.trivyignore.yaml

# Trivy suppressions for the prowlercloud/prowler SDK and API container images.
#
# This file replaces the classic .trivyignore, which parsed only the CVE id: the
# `pkg:` selector written on each line was documentation and the entry suppressed
# its CVE across every package in the image. The `purls` field below is honoured,
# so each entry is scoped to the package it names. Verified against Trivy 0.71.2:
# an entry given the wrong purl leaves the finding reported, where the classic
# format suppressed it.
#
# `expired_at` forces re-review. Keep the dates staggered.
#
# The four entries below are currently redundant: the scan runs with ignore-unfixed,
# and none of them has a published fix, so they never reach the gate either way. They
# are kept because the reasoning is what justifies accepting them, and because they
# apply again the moment any of them gains a fix we do not take.
#
# perl-base is Debian "Essential: yes". Trivy spreads src:perl CVEs across every
# binary package built from that source, so perl-base is flagged for modules only
# perl-modules-* ships. Neither image installs those, and nothing in either
# invokes perl.
#
# Why these four are accepted rather than fixed (reviewed 2026-07-31):
#
#   1. No fix exists. All four report no fixed version on perl-base 5.40.1-6.
#      Debian marks CVE-2026-42496 "fix_deferred" and the other three "affected".
#      A newer base image, apt upgrade, or a newer Debian release changes nothing.
#   2. The package cannot be removed. "Essential: yes" means removal needs
#      dpkg --force-remove-essential, which breaks apt for anything built
#      downstream from these images.
#   3. Changing base distribution was evaluated and rejected. Alpine drops perl
#      entirely, but PowerShell publishes no linux-musl-arm64 build in any
#      release, so M365 scanning would break on arm64 -- which is what we run in
#      production. Wolfi keeps glibc and drops perl, but pinnable versioned tags
#      are a paid tier, so builds would not be reproducibly pinnable.
#
# Not-invoked claim verified by sweeping both images for files with a perl
# shebang, shell/python callers of perl, ELF binaries containing "perl", and
# .pl/.pm files or perl subprocess calls anywhere in site-packages. The only
# consumers found are dpkg/debconf/adduser/pam tooling, none of which runs at
# runtime, plus one build-time script inside the ExchangeOnlineManagement
# PowerShell module that is never invoked.

vulnerabilities:
  # Archive::Tar path traversal. Not installed: `perl -MArchive::Tar -e1` cannot locate it.
  - id: CVE-2026-42496
    purls:
      - "pkg:deb/debian/perl-base"
    expired_at: 2027-01-31

  # Storable integer overflow. Not installed: `perl -MStorable -e1` cannot locate it.
  - id: CVE-2026-57433
    purls:
      - "pkg:deb/debian/perl-base"
    expired_at: 2027-01-31

  # Regex heap overflow on 32-bit builds only; both published arches are 64-bit.
  - id: CVE-2026-8376
    purls:
      - "pkg:deb/debian/perl-base"
    expired_at: 2027-01-31

  # Regex trie bug giving silently wrong matches above 65535 alternation branches.
  # perl 5.40.1 is in range, so this rests on nothing invoking perl. Short expiry
  # to force a re-look. Ref: https://github.com/Perl/perl5/issues/23388
  - id: CVE-2026-13221
    purls:
      - "pkg:deb/debian/perl-base"
    expired_at: 2026-11-30

  # Declared in the SPDX manifest that ships inside PowerShell's MicrosoftTeams module
  # (Modules/MicrosoftTeams/7.9.0/_manifest/spdx_2.2/manifest.spdx.json). Trivy reads that
  # SBOM and reports what it declares, which is not the same as what the image contains:
  # there is no Node runtime and no node_modules anywhere in the image, and the .NET
  # assemblies target net472, a Windows-only framework. Nothing here is reachable, and none
  # of it is a dependency we declare -- only Microsoft can change the module's contents.
  - id: CVE-2020-0606
    purls:
      - "pkg:nuget/Microsoft.WindowsDesktop.App.Ref"
    expired_at: 2027-01-31
  - id: CVE-2019-0820
    purls:
      - "pkg:nuget/System.Text.RegularExpressions"
    expired_at: 2027-01-31
  - id: CVE-2026-47302
    purls:
      - "pkg:nuget/System.Security.Cryptography.Xml"
    expired_at: 2027-01-31
  - id: CVE-2026-47304
    purls:
      - "pkg:nuget/System.Security.Cryptography.Xml"
    expired_at: 2027-01-31
  - id: CVE-2026-50525
    purls:
      - "pkg:nuget/System.Security.Cryptography.Xml"
    expired_at: 2027-01-31
  - id: CVE-2026-50527
    purls:
      - "pkg:nuget/System.Security.Cryptography.Xml"
    expired_at: 2027-01-31
  - id: CVE-2026-50648
    purls:
      - "pkg:nuget/System.Security.Cryptography.Xml"
    expired_at: 2027-01-31
  - id: CVE-2026-13676
    purls:
      - "pkg:npm/fast-uri"
    expired_at: 2027-01-31
  - id: CVE-2026-16221
    purls:
      - "pkg:npm/fast-uri"
    expired_at: 2027-01-31
  - id: CVE-2026-18446
    purls:
      - "pkg:npm/fast-uri"
    expired_at: 2027-01-31
  - id: CVE-2026-75899
    purls:
      - "pkg:npm/fast-uri"
    expired_at: 2027-01-31
  - id: CVE-2026-75975
    purls:
      - "pkg:npm/fast-uri"
    expired_at: 2027-01-31
  - id: CVE-2026-76172
    purls:
      - "pkg:npm/fast-uri"
    expired_at: 2027-01-31
  - id: CVE-2026-69192
    purls:
      - "pkg:npm/ip-address"
    expired_at: 2027-01-31

  # CVE-2026-84304 is a DoS in grpc-go <= 1.83.0: a peer fragments a gRPC stream into
  # millions of tiny HTTP/2 DATA frames until the receiver runs out of heap. Fixed in
  # 1.83.1 (published 2026-09-01). Trivy 0.74.0, the latest published release and the
  # version the images ship, pins 1.82.1 as an indirect dependency:
  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
  # Upstream bump still open: https://github.com/aquasecurity/trivy/pull/11176
  # Trivy only speaks gRPC in client/server mode (`trivy server`, `--server`). Prowler
  # invokes it exclusively as `trivy image` and `trivy fs` on a local path, so no gRPC
  # listener or connection ever exists in the image and the affected path is not
  # reachable. Remove this temporary suppression as soon as a Trivy release pins
  # grpc >= 1.83.1.
  - id: CVE-2026-84304
    purls:
      - "pkg:golang/google.golang.org/grpc"
    expired_at: 2026-10-15

  # CVE-2026-84445 is a DoS in grpc-go servers built with `xds.NewGRPCServer()`: a request
  # carrying neither `:authority` nor `Host` reaches the xDS routing interceptor, which
  # indexes an empty slice of authorities and panics. The per-RPC goroutine does not
  # recover, so the whole server process dies. Fixed in 1.82.2 and 1.83.2 (published
  # 2026-09-08). Trivy 0.74.0, the latest published release and the version the images
  # ship, pins 1.82.1 as an indirect dependency:
  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
  # Trivy main already carries 1.83.2, but no published release includes it yet.
  # The reachability argument is the one made for CVE-2026-84304 above, only narrower:
  # this panic needs an xDS-managed gRPC server. Prowler invokes Trivy exclusively as
  # `trivy image` and `trivy fs` on a local path, never `trivy server`, so the image runs
  # no gRPC server at all, xDS or otherwise. Remove this temporary suppression as soon as
  # a Trivy release pins grpc >= 1.83.2.
  # https://github.com/advisories/GHSA-2v4p-qf9q-27wj
  - id: CVE-2026-84445
    purls:
      - "pkg:golang/google.golang.org/grpc@v1.82.1"
    expired_at: 2026-10-15

  # CVE-2026-56855 and CVE-2026-78662 are DoS deadlocks in x/crypto/ssh: a malicious peer
  # can flood or misuse channel messages (RFC 4254) to block the whole connection.
  # Fixed in golang.org/x/crypto v0.56.0 (published 2026-09-02). Trivy 0.74.0, the latest
  # published release and the version the images ship, still pins v0.55.0, and Trivy main
  # has not bumped it either:
  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
  # x/crypto/ssh is pulled in transitively through go-git's ssh transport, the same
  # dependency chain as the CVE-2026-71556 entry above. Prowler invokes Trivy only with
  # `fs` on an existing local path or with `image`; it never asks Trivy to clone over SSH
  # or to run `trivy server`, so no SSH connection -- as client or server -- ever exists in
  # the image and the affected code path is not reachable. Remove this temporary
  # suppression as soon as a fixed Trivy release is available.
  - id: CVE-2026-56855
    purls:
      - "pkg:golang/golang.org/x/crypto@v0.55.0"
    expired_at: 2026-10-15
  - id: CVE-2026-78662
    purls:
      - "pkg:golang/golang.org/x/crypto@v0.55.0"
    expired_at: 2026-10-15

  - id: CVE-2026-56852
    purls:
      - "pkg:golang/golang.org/x/text"
    expired_at: 2026-12-31
  - id: GHSA-hrxh-6v49-42gf
    purls:
      - "pkg:golang/google.golang.org/grpc"
    expired_at: 2026-12-31
  - id: CVE-2026-50151
    purls:
      - "pkg:golang/oras.land/oras-go/v2"
    expired_at: 2026-12-31
  - id: CVE-2026-50163
    purls:
      - "pkg:golang/oras.land/oras-go/v2"
    expired_at: 2026-12-31