osv-scanner-installed.toml

Rama main · réplica de lectura del repositorio original.

# Exceptions for tools/audit's second osv-scanner pass over software installed outside this checkout.
# Each entry states the reach and when acceptance ends; delete entries listed under unused ignores.

# Bundled inside npm's own dependency tree.
[[IgnoredVulns]]
id = "GHSA-rfgv-xxqx-mfg5"
ignoreUntil = 2027-01-01
reason = "undici 6.28.0, fixed in 6.28.1: denial of service through an unrequested WebSocket subprotocol. Reach: `npm@11.20.0` > node-gyp > undici, Homebrew's bundled npm, which is the npm that runs. node-gyp imports `Agent`, `EnvHttpProxyAgent`, `RetryAgent` and `fetch` from undici and never `WebSocket`, which is the whole of this advisory. Ends when the node formula ships npm 12."

[[IgnoredVulns]]
id = "GHSA-3wwx-pv8p-q78v"
ignoreUntil = 2027-01-01
reason = "undici 6.28.0, fixed in 6.28.1: denial of service through an unhandled error in WebSocket permessage-deflate decompression. Same copy and same end as GHSA-rfgv-xxqx-mfg5, and the same narrowing applies: node-gyp opens no WebSocket, so the decompression path is never entered."

[[IgnoredVulns]]
id = "GHSA-r53p-7pc4-xj5r"
ignoreUntil = 2027-01-01
reason = "undici 6.28.0, fixed in 6.28.1: downstream response splitting through the retry interceptor. This is the one of the three that node-gyp could reach — `lib/download.js` imports `RetryAgent` — so the exposure is real but narrow: node-gyp downloads Node headers only when it builds a native addon, from nodejs.org over HTTPS, and response splitting needs a hostile or broken upstream on that path. Ends when the node formula ships npm 12."

[[IgnoredVulns]]
id = "GHSA-xjj6-f33q-929c"
ignoreUntil = 2027-01-01
reason = "undici 6.29.0, fixed in 6.29.1: `fetch()` aborts the Node.js process when a server answers with more than five content codings and closes before the body. Reach: `npm@11.20.0` (Homebrew's bundled npm) > node-gyp > undici 6.28.0, which the advisory's range below 6.29.1 also covers, npm's own dependency tree, so what is exposed is a registry or tarball host's response to npm itself — the one undici path this machine actually exercises, which is why it is dated rather than dismissed. Nothing here installs that copy separately; the only fix is a newer node-gyp, which is npm's call. Ends when npm ships undici >= 6.29.1."

[[IgnoredVulns]]
id = "GHSA-g3hv-75wg-m249"
ignoreUntil = 2027-01-01
reason = "minimatch 10.2.5, fixed in 11.0.1: an attacker-controlled glob pattern grows quadratically during preprocessing. Reach: `npm@11.20.0` (Homebrew's bundled npm) > @npmcli/map-workspaces and @tufjs/models > minimatch. npm reads the patterns from this machine's own package.json files and from signed TUF metadata, so no untrusted pattern reaches it. npm@12.2.1, the newest release, still requires minimatch ^10.2.5. The repository's Bun lockfiles override to ^11.0.1 instead. Ends when npm ships minimatch 11."

[[IgnoredVulns]]
id = "GHSA-3g3m-2fjr-6pw4"
ignoreUntil = 2027-01-01
reason = "glob 13.0.6, fixed in 14.0.2: an aborted async walk keeps reading directories after it rejects. Reach: `npm@11.20.0` (Homebrew's bundled npm) > @npmcli/map-workspaces and node-gyp > glob. The cost is extra local filesystem reads after npm aborts a walk of this machine's own tree; no remote input starts or aborts the walk. npm@12.2.1 still requires glob ^13.0.6. Ends when npm ships glob 14."

[[IgnoredVulns]]
id = "GHSA-4qv8-2p9j-2685"
ignoreUntil = 2027-01-01
reason = "undici 6.29.0, fixed in 6.29.1: unbounded memory in the `EventSource` parser when a peer sends many tiny `data:` fields with no blank separator. Same reach and same end as GHSA-xjj6-f33q-929c, with one narrowing that matters: npm's registry traffic uses `fetch()`, not `EventSource`, so nothing npm does on this machine reaches the parser. Dated anyway because it rides the same pin, and the next npm move is what ends both."

[[IgnoredVulns]]
id = "GHSA-6j4f-fj2g-mc7p"
ignoreUntil = 2027-01-01
reason = "brace-expansion 5.0.9 denial of service via uncontrolled recursion in parseCommaParts (stack exhaustion), fixed in 5.0.10. Reach: `npm@12.2.0` > minimatch > brace-expansion. The pattern being expanded would have to come from something npm globs, so the exposure is a pathological path or glob reaching the npm CLI. Ends when npm ships brace-expansion >= 5.0.10, or when `tools/updates` re-resolves npm itself, whichever comes first."

[[IgnoredVulns]]
id = "GHSA-q2hr-2g5m-vwhr"
ignoreUntil = 2027-01-01
reason = "brace-expansion 5.0.9, a second denial-of-service advisory against the same version, fixed in 5.0.12. Same reach and same end as GHSA-6j4f-fj2g-mc7p; kept as its own entry because its fixed version is later, so it stops applying at a different moment."

[[IgnoredVulns]]
id = "GHSA-qhr7-859c-m2p7"
ignoreUntil = 2027-01-01
reason = "brace-expansion 5.0.9, a third denial-of-service advisory against the same version, fixed in 5.0.11. Same reach and same end as GHSA-6j4f-fj2g-mc7p."

[[IgnoredVulns]]
id = "GHSA-2vr4-cq9g-pvrc"
ignoreUntil = 2027-01-01
reason = "ip-address 10.5.0 does not classify the NAT64 local-use range 64:ff9b:1::/48, allowing an SSRF and trust-boundary bypass, fixed in 10.5.1. Reach: `npm@12.2.0` > make-fetch-happen > @npmcli/agent > socks-proxy-agent > socks > ip-address, in npm's own dependency tree. The exposed path is a proxy decision npm makes for a registry request. Ends when npm ships ip-address >= 10.5.1."

[[IgnoredVulns]]
id = "GHSA-rpw4-54j3-4h4q"
ignoreUntil = 2027-01-01
reason = "ip-address 10.5.0, a second advisory against the same version, fixed in 10.5.1. Same reach and same end as GHSA-2vr4-cq9g-pvrc."

[[IgnoredVulns]]
id = "GHSA-h3mg-xc3c-68pw"
ignoreUntil = 2027-01-01
reason = "ip-address 10.5.0, a third advisory against the same version, fixed in 10.7.1. Same reach as GHSA-2vr4-cq9g-pvrc, and a later fixed version, so it stops applying on its own date."

[[IgnoredVulns]]
id = "GHSA-j6r3-76f7-8jcv"
ignoreUntil = 2027-01-01
reason = "ip-address 10.5.0, a fourth advisory against the same version, fixed in 10.7.1. Same reach and same end as GHSA-h3mg-xc3c-68pw."

# Informational unmaintained-crate advisories in installed Cargo lockfiles.
# Transitive dependencies in published Cargo.lock files of crates installed at their latest release.
[[IgnoredVulns]]
id = "RUSTSEC-2026-0253"
ignoreUntil = 2027-01-01
reason = "A potential use-after-free in lru 0.18.0's `LruCache::pop()` when a value's destructor panics, fixed in 0.18.2. Two installed crates carry it, both at their latest release: bottom 0.14.9 and macmon 0.8.2, and the audit reports one row per crate because each ships its own lock. macmon is a dependency of the `macmon` capability, so this one runs when that capability is asked for machine metrics; bottom is a terminal monitor. For either to be reached, a cached value's destructor has to panic inside those tools — nothing here hands them a payload. Ends when bottom or macmon republishes against lru >= 0.18.2, or when the tool is dropped."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0285"
ignoreUntil = 2027-01-01
reason = "rustls 0.23.40 accepts TLS 1.3 handshake messages across encryption-level boundaries, fixed in 0.23.45. Reach: the published lock of cargo-deny 0.20.2, installed at its latest release, so no upgrade moves it. cargo-deny is referenced by nothing in this repository — it is not Sjel's, and the honest options are that its own upgrade brings a newer rustls or it is uninstalled. Ends when cargo-deny republishes, or when it is removed."

[[IgnoredVulns]]
id = "GHSA-rj75-hqrm-r3gf"
ignoreUntil = 2027-01-01
reason = "Quadratic complexity in postcss-selector-parser's flat-selector parsing (CVE-2026-104844): `.a.a.a...` reaches itself as one word token carrying n indexes, and three passes scan those arrays per index, so a 400 KB selector costs ~34 s of one thread. Fixed in 7.1.6. Reach: the tree npm 12.2.0 bundles for itself (npm/node_modules/@npmcli/arborist <- @npmcli/query), not a package this machine installed, and 12.2.0 is the newest published release while still carrying 7.1.4 — so no install command here moves it. The exposure needs a caller to hand that parser an attacker-controlled selector; nothing in this repository or its CI does, and the audit's second pass is what reads it at all. Ends when npm republishes against a refreshed tree, or when npm is dropped. Accepted 2026-10-08 after `sjel update apply --only npm --re-resolve postcss-selector-parser` reported the package as one this plan does not move."

# Cargo-installed build tools (xberg-cli, cargo-deny).
[[IgnoredVulns]]
id = "RUSTSEC-2026-0346"
ignoreUntil = 2027-01-01
reason = "The `Debug` impls on `Tls12ClientSessionValue`/`Tls13ClientSessionValue` printed the TLS 1.2 master secret or TLS 1.3 resumption PSK, fixed in 0.23.46 (CVSS AV:L/AC:H/PR:H/UI:R — local, high privilege, user interaction). The trigger is printing one of those values, and no log line in cargo-deny or xberg-cli formats a session value, so this is a latent exposure rather than one a connection reaches. Ends with the rustls version, per the note above."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0348"
ignoreUntil = 2027-01-01
reason = "Brotli certificate decompression can allocate up to 1 GiB before authentication, fixed in 0.23.46 (AV:N/AC:H/PR:N/UI:N, A:L). Reach: a TLS connection one of the three tools makes to a registry or CDN, where the server compresses its certificate chain. It needs rustls's brotli certificate support compiled in — whether these published locks enable that feature was not read, so this is an accepted exposure with a reasoned reach. Ends with the rustls version."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0349"
ignoreUntil = 2027-01-01
reason = "An unauthenticated ServerHello can downgrade later connections to classical key exchange, fixed in 0.23.46 (AV:N/AC:H/PR:N/UI:N, C:L). Reach: an active MITM on a connection one of the three tools makes, which is exactly the access a network attacker has to a build tool fetching a registry. Ends with the rustls version."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0381"
ignoreUntil = 2026-12-01
reason = "webpki-roots 1.0.7 (cargo-deny 0.20.2) and 1.0.9 (xberg-cli 1.3.10) bundle the emSign ECC Root CA - G3. Same reach and end as RUSTSEC-2026-0382."

[[IgnoredVulns]]
id = "GHSA-rxp7-6hxx-x8q5"
ignoreUntil = 2027-01-01
reason = "ip-address <= 10.7.3 strips zone identifiers with /%.*$/ before its 45-character limit, so a long run of `%` characters costs quadratic time (3.9 s of synchronous work for 100,000 of them) and blocks the event loop while rejecting the input. Reach: `npm@12.2.1` (the newest release) > make-fetch-happen > @npmcli/agent > socks-proxy-agent > socks > ip-address 10.7.2, inside npm's own bundled tree; nothing installs that copy separately. Ends when npm bundles ip-address >= 10.7.4, which is npm's call and not this machine's. The snap-happy subtree was re-resolved off 10.7.3 on 2026-10-23."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0391"
ignoreUntil = 2027-01-01
reason = "zstd 0.13.3 and 0.14.2, fixed in 0.14.3: data from an abandoned stream leaks into the next stream on a reused context. Reach: cargo-deny 0.20.2 (zstd 0.13.3 <- spdx, embedded license data) and xberg-cli 1.3.10 (0.14.2 in the published lock, 0.14.3 in the binaries rebuilt on 2026-10-28). Ends when cargo-deny moves spdx to zstd 0.14.3 and xberg-cli republishes."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0395"
ignoreUntil = 2027-01-01
reason = "zstd-safe 7.2.4 and 8.1.0, fixed in 8.2.0: use-after-free with CParameter::StableInBuffer. Same reach and same end as RUSTSEC-2026-0391; cargo-deny's unlocked 7.3.0 is still affected."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0396"
ignoreUntil = 2027-01-01
reason = "zstd-safe 7.2.4 and 8.1.0, fixed in 8.2.0: Seekable reads a NULL or out-of-bounds seek table. Same reach and same end as RUSTSEC-2026-0391; cargo-deny's unlocked 7.3.0 is still affected."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0397"
ignoreUntil = 2027-01-01
reason = "zstd-safe 7.2.4 and 8.1.0, fixed in 8.2.0: OutBuffer::around_pos exposes uninitialized memory. Same reach and same end as RUSTSEC-2026-0391; cargo-deny's unlocked 7.3.0 is still affected."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0398"
ignoreUntil = 2027-01-01
reason = "zstd-safe 7.2.4 and 8.1.0, fixed in 8.2.0: Seekable::decompress sets a Vec length beyond its capacity. Same reach and same end as RUSTSEC-2026-0391; cargo-deny's unlocked 7.3.0 is still affected."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0399"
ignoreUntil = 2027-01-01
reason = "zstd-safe 7.2.4 and 8.1.0, fixed in 8.2.0: use-after-free through init_using_cdict and init_using_ddict. Same reach and same end as RUSTSEC-2026-0391; cargo-deny's unlocked 7.3.0 is still affected."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0400"
ignoreUntil = 2027-01-01
reason = "zstd-safe 7.2.4 and 8.1.0, fixed in 8.2.0: use-after-free of a dictionary after a one-shot call on a context with an open stream. Same reach and same end as RUSTSEC-2026-0391; cargo-deny's unlocked 7.3.0 is still affected."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0401"
ignoreUntil = 2027-01-01
reason = "zstd-safe 7.2.4 and 8.1.0, fixed in 8.2.0: out-of-bounds read in train_from_buffer when sample sizes overflow. Same reach and same end as RUSTSEC-2026-0391; cargo-deny's unlocked 7.3.0 is still affected."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0402"
ignoreUntil = 2027-01-01
reason = "zstd-safe 7.2.4 and 8.1.0, fixed in 8.2.0: heap buffer overflow in CCtx::try_clone on a multithreaded context. Same reach and same end as RUSTSEC-2026-0391; cargo-deny's unlocked 7.3.0 is still affected."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0403"
ignoreUntil = 2027-01-01
reason = "zstd-safe 7.2.4 and 8.1.0, fixed in 8.2.0: uninitialized memory exposed when streaming decompression of a legacy frame fails. Same reach and same end as RUSTSEC-2026-0391; cargo-deny's unlocked 7.3.0 is still affected."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0404"
ignoreUntil = 2027-01-01
reason = "zstd-safe 7.2.4 and 8.1.0, fixed in 8.2.0: double free in DCtx::try_clone. Same reach and same end as RUSTSEC-2026-0391; cargo-deny's unlocked 7.3.0 is still affected."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0405"
ignoreUntil = 2027-01-01
reason = "zstd-safe 7.2.4 and 8.1.0, fixed in 8.2.0: out-of-bounds read with an out-of-range InBuffer::pos. Same reach and same end as RUSTSEC-2026-0391; cargo-deny's unlocked 7.3.0 is still affected."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0406"
ignoreUntil = 2027-01-01
reason = "zstd-safe 7.2.4 and 8.1.0, fixed in 8.2.0: use-after-free when changing a multithreaded context with an unfinished frame. Same reach and same end as RUSTSEC-2026-0391; cargo-deny's unlocked 7.3.0 is still affected."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0410"
ignoreUntil = 2027-01-01
reason = "zstd-sys 2.0.16 and 2.1.1, fixed in 2.1.2: the WebAssembly allocator shim corrupts memory on allocation failure. Reach: none on this machine, which builds no wasm target of these tools; an unlocked resolve of all three gives 2.1.2. Same end as RUSTSEC-2026-0391."

[[IgnoredVulns]]
id = "GHSA-2m5v-pch6-74hx"
ignoreUntil = 2027-01-01
reason = "undici 6.29.0, fixed in 6.29.1: TLS certificate validation can be bypassed when an Agent drops its tls options. Reach: npm@11.20.0 (Homebrew's bundled npm) > node-gyp > undici 6.28.0, which the advisory's range below 6.29.1 also covers, npm's own tree, used when node-gyp downloads Node headers for a native addon build. A MITM on that download is the exposure. Ends when npm ships node-gyp on undici >= 6.29.1."

[[IgnoredVulns]]
id = "GHSA-9fm3-97px-rjf6"
ignoreUntil = 2027-01-01
reason = "undici 6.29.0, fixed in 6.29.1: the WebSocket client buffers automatic PONGs without bound. Same reach and same end as GHSA-2m5v-pch6-74hx; node-gyp opens no WebSocket."

[[IgnoredVulns]]
id = "GHSA-qrxm-fqhp-jwvm"
ignoreUntil = 2027-01-01
reason = "undici 6.29.0, fixed in 6.29.1: denial of service through a TLS 1.2 certificate-changing renegotiation. Same reach and same end as GHSA-2m5v-pch6-74hx."