From 5d29519c8b004dc721c111324e937fe95e0c8794 Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Wed, 19 Aug 2026 22:23:36 +0530 Subject: [PATCH 1/2] update the sha for 2.3.63 --- .trivyignore | 13 ------------- Dockerfile | 2 +- 2 files changed, 1 insertion(+), 14 deletions(-) diff --git a/.trivyignore b/.trivyignore index ed0b15f..55ad2b4 100644 --- a/.trivyignore +++ b/.trivyignore @@ -23,16 +23,3 @@ CVE-2026-48978 # oras-go bearer token realm hijacking # Go Standard Library CVE-2026-39822 # Root escape via symlink + trailing slash CVE-2026-42505 # ECH privacy leak in crypto/tls - -# golang.org/x/net (via stdlib) - disclosed 2026-08-14, fix requires Go toolchain -# upgrade to 1.26.6/1.27.0-rc.3 in ast-cli; tracked for the next cx release. -CVE-2026-39821 exp=2026-09-30 # x/net/idna privilege escalation via incorrect Punycode label processing -CVE-2026-46600 exp=2026-09-30 # x/net/dns/dnsmessage DoS via invalid DNS record parsing - -# Go stdlib (app/bin/cx, gobinary) - same Go 1.26.6/1.27.0-rc.3 toolchain upgrade as above -CVE-2026-33818 exp=2026-09-30 # encoding/asn1 DoS via excessive recursion in Unmarshal -CVE-2026-56853 exp=2026-09-30 # net/http unencrypted HTTP/2 connections DoS -CVE-2026-56858 exp=2026-09-30 # html/template XSS via pathological input -CVE-2026-56859 exp=2026-09-30 # encoding/xml DoS via recursion depth issue -CVE-2026-56860 exp=2026-09-30 # net/url DoS from quadratic complexity in path parsing -CVE-2026-56862 exp=2026-09-30 # crypto/tls DoS via indefinite KeyUpdate messages diff --git a/Dockerfile b/Dockerfile index d8e0930..9cf0792 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Use AST Base image -FROM checkmarx/ast-cli:2.3.60@sha256:ed98724a7a971034b9224eca19e5dca5fad3e1f3dc1624f301a9b766c446d210 +FROM checkmarx/ast-cli:2.3.63@sha256:76915c053671e722dcce735bd18a1e7725c4a2bd21b6d4a443ba1591a2813735 # Docker actions must be run by the default Docker user (root). USER root From 4190900a5d2f768da5fc96de1cc98de1f2674032 Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Thu, 20 Aug 2026 11:50:08 +0530 Subject: [PATCH 2/2] added in trivy ignore --- .trivyignore | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.trivyignore b/.trivyignore index 55ad2b4..e7534e3 100644 --- a/.trivyignore +++ b/.trivyignore @@ -23,3 +23,7 @@ CVE-2026-48978 # oras-go bearer token realm hijacking # Go Standard Library CVE-2026-39822 # Root escape via symlink + trailing slash CVE-2026-42505 # ECH privacy leak in crypto/tls + +# Wolfi OS Layer (inherited from checkmarx/ast-cli:2.3.63) +CVE-2026-38753 exp=2026-XX-XX # busybox awk_sub() DoS, fixed in 1.38.0-r0, pending base image update +CVE-2026-38754 exp=2026-XX-XX # busybox ash.c heap overflow, fixed in 1.38.0-r0, pending base image update