Update VEX Hub reports (#73)

rancher · Jan 19, 2025 · 4270505 · 4270505
1 parent 1d30ba8
commit 4270505
Show file tree

Hide file tree

Showing 5 changed files with 3,848 additions and 3,608 deletions.
diff --git a/index.json b/index.json
@@ -29,6 +29,10 @@
       "id": "pkg:golang/github.com/containerd/containerd",
       "location": "pkg/golang/github.com/containerd/containerd/scan.openvex.json"
     },
+    {
+      "id": "pkg:golang/github.com/containerd/containerd/v2",
+      "location": "pkg/golang/github.com/containerd/containerd/v2/scan.openvex.json"
+    },
     {
       "id": "pkg:golang/github.com/containernetworking/plugins",
       "location": "pkg/golang/github.com/containernetworking/plugins/scan.openvex.json"
@@ -701,6 +705,10 @@
       "id": "pkg:golang/github.com/sclevine/yj/v5",
       "location": "pkg/golang/github.com/sclevine/yj/v5/scan.openvex.json"
     },
+    {
+      "id": "pkg:golang/github.com/spegel-org/spegel",
+      "location": "pkg/golang/github.com/spegel-org/spegel/scan.openvex.json"
+    },
     {
       "id": "pkg:golang/github.com/thanos-io/thanos",
       "location": "pkg/golang/github.com/thanos-io/thanos/scan.openvex.json"

diff --git a/pkg/golang/github.com/containerd/containerd/v2/scan.openvex.json b/pkg/golang/github.com/containerd/containerd/v2/scan.openvex.json
@@ -0,0 +1,62 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-448cca1c5fcf94ecb7030d60b08ef39b387f34f5faaa2be0e8e1f61f31124f1b",
+  "author": "Rancher Security team",
+  "timestamp": "2024-07-12T17:54:37.399069972-03:00",
+  "last_updated": "2025-01-19T02:32:45.038540252Z",
+  "version": 3,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "GO-2024-3321",
+        "aliases": [
+          "CVE-2024-45337",
+          "GHSA-v778-237x-gjrc"
+        ]
+      },
+      "timestamp": "2025-01-19T02:32:16.503103425Z",
+      "products": [
+        {
+          "@id": "pkg:golang/github.com/containerd/containerd/v2",
+          "subcomponents": [
+            {
+              "@id": "pkg:golang/golang.org/x/crypto@v0.28.0"
+            },
+            {
+              "@id": "pkg:golang/golang.org/x/crypto@0.28.0"
+            }
+          ]
+        }
+      ],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_present",
+      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
+    },
+    {
+      "vulnerability": {
+        "name": "GO-2024-3333",
+        "aliases": [
+          "CVE-2024-45338",
+          "GHSA-w32m-9786-jp63"
+        ]
+      },
+      "timestamp": "2025-01-19T02:32:45.038540712Z",
+      "products": [
+        {
+          "@id": "pkg:golang/github.com/containerd/containerd/v2",
+          "subcomponents": [
+            {
+              "@id": "pkg:golang/golang.org/x/net@v0.30.0"
+            },
+            {
+              "@id": "pkg:golang/golang.org/x/net@0.30.0"
+            }
+          ]
+        }
+      ],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
+    }
+  ]
+}
diff --git a/pkg/golang/github.com/spegel-org/spegel/scan.openvex.json b/pkg/golang/github.com/spegel-org/spegel/scan.openvex.json
@@ -0,0 +1,62 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-448cca1c5fcf94ecb7030d60b08ef39b387f34f5faaa2be0e8e1f61f31124f1b",
+  "author": "Rancher Security team",
+  "timestamp": "2024-07-12T17:54:37.399069972-03:00",
+  "last_updated": "2025-01-19T02:32:54.101044497Z",
+  "version": 3,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "GO-2024-3321",
+        "aliases": [
+          "CVE-2024-45337",
+          "GHSA-v778-237x-gjrc"
+        ]
+      },
+      "timestamp": "2025-01-19T02:32:25.882535171Z",
+      "products": [
+        {
+          "@id": "pkg:golang/github.com/spegel-org/spegel",
+          "subcomponents": [
+            {
+              "@id": "pkg:golang/golang.org/x/crypto@v0.28.0"
+            },
+            {
+              "@id": "pkg:golang/golang.org/x/crypto@0.28.0"
+            }
+          ]
+        }
+      ],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_present",
+      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
+    },
+    {
+      "vulnerability": {
+        "name": "GO-2024-3333",
+        "aliases": [
+          "CVE-2024-45338",
+          "GHSA-w32m-9786-jp63"
+        ]
+      },
+      "timestamp": "2025-01-19T02:32:54.101045237Z",
+      "products": [
+        {
+          "@id": "pkg:golang/github.com/spegel-org/spegel",
+          "subcomponents": [
+            {
+              "@id": "pkg:golang/golang.org/x/net@v0.30.0"
+            },
+            {
+              "@id": "pkg:golang/golang.org/x/net@0.30.0"
+            }
+          ]
+        }
+      ],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_present",
+      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
+    }
+  ]
+}