From cede9352953b6b4db2bff22cfd0a9fd86e92a645 Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Fri, 14 Aug 2026 17:12:51 +0530 Subject: [PATCH 1/5] update 2.3.60 cli --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 2057b7d..d8e0930 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Use AST Base image -FROM checkmarx/ast-cli:2.3.59@sha256:92102e087def76f9bfd3af5e8e153bd43a0f5499f118c317151e10f564ecf67a +FROM checkmarx/ast-cli:2.3.60@sha256:ed98724a7a971034b9224eca19e5dca5fad3e1f3dc1624f301a9b766c446d210 # Docker actions must be run by the default Docker user (root). USER root From 05b9ae39cb8958925dbe1a375e83d7f053fd16ba Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Fri, 14 Aug 2026 21:15:05 +0530 Subject: [PATCH 2/5] added in trivy ignore --- .trivyignore | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.trivyignore b/.trivyignore index 55ad2b4..adfc0f1 100644 --- a/.trivyignore +++ b/.trivyignore @@ -23,3 +23,8 @@ CVE-2026-48978 # oras-go bearer token realm hijacking # Go Standard Library CVE-2026-39822 # Root escape via symlink + trailing slash CVE-2026-42505 # ECH privacy leak in crypto/tls + +# golang.org/x/net (via stdlib) - disclosed 2026-08-14, fix requires Go toolchain +# upgrade to 1.26.6/1.27.0-rc.3 in ast-cli; tracked for the next cx release. +CVE-2026-39821 exp=2026-09-30 # x/net/idna privilege escalation via incorrect Punycode label processing +CVE-2026-46600 exp=2026-09-30 # x/net/dns/dnsmessage DoS via invalid DNS record parsing From f05aa6ab3267854209c96ccf866b10a1d195e908 Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Mon, 17 Aug 2026 13:30:03 +0530 Subject: [PATCH 3/5] delete unnecesaary file --- .github/workflows/scan-github-action.yml | 31 ------------------------ 1 file changed, 31 deletions(-) delete mode 100644 .github/workflows/scan-github-action.yml diff --git a/.github/workflows/scan-github-action.yml b/.github/workflows/scan-github-action.yml deleted file mode 100644 index 5ef6a90..0000000 --- a/.github/workflows/scan-github-action.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: Scan for GitHub Actions issues - -on: - pull_request: - workflow_call: - -concurrency: - group: ${{ github.workflow }}-${{ github.repository }}-${{ github.ref }} - -permissions: {} - -jobs: - zizmor: - name: Scan repository contents - runs-on: cx-private-ubuntu-x64 - permissions: - contents: read - steps: - - name: Check out repository - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: - persist-credentials: false - - - name: Run Zizmor linter - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 - with: - advanced-security: false - annotations: false - persona: pedantic - fail-on-no-inputs: false - online-audits: false From e405e34205590e2812f32113420edcbe88efa326 Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Mon, 17 Aug 2026 17:31:15 +0530 Subject: [PATCH 4/5] Suppress 6 Go stdlib CVEs in app/bin/cx pending toolchain upgrade Trivy flags these against ast-cli 2.3.60's embedded Go binary; fix requires the same 1.26.6/1.27.0-rc.3 toolchain bump already tracked for the golang.org/x/net CVEs above. --- .trivyignore | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.trivyignore b/.trivyignore index adfc0f1..ed0b15f 100644 --- a/.trivyignore +++ b/.trivyignore @@ -28,3 +28,11 @@ CVE-2026-42505 # ECH privacy leak in crypto/tls # upgrade to 1.26.6/1.27.0-rc.3 in ast-cli; tracked for the next cx release. CVE-2026-39821 exp=2026-09-30 # x/net/idna privilege escalation via incorrect Punycode label processing CVE-2026-46600 exp=2026-09-30 # x/net/dns/dnsmessage DoS via invalid DNS record parsing + +# Go stdlib (app/bin/cx, gobinary) - same Go 1.26.6/1.27.0-rc.3 toolchain upgrade as above +CVE-2026-33818 exp=2026-09-30 # encoding/asn1 DoS via excessive recursion in Unmarshal +CVE-2026-56853 exp=2026-09-30 # net/http unencrypted HTTP/2 connections DoS +CVE-2026-56858 exp=2026-09-30 # html/template XSS via pathological input +CVE-2026-56859 exp=2026-09-30 # encoding/xml DoS via recursion depth issue +CVE-2026-56860 exp=2026-09-30 # net/url DoS from quadratic complexity in path parsing +CVE-2026-56862 exp=2026-09-30 # crypto/tls DoS via indefinite KeyUpdate messages From 307613ab752e5aa4e58364b7de765f0f23193679 Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Tue, 18 Aug 2026 11:19:35 +0530 Subject: [PATCH 5/5] chnaged code owner --- CODEOWNERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CODEOWNERS b/CODEOWNERS index 6ba245a..4fab2f3 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -2,4 +2,4 @@ # Each line is a file pattern followed by one or more owners # Specify the default owners for the entire repository -* @greensd4 @AlvoBen +* @cx-rakesh-kadu @cx-anurag-dalke @cx-rahul-pidde @cx-anand-nandeshwar @cx-amol-mane