetctl itself, but by Apple’s iTMSTransporter tool, which is included in the Docker image for code signing purposes. fleetctl does not process untrusted XML input. Additionally, this CVE describes a denial-of-service (DoS) vulnerability, and fleetctl is a CLI tool, not a long-running service, and therefore is not susceptible to DoS-style exploitation.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:deb/debian/libxml2@2.9.14+dfsg-1.3~deb12u1`,`pkg:deb/debian/libxml2@2.9.14+dfsg-1.3~deb12u2`
Add VEX statements for libxml2 CVEs (#30011) This PR adds VEX statement files for three vulverabilities: ``` ┌─────────┬────────────────┬──────────┬──────────┬─────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ ├─────────┼────────────────┼──────────┼──────────┼─────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤ │ libxml2 │ CVE-2025-49794 │ CRITICAL │ affected │ 2.9.14+dfsg-1.3~deb12u1 │ │ libxml: Heap use after free (UAF) leads to Denial of service │ │ │ │ │ │ │ │ (DoS)... │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-49794 │ │ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ │ CVE-2025-49795 │ │ │ │ │ libxml: Null pointer dereference leads to Denial of service │ │ │ │ │ │ │ │ (DoS) │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-49795 │ │ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ │ CVE-2025-49796 │ │ │ │ │ libxml: Type confusion leads to Denial of service (DoS) │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-49796 │ └─────────┴────────────────┴──────────┴──────────┴─────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘ ``` the vulnerabilities in libxml2 do not affect fleetctl, since the attack vector is DoS and fleetctl is not a server tool. Additionally the libxml2 package isn't used by fleetctl directly, but by the tools it uses for code signing, which don't parse untrusted XML.
2025-06-13 22:00:49 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2025-06-13 15:57:38
### [CVE-2025-49795](https://nvd.nist.gov/vuln/detail/CVE-2025-49795)
- **Author:** @sgress454
- **Status:** `not_affected`
- **Status notes:** The affected dependency (libxml2) is not utilized by fleetctl itself, but by Apple’s iTMSTransporter tool, which is included in the Docker image for code signing purposes. fleetctl does not process untrusted XML input. Additionally, this CVE describes a denial-of-service (DoS) vulnerability, and fleetctl is a CLI tool, not a long-running service, and therefore is not susceptible to DoS-style exploitation.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:deb/debian/libxml2@2.9.14+dfsg-1.3~deb12u1`
Add VEX statements for libxml2 CVEs (#30011) This PR adds VEX statement files for three vulverabilities: ``` ┌─────────┬────────────────┬──────────┬──────────┬─────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ ├─────────┼────────────────┼──────────┼──────────┼─────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤ │ libxml2 │ CVE-2025-49794 │ CRITICAL │ affected │ 2.9.14+dfsg-1.3~deb12u1 │ │ libxml: Heap use after free (UAF) leads to Denial of service │ │ │ │ │ │ │ │ (DoS)... │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-49794 │ │ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ │ CVE-2025-49795 │ │ │ │ │ libxml: Null pointer dereference leads to Denial of service │ │ │ │ │ │ │ │ (DoS) │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-49795 │ │ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ │ CVE-2025-49796 │ │ │ │ │ libxml: Type confusion leads to Denial of service (DoS) │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-49796 │ └─────────┴────────────────┴──────────┴──────────┴─────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘ ``` the vulnerabilities in libxml2 do not affect fleetctl, since the attack vector is DoS and fleetctl is not a server tool. Additionally the libxml2 package isn't used by fleetctl directly, but by the tools it uses for code signing, which don't parse untrusted XML.
2025-06-13 22:00:49 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2025-06-13 15:57:25
### [CVE-2025-49794](https://nvd.nist.gov/vuln/detail/CVE-2025-49794)
- **Author:** @sgress454
- **Status:** `not_affected`
- **Status notes:** The affected dependency (libxml2) is not utilized by fleetctl itself, but by Apple’s iTMSTransporter tool, which is included in the Docker image for code signing purposes. fleetctl does not process untrusted XML input. Additionally, this CVE describes a denial-of-service (DoS) vulnerability, and fleetctl is a CLI tool, not a long-running service, and therefore is not susceptible to DoS-style exploitation.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:deb/debian/libxml2@2.9.14+dfsg-1.3~deb12u1`,`pkg:deb/debian/libxml2@2.9.14+dfsg-1.3~deb12u2`
Add VEX statements for libxml2 CVEs (#30011) This PR adds VEX statement files for three vulverabilities: ``` ┌─────────┬────────────────┬──────────┬──────────┬─────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ ├─────────┼────────────────┼──────────┼──────────┼─────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤ │ libxml2 │ CVE-2025-49794 │ CRITICAL │ affected │ 2.9.14+dfsg-1.3~deb12u1 │ │ libxml: Heap use after free (UAF) leads to Denial of service │ │ │ │ │ │ │ │ (DoS)... │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-49794 │ │ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ │ CVE-2025-49795 │ │ │ │ │ libxml: Null pointer dereference leads to Denial of service │ │ │ │ │ │ │ │ (DoS) │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-49795 │ │ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ │ CVE-2025-49796 │ │ │ │ │ libxml: Type confusion leads to Denial of service (DoS) │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-49796 │ └─────────┴────────────────┴──────────┴──────────┴─────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘ ``` the vulnerabilities in libxml2 do not affect fleetctl, since the attack vector is DoS and fleetctl is not a server tool. Additionally the libxml2 package isn't used by fleetctl directly, but by the tools it uses for code signing, which don't parse untrusted XML.
2025-06-13 22:00:49 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2025-06-13 15:56:50
Mark `CVE-2025-48734` as not affected (#29692) https://fleetdm.slack.com/archives/C019WG4GH0A/p1748758788762129
2025-06-02 16:53:40 +00:00
### [CVE-2025-48734](https://nvd.nist.gov/vuln/detail/CVE-2025-48734)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** The fleetctl tool is used by IT admins to generate packages so the vulnerable code cannot be controlled by attackers.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:maven/commons-beanutils/commons-beanutils`
Mark `CVE-2025-48734` as not affected (#29692) https://fleetdm.slack.com/archives/C019WG4GH0A/p1748758788762129
2025-06-02 16:53:40 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2025-06-02 07:33:44
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2025-46569](https://nvd.nist.gov/vuln/detail/CVE-2025-46569)
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Author:** @lucasmrod
- **Status:** `not_affected`
Fix detected CVEs and docker scout exit code to fail the Github Action (#28836) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.
2025-05-06 16:35:27 +00:00
- **Status notes:** fleetctl does not use OPA.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:golang/github.com/open-policy-agent/opa`
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-05-06 07:47:31
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
Skip CVE in fleetctl (#33267) Fixes https://github.com/fleetdm/fleet/actions/runs/17906206819.
2025-09-22 21:55:08 +00:00
### [CVE-2025-41249](https://nvd.nist.gov/vuln/detail/CVE-2025-41249)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** Vulnerability affects web servers, not fleetctl.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:maven/org.springframework/spring-core`
Skip CVE in fleetctl (#33267) Fixes https://github.com/fleetdm/fleet/actions/runs/17906206819.
2025-09-22 21:55:08 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2025-09-22 10:27:40
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2025-31115](https://nvd.nist.gov/vuln/detail/CVE-2025-31115)
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Author:** @lucasmrod
- **Status:** `not_affected`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Status notes:** fleetctl does not use liblzma5.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:deb/debian/liblzma5`
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-04-09 13:24:20
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
Add VEX rule to remove CVE-2025-27509 false positive on fleetctl (#32914)
2025-09-12 13:54:46 +00:00
### [CVE-2025-27509](https://nvd.nist.gov/vuln/detail/CVE-2025-27509)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** This vulnerability affected fleet, not fleetctl, adding it here to avoid false positives.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:golang/github.com/fleetdm/fleet/v4`
Add VEX rule to remove CVE-2025-27509 false positive on fleetctl (#32914)
2025-09-12 13:54:46 +00:00
- **Justification:** `component_not_present`
- **Timestamp:** 2025-09-12 09:25:41
Skip openssl vulns in Fleet (#39098) Run: https://github.com/fleetdm/fleet/actions/runs/21532057134
2026-02-02 14:56:39 +00:00
### [CVE-2025-15467](https://nvd.nist.gov/vuln/detail/CVE-2025-15467)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetctl uses Go's crypto and TLS implementation.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:deb/debian/openssl`,`pkg:deb/debian/libssl3`
Skip openssl vulns in Fleet (#39098) Run: https://github.com/fleetdm/fleet/actions/runs/21532057134
2026-02-02 14:56:39 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-01-03 15:15:53
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2024-7254](https://nvd.nist.gov/vuln/detail/CVE-2024-7254)
Run `make generate-doc` (#28595) PRs are failing due to mismatch in auto-generated docs: https://github.com/fleetdm/fleet/actions/runs/14685592347/job/41213770932?pr=28531 Co-authored-by: Rachael Shaw <r@rachael.wtf>
2025-04-28 15:11:45 +00:00
- **Author:** @lucasmrod
- **Status:** `not_affected`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Status notes:** fleetctl does not use Java.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:maven/com.google.protobuf/protobuf-java`
Run `make generate-doc` (#28595) PRs are failing due to mismatch in auto-generated docs: https://github.com/fleetdm/fleet/actions/runs/14685592347/job/41213770932?pr=28531 Co-authored-by: Rachael Shaw <r@rachael.wtf>
2025-04-28 15:11:45 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-04-10 07:34:26
Run `make generate-doc` (#28595) PRs are failing due to mismatch in auto-generated docs: https://github.com/fleetdm/fleet/actions/runs/14685592347/job/41213770932?pr=28531 Co-authored-by: Rachael Shaw <r@rachael.wtf>
2025-04-28 15:11:45 +00:00
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2023-6879](https://nvd.nist.gov/vuln/detail/CVE-2023-6879)
Fix detected CVEs and docker scout exit code to fail the Github Action (#28836) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.
2025-05-06 16:35:27 +00:00
- **Author:** @lucasmrod
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Status:** `not_affected`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Status notes:** fleetctl does not use libaom3.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:deb/debian/libaom3`
Fix detected CVEs and docker scout exit code to fail the Github Action (#28836) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.
2025-05-06 16:35:27 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-04-15 10:28:21
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2023-45853](https://nvd.nist.gov/vuln/detail/CVE-2023-45853)
Run `make generate-doc` (#28595) PRs are failing due to mismatch in auto-generated docs: https://github.com/fleetdm/fleet/actions/runs/14685592347/job/41213770932?pr=28531 Co-authored-by: Rachael Shaw <r@rachael.wtf>
2025-04-28 15:11:45 +00:00
- **Author:** @lucasmrod
- **Status:** `not_affected`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Status notes:** fleetctl does not use zlib C library.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:deb/debian/zlib1g`
Run `make generate-doc` (#28595) PRs are failing due to mismatch in auto-generated docs: https://github.com/fleetdm/fleet/actions/runs/14685592347/job/41213770932?pr=28531 Co-authored-by: Rachael Shaw <r@rachael.wtf>
2025-04-28 15:11:45 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-04-15 10:17:19
Run `make generate-doc` (#28595) PRs are failing due to mismatch in auto-generated docs: https://github.com/fleetdm/fleet/actions/runs/14685592347/job/41213770932?pr=28531 Co-authored-by: Rachael Shaw <r@rachael.wtf>
2025-04-28 15:11:45 +00:00
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2023-32698](https://nvd.nist.gov/vuln/detail/CVE-2023-32698)
Fix detected CVEs and docker scout exit code to fail the Github Action (#28836) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.
2025-05-06 16:35:27 +00:00
- **Author:** @getvictor
- **Status:** `not_affected`
- **Status notes:** When packaging linux files, fleetctl does not use global permissions. It was verified that packed fleetd package files do not have group/global write permissions.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:golang/github.com/goreleaser/nfpm/v2`
Fix detected CVEs and docker scout exit code to fail the Github Action (#28836) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.
2025-05-06 16:35:27 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-04-09 10:26:02
Fix detected CVEs and docker scout exit code to fail the Github Action (#28836) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.
2025-05-06 16:35:27 +00:00
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2019-10202](https://nvd.nist.gov/vuln/detail/CVE-2019-10202)
Run `make generate-doc` (#28595) PRs are failing due to mismatch in auto-generated docs: https://github.com/fleetdm/fleet/actions/runs/14685592347/job/41213770932?pr=28531 Co-authored-by: Rachael Shaw <r@rachael.wtf>
2025-04-28 15:11:45 +00:00
- **Author:** @lucasmrod
- **Status:** `not_affected`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Status notes:** fleetctl does not use Java.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:maven/org.codehaus.jackson/jackson-mapper-asl`
Run `make generate-doc` (#28595) PRs are failing due to mismatch in auto-generated docs: https://github.com/fleetdm/fleet/actions/runs/14685592347/job/41213770932?pr=28531 Co-authored-by: Rachael Shaw <r@rachael.wtf>
2025-04-28 15:11:45 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-04-15 10:31:31
Run `make generate-doc` (#28595) PRs are failing due to mismatch in auto-generated docs: https://github.com/fleetdm/fleet/actions/runs/14685592347/job/41213770932?pr=28531 Co-authored-by: Rachael Shaw <r@rachael.wtf>
2025-04-28 15:11:45 +00:00
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2013-4002](https://nvd.nist.gov/vuln/detail/CVE-2013-4002)
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Author:** @lucasmrod
- **Status:** `not_affected`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Status notes:** fleetctl does not use Java.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:maven/xerces/xercesImpl`
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-04-10 07:36:31
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
### [CVE-2012-0881](https://nvd.nist.gov/vuln/detail/CVE-2012-0881)
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Author:** @lucasmrod
- **Status:** `not_affected`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Status notes:** fleetctl does not use Java.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `fleetctl`,`pkg:maven/xerces/xercesImpl`
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
Iterate `status.md` for reporting vulnerability updates (#29062) For #28805. See scenario we want to support in the linked issue. --------- Co-authored-by: Scott Gress <scottmgress@gmail.com>
2025-05-16 00:15:37 +00:00
- **Timestamp:** 2025-04-10 14:46:52
Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2025-04-16 14:50:10 +00:00
Add CVE scanning for fleetdm/wix and split out workflows (#33687) Attempting to fix https://github.com/fleetdm/fleet/actions/runs/18120473187/job/51564073671#step:11:38 Changes: - The docker images are too big so they started to cause issues in Github runners. Thus I'm splitting the one workflow into three separate workflows, one for each image. - While we are at it: start tracking vulnerabilities in fleetdm/wix and fleetdm/bomutils. New runs: - https://github.com/fleetdm/fleet/actions/runs/18161326970/job/51692559418 - https://github.com/fleetdm/fleet/actions/runs/18161326953/job/51692559257 - https://github.com/fleetdm/fleet/actions/runs/18161326952/job/51692559172
2025-10-01 22:37:22 +00:00
## `fleetdm/wix` docker image
Ignore vulnerabilities in fleetdm/wix (#43764) Run: https://github.com/fleetdm/fleet/actions/runs/24676558778. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added security vulnerability assessments for CVE-2026-28390, CVE-2026-4775, and CVE-2026-5201, confirming these issues do not affect the product. Statements note that vulnerable code is not in the product’s execution path and relevant processing (TLS/TIFF/graphics) is not performed by the shipped components. Includes timestamps and metadata for traceability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-04-20 16:53:36 +00:00
### [CVE-2026-5201](https://nvd.nist.gov/vuln/detail/CVE-2026-5201)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetctl does not do JPEG processing when using fleetdm/wix.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `wix`,`pkg:deb/debian/libgdk-pixbuf-2.0-0`,`pkg:deb/debian/libgdk-pixbuf2.0-common`
Ignore vulnerabilities in fleetdm/wix (#43764) Run: https://github.com/fleetdm/fleet/actions/runs/24676558778. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added security vulnerability assessments for CVE-2026-28390, CVE-2026-4775, and CVE-2026-5201, confirming these issues do not affect the product. Statements note that vulnerable code is not in the product’s execution path and relevant processing (TLS/TIFF/graphics) is not performed by the shipped components. Includes timestamps and metadata for traceability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-04-20 16:53:36 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-04-20 11:41:33
### [CVE-2026-4775](https://nvd.nist.gov/vuln/detail/CVE-2026-4775)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetctl does not do TIFF processing when using fleetdm/wix.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `wix`,`pkg:deb/debian/libtiff6`
Ignore vulnerabilities in fleetdm/wix (#43764) Run: https://github.com/fleetdm/fleet/actions/runs/24676558778. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added security vulnerability assessments for CVE-2026-28390, CVE-2026-4775, and CVE-2026-5201, confirming these issues do not affect the product. Statements note that vulnerable code is not in the product’s execution path and relevant processing (TLS/TIFF/graphics) is not performed by the shipped components. Includes timestamps and metadata for traceability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-04-20 16:53:36 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-04-20 11:42:37
Ignore CVEs on fleetdm/wix (#43226) Fixes https://github.com/fleetdm/fleet/actions/runs/24121241577. New run: https://github.com/fleetdm/fleet/actions/runs/24140346610
2026-04-08 20:48:42 +00:00
### [CVE-2026-33636](https://nvd.nist.gov/vuln/detail/CVE-2026-33636)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetctl does not do PNG processing when using fleetdm/wix.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `wix`,`pkg:deb/debian/libpng16-16t64`
Ignore CVEs on fleetdm/wix (#43226) Fixes https://github.com/fleetdm/fleet/actions/runs/24121241577. New run: https://github.com/fleetdm/fleet/actions/runs/24140346610
2026-04-08 20:48:42 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-04-08 11:43:22
### [CVE-2026-33416](https://nvd.nist.gov/vuln/detail/CVE-2026-33416)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetctl does not do PNG processing when using fleetdm/wix.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `wix`,`pkg:deb/debian/libpng16-16t64`
Ignore CVEs on fleetdm/wix (#43226) Fixes https://github.com/fleetdm/fleet/actions/runs/24121241577. New run: https://github.com/fleetdm/fleet/actions/runs/24140346610
2026-04-08 20:48:42 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-04-08 11:01:10
Fix fleetdm/wix warnings (#42312) Fixes https://github.com/fleetdm/fleet/actions/runs/23475951459/job/68308629296. Runs: - https://github.com/fleetdm/fleet/actions/runs/23497560995 (remote) - https://github.com/fleetdm/fleet/actions/runs/23497590149 (local)
2026-03-24 20:38:33 +00:00
### [CVE-2026-2921](https://nvd.nist.gov/vuln/detail/CVE-2026-2921)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetctl does not process media files when using fleetdm/wix.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `wix`,`pkg:deb/debian/libgstreamer-plugins-base1.0-0`
Fix fleetdm/wix warnings (#42312) Fixes https://github.com/fleetdm/fleet/actions/runs/23475951459/job/68308629296. Runs: - https://github.com/fleetdm/fleet/actions/runs/23497560995 (remote) - https://github.com/fleetdm/fleet/actions/runs/23497590149 (local)
2026-03-24 20:38:33 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2026-03-24 12:23:52
Ignore vulnerabilities in fleetdm/wix (#43764) Run: https://github.com/fleetdm/fleet/actions/runs/24676558778. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added security vulnerability assessments for CVE-2026-28390, CVE-2026-4775, and CVE-2026-5201, confirming these issues do not affect the product. Statements note that vulnerable code is not in the product’s execution path and relevant processing (TLS/TIFF/graphics) is not performed by the shipped components. Includes timestamps and metadata for traceability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-04-20 16:53:36 +00:00
### [CVE-2026-28390](https://nvd.nist.gov/vuln/detail/CVE-2026-28390)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetdm/wix does not connect to TLS servers using OpenSSL.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `wix`,`pkg:deb/debian/libssl3t64`,`pkg:deb/debian/openssl`,`pkg:deb/debian/openssl-provider-legacy`
Ignore vulnerabilities in fleetdm/wix (#43764) Run: https://github.com/fleetdm/fleet/actions/runs/24676558778. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added security vulnerability assessments for CVE-2026-28390, CVE-2026-4775, and CVE-2026-5201, confirming these issues do not affect the product. Statements note that vulnerable code is not in the product’s execution path and relevant processing (TLS/TIFF/graphics) is not performed by the shipped components. Includes timestamps and metadata for traceability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-04-20 16:53:36 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-04-20 11:44:34
Fix fleetdm/wix warnings (#42312) Fixes https://github.com/fleetdm/fleet/actions/runs/23475951459/job/68308629296. Runs: - https://github.com/fleetdm/fleet/actions/runs/23497560995 (remote) - https://github.com/fleetdm/fleet/actions/runs/23497590149 (local)
2026-03-24 20:38:33 +00:00
### [CVE-2026-0861](https://nvd.nist.gov/vuln/detail/CVE-2026-0861)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** No attacker-controlled allocation arguments. The fleetdm/wix container runs WiX toolset commands (heat.exe, candle.exe, light.exe) via Wine to compile .wxs files into an MSI. The only input is a volume-mounted temp directory containing Fleet-generated files (main.wxs, heat.wxs, the orbit root directory). None of this feeds attacker-controlled size/alignment values to memalign.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `wix`,`pkg:deb/debian/libc6`,`pkg:deb/debian/libc-bin`
Fix fleetdm/wix warnings (#42312) Fixes https://github.com/fleetdm/fleet/actions/runs/23475951459/job/68308629296. Runs: - https://github.com/fleetdm/fleet/actions/runs/23497560995 (remote) - https://github.com/fleetdm/fleet/actions/runs/23497590149 (local)
2026-03-24 20:38:33 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2026-03-24 12:18:16
Fix WiX alerts (#37572)
2025-12-19 23:26:26 +00:00
### [CVE-2025-66293](https://nvd.nist.gov/vuln/detail/CVE-2025-66293)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetctl does not do PNG processing when using fleetdm/wix.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `wix`,`pkg:deb/debian/libpng16-16`
Fix WiX alerts (#37572)
2025-12-19 23:26:26 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2025-12-19 18:03:45
### [CVE-2025-65018](https://nvd.nist.gov/vuln/detail/CVE-2025-65018)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetctl does not do PNG processing when using fleetdm/wix.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `wix`,`pkg:deb/debian/libpng16-16`
Fix WiX alerts (#37572)
2025-12-19 23:26:26 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2025-12-19 18:03:33
### [CVE-2025-64720](https://nvd.nist.gov/vuln/detail/CVE-2025-64720)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetctl does not do PNG processing when using fleetdm/wix.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `wix`,`pkg:deb/debian/libpng16-16`
Fix WiX alerts (#37572)
2025-12-19 23:26:26 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2025-12-19 18:02:56
Add CVE scanning for fleetdm/wix and split out workflows (#33687) Attempting to fix https://github.com/fleetdm/fleet/actions/runs/18120473187/job/51564073671#step:11:38 Changes: - The docker images are too big so they started to cause issues in Github runners. Thus I'm splitting the one workflow into three separate workflows, one for each image. - While we are at it: start tracking vulnerabilities in fleetdm/wix and fleetdm/bomutils. New runs: - https://github.com/fleetdm/fleet/actions/runs/18161326970/job/51692559418 - https://github.com/fleetdm/fleet/actions/runs/18161326953/job/51692559257 - https://github.com/fleetdm/fleet/actions/runs/18161326952/job/51692559172
2025-10-01 22:37:22 +00:00
### [CVE-2023-31484](https://nvd.nist.gov/vuln/detail/CVE-2023-31484)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** The WiX toolset is unaffected by the perl vulnerability.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `wix`,`pkg:deb/debian/perl-base`
Add CVE scanning for fleetdm/wix and split out workflows (#33687) Attempting to fix https://github.com/fleetdm/fleet/actions/runs/18120473187/job/51564073671#step:11:38 Changes: - The docker images are too big so they started to cause issues in Github runners. Thus I'm splitting the one workflow into three separate workflows, one for each image. - While we are at it: start tracking vulnerabilities in fleetdm/wix and fleetdm/bomutils. New runs: - https://github.com/fleetdm/fleet/actions/runs/18161326970/job/51692559418 - https://github.com/fleetdm/fleet/actions/runs/18161326953/job/51692559257 - https://github.com/fleetdm/fleet/actions/runs/18161326952/job/51692559172
2025-10-01 22:37:22 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2025-10-01 08:36:42
## `fleetdm/bomutils` docker image
Ignore vulnerabilities in fleetdm/bomutils (#43765) Run: https://github.com/fleetdm/fleet/actions/runs/24673271270 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security** * Added vulnerability assessment documentation for CVE-2026-28390, confirming that bomutils is not affected by this vulnerability. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 15:55:28 +00:00
### [CVE-2026-28390](https://nvd.nist.gov/vuln/detail/CVE-2026-28390)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** fleetdm/bomutils does not connect to TLS servers using OpenSSL.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `bomutils`,`pkg:deb/debian/libssl3t64`,`pkg:deb/debian/openssl`,`pkg:deb/debian/openssl-provider-legacy`
Ignore vulnerabilities in fleetdm/bomutils (#43765) Run: https://github.com/fleetdm/fleet/actions/runs/24673271270 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security** * Added vulnerability assessment documentation for CVE-2026-28390, confirming that bomutils is not affected by this vulnerability. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 15:55:28 +00:00
- **Justification:** `vulnerable_code_not_in_execute_path`
- **Timestamp:** 2026-04-20 11:48:55
Add ignores for CVE-2026-0861 in bomutils (#42292) Resolves https://github.com/fleetdm/fleet/actions/runs/23476296008/job/68309683127. Run: - https://github.com/fleetdm/fleet/actions/runs/23487678187 - https://github.com/fleetdm/fleet/actions/runs/23487670926
2026-03-24 15:10:49 +00:00
### [CVE-2026-0861](https://nvd.nist.gov/vuln/detail/CVE-2026-0861)
- **Author:** @lucasmrod
- **Status:** `not_affected`
- **Status notes:** Use of mkbom and xar from fleetdm/bomutils have admin controlled inputs.
Fix parser extra colon (#43796) Extra colon in the "Products:" section auto-generated file: <img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM" src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected formatting in product list display by removing redundant punctuation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-20 18:35:51 +00:00
- **Products:** `bomutils`,`pkg:deb/debian/libc6`,`pkg:deb/debian/libc-bin`
Add ignores for CVE-2026-0861 in bomutils (#42292) Resolves https://github.com/fleetdm/fleet/actions/runs/23476296008/job/68309683127. Run: - https://github.com/fleetdm/fleet/actions/runs/23487678187 - https://github.com/fleetdm/fleet/actions/runs/23487670926
2026-03-24 15:10:49 +00:00
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
- **Timestamp:** 2026-03-24 08:41:27
Add CVE scanning for fleetdm/wix and split out workflows (#33687) Attempting to fix https://github.com/fleetdm/fleet/actions/runs/18120473187/job/51564073671#step:11:38 Changes: - The docker images are too big so they started to cause issues in Github runners. Thus I'm splitting the one workflow into three separate workflows, one for each image. - While we are at it: start tracking vulnerabilities in fleetdm/wix and fleetdm/bomutils. New runs: - https://github.com/fleetdm/fleet/actions/runs/18161326970/job/51692559418 - https://github.com/fleetdm/fleet/actions/runs/18161326953/job/51692559257 - https://github.com/fleetdm/fleet/actions/runs/18161326952/job/51692559172
2025-10-01 22:37:22 +00:00
Reference in a new issue Copy permalink