mirror of
https://github.com/RayLabsHQ/gitea-mirror.git
synced 2026-10-30 22:21:58 +01:00
ARUNAVO RAY
f0814c14fc
- git-lfs is built with Go 1.27.3, golang.org/x/net 0.61.0 and golang.org/x/crypto 0.58.0. - Raise the floors for sharp, smol-toml, source-map-js and http-cache-semantics in the app and the site, and pin the site's vite to 8.1.6. - The VEX product for the published image is now pkg:docker/raylabshq/gitea-mirror?repository_url=ghcr.io. The old pkg:docker/ghcr.io/... form never matched, so the zlib CVE-2026-85091 exception was ignored on main scans.
27 lines
1.6 KiB
JSON
27 lines
1.6 KiB
JSON
{
|
|
"@context": "https://openvex.dev/ns/v0.2.0",
|
|
"@id": "https://github.com/RayLabsHQ/gitea-mirror/blob/main/.vex/zlib-gz-vacate.vex.json",
|
|
"author": "developer@arunavoray.dev",
|
|
"role": "Gitea Mirror maintainer",
|
|
"timestamp": "2026-10-23T03:00:00Z",
|
|
"version": 2,
|
|
"statements": [
|
|
{
|
|
"vulnerability": {
|
|
"name": "CVE-2026-85091",
|
|
"description": "zlib gz_vacate() heap buffer overflow: a non-blocking gzwrite() that stalls leaves a stale external buffer pointer, and a later gzprintf() or gzvprintf() moves more bytes than the internal input buffer holds."
|
|
},
|
|
"timestamp": "2026-09-07T01:20:00Z",
|
|
"products": [
|
|
{ "@id": "pkg:docker/raylabshq/gitea-mirror" },
|
|
{ "@id": "pkg:docker/raylabshq/gitea-mirror?repository_url=ghcr.io" },
|
|
{ "@id": "pkg:docker/gitea-mirror" },
|
|
{ "@id": "pkg:docker/library/gitea-mirror" }
|
|
],
|
|
"status": "not_affected",
|
|
"justification": "vulnerable_code_not_in_execute_path",
|
|
"impact_statement": "The flaw sits in zlib's gz* file writing API (gzwrite, gzprintf, gzvprintf) and needs a gz stream opened for writing on a non-blocking descriptor that stalls. Nothing in this image writes gzip files through that API: git links only the deflate and inflate stream entry points for its objects and packs, git-lfs is a Go binary with its own compress/flate, and Bun's zlib bindings expose stream compression only. The application itself never opens gz streams. Debian ships zlib 1:1.3.dfsg+really1.3.1-1 in trixie and has no fix in any release (bug #1146895); upstream describes the affected range as 1.3.1.2 through 1.3.2."
|
|
}
|
|
]
|
|
}
|