From ecb4178cc9bb585643b948edad68eaf92d61a32a Mon Sep 17 00:00:00 2001 From: sean wibisono Date: Tue, 4 Aug 2026 16:27:20 +1000 Subject: [PATCH] suppress CVE-2026-45447 in .trivyignore (exp 2026-09-04) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit openssl (libcrypto3 / libssl3, Alpine base image) is present but not reachable from this service — see the linked PR. Reachability alone determines suppress-vs-fix. --- .trivyignore | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.trivyignore b/.trivyignore index 3511344..7b6e069 100644 --- a/.trivyignore +++ b/.trivyignore @@ -38,3 +38,10 @@ CVE-2026-56408 exp:2026-08-09 # jackson-core's non-blocking/async parser. A jackson bump is also in flight via uid2-shared # (PR #631) and will flow on the next release. See: UID2-7557 (predecessor UID2-6670) GHSA-r7wm-3cxj-wff9 exp:2026-08-23 + +# CVE-2026-45447 — openssl (libcrypto3 / libssl3, Alpine base image) (HIGH). +# Not exploitable here: Dockerfile:19 apk adds libcrypto3/libssl3; no +# tcnative/conscrypt/bouncycastle in pom.xml and no openssl/pkcs7/OpenSsl refs in any *.java — +# pure-Java Vert.x uses JSSE +# See: [TICKET] +CVE-2026-45447 exp:2026-09-04