security review: SCANNERS.md, redacted scanner output, live evidence (demo-hp, public sites, hub 0.148.0 check)
gates / gates (push) Successful in 6m26s
gates / gates (push) Successful in 6m26s
This commit is contained in:
@@ -0,0 +1,81 @@
|
||||
# Scanner baseline — security review 2026-10-12
|
||||
|
||||
Standard (non-AI) tools, installed as user binaries under `/mnt/5_hdd/felhom.eu/tools/security/bin/` on DooPlex.
|
||||
Nothing was installed system-wide or on any box. Raw output (redacted) is in `scanners/`.
|
||||
|
||||
| tool | version | how installed | sha256 of the binary (first..last 4) |
|
||||
|---|---|---|---|
|
||||
| govulncheck | v1.1.4 | `go install golang.org/x/vuln/cmd/govulncheck@v1.1.4` | 6b04..2f5e |
|
||||
| gosec | v2.22.4 | `go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4` | 3111..607e |
|
||||
| gitleaks | 8.24.3 | GitHub release tarball, checked against the release checksums file | e183..72d3 |
|
||||
| trivy | 0.74.0 | GitHub release tarball, checked against the release checksums file | d89b..d7b9 |
|
||||
|
||||
Trivy note: releases 0.27–0.69.1 are no longer published upstream; 0.74.0 (2026-08-14) was the newest release older
|
||||
than two weeks.
|
||||
|
||||
## Reviewed commits
|
||||
|
||||
controller `dcd89364a4` (v0.307.0) · agent `86adbcaf8a` (v0.154.0) · felhom.eu `c9b9432986` · catalog `1a642b43e7` ·
|
||||
homelab-manifests `fdd324bb62`. Shipped artifacts: controller image `0.307.0`, hub image `0.146.0`, agent binary
|
||||
`0.154.0` (copied from demo-hp).
|
||||
|
||||
## 1. govulncheck
|
||||
|
||||
Commands: `govulncheck ./...` in each module (source mode), and `govulncheck -mode binary <file>` on the shipped
|
||||
binaries. Source mode reports the stdlib of the LOCAL toolchain (go1.26.0), not the one that built the shipped
|
||||
program, so the binary mode is the one that counts.
|
||||
|
||||
| target | built with | vulnerabilities reported as reachable | triage |
|
||||
|---|---|---|---|
|
||||
| controller 0.307.0 binary | go1.24.13, x/crypto v0.31.0 | 62 (stdlib + x/crypto/ssh) | real → R-972 (toolchain) |
|
||||
| hub 0.146.0 binary | go1.24.13, x/crypto v0.31.0 | 62 (stdlib + x/crypto/ssh) | real → R-972 |
|
||||
| agent 0.154.0 binary | go1.26.0 | 27 (stdlib) | real → R-972 |
|
||||
| source mode, three modules | local go1.26.0 | 46 / 45 / 27 | superseded by the binary rows |
|
||||
|
||||
Mostly denial-of-service fixes; it includes html/template escaping fixes and x/crypto/ssh fixes. Go 1.24 is past the
|
||||
Go support window (the two newest major releases: https://go.dev/doc/devel/release#policy).
|
||||
|
||||
## 2. gitleaks
|
||||
|
||||
Command: `gitleaks git <repo> --redact=100 --log-opts=--all -f json`, full history of all five repositories.
|
||||
Redacted reports in `scanners/` (author name and e-mail dropped). Each hit was triaged by masked context only: the
|
||||
line was shown with every long token replaced by its length and a hash prefix; no value was printed.
|
||||
|
||||
| repo | hits | triage |
|
||||
|---|---|---|
|
||||
| felhom-controller | 12 | 4 were one live credential → R-950 (rotated 2026-10-12; withheld from the report file); the rest are test constants, docs and decoy fixtures |
|
||||
| felhom-agent | 15 | all test fixtures |
|
||||
| felhom.eu | 43 | 1 → R-950 (withheld); 5 are `manifests/felhom.secret.yaml` history → R-925; the rest are old evidence logs of throwaway demo apps (values compared by hash with the running demo apps: none match), test constants, public keys, fingerprints |
|
||||
| app-catalog-felhom.eu | 1 | a health-probe URL, noise |
|
||||
| homelab-manifests | 17 | private repository; locations kept off-git; not product. gitleaks did NOT flag R-908's key (note on R-908) |
|
||||
|
||||
A credential found only in history counted until its rotation was checked: the old Gitea registry token in
|
||||
felhom.eu history is not among the admin account's live tokens (compared by its last eight characters with the token
|
||||
list); the old Resend key in hub.yaml history was rotated in June (hash differs from the live one).
|
||||
|
||||
## 3. trivy image
|
||||
|
||||
Command: `trivy image --image-src remote --scanners vuln -f json <image>` (registry API, no Docker daemon).
|
||||
|
||||
| image | OS | fixable CRITICAL / HIGH (OS) | Go binary | triage |
|
||||
|---|---|---|---|---|
|
||||
| felhom-controller:0.307.0 | Debian 12.15 | 12 / 23 | felhom-controller go1.24.13 (34 HIGH) | real → R-972 |
|
||||
| felhom-hub:0.146.0 | Alpine 3.21.8 | 0 / 2 | felhom-hub go1.24.13 (34 HIGH) | real → R-972 |
|
||||
| felhom-samba:1.1.0 | Alpine 3.21.7 | 0 / 48 | — | real → R-972 |
|
||||
| traefik:v3.7.13 | Alpine 3.24.2 | 0 / 0 | 4 HIGH (upstream) | upstream; R-979 (pins) |
|
||||
| cloudflared:2026.9.3 | Debian 13.7 | 0 / 1 | 4 HIGH (upstream) | upstream |
|
||||
| filebrowser 1.5.6-stable | Alpine 3.24.1 | 1 / 2 | 4 HIGH (upstream) | upstream |
|
||||
|
||||
Not scanned: the 53 catalog app images → R-987.
|
||||
|
||||
## 4. gosec (leads only)
|
||||
|
||||
Command: `gosec -quiet -tests=false -fmt=json ./...` per module. Hits: controller 470, agent 117, hub 215.
|
||||
Triage of the high-signal rules: G202 (SQL string building) — every hit builds `?` placeholders, noise. G402 (TLS
|
||||
verify off) — each sits beside a certificate pin, noise. G407/G404 — the export cipher uses random IVs and scrypt, a
|
||||
backoff jitter uses math/rand, noise. G101 — comments and constant names, noise. G304/G301/G306/G104 — bulk noise,
|
||||
not filed.
|
||||
|
||||
## 5. Proposed push gate
|
||||
|
||||
Not wired in this session. Shape: R-986.
|
||||
@@ -0,0 +1,28 @@
|
||||
# demo-hp guests 9201 (reads only) / 9202, 2026-10-12T15:13:29+02:00
|
||||
=== guest 9201
|
||||
permitrootlogin without-password
|
||||
passwordauthentication yes
|
||||
root L 2026-08-18 0 99999 7 -1
|
||||
*:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:25 [::1]:25 [::]:443 [::]:80
|
||||
controller privileged=false binds=[/opt/docker/stacks:/opt/docker/stacks /mnt:/mnt:rslave /var/run/docker.sock:/var/run/docker.sock /etc/felhom-bootstrap:/etc/felhom-bootstrap:ro felhom-controller-data:/opt/docker/felhom-controller]
|
||||
644 root data/settings.json.bak
|
||||
644 root data/settings.json
|
||||
600 root data/family.json
|
||||
600 root data/dashboard-sessions.json
|
||||
600 root data/encryption.key
|
||||
644 root data/settings.json.pre-gate-day
|
||||
600 root data/setup-gate.key
|
||||
600 root controller.yaml
|
||||
=== guest 9202
|
||||
permitrootlogin without-password
|
||||
passwordauthentication yes
|
||||
root L 2026-09-13 0 99999 7 -1
|
||||
*:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:25 [::1]:25 [::]:443 [::]:80
|
||||
controller privileged=false binds=[/var/run/docker.sock:/var/run/docker.sock /etc/felhom-bootstrap:/etc/felhom-bootstrap:ro felhom-controller-data:/opt/docker/felhom-controller /opt/docker/stacks:/opt/docker/stacks /mnt:/mnt:rslave]
|
||||
600 root data/family.json
|
||||
644 root data/settings.json.bak
|
||||
600 root data/setup-gate.key
|
||||
600 root data/encryption.key
|
||||
644 root data/settings.json
|
||||
600 root data/dashboard-sessions.json
|
||||
600 root controller.yaml
|
||||
@@ -0,0 +1,108 @@
|
||||
# demo-hp host reads, 2026-10-12T15:13:29+02:00, via ssh demo-hp (read-only)
|
||||
felhom-agent 0.154.0
|
||||
## listening sockets
|
||||
tcp *:3128 users:(("spiceproxy
|
||||
tcp *:8006 users:(("pveproxy
|
||||
tcp 0.0.0.0:111 users:(("rpcbind",pid=689,fd=4),("systemd",pid=1,fd=169))
|
||||
tcp 0.0.0.0:22 users:(("sshd",pid=1010,fd=6))
|
||||
tcp 0.0.0.0:8822 users:(("sshd",pid=1004,fd=7))
|
||||
tcp 127.0.0.1:25 users:(("master",pid=1185,fd=13))
|
||||
tcp 127.0.0.1:53 users:(("dnsmasq",pid=1001,fd=7))
|
||||
tcp 127.0.0.1:85 users:(("pvedaemon
|
||||
tcp 169.254.253.1:8443 users:(("felhom-agent",pid=1265,fd=16))
|
||||
tcp 192.168.0.104:53 users:(("dnsmasq",pid=1001,fd=5))
|
||||
tcp [::1]:25 users:(("master",pid=1185,fd=14))
|
||||
tcp [::]:111 users:(("rpcbind",pid=689,fd=6),("systemd",pid=1,fd=171))
|
||||
tcp [::]:22 users:(("sshd",pid=1010,fd=7))
|
||||
tcp [::]:8822 users:(("sshd",pid=1004,fd=6))
|
||||
udp 0.0.0.0:111 users:(("rpcbind",pid=689,fd=5),("systemd",pid=1,fd=170))
|
||||
udp 0.0.0.0:55675
|
||||
udp 10.77.0.3:51822 users:(("felhom-agent",pid=1265,fd=24))
|
||||
udp 127.0.0.1:323 users:(("chronyd",pid=777,fd=4))
|
||||
udp 127.0.0.1:53 users:(("dnsmasq",pid=1001,fd=6))
|
||||
udp 192.168.0.104:53 users:(("dnsmasq",pid=1001,fd=4))
|
||||
udp [::1]:323 users:(("chronyd",pid=777,fd=5))
|
||||
udp [::]:111 users:(("rpcbind",pid=689,fd=7),("systemd",pid=1,fd=172))
|
||||
udp [::]:55675
|
||||
## sshd -T (auth lines)
|
||||
port 22
|
||||
listenaddress [::]:22
|
||||
listenaddress 0.0.0.0:22
|
||||
maxauthtries 6
|
||||
permitrootlogin yes
|
||||
pubkeyauthentication yes
|
||||
passwordauthentication yes
|
||||
kbdinteractiveauthentication no
|
||||
## nft felhom_oob
|
||||
chain input {
|
||||
type filter hook input priority filter - 5; policy accept;
|
||||
iifname "wg-felhom" tcp dport @ssh_port ip saddr @operator_ips accept
|
||||
iifname "wg-felhom" tcp dport @ssh_port drop
|
||||
tcp dport @ssh_port iifname != "wg-felhom" drop
|
||||
## sudoers.d
|
||||
total 36
|
||||
-r--r----- 1 root root 1068 Apr 11 2026 README
|
||||
-r--r----- 1 root root 24335 Oct 7 13:36 felhom-agent
|
||||
-r--r----- 1 root root 1466 Oct 7 13:36 felhom-op
|
||||
-r--r----- 1 root root 666 May 20 2023 zfs
|
||||
## guest LXC 9201 (mac masked)
|
||||
arch: amd64
|
||||
cores: 7
|
||||
features: nesting=1,keyctl=1
|
||||
hookscript: local:snippets/felhom-guest-hook.sh
|
||||
hostname: demo-hp
|
||||
memory: 25898
|
||||
mp0: local-lvm:vm-9201-disk-1,mp=/var/lib/felhom,backup=1,size=70G
|
||||
mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives
|
||||
mp9: /var/lib/felhom-agent/guests/9201/bootstrap,mp=/etc/felhom-bootstrap,ro=1
|
||||
net0: name=eth0,bridge=vmbr0,hwaddr=<mac>,ip=dhcp,type=veth
|
||||
net1: name=eth1,bridge=vmbr9,hwaddr=<mac>,ip=169.254.253.2/30,type=veth
|
||||
onboot: 1
|
||||
ostype: debian
|
||||
rootfs: local-lvm:vm-9201-disk-0,size=32G
|
||||
swap: 512
|
||||
unprivileged: 1
|
||||
## secret-file modes (paths/modes only)
|
||||
600 felhom-agent:felhom-agent 2454 /etc/felhom-agent/agent.json
|
||||
600 felhom-agent:felhom-agent 2498 /etc/felhom-agent/agent.json.night-0925-off
|
||||
600 felhom-agent:felhom-agent 2451 /etc/felhom-agent/agent.json.pre-a4-retention
|
||||
600 felhom-agent:felhom-agent 2451 /etc/felhom-agent/agent.json.pre-d44
|
||||
600 root:root 2451 /etc/felhom-agent/agent.json.pre-r672
|
||||
644 root:root 0 /etc/felhom/.bootstrap-done
|
||||
644 root:root 7 /etc/felhom/appliance-pairing-code
|
||||
644 root:root 3429 /etc/felhom/config-bundle.json
|
||||
644 root:root 456 /etc/felhom/crash-guard.conf
|
||||
644 root:root 131 /etc/felhom/operator-signers
|
||||
644 root:root 61 /etc/felhom/os-trust.json
|
||||
600 felhom-agent:felhom-agent 189 /var/lib/felhom-agent/backup-success-state.json
|
||||
600 felhom-agent:felhom-agent 290 /var/lib/felhom-agent/controller-swap-9201.json
|
||||
600 felhom-agent:felhom-agent 61 /var/lib/felhom-agent/drive-intents.json
|
||||
600 felhom-agent:felhom-agent 64 /var/lib/felhom-agent/escrow-stage/restic_repo_password
|
||||
600 felhom-agent:felhom-agent 93 /var/lib/felhom-agent/felhom-sshd/authorized_keys.felhom-op
|
||||
600 felhom-agent:felhom-agent 5 /var/lib/felhom-agent/felhom-sshd/port
|
||||
600 felhom-agent:felhom-agent 433 /var/lib/felhom-agent/felhom-sshd/sshd_config
|
||||
600 felhom-agent:felhom-agent 67 /var/lib/felhom-agent/guest-binds.json
|
||||
600 felhom-agent:felhom-agent 241 /var/lib/felhom-agent/guest-disk-trim.json
|
||||
600 100000:100000 403 /var/lib/felhom-agent/guests/9201/bootstrap/bootstrap.json
|
||||
600 felhom-agent:felhom-agent 234 /var/lib/felhom-agent/guests/9201/controller-restarts-24h.json
|
||||
644 root:root 254 /var/lib/felhom-agent/guests/9202/bootstrap/bootstrap.json
|
||||
600 felhom-agent:felhom-agent 31342 /var/lib/felhom-agent/journal.log
|
||||
644 felhom-agent:felhom-agent 591 /var/lib/felhom-agent/local-api.crt
|
||||
600 felhom-agent:felhom-agent 227 /var/lib/felhom-agent/local-api.key
|
||||
600 felhom-agent:felhom-agent 82 /var/lib/felhom-agent/local-tokens.log
|
||||
600 felhom-agent:felhom-agent 3196 /var/lib/felhom-agent/nonces.log
|
||||
600 felhom-agent:felhom-agent 20 /var/lib/felhom-agent/os/last-night-run
|
||||
600 felhom-agent:felhom-agent 79 /var/lib/felhom-agent/os/os-update-block.json
|
||||
600 felhom-agent:felhom-agent 0 /var/lib/felhom-agent/os/pass.lock
|
||||
600 felhom-agent:felhom-agent 148 /var/lib/felhom-agent/os/plan-20261005T025659Z-guest-apply.json
|
||||
600 felhom-agent:felhom-agent 203 /var/lib/felhom-agent/os/plan-20261005T054446Z-guest-apply.json
|
||||
600 felhom-agent:felhom-agent 203 /var/lib/felhom-agent/os/plan-20261005T061334Z-guest-apply.json
|
||||
600 felhom-agent:felhom-agent 203 /var/lib/felhom-agent/os/plan-20261005T075541Z-guest-apply.json
|
||||
600 felhom-agent:felhom-agent 2398 /var/lib/felhom-agent/pbsdr/agent.json.pre-seed
|
||||
600 felhom-agent:felhom-agent 129 /var/lib/felhom-agent/pbsdr/marker.json
|
||||
600 felhom-agent:felhom-agent 367 /var/lib/felhom-agent/restore-test-state.json
|
||||
644 felhom-agent:felhom-agent 288 /var/lib/felhom-agent/units/mnt-hdd_1.mount
|
||||
600 felhom-agent:felhom-agent 64 /var/lib/felhom-agent/wg/last-applied.sha
|
||||
600 felhom-agent:felhom-agent 45 /var/lib/felhom-agent/wg/private.key
|
||||
600 felhom-agent:felhom-agent 101 /var/lib/felhom-agent/wg/registered.json
|
||||
600 felhom-agent:felhom-agent 327 /var/lib/felhom-agent/wg/wg-felhom.conf
|
||||
@@ -0,0 +1 @@
|
||||
192.168.0.104 open TCP: [22, 53, 111, 3128, 8006]
|
||||
@@ -0,0 +1,7 @@
|
||||
# hub v0.148.0 live check 2026-10-12T16:58:46+02:00 from DooPlex (LAN; the ingress admits LAN, HU, IE)
|
||||
A no credential GET /api/v1/customers -> 403 body names a customer: False body: Forbidden: global key required
|
||||
C operator key GET /api/v1/customers -> 200 bytes 1247
|
||||
A no credential GET /api/v1/customers/<customer-id> -> 403 body names a customer: False body: Forbidden: global key required
|
||||
C operator key GET /api/v1/customers/<customer-id> -> 200 bytes 2542
|
||||
A no credential GET /api/v1/customers/<customer-id>/history -> 403 body names a customer: False body: Forbidden: global key required
|
||||
C operator key GET /api/v1/customers/<customer-id>/history -> 200 bytes 3
|
||||
@@ -0,0 +1,29 @@
|
||||
# public sites, read-only GETs at browsing rate, 2026-10-12T15:13:59+02:00, from DooPlex
|
||||
== https://felhom.eu/
|
||||
HTTP/2 200
|
||||
x-frame-options: SAMEORIGIN
|
||||
x-content-type-options: nosniff
|
||||
strict-transport-security: max-age=31536000; includeSubDomains
|
||||
== https://iso.felhom.eu/
|
||||
HTTP/2 404
|
||||
server: cloudflare
|
||||
== https://stats.felhom.eu/
|
||||
HTTP/2 200
|
||||
content-security-policy: default-src 'self'; img-src 'self' https: data:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self' https:; frame-ancestors 'self' ;
|
||||
strict-transport-security: max-age=31536000; includeSubDomains
|
||||
== https://gitea.dooplex.hu/
|
||||
HTTP/2 200
|
||||
x-frame-options: SAMEORIGIN
|
||||
strict-transport-security: max-age=31536000; includeSubDomains
|
||||
== https://hub.felhom.eu/login
|
||||
HTTP/2 200
|
||||
strict-transport-security: max-age=31536000; includeSubDomains
|
||||
felhom.eu/.git/HEAD 404
|
||||
felhom.eu/scripts/ 403
|
||||
felhom.eu/.env 404
|
||||
felhom.eu/robots.txt 200
|
||||
== gitea anonymous repo list
|
||||
[('admin/app-catalog-felhom.eu', 'public'), ('admin/felhom-agent', 'public'), ('admin/felhom-controller', 'public'), ('admin/felhom.eu', 'public'), ('admin/misc-scripts', 'public'), ('admin/recipe-importer', 'public'), ('admin/revfulop-calendar', 'public')]
|
||||
== gitea sign-up page says:
|
||||
['Registration is disabled.']
|
||||
gitea anon packages API 401
|
||||
+22
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"withheld_P1_entries": 0,
|
||||
"findings": [
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 13,
|
||||
"EndLine": 13,
|
||||
"StartColumn": 53,
|
||||
"EndColumn": 90,
|
||||
"Secret": "REDACTED",
|
||||
"File": "REPORT.md",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "f51f794cf0f2d03206449bf7b79381be85879d32",
|
||||
"Entropy": 3.9232519,
|
||||
"Date": "2026-06-22T13:12:19Z",
|
||||
"Message": "docs: REPORT for komga healthcheck fix\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
|
||||
"Tags": [],
|
||||
"Fingerprint": "f51f794cf0f2d03206449bf7b79381be85879d32:REPORT.md:generic-api-key:13"
|
||||
}
|
||||
]
|
||||
}
|
||||
+260
@@ -0,0 +1,260 @@
|
||||
{
|
||||
"withheld_P1_entries": 0,
|
||||
"findings": [
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 246,
|
||||
"EndLine": 246,
|
||||
"StartColumn": 43,
|
||||
"EndColumn": 128,
|
||||
"Secret": "REDACTED",
|
||||
"File": "internal/escrow/recover_retained_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "91b9405c81bd94f6f1067eed5ce866879363ba29",
|
||||
"Entropy": 3.97006,
|
||||
"Date": "2026-10-08T05:53:01Z",
|
||||
"Message": "R-304: no 'wrong code' when earlier sealed packages were not all checked (424 older_unchecked)\n\nUnreleased; ships with tomorrow's release.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "91b9405c81bd94f6f1067eed5ce866879363ba29:internal/escrow/recover_retained_test.go:generic-api-key:246"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 247,
|
||||
"EndLine": 247,
|
||||
"StartColumn": 41,
|
||||
"EndColumn": 126,
|
||||
"Secret": "REDACTED",
|
||||
"File": "internal/escrow/recover_retained_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "91b9405c81bd94f6f1067eed5ce866879363ba29",
|
||||
"Entropy": 3.9528196,
|
||||
"Date": "2026-10-08T05:53:01Z",
|
||||
"Message": "R-304: no 'wrong code' when earlier sealed packages were not all checked (424 older_unchecked)\n\nUnreleased; ships with tomorrow's release.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "91b9405c81bd94f6f1067eed5ce866879363ba29:internal/escrow/recover_retained_test.go:generic-api-key:247"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 295,
|
||||
"EndLine": 295,
|
||||
"StartColumn": 43,
|
||||
"EndColumn": 128,
|
||||
"Secret": "REDACTED",
|
||||
"File": "internal/escrow/recover_retained_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "91b9405c81bd94f6f1067eed5ce866879363ba29",
|
||||
"Entropy": 3.9528196,
|
||||
"Date": "2026-10-08T05:53:01Z",
|
||||
"Message": "R-304: no 'wrong code' when earlier sealed packages were not all checked (424 older_unchecked)\n\nUnreleased; ships with tomorrow's release.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "91b9405c81bd94f6f1067eed5ce866879363ba29:internal/escrow/recover_retained_test.go:generic-api-key:295"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 30,
|
||||
"EndLine": 30,
|
||||
"StartColumn": 43,
|
||||
"EndColumn": 128,
|
||||
"Secret": "REDACTED",
|
||||
"File": "internal/escrow/recover_retained_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79",
|
||||
"Entropy": 3.9528196,
|
||||
"Date": "2026-08-12T16:40:00Z",
|
||||
"Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:30"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 102,
|
||||
"EndLine": 102,
|
||||
"StartColumn": 43,
|
||||
"EndColumn": 128,
|
||||
"Secret": "REDACTED",
|
||||
"File": "internal/escrow/recover_retained_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79",
|
||||
"Entropy": 3.9528196,
|
||||
"Date": "2026-08-12T16:40:00Z",
|
||||
"Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:102"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 103,
|
||||
"EndLine": 103,
|
||||
"StartColumn": 44,
|
||||
"EndColumn": 129,
|
||||
"Secret": "REDACTED",
|
||||
"File": "internal/escrow/recover_retained_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79",
|
||||
"Entropy": 3.9528196,
|
||||
"Date": "2026-08-12T16:40:00Z",
|
||||
"Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:103"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 125,
|
||||
"EndLine": 125,
|
||||
"StartColumn": 43,
|
||||
"EndColumn": 128,
|
||||
"Secret": "REDACTED",
|
||||
"File": "internal/escrow/recover_retained_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79",
|
||||
"Entropy": 3.9528196,
|
||||
"Date": "2026-08-12T16:40:00Z",
|
||||
"Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:125"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 151,
|
||||
"EndLine": 151,
|
||||
"StartColumn": 43,
|
||||
"EndColumn": 128,
|
||||
"Secret": "REDACTED",
|
||||
"File": "internal/escrow/recover_retained_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79",
|
||||
"Entropy": 3.9528196,
|
||||
"Date": "2026-08-12T16:40:00Z",
|
||||
"Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:151"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 169,
|
||||
"EndLine": 169,
|
||||
"StartColumn": 43,
|
||||
"EndColumn": 128,
|
||||
"Secret": "REDACTED",
|
||||
"File": "internal/escrow/recover_retained_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79",
|
||||
"Entropy": 3.97006,
|
||||
"Date": "2026-08-12T16:40:00Z",
|
||||
"Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:169"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 196,
|
||||
"EndLine": 196,
|
||||
"StartColumn": 43,
|
||||
"EndColumn": 128,
|
||||
"Secret": "REDACTED",
|
||||
"File": "internal/escrow/recover_retained_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79",
|
||||
"Entropy": 3.97006,
|
||||
"Date": "2026-08-12T16:40:00Z",
|
||||
"Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:196"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 197,
|
||||
"EndLine": 197,
|
||||
"StartColumn": 40,
|
||||
"EndColumn": 125,
|
||||
"Secret": "REDACTED",
|
||||
"File": "internal/escrow/recover_retained_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79",
|
||||
"Entropy": 3.97006,
|
||||
"Date": "2026-08-12T16:40:00Z",
|
||||
"Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:197"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 243,
|
||||
"EndLine": 243,
|
||||
"StartColumn": 40,
|
||||
"EndColumn": 77,
|
||||
"Secret": "REDACTED",
|
||||
"File": "internal/escrow/recover_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "a2e914f683bd1fddbc843c5ebf38e71500ebf0b9",
|
||||
"Entropy": 4,
|
||||
"Date": "2026-08-06T05:55:15Z",
|
||||
"Message": "v0.126.0: a fetch failure is not a wrong recovery code (R-224)\n\nA hub the agent could not reach was reported to the customer as a bad recovery\ncode. Measured live 2026-08-05 (CAMPAIGN-11 F3): hub firewalled off, a CORRECT\ncurrent code, and the customer told it did not open their package \u2014 in 0.0556s\nagainst ~1.0s for a real unseal. No unseal was attempted.\n\nThe discriminator existed here and this boundary threw it away: recover.go\nfails at four distinguishable points and the local-api handler had cases for\ntwo, with a default answering 'the recovery code did not open the sealed\nbundle, OR the bundle could not be fetched'.\n\nescrow.ErrBundleFetch now joins the fetch leg and the handler routes it to 502\nwith its own words \u2014 the code was NOT used. 502 not 4xx: the request was not\nbad, an upstream dependency failed. Four situations, four statuses: 502 fetch /\n400 fetched-and-refused / 404 no bundle / 409 predates the field. The\ncontroller classifies on the STATUS and never parses the sentence.\n\nA GREEN TEST NAMED THIS DEFECT AND DID NOT PREVENT IT.\nTestRecoverOffsiteRepoPassword_FetchErrorIsDistinct has said since v0.125.0\nthat the operator must not be sent to re-read their code because the hub was\nunreachable \u2014 and passed throughout, because it asserted this package's error\nSTRING one layer below the merge, and a string is not something a caller can\nbranch on. Re-pointed at the sentinel, with a consequence-level twin asserting\nthe status.\n\nRed-proofs: removing the %w join fails the sentinel test; deleting the handler\ncase makes fetch and wrong-code both answer 400 with the wrong-code sentence.\n\n29 packages ok, vet clean, agent gates OK.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "a2e914f683bd1fddbc843c5ebf38e71500ebf0b9:internal/escrow/recover_test.go:generic-api-key:243"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 128,
|
||||
"EndLine": 128,
|
||||
"StartColumn": 9,
|
||||
"EndColumn": 46,
|
||||
"Secret": "REDACTED",
|
||||
"File": "internal/pbsdr/wrapper_read_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "b2ca63ee9fe3eec9454b05c7d8d8dd2ace51b35e",
|
||||
"Entropy": 4.3565583,
|
||||
"Date": "2026-07-21T08:12:31Z",
|
||||
"Message": "v0.91.0 \u2014 the DR tier can no longer be `applied` and dead at the same time (R-39 + R-50b(a))\n\nCloses the agent half of R-39's fleet fix. Requires hub >=0.68.0 for the re-arm signal;\nthat hub is safe for 0.90.0 agents (unknown key dropped), so it deploys first.\n\nThree compounding defects let a box report `applied` while every PBS request 401'd:\n\n1. The re-key was INVISIBLE. An ep0 re-issue rotates the secret of an existing token, so\n token_id/fingerprint/datastore/namespace come back byte-identical and the descriptor\n content hash never moved \u2014 the converged agent short-circuited and never consumed the\n fresh secret. WirePBSDR.SecretGeneration (field-exact with the hub) is what moves the\n hash now, because descriptorHash marshals this struct.\n\n2. The agent could not READ its own credential. It writes /etc/pve/priv/storage/<id>.pw\n through the root wrapper, but that dir is 0700 root:www-data and the wrapper had no\n read verb \u2014 so the target resolver got \"permission denied\" every cycle, warned, and\n skipped. The one loop that could have caught the 401 was blind BY CONSTRUCTION. Adds a\n narrow `read` verb (+ exactly one sudoers line, + a pbsdr-read capability row): one\n secret to stdout, no network, no mutation, never in argv (sudo logs argv), traversal\n refused by the id grammar, the dir allowlist AND a resolved-path prefix assertion.\n\n3. Nothing probed AUTHENTICATION. pbs.ProbeAuth (GET /version + an ErrUnauthorized\n sentinel) runs on the 15-minute collect path and its verdict becomes a loud\n `auth_failed` the hub escalates to a fresh mint. /version needs no datastore, namespace\n or privilege, so a 401 means the CREDENTIAL is bad; 403 is deliberately NOT treated as\n unauthorized, since re-keying a too-narrow token would mint forever without fixing\n anything. A transport error is UNKNOWN, never a rejection \u2014 otherwise every network\n blip burns a credential. Recovery self-clears.\n\nR-50b(a): the report now carries the installed wrapper's sha256 so drift against the\nvouched manifest value is answerable. Empty = unknown, never drift.\n\nThree red-proofs, all at the assertion level. Removing SecretGeneration fails the re-arm\ntest with \"consume calls=1, want 2\". Swallowing the probe result leaves State:applied\nAuthFailed:false \u2014 the July-18 shape exactly. Notably, deleting the wrapper's id charset\nguard alone does NOT open a traversal hole (readlink + the prefix assertion still catch\nit), so the isolating red-proof removes BOTH and shows the out-of-tree secret printed \u2014\nthe layering is real, and a single-guard red-proof would have passed vacuously.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "b2ca63ee9fe3eec9454b05c7d8d8dd2ace51b35e:internal/pbsdr/wrapper_read_test.go:generic-api-key:128"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 22,
|
||||
"EndLine": 22,
|
||||
"StartColumn": 9,
|
||||
"EndColumn": 83,
|
||||
"Secret": "REDACTED",
|
||||
"File": "internal/localapi/escrow_stage_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "0c22b9bbf3c6a6d1411f9527df0ce40b26c5236e",
|
||||
"Entropy": 3.6241388,
|
||||
"Date": "2026-07-09T12:56:09Z",
|
||||
"Message": "v0.77.0: fork-4 \u2014 escrow the offsite restic repo password under R\n\nIdentityBundle gains ResticRepoPassword (rides existing age-under-R\nWrapIdentityBundle; custody spike febdc56 proved a recovered value opens the\nreal repo). POST /escrow/stage-secret (withGuest, scopedFromBody) transiently\nstages the controller-pushed password (0600, atomic, NEVER logged), which the\nescrow-create ceremony auto-injects then wipes. Adds AttachResticPassword +\nStagedResticPasswordPath + WipeStagedResticPassword; EscrowStagePath injectable\nfor tests. Tests: bundle carries pw byte-exact + not-in-blob + wrong-R fails\nclosed; stage 0600 + non-secret ack + cross-guest 403 + value-not-in-log.\nAdditive; PBS-K escrow untouched. NOT yet live-validated (supervised ceremony).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6",
|
||||
"Tags": [],
|
||||
"Fingerprint": "0c22b9bbf3c6a6d1411f9527df0ce40b26c5236e:internal/localapi/escrow_stage_test.go:generic-api-key:22"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 49,
|
||||
"EndLine": 49,
|
||||
"StartColumn": 28,
|
||||
"EndColumn": 69,
|
||||
"Secret": "REDACTED",
|
||||
"File": "internal/escrow/identity_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "e4dfe5ccc7df4182255d44a0565ebcfe95aeb68a",
|
||||
"Entropy": 4.060262,
|
||||
"Date": "2026-06-11T07:48:36Z",
|
||||
"Message": "slice 10D (agent): DR capstone \u2014 identity escrow + restore-mode consumption (v0.18.0)\n\nIdentity escrow wraps {tunnel_token,pbs_token} under the SAME R via age\n(scrypt+ChaCha20-Poly1305), reusing the K-escrow pty; wrong R fails closed.\nescrow.Create optionally emits the identity blob; escrow-create uploads it +\nthe non-secret directive; identity-consume recovers it (R by hand, never\nlogged). K-escrow + 10C Consume untouched. Closes slice 10 with hub v0.11.0;\noperator-side rotation model (hub holds no Cloudflare write-power).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
|
||||
"Tags": [],
|
||||
"Fingerprint": "e4dfe5ccc7df4182255d44a0565ebcfe95aeb68a:internal/escrow/identity_test.go:generic-api-key:49"
|
||||
}
|
||||
]
|
||||
}
|
||||
+141
@@ -0,0 +1,141 @@
|
||||
{
|
||||
"withheld_P1_entries": 4,
|
||||
"findings": [
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 272,
|
||||
"EndLine": 272,
|
||||
"StartColumn": 21,
|
||||
"EndColumn": 52,
|
||||
"Secret": "REDACTED",
|
||||
"File": "controller/scripts/test_gate_decoys.py",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "074ddda352e3e03388801c47f3848e5634379a1c",
|
||||
"Entropy": 3.6168747,
|
||||
"Date": "2026-10-05T19:54:41Z",
|
||||
"Message": "R-576: go-parity gate also judges the CALL \u2014 arity vs printf verbs, and no key glued with +\n\nChecks 4 (ARITY) and 5 (NO-CONCAT) in i18n_go_parity.py: at every message-helper call\n(MsgError/MsgErrorf/Text/Msgf/msg/msgLang/msgHU/note) whose key is a literal hu.json knows,\nthe argument count must equal the Hungarian value's printf verbs; a known key literal may\nnever be an operand of +. 485 calls judged, 0 defects today. Decoys: a dropped argument and\na key+suffix concatenation on a real producer convict; a nested-paren argument is accepted.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "074ddda352e3e03388801c47f3848e5634379a1c:controller/scripts/test_gate_decoys.py:generic-api-key:272"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 151,
|
||||
"EndLine": 151,
|
||||
"StartColumn": 16,
|
||||
"EndColumn": 53,
|
||||
"Secret": "REDACTED",
|
||||
"File": "controller/scripts/test_gate_decoys.py",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "612c4170242760ab56aea8f43398a7e772898051",
|
||||
"Entropy": 3.6841838,
|
||||
"Date": "2026-09-17T12:50:57Z",
|
||||
"Message": "v0.247.0: i18n spike \u2014 the dashboard can speak English, Hungarian byte-identical\n\nMessage bundles (internal/i18n) expanded into templates before parsing, one\ntemplate set per language. Launcher, /backups, /apps/<slug> and the layout\nconverted; household language setting, POST /settings/language, ?lang= override,\nreport field. Parity test against fixtures captured from unconverted templates;\ncopy gates read templates expanded; new i18n_missing_gate.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "612c4170242760ab56aea8f43398a7e772898051:controller/scripts/test_gate_decoys.py:generic-api-key:151"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 43,
|
||||
"EndLine": 43,
|
||||
"StartColumn": 8,
|
||||
"EndColumn": 88,
|
||||
"Secret": "REDACTED",
|
||||
"File": "controller/internal/backup/offbox_offer_shapec_r241_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "a491abef6c2043ff260fde5dd8a8c4be7d7456df",
|
||||
"Entropy": 3.8961687,
|
||||
"Date": "2026-08-07T09:33:42Z",
|
||||
"Message": "R-241 part 2: the comparison the box already makes becomes the thing that offers recovery\n\nTHE FACT WAS COMPUTED EVERY CYCLE AND KEPT NOWHERE. EscrowAutoConfirmer.Reconcile\nhas compared the hub's restic_pw_sha256 against the local key on every ACK since\nSLICE 3. On the final-walk venue it logged, at 03:28:03Z and thirty-five minutes\nbefore the customer looked, \"the hub's escrow blob does not cover the CURRENT repo\npassword (hub hash 30ef574f != local 9b4a9a9d)\" - and dropped it. The recovery\nscreen, evaluating in the same process, went on asking a question that could not\nsee it.\n\nNow persisted: settings.HubEscrowKeySHA256 + HubEscrowKeyCheckedAt, recorded\nUNCONDITIONALLY in Reconcile beside RecordPresence and RecordSuperseded - same\nplace, same reason: the box that needs it most is the rebuilt one with no target,\non which every gate below returns early.\n\nOffsiteRecoveryOffer gains SHAPE (c): the hub holds a package for a key OTHER than\nthe one we are using. (a) and (b) are both proxies for that question and both have\nnow been wrong in opposite directions - (a) goes false the moment anything mints,\n(b) is unreachable while the escrow is pending.\n\nSEC 7.2, decided deliberately and stated in the code:\n - a KNOWN DIFFERENCE offers, however old the reading. Age is not gated on. Both\n sides are local; only the hub's half can be stale, and what the hub holds does\n not change without a ceremony THIS box runs, which refreshes the hash on the\n next ACK. Gating on age would make a box offline from the hub silently stop\n offering - the exact failure this session removes. CheckedAt is persisted for\n diagnosis, not as a gate.\n - an ABSENT hash falls back to (a)/(b) and does NOT offer. \"\" is the hub\n positively saying its package seals no repository password (legacy hash-less\n escrow). Nothing to compare, and offering would put a permanent screen in\n front of every legacy box.\n\nThe write damper: CheckedAt refreshes on every ack carrying a hash, but a save is\nskipped when both the hash and the UTC day are unchanged, so an idle box does not\nrewrite settings.json every fifteen minutes. It records WHEN WE LAST HEARD, not\nwhen it last changed - the R-100 distinction.\n\nTests: Scenario C (a differing key offers, with both proxies asserted false first),\nScenario D (a matching key offers nothing), fact 1 still required, shape (a) still\nworks, and both SEC 7.2 halves.\n\nRED-PROOFS, each with the mutation confirmed present in the file first:\n D) hubHash != localHash conjunct dropped -> Scenario D FAILS (a healthy box\n offered recovery forever); Scenario C still passes\n WIRING) RecordEscrowKeyHash removed from the EscrowAutoConfirmer literal in\n main.go -> TestMainWiresRecordEscrowKeyHash FAILS. This is the ships-inert\n shape: unwired, everything compiles, every test in the package passes, the\n auto-confirm still works, and shape (c) reads an empty hash forever.\n\nGreen: go build, go vet, go test ./... all pass.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "a491abef6c2043ff260fde5dd8a8c4be7d7456df:controller/internal/backup/offbox_offer_shapec_r241_test.go:generic-api-key:43"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 85,
|
||||
"EndLine": 85,
|
||||
"StartColumn": 8,
|
||||
"EndColumn": 89,
|
||||
"Secret": "REDACTED",
|
||||
"File": "REPORT.md",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "3d3b4496f37708269b73f15772a66f6218f5f9ba",
|
||||
"Entropy": 3.794148,
|
||||
"Date": "2026-08-07T10:23:55Z",
|
||||
"Message": "REPORT.md \u2014 R-241 fixed, deployed, live-validated on both demo boxes\n\nScenario A's live result first: on demo-hp in the rebuilt shape, no key was\nminted on the real start-up offsite-apply path, and the hub received the state\nit reports instead - offsite.state=awaiting_recovery_key with enabled:false.\nKey restored byte-identical afterwards.\n\nIncludes Q4's seven rows mapped to the three states, the SEC 7.2 choice and\nwhy, SEC 7.3's answer on the new-code button, every changed Hungarian string\nquoted, all nine red-proofs with what was mutated, the R-245 reasoning, and\nthree observations noticed but not acted on.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "3d3b4496f37708269b73f15772a66f6218f5f9ba:REPORT.md:generic-api-key:85"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 86,
|
||||
"EndLine": 86,
|
||||
"StartColumn": 2,
|
||||
"EndColumn": 89,
|
||||
"Secret": "REDACTED",
|
||||
"File": "REPORT.md",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "3d3b4496f37708269b73f15772a66f6218f5f9ba",
|
||||
"Entropy": 3.794148,
|
||||
"Date": "2026-08-07T10:23:55Z",
|
||||
"Message": "REPORT.md \u2014 R-241 fixed, deployed, live-validated on both demo boxes\n\nScenario A's live result first: on demo-hp in the rebuilt shape, no key was\nminted on the real start-up offsite-apply path, and the hub received the state\nit reports instead - offsite.state=awaiting_recovery_key with enabled:false.\nKey restored byte-identical afterwards.\n\nIncludes Q4's seven rows mapped to the three states, the SEC 7.2 choice and\nwhy, SEC 7.3's answer on the new-code button, every changed Hungarian string\nquoted, all nine red-proofs with what was mutated, the R-245 reasoning, and\nthree observations noticed but not acted on.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "3d3b4496f37708269b73f15772a66f6218f5f9ba:REPORT.md:generic-api-key:86"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 258,
|
||||
"EndLine": 258,
|
||||
"StartColumn": 9,
|
||||
"EndColumn": 34,
|
||||
"Secret": "REDACTED",
|
||||
"File": "controller/internal/stacks/samba_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "0dcbea90b2b9fc2dc9194e6ae6b2db1796d77c1b",
|
||||
"Entropy": 3.640224,
|
||||
"Date": "2026-07-18T09:30:04Z",
|
||||
"Message": "feat(samba): lifecycle \u2014 ensureSamba/ReconcileSamba/password/disable (R-7 slice 1, Part 2)\n\nensureSamba joins EnsureBaseStack after filebrowser, gated on SMB.Enabled\n(cloudflared conditional precedent); reconcile is idempotent (unchanged config +\nrunning container = ZERO compose calls, asserted via seam). Atomic tmp+fsync+\nrename config writes. Password applied via smbpasswd on STDIN (never argv/log/\nsettings). Disable = compose down, volumes + folders KEPT. samba added to\nIsProtectedStack in code (controller.yaml is golden-generated and predates it),\nwhich also makes the app-backup loops correctly skip it.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "0dcbea90b2b9fc2dc9194e6ae6b2db1796d77c1b:controller/internal/stacks/samba_test.go:generic-api-key:258"
|
||||
},
|
||||
{
|
||||
"RuleID": "curl-auth-header",
|
||||
"Description": "Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.",
|
||||
"StartLine": 1413,
|
||||
"EndLine": 1416,
|
||||
"StartColumn": 2,
|
||||
"EndColumn": 97,
|
||||
"Secret": "REDACTED",
|
||||
"File": "TASK2.md",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "6713df2186aa87b5ad0862d678b5f5ddb1cc349f",
|
||||
"Entropy": 3.8710182,
|
||||
"Date": "2026-02-19T12:16:46Z",
|
||||
"Message": "v0.15.5: Disaster recovery \u2014 Hub-based infra backup, auto-mount, restore UI\n\nComplete DR implementation (TASK2.md Phases 1-4):\n- Hub infra-backup push/pull endpoints (controller.yaml, disk layout, stacks)\n- Fresh-deployment detection pulls config from Hub, auto-mounts drives by UUID\n- Full-page restore UI with drive status, app table, sequential restore\n- docker-setup.sh shows DR instructions when customer_id is configured\n\nNew files: disk_layout.go, restore_scan.go, restore_app_linux.go,\nrestore_drives_linux.go, infra_backup.go, infra_pull.go,\nhandler_restore.go, restore.html\n\nCo-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>",
|
||||
"Tags": [],
|
||||
"Fingerprint": "6713df2186aa87b5ad0862d678b5f5ddb1cc349f:TASK2.md:curl-auth-header:1413"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 1638,
|
||||
"EndLine": 1638,
|
||||
"StartColumn": 4,
|
||||
"EndColumn": 78,
|
||||
"Secret": "REDACTED",
|
||||
"File": "scripts/docker-setup.sh",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "cdaa13711843fc9bb9bccf31b784ee68a4108966",
|
||||
"Entropy": 3.8710182,
|
||||
"Date": "2026-02-19T12:33:39Z",
|
||||
"Message": "docker-setup.sh v5.0: Config wizard, controller deployment, FileBrowser rewrite\n\nComplete TASK.md implementation:\n- \u00a71: Version bump to 5.0.0, updated banner and header comment\n- \u00a73+\u00a74: Remove --cf-tunnel-token and --hdd-path CLI options (deprecated)\n- \u00a75: Rewrite install_filebrowser() with auto drive discovery from /mnt/\n- \u00a76: New install_controller() deploys felhom-controller with compose\n- \u00a77: Interactive run_config_wizard() generates controller.yaml\n- \u00a79: install_cloudflare_tunnel() reads from wizard variable\n- \u00a710: New execution order: infra \u2192 wizard \u2192 tunnel \u2192 filebrowser \u2192 controller\n- \u00a711: Fix print_summary() \u2014 controller URL, hub status, fix CUSTOMER_ID bug\n- \u00a712: Update print_help() for new workflow\n\nCo-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>",
|
||||
"Tags": [],
|
||||
"Fingerprint": "cdaa13711843fc9bb9bccf31b784ee68a4108966:scripts/docker-setup.sh:generic-api-key:1638"
|
||||
}
|
||||
]
|
||||
}
|
||||
+719
@@ -0,0 +1,719 @@
|
||||
{
|
||||
"withheld_P1_entries": 1,
|
||||
"findings": [
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 38,
|
||||
"EndLine": 38,
|
||||
"StartColumn": 287,
|
||||
"EndColumn": 314,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/r890-instructions-2026-10-06/tools/wgerwalk.py",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "01d5dbd3e0325809147ccaf9fce4fa2efabf1c51",
|
||||
"Entropy": 3.6168747,
|
||||
"Date": "2026-10-06T12:03:28Z",
|
||||
"Message": "Part C: R-644, R-763, R-764 closed (wger's fixes proven on 9202), R-762/R-717 stopped with reasons; STATUS, CONTEXT, REPORT (142 -> 137; 0 opened, 5 closed)\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "01d5dbd3e0325809147ccaf9fce4fa2efabf1c51:documentation/audits/r890-instructions-2026-10-06/tools/wgerwalk.py:generic-api-key:38"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 16,
|
||||
"EndLine": 16,
|
||||
"StartColumn": 3,
|
||||
"EndColumn": 67,
|
||||
"Secret": "REDACTED",
|
||||
"File": "hub/internal/store/r879_box_seal_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "5f060e3d1e669e8f0db89a88c14d18f7ac3a1141",
|
||||
"Entropy": 4.4701757,
|
||||
"Date": "2026-10-05T19:18:14Z",
|
||||
"Message": "R-879: seal box API keys, owner passphrases, controller keys and PBS-DR tokens at rest\n\nhosts.api_key, customer_configs.api_key / retrieval_password and host_pbs_secrets.value now hold the\nR-821/R-133 seal (enc:v1:, OFFSITE_SECRET_KEY). The two API keys get an api_key_hash lookup twin\n(SHA-256, backfilled keyless in migrate()), so box authentication never needs the sealing key; a row\nwith no hash is matched on its plaintext only while it is plaintext. SealLegacyBoxSecrets seals legacy\nrows at start-up (idempotent, non-fatal). A sealed value that does not open sets SecretsUnreadable:\nserve/compare paths answer 500, saves refuse the record, the PBS token is not burned.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "5f060e3d1e669e8f0db89a88c14d18f7ac3a1141:hub/internal/store/r879_box_seal_test.go:generic-api-key:16"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 5,
|
||||
"EndLine": 5,
|
||||
"StartColumn": 84,
|
||||
"EndColumn": 138,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa",
|
||||
"Entropy": 4.8619704,
|
||||
"Date": "2026-10-03T19:21:04Z",
|
||||
"Message": "Off-site lock live: Parts D/E/F evidence, ep0 copy runbook, 06/07 facts, register (R-820/R-821/R-342 closed, R-825 opened+closed, R-95/R-822 narrowed, R-823/R-824/R-826/R-827/R-828/R-830 opened; 327 -> 330); hub window-sweep test (test-only)\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa:documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt:generic-api-key:5"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 7,
|
||||
"EndLine": 7,
|
||||
"StartColumn": 56,
|
||||
"EndColumn": 110,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa",
|
||||
"Entropy": 4.8619704,
|
||||
"Date": "2026-10-03T19:21:04Z",
|
||||
"Message": "Off-site lock live: Parts D/E/F evidence, ep0 copy runbook, 06/07 facts, register (R-820/R-821/R-342 closed, R-825 opened+closed, R-95/R-822 narrowed, R-823/R-824/R-826/R-827/R-828/R-830 opened; 327 -> 330); hub window-sweep test (test-only)\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa:documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt:generic-api-key:7"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 8,
|
||||
"EndLine": 8,
|
||||
"StartColumn": 56,
|
||||
"EndColumn": 110,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa",
|
||||
"Entropy": 4.8619704,
|
||||
"Date": "2026-10-03T19:21:04Z",
|
||||
"Message": "Off-site lock live: Parts D/E/F evidence, ep0 copy runbook, 06/07 facts, register (R-820/R-821/R-342 closed, R-825 opened+closed, R-95/R-822 narrowed, R-823/R-824/R-826/R-827/R-828/R-830 opened; 327 -> 330); hub window-sweep test (test-only)\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa:documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt:generic-api-key:8"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 14,
|
||||
"EndLine": 14,
|
||||
"StartColumn": 83,
|
||||
"EndColumn": 126,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/family-gate-2026-10-02/tools/fg_items.py",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "e6d1ebd1525171a4e35c51d5d791af3a65e0707c",
|
||||
"Entropy": 4.168296,
|
||||
"Date": "2026-10-02T07:35:42Z",
|
||||
"Message": "Family gate built + licence read: evidence (9202, bench, floor), licence table + SparkyFitness request draft (not sent), 01 \u00a75 family gate, 09 decision 64 built, capability map, register 422 -> 436 (R-767/R-780/R-787 closed; R-775/R-784 updated; R-788..R-801 opened), CONTEXT\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "e6d1ebd1525171a4e35c51d5d791af3a65e0707c:documentation/audits/family-gate-2026-10-02/tools/fg_items.py:generic-api-key:14"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 9,
|
||||
"EndLine": 9,
|
||||
"StartColumn": 83,
|
||||
"EndColumn": 126,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/permanent-gate-2026-10-01/tools/items12.py",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "b50289074d92d6a23975fda65475adf8ba09bb73",
|
||||
"Entropy": 4.168296,
|
||||
"Date": "2026-10-01T19:26:23Z",
|
||||
"Message": "Evidence: Part A (visitors apart \u2014 measurements, design, sweep, 9202 live) and the permanent-gate spike (items 1\u20136, VERDICT: PASS, build plan)\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "b50289074d92d6a23975fda65475adf8ba09bb73:documentation/audits/permanent-gate-2026-10-01/tools/items12.py:generic-api-key:9"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 184,
|
||||
"EndLine": 184,
|
||||
"StartColumn": 40,
|
||||
"EndColumn": 67,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/new-apps-2026-10-01/tools/newapp_box.py",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "bc9c7b49346b664ed37aa60d52c1f9ee4c6acd1d",
|
||||
"Entropy": 3.9068906,
|
||||
"Date": "2026-10-01T17:52:32Z",
|
||||
"Message": "New apps night: Radicale, Karakeep, Dawarich published; Grimmory held (R-775); fit table; R-765..R-775; STATUS, CONTEXT, report, evidence\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "bc9c7b49346b664ed37aa60d52c1f9ee4c6acd1d:documentation/audits/new-apps-2026-10-01/tools/newapp_box.py:generic-api-key:184"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 4,
|
||||
"EndLine": 4,
|
||||
"StartColumn": 14,
|
||||
"EndColumn": 61,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/night-rulings-2026-09-30/D/D3-wanderer-routes-probe.txt",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "3159892fabbf5827c071c67cb5018e35223f55e0",
|
||||
"Entropy": 4.0980687,
|
||||
"Date": "2026-09-30T21:26:21Z",
|
||||
"Message": "Both rulings built: same-tag re-tests (decision 52), image retention + the install hold (controller 0.284.2); golden 0.284.2\n\n- Decision 52: catalog 6a3ead9 (re-test entries, gates, decoys, the monthly command); proven end to end on 9202\n through the leg; runbook monthly-floating-retest.md; nothing to re-test on the engine lines today.\n- Decision 53 + R-741: controller v0.284.2 (0.284.0/0.284.1 never floored \u2014 two wiring faults found live on 9202);\n floor 0.284.2; one-time sweep 9202 26.6 -> 5.7 GB, demo-hp 24.3 -> 13.5 GB; the install hold proven as a stranger.\n- Golden 0.284.2 baked, round-trip identical, vouched (agent 0.138.0, min_agent 0.131.0); the gate prints OK.\n- Rows 377 -> 383: opened R-743..R-748, closed R-736, R-737, R-740, R-741, R-748; narrowed R-739, R-698, R-446.\n- register_shape_gate: a lettered id (R-88a) is a row too (R-748), with a decoy seen red.\n\nEvidence: documentation/audits/night-rulings-2026-09-30/, documentation/tests/golden-0.284.2-2026-09-30/.\nReport: REPORT-night-rulings-2026-09-30.md.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "3159892fabbf5827c071c67cb5018e35223f55e0:documentation/audits/night-rulings-2026-09-30/D/D3-wanderer-routes-probe.txt:generic-api-key:4"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 2,
|
||||
"EndLine": 2,
|
||||
"StartColumn": 20,
|
||||
"EndColumn": 78,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/cloudflare-dns.txt",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "4951fc22836835b90b951cd1cbe21c797fc85ead",
|
||||
"Entropy": 3.5413363,
|
||||
"Date": "2026-09-30T07:49:41Z",
|
||||
"Message": "Decisions 50 (apps off-site by default, R-720) and 51 (ep0 drill archives; restore test on own archives, R-727) recorded; Tester-2 read-only checklist\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "4951fc22836835b90b951cd1cbe21c797fc85ead:documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/cloudflare-dns.txt:generic-api-key:2"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 5,
|
||||
"EndLine": 5,
|
||||
"StartColumn": 236,
|
||||
"EndColumn": 259,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/signup-lock-2026-09-29/B/wd.sh",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "8cadacb553ba5003800eb6c861f766054b36c8c1",
|
||||
"Entropy": 3.5849626,
|
||||
"Date": "2026-09-29T15:19:43Z",
|
||||
"Message": "Sign-up lock 2026-09-29 evening: decisions 48/49 outcomes, two locks, wanderer closable, R-714/715/716 closed, R-717/718 opened; STATUS, CONTEXT, report\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "8cadacb553ba5003800eb6c861f766054b36c8c1:documentation/audits/signup-lock-2026-09-29/B/wd.sh:generic-api-key:5"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 5,
|
||||
"EndLine": 5,
|
||||
"StartColumn": 262,
|
||||
"EndColumn": 292,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/signup-lock-2026-09-29/B/wd.sh",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "8cadacb553ba5003800eb6c861f766054b36c8c1",
|
||||
"Entropy": 3.5849626,
|
||||
"Date": "2026-09-29T15:19:43Z",
|
||||
"Message": "Sign-up lock 2026-09-29 evening: decisions 48/49 outcomes, two locks, wanderer closable, R-714/715/716 closed, R-717/718 opened; STATUS, CONTEXT, report\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "8cadacb553ba5003800eb6c861f766054b36c8c1:documentation/audits/signup-lock-2026-09-29/B/wd.sh:generic-api-key:5"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 6,
|
||||
"EndLine": 6,
|
||||
"StartColumn": 84,
|
||||
"EndColumn": 128,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/night-2026-09-23/chaos/round-01-run.txt",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "3e58c184f62e3dc5048bbe935543c7fee0a55f0b",
|
||||
"Entropy": 3.7709103,
|
||||
"Date": "2026-09-23T22:24:04Z",
|
||||
"Message": "night shift 2026-09-23: the record, the register, the morning note\n\nDRILL-night-2026-09-23.md: Parts A-E. 09 \u00a73 decisions 21 (operator word),\n22 and 23 (CC unattended, operator may reverse); \u00a76.4 parts 4 and 6\n(catalog half) shipped; \u00a76.1a residuals R-658/R-659. Register 330 -> 336:\nR-651..R-660 opened (R-658 and R-659 P1), R-650/R-640/R-499/R-626 closed.\nCapability map, nightly rotation (opengist), STATUS (one question: the\nfloor), CONTEXT, REPORT. The floor stays 0.266.0.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "3e58c184f62e3dc5048bbe935543c7fee0a55f0b:documentation/audits/night-2026-09-23/chaos/round-01-run.txt:generic-api-key:6"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 6,
|
||||
"EndLine": 6,
|
||||
"StartColumn": 84,
|
||||
"EndColumn": 128,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/night-2026-09-23/chaos/round-01.log",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "3e58c184f62e3dc5048bbe935543c7fee0a55f0b",
|
||||
"Entropy": 3.7709103,
|
||||
"Date": "2026-09-23T22:24:04Z",
|
||||
"Message": "night shift 2026-09-23: the record, the register, the morning note\n\nDRILL-night-2026-09-23.md: Parts A-E. 09 \u00a73 decisions 21 (operator word),\n22 and 23 (CC unattended, operator may reverse); \u00a76.4 parts 4 and 6\n(catalog half) shipped; \u00a76.1a residuals R-658/R-659. Register 330 -> 336:\nR-651..R-660 opened (R-658 and R-659 P1), R-650/R-640/R-499/R-626 closed.\nCapability map, nightly rotation (opengist), STATUS (one question: the\nfloor), CONTEXT, REPORT. The floor stays 0.266.0.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "3e58c184f62e3dc5048bbe935543c7fee0a55f0b:documentation/audits/night-2026-09-23/chaos/round-01.log:generic-api-key:6"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 5,
|
||||
"EndLine": 5,
|
||||
"StartColumn": 84,
|
||||
"EndColumn": 128,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/update-night-2026-09-21/apps/actualbudget/log.txt",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "da20722e76a7367e311c7b5055038e5470f1586e",
|
||||
"Entropy": 3.718129,
|
||||
"Date": "2026-09-21T19:17:46Z",
|
||||
"Message": "Update night 2026-09-21: Phase 0 and Phase 1 evidence, the drill method, and two instrument fixes\n\nINTERIM CHECKPOINT \u2014 evidence off the machine at the end of the phase that produced it (R-320),\nnot at the end of the session. Phases 2-5 follow in a later commit.\n\nPhase 0, all three mechanisms proven with their controls:\n- the fleet floor to 0.261.0 with its declared MinAgent \u2014 both demo boxes in 13 s, the hub\n logging `managed floor SERVED ... from declared (golden 0.258.0)`.\n- a PRIVATE DRILL CATALOG (admin/app-catalog-drill), so that broken, dummy, cross-repo and\n engine-major edges can be measured without the live catalog ever carrying one. Positive\n control quoted, and two negative controls: the live catalog's main and both real boxes'\n caches unchanged.\n- a throwaway image store on the scratch guest, which is what makes an UNATTENDED HOLD\n measurable at all: an edge that PASSES the within-a-major test and still fails.\n CompareImageRefs was proven to order host:port/ references by RUNNING it (4 positive cases\n + 1 negative control), not by reading it.\n\nPhase 1: real within-a-major upstream edges walked on guest 9202 through the product's own\nguarded Update, each app seeded and read back through its OWN front door (R-156), with a\nper-edge verdict record in 09's shape. `inconclusive` is never collapsed into `failed`.\n\nTWO INSTRUMENT FIXES, both in this repo's own evidence code:\n- 00-api-recipe.md said the app page is /app/<n>; it is /apps/<n>, and every call it described\n 404s. Corrected, with the session-expiry note that cost the same time.\n- unattended-caller.py's follow() read update_phase/updating off the API ENVELOPE, so both were\n always None and EVERY followed update ran to its 900 s timeout and was then recorded\n `timeout` and never-press-again. Fixed before B1 relied on it. R-623.\n\nNo controller, agent or hub code was written. The live catalog carries no broken reference.\n\nGates: repo_gates.py --fast \u2014 all 15 OK, exit 0.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "da20722e76a7367e311c7b5055038e5470f1586e:documentation/audits/update-night-2026-09-21/apps/actualbudget/log.txt:generic-api-key:5"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 52,
|
||||
"EndLine": 52,
|
||||
"StartColumn": 84,
|
||||
"EndColumn": 128,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/update-night-2026-09-21/batchA.log",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "da20722e76a7367e311c7b5055038e5470f1586e",
|
||||
"Entropy": 3.718129,
|
||||
"Date": "2026-09-21T19:17:46Z",
|
||||
"Message": "Update night 2026-09-21: Phase 0 and Phase 1 evidence, the drill method, and two instrument fixes\n\nINTERIM CHECKPOINT \u2014 evidence off the machine at the end of the phase that produced it (R-320),\nnot at the end of the session. Phases 2-5 follow in a later commit.\n\nPhase 0, all three mechanisms proven with their controls:\n- the fleet floor to 0.261.0 with its declared MinAgent \u2014 both demo boxes in 13 s, the hub\n logging `managed floor SERVED ... from declared (golden 0.258.0)`.\n- a PRIVATE DRILL CATALOG (admin/app-catalog-drill), so that broken, dummy, cross-repo and\n engine-major edges can be measured without the live catalog ever carrying one. Positive\n control quoted, and two negative controls: the live catalog's main and both real boxes'\n caches unchanged.\n- a throwaway image store on the scratch guest, which is what makes an UNATTENDED HOLD\n measurable at all: an edge that PASSES the within-a-major test and still fails.\n CompareImageRefs was proven to order host:port/ references by RUNNING it (4 positive cases\n + 1 negative control), not by reading it.\n\nPhase 1: real within-a-major upstream edges walked on guest 9202 through the product's own\nguarded Update, each app seeded and read back through its OWN front door (R-156), with a\nper-edge verdict record in 09's shape. `inconclusive` is never collapsed into `failed`.\n\nTWO INSTRUMENT FIXES, both in this repo's own evidence code:\n- 00-api-recipe.md said the app page is /app/<n>; it is /apps/<n>, and every call it described\n 404s. Corrected, with the session-expiry note that cost the same time.\n- unattended-caller.py's follow() read update_phase/updating off the API ENVELOPE, so both were\n always None and EVERY followed update ran to its 900 s timeout and was then recorded\n `timeout` and never-press-again. Fixed before B1 relied on it. R-623.\n\nNo controller, agent or hub code was written. The live catalog carries no broken reference.\n\nGates: repo_gates.py --fast \u2014 all 15 OK, exit 0.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "da20722e76a7367e311c7b5055038e5470f1586e:documentation/audits/update-night-2026-09-21/batchA.log:generic-api-key:52"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 25,
|
||||
"EndLine": 25,
|
||||
"StartColumn": 3,
|
||||
"EndColumn": 45,
|
||||
"Secret": "REDACTED",
|
||||
"File": "hub/internal/web/bind_language_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "9167cf53afbc9cf62fdc92ca248d37a493e915e7",
|
||||
"Entropy": 4,
|
||||
"Date": "2026-09-18T14:20:11Z",
|
||||
"Message": "hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)\n\nThe hub has written every customer e-mail in Hungarian whatever the box was set\nto. The box has published its language since controller v0.247.0; nothing read\nit. Now it does.\n\nNothing an operator reads changes. The Hungarian mails are byte-identical, and\nthat is a diff rather than a reading: 56 goldens per language captured from\nv0.117.0 BEFORE any string moved, and all 56 Hungarian ones pass unchanged after\nevery sentence was routed through the new bundle.\n\n- internal/i18n: flat bundle, 79 keys, hu authoritative + hu fallback, ceiling 0.\n- customerMessages/severityLabels are DERIVED from the bundle, so a sentence is\n written in one place and all 40+ tests that read those maps still work.\n- Language order: last reported -> created-with -> hu. reports.language defaults\n to EMPTY, never hu: \"never told us\" is not \"chose Hungarian\".\n- message_customer on POST /api/v1/event, additive and optional forever, for the\n sentences the box composes and the hub cannot translate.\n- The bind page is per-language, and its `expired` state stays Hungarian: it is\n the state an unknown token lands in, so rendering a real English customer's\n token in English would make the LANGUAGE answer what the TEXT refuses to.\n\nTwo defects found inside the release:\n- R-581: the newest report was picked by received_at, which has SECOND\n granularity, so same-second reports tied and the winner was arbitrary. Ordered\n by the autoincrement id now. GetCustomers() still has the shape - row open.\n- R-582: the English copy-guard stems, ported word for word from Hungarian,\n convicted 141 honest sentences. The English claim is a phrase with a modal.\n\nR-555 closed: the language allowlist entry is out of wire_contract_gate.py.\nhub_copy_gate.py follows the sentences into the bundle - without that it would\nhave scanned four files that no longer hold any customer text and reported\nsuccess. Three new decoys incl. an innocent control.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS",
|
||||
"Tags": [],
|
||||
"Fingerprint": "9167cf53afbc9cf62fdc92ca248d37a493e915e7:hub/internal/web/bind_language_test.go:generic-api-key:25"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 121,
|
||||
"EndLine": 121,
|
||||
"StartColumn": 11,
|
||||
"EndColumn": 59,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/evidence-rehearsal-2026-08-09/P1-demo-hp-after.txt",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "b1afbb8a4d6c06e782da726785502323e4c163bb",
|
||||
"Entropy": 4.851366,
|
||||
"Date": "2026-08-09T08:59:44Z",
|
||||
"Message": "Rehearsal 2026-08-09: the walk stops at P3 \u2014 R-273 blocks every install fleet-wide\n\nP1 uninstall, P2 preflight, P3 install. The install FAILED at step 5/8 in 44s,\nand the two rank-1 findings are both on the setting-up path a tester's visit is\nmade of. Eleven register rows minted (R-269..R-279); ceiling moves 268 -> 279.\n\nR-273 (RANK 1) \u2014 the hub vouches agent 0.128.0; that version was published as a\nGitea PACKAGE but never git-tagged. Since R-183 the installer correctly pins its\nconfig fetches to raw/tag/v<vouched>, so every fresh install and every reinstall\nnow 404s as root, mid-install. Measured: main 200, v0.127.0 200, v0.128.0 404.\nThis is R-184 arriving; release-agent.sh:23 already documents the exact hazard.\nExisting boxes are fine (self-update takes the binary from the registry).\nNOT fixed here \u2014 publishing a release tag is outward-facing and the runbook says\nstop and report. One command unblocks it; it is in STATUS.md.\n\nR-272 (RANK 1) \u2014 Felhom's own uninstall leaves the condition that makes Felhom's\nown reinstall refuse. It installs dnsmasq at day-0, then on teardown removes the\nsnippet and RESTARTS the daemon unconstrained (process start time lands inside\nthe uninstall window), which grabs 0.0.0.0:53; the next preflight then refuses,\nand the message reads as though the owner's LAN DNS is at fault.\n\nR-274 \u2014 a local golden is adopted with no version and no sha check; the manifest\nvouch is consulted only on the fetch path. demo-hp's local copy is controller\n0.192.0 against a vouched 0.210.0, and below the 0.200.0 where the recovery\nscreen shipped. Not yet observed end-to-end (R-273 killed step 5 first).\n\nAlso: R-275 orphaned credential backups + uid reuse, R-276 the wg tunnel outlives\nthe uninstall, R-269/270/271 from the token rotation, R-277 three hub surfaces\nmisreport a healthy off-site tier, R-278 demo-felhom six days unprotected,\nR-279 no operator-triggerable off-site run.\n\nTwo hypotheses of mine were tested and REFUTED rather than shipped as findings:\nthe leftover sudoers file is inert (sudo skips dotted filenames), and demo-hp's\noff-site tier was healthy all along - I had misread the hub and said so.\n\nSTATUS.md records the three rulings \u00a78.3 asked for, with the floor CORRECTED to\nits live value 0.200.0 and the count corrected to twenty.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "b1afbb8a4d6c06e782da726785502323e4c163bb:documentation/audits/evidence-rehearsal-2026-08-09/P1-demo-hp-after.txt:generic-api-key:121"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 194,
|
||||
"EndLine": 194,
|
||||
"StartColumn": 11,
|
||||
"EndColumn": 59,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/audits/evidence-rehearsal-2026-08-09/GATE0-demo-hp-before.txt",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "34646295dc27cf1b720ffea2bada87332aa8778b",
|
||||
"Entropy": 4.851366,
|
||||
"Date": "2026-08-09T08:34:57Z",
|
||||
"Message": "Rehearsal 2026-08-09: pre-phase + Gate 0 recorded before the destructive walk\n\nVenue demo-hp, operator-approved at STOP 1. Records the state that P1 destroys,\nplus seven pre-walk findings, while they can still be checked against a live box.\n\nR-268 CLOSED \u2014 the leaked per-guest local-API token is rotated and the rotation\nis PROVEN in both directions (old refused, new accepted, channel up with a\npositive observable). Rotating it surfaced three defects:\n\n- an out-of-process rotation does NOT revoke the old token. The daemon serves\n Lookup from a stale index and re-reads only on a MISS, so a superseded token\n is a direct hit. Red-proved in a unit probe AND live on hardware; the shipped\n RemintCoherence test passes only because it looks up the NEW token first.\n- R-268's own recipe is incomplete: ensureLocalAPI returns early on a present\n local_api block, so writing bootstrap.json is not enough \u2014 the controller\n serves the old token from controller.yaml across restarts.\n- the agent-channel alarm never closes: the UP branch does not notify from an\n unseeded state, and the alarm's own remedy (\"re-bootstrap\") resets it.\n\nGate 0 complete: dataset planted in the Calibre library (coverage verified, not\nassumed) with two Hungarian accented filenames; the comparator watched FAILING\nthree ways including an NFC->NFD rename that renders identically; off-site run\ndriven through the product's own button; restore point recorded by identity as\nsnapshot 41c830db, confirmed to carry all four files.\n\nAlso corrects the record: demo-hp's off-site tier is HEALTHY. Three hub surfaces\nagreed it was absent and all three mislead \u2014 the panel showing 0 snapshots renders\nthe LOCAL tier, 162 KB rounds to 0.0 GB, and a two-day-old stuck event reads as\ncurrent. And the managed-update floor is live at 0.200.0, not 0.156.0.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "34646295dc27cf1b720ffea2bada87332aa8778b:documentation/audits/evidence-rehearsal-2026-08-09/GATE0-demo-hp-before.txt:generic-api-key:194"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 366,
|
||||
"EndLine": 366,
|
||||
"StartColumn": 21,
|
||||
"EndColumn": 108,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/tests/walk5-r201-2026-08-07/journal.md",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "879007aaecea5b8123a3c6d0344063de16788535",
|
||||
"Entropy": 3.8865879,
|
||||
"Date": "2026-08-07T13:05:35Z",
|
||||
"Message": "walk5 (R-201, fifth walk): Phase A journal \u2014 fixture built, sentinels proved by name\n\nWritten before the destruction, per \u00a79.9. A fresh install landed on the VOUCHED\nset with no hand upgrade (controller 0.206.0, agent 0.127.0) \u2014 R-239's delivery\ngap is closed for this run, which is the first of the five walks where the box\nunder test is the box a customer receives.\n\nBoth \u00a74.6 pre-destruction checks pass, neither previously exercised on a clean\nbox: the recovery offer is correctly SILENT (shape (c) compares equal \u2014 the two\nkey hashes are byte-identical on box and hub), and the restore page lists the app\nwith the future-backup toggle OFF (R-237's fix, which the last walk measured\nfailing).\n\nAlso recorded: the \u00a74.5 gate caught a harness fault (a toggle sent as enabled=1\nrather than enabled=on) that had produced a green 'ok' over a zero-snapshot\nrepository \u2014 the exact shape the gate exists for.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "879007aaecea5b8123a3c6d0344063de16788535:documentation/tests/walk5-r201-2026-08-07/journal.md:generic-api-key:366"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 367,
|
||||
"EndLine": 367,
|
||||
"StartColumn": 8,
|
||||
"EndColumn": 107,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/tests/walk5-r201-2026-08-07/journal.md",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "879007aaecea5b8123a3c6d0344063de16788535",
|
||||
"Entropy": 3.8865879,
|
||||
"Date": "2026-08-07T13:05:35Z",
|
||||
"Message": "walk5 (R-201, fifth walk): Phase A journal \u2014 fixture built, sentinels proved by name\n\nWritten before the destruction, per \u00a79.9. A fresh install landed on the VOUCHED\nset with no hand upgrade (controller 0.206.0, agent 0.127.0) \u2014 R-239's delivery\ngap is closed for this run, which is the first of the five walks where the box\nunder test is the box a customer receives.\n\nBoth \u00a74.6 pre-destruction checks pass, neither previously exercised on a clean\nbox: the recovery offer is correctly SILENT (shape (c) compares equal \u2014 the two\nkey hashes are byte-identical on box and hub), and the restore page lists the app\nwith the future-backup toggle OFF (R-237's fix, which the last walk measured\nfailing).\n\nAlso recorded: the \u00a74.5 gate caught a harness fault (a toggle sent as enabled=1\nrather than enabled=on) that had produced a green 'ok' over a zero-snapshot\nrepository \u2014 the exact shape the gate exists for.",
|
||||
"Tags": [],
|
||||
"Fingerprint": "879007aaecea5b8123a3c6d0344063de16788535:documentation/tests/walk5-r201-2026-08-07/journal.md:generic-api-key:367"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 129,
|
||||
"EndLine": 129,
|
||||
"StartColumn": 9,
|
||||
"EndColumn": 52,
|
||||
"Secret": "REDACTED",
|
||||
"File": "hub/internal/web/render_test.go",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "b93dd03f0a613e48422bc0745e4c2731ddbf9412",
|
||||
"Entropy": 3.7487915,
|
||||
"Date": "2026-07-09T06:23:41Z",
|
||||
"Message": "GL-7 Part 1: passphrase hardening on the customer page (security)\n\nThe Setup Command panel rendered the per-customer retrieval passphrase (the\nsecret that fetches the WHOLE config) in cleartext twice \u2014 as #retrieval-pw\ntext and baked into the Option-3 curl's X-Retrieval-Password header \u2014 which\ncontradicts the panel's own \"never on the command line\" guidance. Now:\nthe retrieval password is MASKED by default (bullet run) with Reveal/Hide +\ncopy-secret controls (value lives in data-secret \u2014 the existing reveal\nmodel); the Option-3 debug command carries a <YOUR-RETRIEVAL-PASSWORD>\nplaceholder, never the secret. Render test asserts the secret is not baked\ninto any command + is masked by default; red-proof (bake it back) FAILS.\n(A zero-secret-in-DOM reveal-on-demand fetch is a noted follow-up, not this task.)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6",
|
||||
"Tags": [],
|
||||
"Fingerprint": "b93dd03f0a613e48422bc0745e4c2731ddbf9412:hub/internal/web/render_test.go:generic-api-key:129"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 1,
|
||||
"EndLine": 1,
|
||||
"StartColumn": 36,
|
||||
"EndColumn": 79,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_vaultwarden.json",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49",
|
||||
"Entropy": 4.164498,
|
||||
"Date": "2026-07-07T12:26:52Z",
|
||||
"Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6",
|
||||
"Tags": [],
|
||||
"Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_vaultwarden.json:generic-api-key:1"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 1,
|
||||
"EndLine": 1,
|
||||
"StartColumn": 36,
|
||||
"EndColumn": 75,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_bookstack.json",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49",
|
||||
"Entropy": 4.324863,
|
||||
"Date": "2026-07-07T12:26:52Z",
|
||||
"Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6",
|
||||
"Tags": [],
|
||||
"Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_bookstack.json:generic-api-key:1"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 1,
|
||||
"EndLine": 1,
|
||||
"StartColumn": 79,
|
||||
"EndColumn": 122,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_bookstack.json",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49",
|
||||
"Entropy": 4.324863,
|
||||
"Date": "2026-07-07T12:26:52Z",
|
||||
"Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6",
|
||||
"Tags": [],
|
||||
"Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_bookstack.json:generic-api-key:1"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 1,
|
||||
"EndLine": 1,
|
||||
"StartColumn": 35,
|
||||
"EndColumn": 78,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49",
|
||||
"Entropy": 4.235926,
|
||||
"Date": "2026-07-07T12:26:52Z",
|
||||
"Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6",
|
||||
"Tags": [],
|
||||
"Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json:generic-api-key:1"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 1,
|
||||
"EndLine": 1,
|
||||
"StartColumn": 82,
|
||||
"EndColumn": 134,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49",
|
||||
"Entropy": 4.235926,
|
||||
"Date": "2026-07-07T12:26:52Z",
|
||||
"Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6",
|
||||
"Tags": [],
|
||||
"Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json:generic-api-key:1"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 1,
|
||||
"EndLine": 1,
|
||||
"StartColumn": 138,
|
||||
"EndColumn": 194,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49",
|
||||
"Entropy": 4.235926,
|
||||
"Date": "2026-07-07T12:26:52Z",
|
||||
"Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6",
|
||||
"Tags": [],
|
||||
"Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json:generic-api-key:1"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 28,
|
||||
"EndLine": 28,
|
||||
"StartColumn": 119,
|
||||
"EndColumn": 162,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49",
|
||||
"Entropy": 4.164498,
|
||||
"Date": "2026-07-07T12:26:52Z",
|
||||
"Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6",
|
||||
"Tags": [],
|
||||
"Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:28"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 37,
|
||||
"EndLine": 37,
|
||||
"StartColumn": 120,
|
||||
"EndColumn": 163,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49",
|
||||
"Entropy": 4.2803946,
|
||||
"Date": "2026-07-07T12:26:52Z",
|
||||
"Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6",
|
||||
"Tags": [],
|
||||
"Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:37"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 37,
|
||||
"EndLine": 37,
|
||||
"StartColumn": 167,
|
||||
"EndColumn": 205,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49",
|
||||
"Entropy": 3.640224,
|
||||
"Date": "2026-07-07T12:26:52Z",
|
||||
"Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6",
|
||||
"Tags": [],
|
||||
"Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:37"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 43,
|
||||
"EndLine": 43,
|
||||
"StartColumn": 117,
|
||||
"EndColumn": 156,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49",
|
||||
"Entropy": 4.324863,
|
||||
"Date": "2026-07-07T12:26:52Z",
|
||||
"Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6",
|
||||
"Tags": [],
|
||||
"Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:43"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 43,
|
||||
"EndLine": 43,
|
||||
"StartColumn": 160,
|
||||
"EndColumn": 201,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49",
|
||||
"Entropy": 4.3285995,
|
||||
"Date": "2026-07-07T12:26:52Z",
|
||||
"Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6",
|
||||
"Tags": [],
|
||||
"Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:43"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 79,
|
||||
"EndLine": 79,
|
||||
"StartColumn": 120,
|
||||
"EndColumn": 163,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49",
|
||||
"Entropy": 4.235926,
|
||||
"Date": "2026-07-07T12:26:52Z",
|
||||
"Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6",
|
||||
"Tags": [],
|
||||
"Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:79"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 79,
|
||||
"EndLine": 79,
|
||||
"StartColumn": 167,
|
||||
"EndColumn": 205,
|
||||
"Secret": "REDACTED",
|
||||
"File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49",
|
||||
"Entropy": 3.589898,
|
||||
"Date": "2026-07-07T12:26:52Z",
|
||||
"Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6",
|
||||
"Tags": [],
|
||||
"Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:79"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 88,
|
||||
"EndLine": 88,
|
||||
"StartColumn": 8,
|
||||
"EndColumn": 56,
|
||||
"Secret": "REDACTED",
|
||||
"File": "manifests/hub.yaml",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "0fcc7d8e6f97f68600842aa9483d1152efb633c8",
|
||||
"Entropy": 3.7495818,
|
||||
"Date": "2026-02-20T13:03:39Z",
|
||||
"Message": "docs: add hub CHANGELOG.md, update ConfigMap with registry section\n\n- hub/CHANGELOG.md: new file with v0.2.0 and prior version history\n- manifests/hub.yaml: add registry config (version checker + template fetcher),\n pin image to v0.2.0, remove stale /healthz TODO comment\n\nCo-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>",
|
||||
"Tags": [],
|
||||
"Fingerprint": "0fcc7d8e6f97f68600842aa9483d1152efb633c8:manifests/hub.yaml:generic-api-key:88"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 84,
|
||||
"EndLine": 84,
|
||||
"StartColumn": 8,
|
||||
"EndColumn": 61,
|
||||
"Secret": "REDACTED",
|
||||
"File": "manifests/hub.yaml",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "c9abc6bb9e56291603c7a27f3060d8288e5bac97",
|
||||
"Entropy": 4.572431,
|
||||
"Date": "2026-02-16T18:45:09Z",
|
||||
"Message": "added resend api key",
|
||||
"Tags": [],
|
||||
"Fingerprint": "c9abc6bb9e56291603c7a27f3060d8288e5bac97:manifests/hub.yaml:generic-api-key:84"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 10,
|
||||
"EndLine": 10,
|
||||
"StartColumn": 4,
|
||||
"EndColumn": 84,
|
||||
"Secret": "REDACTED",
|
||||
"File": "manifests/felhom.secret.yaml",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141",
|
||||
"Entropy": 5.356988,
|
||||
"Date": "2026-02-11T07:50:08Z",
|
||||
"Message": "initial move to gitea",
|
||||
"Tags": [],
|
||||
"Fingerprint": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141:manifests/felhom.secret.yaml:generic-api-key:10"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 20,
|
||||
"EndLine": 20,
|
||||
"StartColumn": 4,
|
||||
"EndColumn": 62,
|
||||
"Secret": "REDACTED",
|
||||
"File": "manifests/felhom.secret.yaml",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141",
|
||||
"Entropy": 4.572431,
|
||||
"Date": "2026-02-11T07:50:08Z",
|
||||
"Message": "initial move to gitea",
|
||||
"Tags": [],
|
||||
"Fingerprint": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141:manifests/felhom.secret.yaml:generic-api-key:20"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 32,
|
||||
"EndLine": 32,
|
||||
"StartColumn": 4,
|
||||
"EndColumn": 57,
|
||||
"Secret": "REDACTED",
|
||||
"File": "manifests/felhom.secret.yaml",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141",
|
||||
"Entropy": 4.572431,
|
||||
"Date": "2026-02-11T07:50:08Z",
|
||||
"Message": "initial move to gitea",
|
||||
"Tags": [],
|
||||
"Fingerprint": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141:manifests/felhom.secret.yaml:generic-api-key:32"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 41,
|
||||
"EndLine": 41,
|
||||
"StartColumn": 4,
|
||||
"EndColumn": 81,
|
||||
"Secret": "REDACTED",
|
||||
"File": "manifests/felhom.secret.yaml",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141",
|
||||
"Entropy": 3.8505487,
|
||||
"Date": "2026-02-11T07:50:08Z",
|
||||
"Message": "initial move to gitea",
|
||||
"Tags": [],
|
||||
"Fingerprint": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141:manifests/felhom.secret.yaml:generic-api-key:41"
|
||||
},
|
||||
{
|
||||
"RuleID": "generic-api-key",
|
||||
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
|
||||
"StartLine": 42,
|
||||
"EndLine": 42,
|
||||
"StartColumn": 4,
|
||||
"EndColumn": 56,
|
||||
"Secret": "REDACTED",
|
||||
"File": "manifests/felhom.secret.yaml",
|
||||
"SymlinkFile": "",
|
||||
"Commit": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141",
|
||||
"Entropy": 3.628928,
|
||||
"Date": "2026-02-11T07:50:08Z",
|
||||
"Message": "initial move to gitea",
|
||||
"Tags": [],
|
||||
"Fingerprint": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141:manifests/felhom.secret.yaml:generic-api-key:42"
|
||||
}
|
||||
]
|
||||
}
|
||||
+4
@@ -0,0 +1,4 @@
|
||||
{
|
||||
"note": "homelab-manifests is a PRIVATE repo (anonymous 404); its 17 hit locations are kept off-git on DooPlex: /mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/",
|
||||
"hits": 17
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
+7532
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
+327
@@ -0,0 +1,327 @@
|
||||
=== Symbol Results ===
|
||||
|
||||
Vulnerability #1: GO-2026-6617
|
||||
HTTP/2 server crash due to HPACK encoder race in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6617
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.CanonicalHeaderKey
|
||||
#2: http.CanonicalHeaderKey
|
||||
#3: http.Client.Do
|
||||
#4: http.Client.Do
|
||||
#5: http.Cookie.String
|
||||
Use '-show traces' to see the other 267 found symbols
|
||||
|
||||
Vulnerability #2: GO-2026-6613
|
||||
HTTP/1 server connection desynchronization after 2xx CONNECT response in
|
||||
net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6613
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.CanonicalHeaderKey
|
||||
#2: http.Client.Do
|
||||
#3: http.Cookie.String
|
||||
#4: http.Error
|
||||
#5: http.HandlerFunc.ServeHTTP
|
||||
Use '-show traces' to see the other 66 found symbols
|
||||
|
||||
Vulnerability #3: GO-2026-6612
|
||||
Double flow control refund on HTTP/2 server streams in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6612
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.CanonicalHeaderKey
|
||||
#2: http.CanonicalHeaderKey
|
||||
#3: http.Client.Do
|
||||
#4: http.Client.Do
|
||||
#5: http.Cookie.String
|
||||
Use '-show traces' to see the other 267 found symbols
|
||||
|
||||
Vulnerability #4: GO-2026-6611
|
||||
Excessive CPU consumption from repeated initial window changes in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6611
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.CanonicalHeaderKey
|
||||
#2: http.CanonicalHeaderKey
|
||||
#3: http.Client.Do
|
||||
#4: http.Client.Do
|
||||
#5: http.Cookie.String
|
||||
Use '-show traces' to see the other 271 found symbols
|
||||
|
||||
Vulnerability #5: GO-2026-6610
|
||||
HTTP/2 transport accepts malformed framing-related headers in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6610
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.Client.Do
|
||||
#2: http.Client.Do
|
||||
#3: http.Transport.RoundTrip
|
||||
#4: http.Transport.RoundTrip
|
||||
#5: http.http2Transport.NewClientConn
|
||||
Use '-show traces' to see the other 15 found symbols
|
||||
|
||||
Vulnerability #6: GO-2026-6608
|
||||
Memory limit bypass when parsing MIME headers in net/textproto,
|
||||
mime/multipart
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6608
|
||||
Standard library
|
||||
Found in: net/textproto@go1.26
|
||||
Fixed in: net/textproto@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: textproto.Reader.ReadMIMEHeader
|
||||
|
||||
Vulnerability #7: GO-2026-6607
|
||||
Reject malformed ECH outer extension references in crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6607
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.26
|
||||
Fixed in: crypto/tls@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: tls.Conn.Handshake
|
||||
#2: tls.Conn.HandshakeContext
|
||||
#3: tls.Conn.Read
|
||||
#4: tls.Conn.Write
|
||||
#5: tls.Dialer.DialContext
|
||||
|
||||
Vulnerability #8: GO-2026-6605
|
||||
HTTP/1 client connection desynchronization after CONNECT rejection in
|
||||
net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6605
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.Client.Do
|
||||
#2: http.Transport.RoundTrip
|
||||
|
||||
Vulnerability #9: GO-2026-6603
|
||||
HTTP/2 server memory exhaustion due to Trailer headers in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6603
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.CanonicalHeaderKey
|
||||
#2: http.CanonicalHeaderKey
|
||||
#3: http.Client.Do
|
||||
#4: http.Client.Do
|
||||
#5: http.Cookie.String
|
||||
Use '-show traces' to see the other 267 found symbols
|
||||
|
||||
Vulnerability #10: GO-2026-6218
|
||||
Avoid quadratic complexity in resolvePath in net/url
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6218
|
||||
Standard library
|
||||
Found in: net/url@go1.26
|
||||
Fixed in: net/url@go1.26.6
|
||||
Vulnerable symbols found:
|
||||
#1: url.URL.Parse
|
||||
#2: url.URL.ResolveReference
|
||||
|
||||
Vulnerability #11: GO-2026-6090
|
||||
Limit handshake messages we are willing to accept post-handshake in
|
||||
crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6090
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.26
|
||||
Fixed in: crypto/tls@go1.26.6
|
||||
Vulnerable symbols found:
|
||||
#1: tls.Conn.Handshake
|
||||
#2: tls.Conn.HandshakeContext
|
||||
#3: tls.Conn.Read
|
||||
#4: tls.Conn.Write
|
||||
#5: tls.Dialer.DialContext
|
||||
|
||||
Vulnerability #12: GO-2026-6089
|
||||
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6089
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.6
|
||||
Vulnerable symbols found:
|
||||
#1: http.Server.Serve
|
||||
#2: http.Server.ServeTLS
|
||||
|
||||
Vulnerability #13: GO-2026-5972
|
||||
Enforce maximum recursion depth in encoding/asn1
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5972
|
||||
Standard library
|
||||
Found in: encoding/asn1@go1.26
|
||||
Fixed in: encoding/asn1@go1.26.6
|
||||
Vulnerable symbols found:
|
||||
#1: asn1.Unmarshal
|
||||
#2: asn1.UnmarshalWithParams
|
||||
|
||||
Vulnerability #14: GO-2026-5856
|
||||
Invoking Encrypted Client Hello privacy leak in crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5856
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.26
|
||||
Fixed in: crypto/tls@go1.26.5
|
||||
Vulnerable symbols found:
|
||||
#1: tls.Conn.Handshake
|
||||
#2: tls.Conn.HandshakeContext
|
||||
#3: tls.Conn.Read
|
||||
#4: tls.Conn.Write
|
||||
#5: tls.Dialer.DialContext
|
||||
|
||||
Vulnerability #15: GO-2026-5039
|
||||
Arbitrary inputs are included in errors without any escaping in
|
||||
net/textproto
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5039
|
||||
Standard library
|
||||
Found in: net/textproto@go1.26
|
||||
Fixed in: net/textproto@go1.26.4
|
||||
Vulnerable symbols found:
|
||||
#1: textproto.Reader.ReadMIMEHeader
|
||||
|
||||
Vulnerability #16: GO-2026-5037
|
||||
Inefficient candidate hostname parsing in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5037
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.26
|
||||
Fixed in: crypto/x509@go1.26.4
|
||||
Vulnerable symbols found:
|
||||
#1: x509.Certificate.Verify
|
||||
#2: x509.Certificate.VerifyHostname
|
||||
#3: x509.HostnameError.Error
|
||||
|
||||
Vulnerability #17: GO-2026-5026
|
||||
Invoking failure to reject ASCII-only Punycode-encoded labels in
|
||||
golang.org/x/net/idna
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5026
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.6
|
||||
Vulnerable symbols found:
|
||||
#1: http.Client.Do
|
||||
#2: http.Transport.RoundTrip
|
||||
#3: http.http2ClientConn.RoundTrip
|
||||
|
||||
Vulnerability #18: GO-2026-4971
|
||||
Panic in Dial and LookupPort when handling NUL byte on Windows in net
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4971
|
||||
Standard library
|
||||
Found in: net@go1.26
|
||||
Fixed in: net@go1.26.3
|
||||
Vulnerable symbols found:
|
||||
#1: net.DialTimeout
|
||||
#2: net.Dialer.Dial
|
||||
#3: net.Dialer.DialContext
|
||||
#4: net.Listen
|
||||
#5: net.ListenConfig.Listen
|
||||
Use '-show traces' to see the other 4 found symbols
|
||||
|
||||
Vulnerability #19: GO-2026-4947
|
||||
Unexpected work during chain building in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4947
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.26
|
||||
Fixed in: crypto/x509@go1.26.2
|
||||
Vulnerable symbols found:
|
||||
#1: x509.Certificate.Verify
|
||||
|
||||
Vulnerability #20: GO-2026-4946
|
||||
Inefficient policy validation in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4946
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.26
|
||||
Fixed in: crypto/x509@go1.26.2
|
||||
Vulnerable symbols found:
|
||||
#1: x509.Certificate.Verify
|
||||
|
||||
Vulnerability #21: GO-2026-4918
|
||||
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in
|
||||
net/http/internal/http2 in golang.org/x/net
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4918
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.3
|
||||
Vulnerable symbols found:
|
||||
#1: http.Client.Do
|
||||
#2: http.Transport.RoundTrip
|
||||
#3: http.http2Transport.NewClientConn
|
||||
#4: http.http2Transport.RoundTrip
|
||||
#5: http.http2Transport.RoundTripOpt
|
||||
Use '-show traces' to see the other 5 found symbols
|
||||
|
||||
Vulnerability #22: GO-2026-4870
|
||||
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection
|
||||
retention and DoS in crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4870
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.26
|
||||
Fixed in: crypto/tls@go1.26.2
|
||||
Vulnerable symbols found:
|
||||
#1: tls.Conn.Handshake
|
||||
#2: tls.Conn.HandshakeContext
|
||||
#3: tls.Conn.Read
|
||||
#4: tls.Conn.Write
|
||||
#5: tls.Dialer.DialContext
|
||||
|
||||
Vulnerability #23: GO-2026-4866
|
||||
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in
|
||||
crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4866
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.26
|
||||
Fixed in: crypto/x509@go1.26.2
|
||||
Vulnerable symbols found:
|
||||
#1: x509.Certificate.Verify
|
||||
|
||||
Vulnerability #24: GO-2026-4602
|
||||
FileInfo can escape from a Root in os
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4602
|
||||
Standard library
|
||||
Found in: os@go1.26
|
||||
Fixed in: os@go1.26.1
|
||||
Vulnerable symbols found:
|
||||
#1: os.File.ReadDir
|
||||
#2: os.ReadDir
|
||||
|
||||
Vulnerability #25: GO-2026-4601
|
||||
Incorrect parsing of IPv6 host literals in net/url
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4601
|
||||
Standard library
|
||||
Found in: net/url@go1.26
|
||||
Fixed in: net/url@go1.26.1
|
||||
Vulnerable symbols found:
|
||||
#1: url.Parse
|
||||
#2: url.ParseRequestURI
|
||||
#3: url.URL.Parse
|
||||
#4: url.URL.UnmarshalBinary
|
||||
|
||||
Vulnerability #26: GO-2026-4600
|
||||
Panic in name constraint checking for malformed certificates in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4600
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.26
|
||||
Fixed in: crypto/x509@go1.26.1
|
||||
Vulnerable symbols found:
|
||||
#1: x509.Certificate.Verify
|
||||
|
||||
Vulnerability #27: GO-2026-4599
|
||||
Incorrect enforcement of email constraints in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4599
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.26
|
||||
Fixed in: crypto/x509@go1.26.1
|
||||
Vulnerable symbols found:
|
||||
#1: x509.Certificate.Verify
|
||||
|
||||
Your code is affected by 27 vulnerabilities from the Go standard library.
|
||||
This scan also found 9 vulnerabilities in packages you import and 13
|
||||
vulnerabilities in modules you require, but your code doesn't appear to call
|
||||
these vulnerabilities.
|
||||
Use '-show verbose' for more details.
|
||||
+840
@@ -0,0 +1,840 @@
|
||||
=== Symbol Results ===
|
||||
|
||||
Vulnerability #1: GO-2026-6617
|
||||
HTTP/2 server crash due to HPACK encoder race in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6617
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.CanonicalHeaderKey
|
||||
#2: http.CanonicalHeaderKey
|
||||
#3: http.CanonicalHeaderKey
|
||||
#4: http.CanonicalHeaderKey
|
||||
#5: http.CanonicalHeaderKey
|
||||
Use '-show traces' to see the other 3999 found symbols
|
||||
|
||||
Vulnerability #2: GO-2026-6613
|
||||
HTTP/1 server connection desynchronization after 2xx CONNECT response in
|
||||
net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6613
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.CanonicalHeaderKey
|
||||
#2: http.CanonicalHeaderKey
|
||||
#3: http.CanonicalHeaderKey
|
||||
#4: http.CanonicalHeaderKey
|
||||
#5: http.CanonicalHeaderKey
|
||||
Use '-show traces' to see the other 1388 found symbols
|
||||
|
||||
Vulnerability #3: GO-2026-6612
|
||||
Double flow control refund on HTTP/2 server streams in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6612
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.CanonicalHeaderKey
|
||||
#2: http.CanonicalHeaderKey
|
||||
#3: http.CanonicalHeaderKey
|
||||
#4: http.CanonicalHeaderKey
|
||||
#5: http.CanonicalHeaderKey
|
||||
Use '-show traces' to see the other 3999 found symbols
|
||||
|
||||
Vulnerability #4: GO-2026-6611
|
||||
Excessive CPU consumption from repeated initial window changes in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6611
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.CanonicalHeaderKey
|
||||
#2: http.CanonicalHeaderKey
|
||||
#3: http.CanonicalHeaderKey
|
||||
#4: http.CanonicalHeaderKey
|
||||
#5: http.CanonicalHeaderKey
|
||||
Use '-show traces' to see the other 4019 found symbols
|
||||
|
||||
Vulnerability #5: GO-2026-6610
|
||||
HTTP/2 transport accepts malformed framing-related headers in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6610
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.Client.CloseIdleConnections
|
||||
#2: http.Client.CloseIdleConnections
|
||||
#3: http.Client.CloseIdleConnections
|
||||
#4: http.Client.CloseIdleConnections
|
||||
#5: http.Client.CloseIdleConnections
|
||||
Use '-show traces' to see the other 647 found symbols
|
||||
|
||||
Vulnerability #6: GO-2026-6609
|
||||
Lack of limit on size of parsed Range headers in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6609
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.ServeContent
|
||||
#2: http.ServeContent
|
||||
#3: http.ServeContent
|
||||
#4: http.ServeContent
|
||||
#5: http.ServeContent
|
||||
Use '-show traces' to see the other 45 found symbols
|
||||
|
||||
Vulnerability #7: GO-2026-6608
|
||||
Memory limit bypass when parsing MIME headers in net/textproto,
|
||||
mime/multipart
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6608
|
||||
Standard library
|
||||
Found in: mime/multipart@go1.24.13
|
||||
Fixed in: mime/multipart@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: multipart.Reader.NextPart
|
||||
#2: multipart.Reader.NextRawPart
|
||||
#3: multipart.Reader.ReadForm
|
||||
#4: textproto.Reader.ReadContinuedLine
|
||||
#5: textproto.Reader.ReadContinuedLineBytes
|
||||
Use '-show traces' to see the other 2 found symbols
|
||||
|
||||
Vulnerability #8: GO-2026-6607
|
||||
Reject malformed ECH outer extension references in crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6607
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.24.13
|
||||
Fixed in: crypto/tls@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: tls.Conn.Handshake
|
||||
#2: tls.Conn.Handshake
|
||||
#3: tls.Conn.Handshake
|
||||
#4: tls.Conn.Handshake
|
||||
#5: tls.Conn.HandshakeContext
|
||||
Use '-show traces' to see the other 31 found symbols
|
||||
|
||||
Vulnerability #9: GO-2026-6605
|
||||
HTTP/1 client connection desynchronization after CONNECT rejection in
|
||||
net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6605
|
||||
Standard library
|
||||
Found in: net/http/httputil@go1.24.13
|
||||
Fixed in: net/http/httputil@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.Client.CloseIdleConnections
|
||||
#2: http.Client.CloseIdleConnections
|
||||
#3: http.Client.CloseIdleConnections
|
||||
#4: http.Client.CloseIdleConnections
|
||||
#5: http.Client.CloseIdleConnections
|
||||
Use '-show traces' to see the other 236 found symbols
|
||||
|
||||
Vulnerability #10: GO-2026-6603
|
||||
HTTP/2 server memory exhaustion due to Trailer headers in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6603
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.CanonicalHeaderKey
|
||||
#2: http.CanonicalHeaderKey
|
||||
#3: http.CanonicalHeaderKey
|
||||
#4: http.CanonicalHeaderKey
|
||||
#5: http.CanonicalHeaderKey
|
||||
Use '-show traces' to see the other 3999 found symbols
|
||||
|
||||
Vulnerability #11: GO-2026-6600
|
||||
Recognize yield as regexp preceder keyword in html/template
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6600
|
||||
Standard library
|
||||
Found in: html/template@go1.24.13
|
||||
Fixed in: html/template@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: template.Template.Execute
|
||||
#2: template.Template.Execute
|
||||
#3: template.Template.Execute
|
||||
#4: template.Template.Execute
|
||||
#5: template.Template.Execute
|
||||
Use '-show traces' to see the other 9 found symbols
|
||||
|
||||
Vulnerability #12: GO-2026-6599
|
||||
Reset context tracking on consecutive template expressions in html/template
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6599
|
||||
Standard library
|
||||
Found in: html/template@go1.24.13
|
||||
Fixed in: html/template@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: template.Template.Execute
|
||||
#2: template.Template.Execute
|
||||
#3: template.Template.Execute
|
||||
#4: template.Template.Execute
|
||||
#5: template.Template.Execute
|
||||
Use '-show traces' to see the other 9 found symbols
|
||||
|
||||
Vulnerability #13: GO-2026-6355
|
||||
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6355
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.56.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.Dial
|
||||
#2: ssh.Dial
|
||||
#3: ssh.Dial
|
||||
#4: ssh.Dial
|
||||
#5: ssh.Dial
|
||||
Use '-show traces' to see the other 25 found symbols
|
||||
|
||||
Vulnerability #14: GO-2026-6354
|
||||
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6354
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.56.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.Dial
|
||||
#2: ssh.Dial
|
||||
#3: ssh.Dial
|
||||
#4: ssh.Dial
|
||||
#5: ssh.Dial
|
||||
Use '-show traces' to see the other 27 found symbols
|
||||
|
||||
Vulnerability #15: GO-2026-6303
|
||||
Source-address critical option not enforced for non-public-key auth
|
||||
callbacks in golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6303
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.55.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.NewServerConn
|
||||
#2: ssh.NewServerConn
|
||||
#3: ssh.NewServerConn
|
||||
#4: ssh.NewServerConn
|
||||
#5: ssh.NewServerConn
|
||||
Use '-show traces' to see the other 7 found symbols
|
||||
|
||||
Vulnerability #16: GO-2026-6218
|
||||
Avoid quadratic complexity in resolvePath in net/url
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6218
|
||||
Standard library
|
||||
Found in: net/url@go1.24.13
|
||||
Fixed in: net/url@go1.25.13
|
||||
Vulnerable symbols found:
|
||||
#1: url.URL.Parse
|
||||
#2: url.URL.Parse
|
||||
#3: url.URL.ResolveReference
|
||||
|
||||
Vulnerability #17: GO-2026-6091
|
||||
Fix Javascript regexp context tracking in html/template
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6091
|
||||
Standard library
|
||||
Found in: html/template@go1.24.13
|
||||
Fixed in: html/template@go1.25.13
|
||||
Vulnerable symbols found:
|
||||
#1: template.Template.Execute
|
||||
#2: template.Template.Execute
|
||||
#3: template.Template.Execute
|
||||
#4: template.Template.Execute
|
||||
#5: template.Template.Execute
|
||||
Use '-show traces' to see the other 9 found symbols
|
||||
|
||||
Vulnerability #18: GO-2026-6090
|
||||
Limit handshake messages we are willing to accept post-handshake in
|
||||
crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6090
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.24.13
|
||||
Fixed in: crypto/tls@go1.25.13
|
||||
Vulnerable symbols found:
|
||||
#1: tls.Conn.Handshake
|
||||
#2: tls.Conn.Handshake
|
||||
#3: tls.Conn.Handshake
|
||||
#4: tls.Conn.Handshake
|
||||
#5: tls.Conn.HandshakeContext
|
||||
Use '-show traces' to see the other 34 found symbols
|
||||
|
||||
Vulnerability #19: GO-2026-6089
|
||||
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6089
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.25.13
|
||||
Vulnerable symbols found:
|
||||
#1: http.ListenAndServe
|
||||
#2: http.ListenAndServe
|
||||
#3: http.ListenAndServe
|
||||
#4: http.ListenAndServe
|
||||
#5: http.ListenAndServe
|
||||
Use '-show traces' to see the other 75 found symbols
|
||||
|
||||
Vulnerability #20: GO-2026-6088
|
||||
Add recursion depth guard during decode in encoding/xml
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6088
|
||||
Standard library
|
||||
Found in: encoding/xml@go1.24.13
|
||||
Fixed in: encoding/xml@go1.25.13
|
||||
Vulnerable symbols found:
|
||||
#1: xml.Decoder.Decode
|
||||
#2: xml.Decoder.DecodeElement
|
||||
#3: xml.Decoder.RawToken
|
||||
#4: xml.Decoder.Skip
|
||||
#5: xml.Decoder.Token
|
||||
Use '-show traces' to see the other 1 found symbols
|
||||
|
||||
Vulnerability #21: GO-2026-5972
|
||||
Enforce maximum recursion depth in encoding/asn1
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5972
|
||||
Standard library
|
||||
Found in: encoding/asn1@go1.24.13
|
||||
Fixed in: encoding/asn1@go1.25.13
|
||||
Vulnerable symbols found:
|
||||
#1: asn1.Unmarshal
|
||||
#2: asn1.UnmarshalWithParams
|
||||
|
||||
Vulnerability #22: GO-2026-5932
|
||||
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design,
|
||||
and has known security issues
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5932
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: N/A
|
||||
Vulnerable symbols found:
|
||||
#1: armor.golang.org/x/crypto/openpgp/armor/*
|
||||
#2: clearsign.golang.org/x/crypto/openpgp/clearsign/*
|
||||
#3: elgamal.golang.org/x/crypto/openpgp/elgamal/*
|
||||
#4: errors.golang.org/x/crypto/openpgp/errors/*
|
||||
#5: openpgp.golang.org/x/crypto/openpgp/*
|
||||
Use '-show traces' to see the other 2 found symbols
|
||||
|
||||
Vulnerability #23: GO-2026-5856
|
||||
Invoking Encrypted Client Hello privacy leak in crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5856
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.24.13
|
||||
Fixed in: crypto/tls@go1.25.12
|
||||
Vulnerable symbols found:
|
||||
#1: tls.Conn.Handshake
|
||||
#2: tls.Conn.Handshake
|
||||
#3: tls.Conn.Handshake
|
||||
#4: tls.Conn.Handshake
|
||||
#5: tls.Conn.HandshakeContext
|
||||
Use '-show traces' to see the other 35 found symbols
|
||||
|
||||
Vulnerability #24: GO-2026-5039
|
||||
Arbitrary inputs are included in errors without any escaping in
|
||||
net/textproto
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5039
|
||||
Standard library
|
||||
Found in: net/textproto@go1.24.13
|
||||
Fixed in: net/textproto@go1.25.11
|
||||
Vulnerable symbols found:
|
||||
#1: textproto.Error.Error
|
||||
#2: textproto.Reader.ReadCodeLine
|
||||
#3: textproto.Reader.ReadMIMEHeader
|
||||
#4: textproto.Reader.ReadMIMEHeader
|
||||
#5: textproto.Reader.ReadResponse
|
||||
|
||||
Vulnerability #25: GO-2026-5038
|
||||
Quadratic complexity in WordDecoder.DecodeHeader in mime
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5038
|
||||
Standard library
|
||||
Found in: mime@go1.24.13
|
||||
Fixed in: mime@go1.25.11
|
||||
Vulnerable symbols found:
|
||||
#1: mime.WordDecoder.DecodeHeader
|
||||
|
||||
Vulnerability #26: GO-2026-5037
|
||||
Inefficient candidate hostname parsing in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5037
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.24.13
|
||||
Fixed in: crypto/x509@go1.25.11
|
||||
Vulnerable symbols found:
|
||||
#1: x509.Certificate.Verify
|
||||
#2: x509.Certificate.Verify
|
||||
#3: x509.Certificate.Verify
|
||||
#4: x509.Certificate.VerifyHostname
|
||||
#5: x509.HostnameError.Error
|
||||
|
||||
Vulnerability #27: GO-2026-5033
|
||||
Invoking pathological inputs can lead to client panic in
|
||||
golang.org/x/crypto/ssh/agent
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5033
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: agent.ForwardToAgent
|
||||
#2: agent.ForwardToAgent
|
||||
#3: agent.ServeAgent
|
||||
#4: agent.ServeAgent
|
||||
|
||||
Vulnerability #28: GO-2026-5026
|
||||
Invoking failure to reject ASCII-only Punycode-encoded labels in
|
||||
golang.org/x/net/idna
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5026
|
||||
Standard library
|
||||
Found in: net/http/internal/http2@go1.24.13
|
||||
Fixed in: net/http/internal/http2@go1.25.13
|
||||
Vulnerable symbols found:
|
||||
#1: http.Client.CloseIdleConnections
|
||||
#2: http.Client.CloseIdleConnections
|
||||
#3: http.Client.CloseIdleConnections
|
||||
#4: http.Client.CloseIdleConnections
|
||||
#5: http.Client.CloseIdleConnections
|
||||
Use '-show traces' to see the other 248 found symbols
|
||||
|
||||
Vulnerability #29: GO-2026-5023
|
||||
Invoking VerifiedPublicKeyCallback permissions skip enforcement in
|
||||
golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5023
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.NewServerConn
|
||||
#2: ssh.NewServerConn
|
||||
#3: ssh.NewServerConn
|
||||
#4: ssh.NewServerConn
|
||||
#5: ssh.NewServerConn
|
||||
Use '-show traces' to see the other 7 found symbols
|
||||
|
||||
Vulnerability #30: GO-2026-5021
|
||||
Invoking auth bypass via unenforced @revoked status in
|
||||
golang.org/x/crypto/ssh/knownhosts
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5021
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: knownhosts.hostKeyDB.IsRevoked
|
||||
|
||||
Vulnerability #31: GO-2026-5020
|
||||
Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5020
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.Dial
|
||||
#2: ssh.Dial
|
||||
#3: ssh.Dial
|
||||
#4: ssh.Dial
|
||||
#5: ssh.Dial
|
||||
Use '-show traces' to see the other 72 found symbols
|
||||
|
||||
Vulnerability #32: GO-2026-5019
|
||||
Invoking bypass of FIDO/U2F security keys physical interaction in
|
||||
golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5019
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.CertChecker.Authenticate
|
||||
#2: ssh.CertChecker.Authenticate
|
||||
#3: ssh.CertChecker.CheckCert
|
||||
#4: ssh.CertChecker.CheckHostKey
|
||||
#5: ssh.CertChecker.CheckHostKey
|
||||
Use '-show traces' to see the other 31 found symbols
|
||||
|
||||
Vulnerability #33: GO-2026-5018
|
||||
Invoking pathological RSA/DSA parameters may cause DoS in
|
||||
golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5018
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.Dial
|
||||
#2: ssh.Dial
|
||||
#3: ssh.Dial
|
||||
#4: ssh.Dial
|
||||
#5: ssh.Dial
|
||||
Use '-show traces' to see the other 31 found symbols
|
||||
|
||||
Vulnerability #34: GO-2026-5017
|
||||
Invoking client can cause server deadlock on unexpected responses in
|
||||
golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5017
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.Client.Listen
|
||||
#2: ssh.Client.Listen
|
||||
#3: ssh.Client.ListenTCP
|
||||
#4: ssh.Client.ListenTCP
|
||||
#5: ssh.Client.ListenUnix
|
||||
Use '-show traces' to see the other 64 found symbols
|
||||
|
||||
Vulnerability #35: GO-2026-5016
|
||||
Invoking memory leak when rejecting channels can lead to DoS in
|
||||
golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5016
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.channel.Reject
|
||||
#2: ssh.channel.Reject
|
||||
|
||||
Vulnerability #36: GO-2026-5015
|
||||
Invoking server panic during CheckHostKey/Authenticate in
|
||||
golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5015
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.CertChecker.Authenticate
|
||||
#2: ssh.CertChecker.Authenticate
|
||||
#3: ssh.CertChecker.CheckHostKey
|
||||
#4: ssh.CertChecker.CheckHostKey
|
||||
|
||||
Vulnerability #37: GO-2026-5014
|
||||
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5014
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.NewServerConn
|
||||
#2: ssh.NewServerConn
|
||||
#3: ssh.NewServerConn
|
||||
#4: ssh.NewServerConn
|
||||
#5: ssh.NewServerConn
|
||||
Use '-show traces' to see the other 7 found symbols
|
||||
|
||||
Vulnerability #38: GO-2026-5013
|
||||
Invoking byte arithmetic causes underflow and panic in
|
||||
golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5013
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.Dial
|
||||
#2: ssh.Dial
|
||||
#3: ssh.Dial
|
||||
#4: ssh.Dial
|
||||
#5: ssh.Dial
|
||||
Use '-show traces' to see the other 51 found symbols
|
||||
|
||||
Vulnerability #39: GO-2026-5006
|
||||
Invoking agent constraints dropped when forwarding keys in
|
||||
golang.org/x/crypto/ssh/agent
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5006
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: agent.client.Add
|
||||
#2: agent.keyring.Add
|
||||
#3: agent.keyring.Add
|
||||
|
||||
Vulnerability #40: GO-2026-5005
|
||||
Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5005
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: agent.keyring.Add
|
||||
#2: agent.keyring.Add
|
||||
|
||||
Vulnerability #41: GO-2026-4986
|
||||
Quadratic string concatentation in consumeComment in net/mail
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4986
|
||||
Standard library
|
||||
Found in: net/mail@go1.24.13
|
||||
Fixed in: net/mail@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: mail.AddressParser.Parse
|
||||
#2: mail.AddressParser.Parse
|
||||
#3: mail.AddressParser.ParseList
|
||||
#4: mail.AddressParser.ParseList
|
||||
#5: mail.Header.AddressList
|
||||
Use '-show traces' to see the other 7 found symbols
|
||||
|
||||
Vulnerability #42: GO-2026-4982
|
||||
Bypass of meta content URL escaping causes XSS in html/template
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4982
|
||||
Standard library
|
||||
Found in: html/template@go1.24.13
|
||||
Fixed in: html/template@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: template.Template.Execute
|
||||
#2: template.Template.Execute
|
||||
#3: template.Template.Execute
|
||||
#4: template.Template.Execute
|
||||
#5: template.Template.Execute
|
||||
Use '-show traces' to see the other 9 found symbols
|
||||
|
||||
Vulnerability #43: GO-2026-4981
|
||||
Crash when handling long CNAME response in net
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4981
|
||||
Standard library
|
||||
Found in: net@go1.24.13
|
||||
Fixed in: net@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: net.LookupCNAME
|
||||
#2: net.LookupCNAME
|
||||
#3: net.Resolver.LookupCNAME
|
||||
#4: net.Resolver.LookupCNAME
|
||||
|
||||
Vulnerability #44: GO-2026-4980
|
||||
Escaper bypass leads to XSS in html/template
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4980
|
||||
Standard library
|
||||
Found in: html/template@go1.24.13
|
||||
Fixed in: html/template@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: template.Template.Execute
|
||||
#2: template.Template.Execute
|
||||
#3: template.Template.Execute
|
||||
#4: template.Template.Execute
|
||||
#5: template.Template.Execute
|
||||
Use '-show traces' to see the other 9 found symbols
|
||||
|
||||
Vulnerability #45: GO-2026-4977
|
||||
Quadratic string concatenation in consumePhrase in net/mail
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4977
|
||||
Standard library
|
||||
Found in: net/mail@go1.24.13
|
||||
Fixed in: net/mail@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: mail.AddressParser.Parse
|
||||
#2: mail.AddressParser.Parse
|
||||
#3: mail.AddressParser.ParseList
|
||||
#4: mail.AddressParser.ParseList
|
||||
#5: mail.Header.AddressList
|
||||
Use '-show traces' to see the other 5 found symbols
|
||||
|
||||
Vulnerability #46: GO-2026-4976
|
||||
ReverseProxy forwards queries with more than urlmaxqueryparams parameters in
|
||||
net/http/httputil
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4976
|
||||
Standard library
|
||||
Found in: net/http/httputil@go1.24.13
|
||||
Fixed in: net/http/httputil@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: httputil.ReverseProxy.ServeHTTP
|
||||
#2: httputil.ReverseProxy.ServeHTTP
|
||||
|
||||
Vulnerability #47: GO-2026-4971
|
||||
Panic in Dial and LookupPort when handling NUL byte on Windows in net
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4971
|
||||
Standard library
|
||||
Found in: net@go1.24.13
|
||||
Fixed in: net@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: net.Dial
|
||||
#2: net.DialTimeout
|
||||
#3: net.Dialer.Dial
|
||||
#4: net.Dialer.DialContext
|
||||
#5: net.Listen
|
||||
Use '-show traces' to see the other 28 found symbols
|
||||
|
||||
Vulnerability #48: GO-2026-4970
|
||||
Root escape via symlink plus trailing slash in os
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4970
|
||||
Standard library
|
||||
Found in: os@go1.24.13
|
||||
Fixed in: os@go1.25.12
|
||||
Vulnerable symbols found:
|
||||
#1: os.OpenInRoot
|
||||
#2: os.Root.Create
|
||||
#3: os.Root.Open
|
||||
#4: os.Root.OpenFile
|
||||
#5: os.Root.OpenRoot
|
||||
Use '-show traces' to see the other 6 found symbols
|
||||
|
||||
Vulnerability #49: GO-2026-4947
|
||||
Unexpected work during chain building in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4947
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.24.13
|
||||
Fixed in: crypto/x509@go1.25.9
|
||||
Vulnerable symbols found:
|
||||
#1: x509.Certificate.Verify
|
||||
#2: x509.Certificate.Verify
|
||||
#3: x509.Certificate.Verify
|
||||
|
||||
Vulnerability #50: GO-2026-4946
|
||||
Inefficient policy validation in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4946
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.24.13
|
||||
Fixed in: crypto/x509@go1.25.9
|
||||
Vulnerable symbols found:
|
||||
#1: x509.Certificate.Verify
|
||||
#2: x509.Certificate.Verify
|
||||
#3: x509.Certificate.Verify
|
||||
|
||||
Vulnerability #51: GO-2026-4918
|
||||
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in
|
||||
net/http/internal/http2 in golang.org/x/net
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4918
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: http.Client.CloseIdleConnections
|
||||
#2: http.Client.CloseIdleConnections
|
||||
#3: http.Client.CloseIdleConnections
|
||||
#4: http.Client.CloseIdleConnections
|
||||
#5: http.Client.CloseIdleConnections
|
||||
Use '-show traces' to see the other 321 found symbols
|
||||
|
||||
Vulnerability #52: GO-2026-4870
|
||||
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection
|
||||
retention and DoS in crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4870
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.24.13
|
||||
Fixed in: crypto/tls@go1.25.9
|
||||
Vulnerable symbols found:
|
||||
#1: tls.Conn.Handshake
|
||||
#2: tls.Conn.Handshake
|
||||
#3: tls.Conn.Handshake
|
||||
#4: tls.Conn.Handshake
|
||||
#5: tls.Conn.HandshakeContext
|
||||
Use '-show traces' to see the other 34 found symbols
|
||||
|
||||
Vulnerability #53: GO-2026-4869
|
||||
Unbounded allocation for old GNU sparse in archive/tar
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4869
|
||||
Standard library
|
||||
Found in: archive/tar@go1.24.13
|
||||
Fixed in: archive/tar@go1.25.9
|
||||
Vulnerable symbols found:
|
||||
#1: tar.Reader.Next
|
||||
|
||||
Vulnerability #54: GO-2026-4865
|
||||
JsBraceDepth Context Tracking Bugs (XSS) in html/template
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4865
|
||||
Standard library
|
||||
Found in: html/template@go1.24.13
|
||||
Fixed in: html/template@go1.25.9
|
||||
Vulnerable symbols found:
|
||||
#1: template.Error.Error
|
||||
#2: template.HTMLEscaper
|
||||
#3: template.JSEscape
|
||||
#4: template.JSEscapeString
|
||||
#5: template.JSEscaper
|
||||
Use '-show traces' to see the other 27 found symbols
|
||||
|
||||
Vulnerability #55: GO-2026-4864
|
||||
TOCTOU permits root escape on Linux via Root.Chmod in os in
|
||||
internal/syscall/unix
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4864
|
||||
Standard library
|
||||
Found in: internal/syscall/unix@go1.24.13
|
||||
Fixed in: internal/syscall/unix@go1.25.9
|
||||
Platforms: linux
|
||||
Vulnerable symbols found:
|
||||
#1: unix.Fchmodat
|
||||
|
||||
Vulnerability #56: GO-2026-4603
|
||||
URLs in meta content attribute actions are not escaped in html/template
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4603
|
||||
Standard library
|
||||
Found in: html/template@go1.24.13
|
||||
Fixed in: html/template@go1.25.8
|
||||
Vulnerable symbols found:
|
||||
#1: template.Template.Execute
|
||||
#2: template.Template.Execute
|
||||
#3: template.Template.Execute
|
||||
#4: template.Template.Execute
|
||||
#5: template.Template.Execute
|
||||
Use '-show traces' to see the other 9 found symbols
|
||||
|
||||
Vulnerability #57: GO-2026-4602
|
||||
FileInfo can escape from a Root in os
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4602
|
||||
Standard library
|
||||
Found in: os@go1.24.13
|
||||
Fixed in: os@go1.25.8
|
||||
Vulnerable symbols found:
|
||||
#1: os.File.ReadDir
|
||||
#2: os.File.Readdir
|
||||
#3: os.ReadDir
|
||||
#4: os.dirFS.ReadDir
|
||||
#5: os.rootFS.ReadDir
|
||||
Use '-show traces' to see the other 1 found symbols
|
||||
|
||||
Vulnerability #58: GO-2026-4601
|
||||
Incorrect parsing of IPv6 host literals in net/url
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4601
|
||||
Standard library
|
||||
Found in: net/url@go1.24.13
|
||||
Fixed in: net/url@go1.25.8
|
||||
Vulnerable symbols found:
|
||||
#1: url.JoinPath
|
||||
#2: url.Parse
|
||||
#3: url.ParseRequestURI
|
||||
#4: url.URL.Parse
|
||||
#5: url.URL.Parse
|
||||
Use '-show traces' to see the other 1 found symbols
|
||||
|
||||
Vulnerability #59: GO-2025-4135
|
||||
Malformed constraint may cause denial of service in
|
||||
golang.org/x/crypto/ssh/agent
|
||||
More info: https://pkg.go.dev/vuln/GO-2025-4135
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.45.0
|
||||
Vulnerable symbols found:
|
||||
#1: agent.ForwardToAgent
|
||||
#2: agent.ForwardToAgent
|
||||
#3: agent.ServeAgent
|
||||
#4: agent.ServeAgent
|
||||
|
||||
Vulnerability #60: GO-2025-4134
|
||||
Unbounded memory consumption in golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2025-4134
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.45.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.NewServerConn
|
||||
#2: ssh.NewServerConn
|
||||
#3: ssh.NewServerConn
|
||||
#4: ssh.NewServerConn
|
||||
#5: ssh.NewServerConn
|
||||
Use '-show traces' to see the other 7 found symbols
|
||||
|
||||
Vulnerability #61: GO-2025-4116
|
||||
Potential denial of service in golang.org/x/crypto/ssh/agent
|
||||
More info: https://pkg.go.dev/vuln/GO-2025-4116
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.43.0
|
||||
Vulnerable symbols found:
|
||||
#1: agent.agentKeyringSigner.Sign
|
||||
#2: agent.agentKeyringSigner.SignWithAlgorithm
|
||||
#3: agent.client.List
|
||||
#4: agent.client.Sign
|
||||
#5: agent.client.SignWithFlags
|
||||
Use '-show traces' to see the other 1 found symbols
|
||||
|
||||
Vulnerability #62: GO-2025-3487
|
||||
Potential denial of service in golang.org/x/crypto
|
||||
More info: https://pkg.go.dev/vuln/GO-2025-3487
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.35.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.Client.Dial
|
||||
#2: ssh.Client.DialContext
|
||||
#3: ssh.Client.DialTCP
|
||||
#4: ssh.Client.Listen
|
||||
#5: ssh.Client.Listen
|
||||
Use '-show traces' to see the other 117 found symbols
|
||||
|
||||
Your code is affected by 62 vulnerabilities from 1 module and the Go standard library.
|
||||
This scan found no other vulnerabilities in packages you import or modules you
|
||||
require.
|
||||
Use '-show verbose' for more details.
|
||||
+840
@@ -0,0 +1,840 @@
|
||||
=== Symbol Results ===
|
||||
|
||||
Vulnerability #1: GO-2026-6617
|
||||
HTTP/2 server crash due to HPACK encoder race in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6617
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.CanonicalHeaderKey
|
||||
#2: http.CanonicalHeaderKey
|
||||
#3: http.CanonicalHeaderKey
|
||||
#4: http.CanonicalHeaderKey
|
||||
#5: http.CanonicalHeaderKey
|
||||
Use '-show traces' to see the other 3999 found symbols
|
||||
|
||||
Vulnerability #2: GO-2026-6613
|
||||
HTTP/1 server connection desynchronization after 2xx CONNECT response in
|
||||
net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6613
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.CanonicalHeaderKey
|
||||
#2: http.CanonicalHeaderKey
|
||||
#3: http.CanonicalHeaderKey
|
||||
#4: http.CanonicalHeaderKey
|
||||
#5: http.CanonicalHeaderKey
|
||||
Use '-show traces' to see the other 1388 found symbols
|
||||
|
||||
Vulnerability #3: GO-2026-6612
|
||||
Double flow control refund on HTTP/2 server streams in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6612
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.CanonicalHeaderKey
|
||||
#2: http.CanonicalHeaderKey
|
||||
#3: http.CanonicalHeaderKey
|
||||
#4: http.CanonicalHeaderKey
|
||||
#5: http.CanonicalHeaderKey
|
||||
Use '-show traces' to see the other 3999 found symbols
|
||||
|
||||
Vulnerability #4: GO-2026-6611
|
||||
Excessive CPU consumption from repeated initial window changes in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6611
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.CanonicalHeaderKey
|
||||
#2: http.CanonicalHeaderKey
|
||||
#3: http.CanonicalHeaderKey
|
||||
#4: http.CanonicalHeaderKey
|
||||
#5: http.CanonicalHeaderKey
|
||||
Use '-show traces' to see the other 4019 found symbols
|
||||
|
||||
Vulnerability #5: GO-2026-6610
|
||||
HTTP/2 transport accepts malformed framing-related headers in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6610
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.Client.CloseIdleConnections
|
||||
#2: http.Client.CloseIdleConnections
|
||||
#3: http.Client.CloseIdleConnections
|
||||
#4: http.Client.CloseIdleConnections
|
||||
#5: http.Client.CloseIdleConnections
|
||||
Use '-show traces' to see the other 647 found symbols
|
||||
|
||||
Vulnerability #6: GO-2026-6609
|
||||
Lack of limit on size of parsed Range headers in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6609
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.ServeContent
|
||||
#2: http.ServeContent
|
||||
#3: http.ServeContent
|
||||
#4: http.ServeContent
|
||||
#5: http.ServeContent
|
||||
Use '-show traces' to see the other 45 found symbols
|
||||
|
||||
Vulnerability #7: GO-2026-6608
|
||||
Memory limit bypass when parsing MIME headers in net/textproto,
|
||||
mime/multipart
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6608
|
||||
Standard library
|
||||
Found in: net/textproto@go1.24.13
|
||||
Fixed in: net/textproto@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: multipart.Reader.NextPart
|
||||
#2: multipart.Reader.NextRawPart
|
||||
#3: multipart.Reader.ReadForm
|
||||
#4: textproto.Reader.ReadContinuedLine
|
||||
#5: textproto.Reader.ReadContinuedLineBytes
|
||||
Use '-show traces' to see the other 2 found symbols
|
||||
|
||||
Vulnerability #8: GO-2026-6607
|
||||
Reject malformed ECH outer extension references in crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6607
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.24.13
|
||||
Fixed in: crypto/tls@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: tls.Conn.Handshake
|
||||
#2: tls.Conn.Handshake
|
||||
#3: tls.Conn.Handshake
|
||||
#4: tls.Conn.Handshake
|
||||
#5: tls.Conn.HandshakeContext
|
||||
Use '-show traces' to see the other 31 found symbols
|
||||
|
||||
Vulnerability #9: GO-2026-6605
|
||||
HTTP/1 client connection desynchronization after CONNECT rejection in
|
||||
net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6605
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.Client.CloseIdleConnections
|
||||
#2: http.Client.CloseIdleConnections
|
||||
#3: http.Client.CloseIdleConnections
|
||||
#4: http.Client.CloseIdleConnections
|
||||
#5: http.Client.CloseIdleConnections
|
||||
Use '-show traces' to see the other 236 found symbols
|
||||
|
||||
Vulnerability #10: GO-2026-6603
|
||||
HTTP/2 server memory exhaustion due to Trailer headers in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6603
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: http.CanonicalHeaderKey
|
||||
#2: http.CanonicalHeaderKey
|
||||
#3: http.CanonicalHeaderKey
|
||||
#4: http.CanonicalHeaderKey
|
||||
#5: http.CanonicalHeaderKey
|
||||
Use '-show traces' to see the other 3999 found symbols
|
||||
|
||||
Vulnerability #11: GO-2026-6600
|
||||
Recognize yield as regexp preceder keyword in html/template
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6600
|
||||
Standard library
|
||||
Found in: html/template@go1.24.13
|
||||
Fixed in: html/template@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: template.Template.Execute
|
||||
#2: template.Template.Execute
|
||||
#3: template.Template.Execute
|
||||
#4: template.Template.Execute
|
||||
#5: template.Template.Execute
|
||||
Use '-show traces' to see the other 9 found symbols
|
||||
|
||||
Vulnerability #12: GO-2026-6599
|
||||
Reset context tracking on consecutive template expressions in html/template
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6599
|
||||
Standard library
|
||||
Found in: html/template@go1.24.13
|
||||
Fixed in: html/template@go1.26.9
|
||||
Vulnerable symbols found:
|
||||
#1: template.Template.Execute
|
||||
#2: template.Template.Execute
|
||||
#3: template.Template.Execute
|
||||
#4: template.Template.Execute
|
||||
#5: template.Template.Execute
|
||||
Use '-show traces' to see the other 9 found symbols
|
||||
|
||||
Vulnerability #13: GO-2026-6355
|
||||
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6355
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.56.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.Dial
|
||||
#2: ssh.Dial
|
||||
#3: ssh.Dial
|
||||
#4: ssh.Dial
|
||||
#5: ssh.Dial
|
||||
Use '-show traces' to see the other 25 found symbols
|
||||
|
||||
Vulnerability #14: GO-2026-6354
|
||||
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6354
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.56.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.Dial
|
||||
#2: ssh.Dial
|
||||
#3: ssh.Dial
|
||||
#4: ssh.Dial
|
||||
#5: ssh.Dial
|
||||
Use '-show traces' to see the other 27 found symbols
|
||||
|
||||
Vulnerability #15: GO-2026-6303
|
||||
Source-address critical option not enforced for non-public-key auth
|
||||
callbacks in golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6303
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.55.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.NewServerConn
|
||||
#2: ssh.NewServerConn
|
||||
#3: ssh.NewServerConn
|
||||
#4: ssh.NewServerConn
|
||||
#5: ssh.NewServerConn
|
||||
Use '-show traces' to see the other 7 found symbols
|
||||
|
||||
Vulnerability #16: GO-2026-6218
|
||||
Avoid quadratic complexity in resolvePath in net/url
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6218
|
||||
Standard library
|
||||
Found in: net/url@go1.24.13
|
||||
Fixed in: net/url@go1.25.13
|
||||
Vulnerable symbols found:
|
||||
#1: url.URL.Parse
|
||||
#2: url.URL.Parse
|
||||
#3: url.URL.ResolveReference
|
||||
|
||||
Vulnerability #17: GO-2026-6091
|
||||
Fix Javascript regexp context tracking in html/template
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6091
|
||||
Standard library
|
||||
Found in: html/template@go1.24.13
|
||||
Fixed in: html/template@go1.25.13
|
||||
Vulnerable symbols found:
|
||||
#1: template.Template.Execute
|
||||
#2: template.Template.Execute
|
||||
#3: template.Template.Execute
|
||||
#4: template.Template.Execute
|
||||
#5: template.Template.Execute
|
||||
Use '-show traces' to see the other 9 found symbols
|
||||
|
||||
Vulnerability #18: GO-2026-6090
|
||||
Limit handshake messages we are willing to accept post-handshake in
|
||||
crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6090
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.24.13
|
||||
Fixed in: crypto/tls@go1.25.13
|
||||
Vulnerable symbols found:
|
||||
#1: tls.Conn.Handshake
|
||||
#2: tls.Conn.Handshake
|
||||
#3: tls.Conn.Handshake
|
||||
#4: tls.Conn.Handshake
|
||||
#5: tls.Conn.HandshakeContext
|
||||
Use '-show traces' to see the other 34 found symbols
|
||||
|
||||
Vulnerability #19: GO-2026-6089
|
||||
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6089
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.25.13
|
||||
Vulnerable symbols found:
|
||||
#1: http.ListenAndServe
|
||||
#2: http.ListenAndServe
|
||||
#3: http.ListenAndServe
|
||||
#4: http.ListenAndServe
|
||||
#5: http.ListenAndServe
|
||||
Use '-show traces' to see the other 75 found symbols
|
||||
|
||||
Vulnerability #20: GO-2026-6088
|
||||
Add recursion depth guard during decode in encoding/xml
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6088
|
||||
Standard library
|
||||
Found in: encoding/xml@go1.24.13
|
||||
Fixed in: encoding/xml@go1.25.13
|
||||
Vulnerable symbols found:
|
||||
#1: xml.Decoder.Decode
|
||||
#2: xml.Decoder.DecodeElement
|
||||
#3: xml.Decoder.RawToken
|
||||
#4: xml.Decoder.Skip
|
||||
#5: xml.Decoder.Token
|
||||
Use '-show traces' to see the other 1 found symbols
|
||||
|
||||
Vulnerability #21: GO-2026-5972
|
||||
Enforce maximum recursion depth in encoding/asn1
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5972
|
||||
Standard library
|
||||
Found in: encoding/asn1@go1.24.13
|
||||
Fixed in: encoding/asn1@go1.25.13
|
||||
Vulnerable symbols found:
|
||||
#1: asn1.Unmarshal
|
||||
#2: asn1.UnmarshalWithParams
|
||||
|
||||
Vulnerability #22: GO-2026-5932
|
||||
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design,
|
||||
and has known security issues
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5932
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: N/A
|
||||
Vulnerable symbols found:
|
||||
#1: armor.golang.org/x/crypto/openpgp/armor/*
|
||||
#2: clearsign.golang.org/x/crypto/openpgp/clearsign/*
|
||||
#3: elgamal.golang.org/x/crypto/openpgp/elgamal/*
|
||||
#4: errors.golang.org/x/crypto/openpgp/errors/*
|
||||
#5: openpgp.golang.org/x/crypto/openpgp/*
|
||||
Use '-show traces' to see the other 2 found symbols
|
||||
|
||||
Vulnerability #23: GO-2026-5856
|
||||
Invoking Encrypted Client Hello privacy leak in crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5856
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.24.13
|
||||
Fixed in: crypto/tls@go1.25.12
|
||||
Vulnerable symbols found:
|
||||
#1: tls.Conn.Handshake
|
||||
#2: tls.Conn.Handshake
|
||||
#3: tls.Conn.Handshake
|
||||
#4: tls.Conn.Handshake
|
||||
#5: tls.Conn.HandshakeContext
|
||||
Use '-show traces' to see the other 35 found symbols
|
||||
|
||||
Vulnerability #24: GO-2026-5039
|
||||
Arbitrary inputs are included in errors without any escaping in
|
||||
net/textproto
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5039
|
||||
Standard library
|
||||
Found in: net/textproto@go1.24.13
|
||||
Fixed in: net/textproto@go1.25.11
|
||||
Vulnerable symbols found:
|
||||
#1: textproto.Error.Error
|
||||
#2: textproto.Reader.ReadCodeLine
|
||||
#3: textproto.Reader.ReadMIMEHeader
|
||||
#4: textproto.Reader.ReadMIMEHeader
|
||||
#5: textproto.Reader.ReadResponse
|
||||
|
||||
Vulnerability #25: GO-2026-5038
|
||||
Quadratic complexity in WordDecoder.DecodeHeader in mime
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5038
|
||||
Standard library
|
||||
Found in: mime@go1.24.13
|
||||
Fixed in: mime@go1.25.11
|
||||
Vulnerable symbols found:
|
||||
#1: mime.WordDecoder.DecodeHeader
|
||||
|
||||
Vulnerability #26: GO-2026-5037
|
||||
Inefficient candidate hostname parsing in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5037
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.24.13
|
||||
Fixed in: crypto/x509@go1.25.11
|
||||
Vulnerable symbols found:
|
||||
#1: x509.Certificate.Verify
|
||||
#2: x509.Certificate.Verify
|
||||
#3: x509.Certificate.Verify
|
||||
#4: x509.Certificate.VerifyHostname
|
||||
#5: x509.HostnameError.Error
|
||||
|
||||
Vulnerability #27: GO-2026-5033
|
||||
Invoking pathological inputs can lead to client panic in
|
||||
golang.org/x/crypto/ssh/agent
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5033
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: agent.ForwardToAgent
|
||||
#2: agent.ForwardToAgent
|
||||
#3: agent.ServeAgent
|
||||
#4: agent.ServeAgent
|
||||
|
||||
Vulnerability #28: GO-2026-5026
|
||||
Invoking failure to reject ASCII-only Punycode-encoded labels in
|
||||
golang.org/x/net/idna
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5026
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.25.13
|
||||
Vulnerable symbols found:
|
||||
#1: http.Client.CloseIdleConnections
|
||||
#2: http.Client.CloseIdleConnections
|
||||
#3: http.Client.CloseIdleConnections
|
||||
#4: http.Client.CloseIdleConnections
|
||||
#5: http.Client.CloseIdleConnections
|
||||
Use '-show traces' to see the other 248 found symbols
|
||||
|
||||
Vulnerability #29: GO-2026-5023
|
||||
Invoking VerifiedPublicKeyCallback permissions skip enforcement in
|
||||
golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5023
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.NewServerConn
|
||||
#2: ssh.NewServerConn
|
||||
#3: ssh.NewServerConn
|
||||
#4: ssh.NewServerConn
|
||||
#5: ssh.NewServerConn
|
||||
Use '-show traces' to see the other 7 found symbols
|
||||
|
||||
Vulnerability #30: GO-2026-5021
|
||||
Invoking auth bypass via unenforced @revoked status in
|
||||
golang.org/x/crypto/ssh/knownhosts
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5021
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: knownhosts.hostKeyDB.IsRevoked
|
||||
|
||||
Vulnerability #31: GO-2026-5020
|
||||
Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5020
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.Dial
|
||||
#2: ssh.Dial
|
||||
#3: ssh.Dial
|
||||
#4: ssh.Dial
|
||||
#5: ssh.Dial
|
||||
Use '-show traces' to see the other 72 found symbols
|
||||
|
||||
Vulnerability #32: GO-2026-5019
|
||||
Invoking bypass of FIDO/U2F security keys physical interaction in
|
||||
golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5019
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.CertChecker.Authenticate
|
||||
#2: ssh.CertChecker.Authenticate
|
||||
#3: ssh.CertChecker.CheckCert
|
||||
#4: ssh.CertChecker.CheckHostKey
|
||||
#5: ssh.CertChecker.CheckHostKey
|
||||
Use '-show traces' to see the other 31 found symbols
|
||||
|
||||
Vulnerability #33: GO-2026-5018
|
||||
Invoking pathological RSA/DSA parameters may cause DoS in
|
||||
golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5018
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.Dial
|
||||
#2: ssh.Dial
|
||||
#3: ssh.Dial
|
||||
#4: ssh.Dial
|
||||
#5: ssh.Dial
|
||||
Use '-show traces' to see the other 31 found symbols
|
||||
|
||||
Vulnerability #34: GO-2026-5017
|
||||
Invoking client can cause server deadlock on unexpected responses in
|
||||
golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5017
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.Client.Listen
|
||||
#2: ssh.Client.Listen
|
||||
#3: ssh.Client.ListenTCP
|
||||
#4: ssh.Client.ListenTCP
|
||||
#5: ssh.Client.ListenUnix
|
||||
Use '-show traces' to see the other 64 found symbols
|
||||
|
||||
Vulnerability #35: GO-2026-5016
|
||||
Invoking memory leak when rejecting channels can lead to DoS in
|
||||
golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5016
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.channel.Reject
|
||||
#2: ssh.channel.Reject
|
||||
|
||||
Vulnerability #36: GO-2026-5015
|
||||
Invoking server panic during CheckHostKey/Authenticate in
|
||||
golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5015
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.CertChecker.Authenticate
|
||||
#2: ssh.CertChecker.Authenticate
|
||||
#3: ssh.CertChecker.CheckHostKey
|
||||
#4: ssh.CertChecker.CheckHostKey
|
||||
|
||||
Vulnerability #37: GO-2026-5014
|
||||
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5014
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.NewServerConn
|
||||
#2: ssh.NewServerConn
|
||||
#3: ssh.NewServerConn
|
||||
#4: ssh.NewServerConn
|
||||
#5: ssh.NewServerConn
|
||||
Use '-show traces' to see the other 7 found symbols
|
||||
|
||||
Vulnerability #38: GO-2026-5013
|
||||
Invoking byte arithmetic causes underflow and panic in
|
||||
golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5013
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.Dial
|
||||
#2: ssh.Dial
|
||||
#3: ssh.Dial
|
||||
#4: ssh.Dial
|
||||
#5: ssh.Dial
|
||||
Use '-show traces' to see the other 51 found symbols
|
||||
|
||||
Vulnerability #39: GO-2026-5006
|
||||
Invoking agent constraints dropped when forwarding keys in
|
||||
golang.org/x/crypto/ssh/agent
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5006
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: agent.client.Add
|
||||
#2: agent.keyring.Add
|
||||
#3: agent.keyring.Add
|
||||
|
||||
Vulnerability #40: GO-2026-5005
|
||||
Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5005
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.52.0
|
||||
Vulnerable symbols found:
|
||||
#1: agent.keyring.Add
|
||||
#2: agent.keyring.Add
|
||||
|
||||
Vulnerability #41: GO-2026-4986
|
||||
Quadratic string concatentation in consumeComment in net/mail
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4986
|
||||
Standard library
|
||||
Found in: net/mail@go1.24.13
|
||||
Fixed in: net/mail@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: mail.AddressParser.Parse
|
||||
#2: mail.AddressParser.Parse
|
||||
#3: mail.AddressParser.ParseList
|
||||
#4: mail.AddressParser.ParseList
|
||||
#5: mail.Header.AddressList
|
||||
Use '-show traces' to see the other 7 found symbols
|
||||
|
||||
Vulnerability #42: GO-2026-4982
|
||||
Bypass of meta content URL escaping causes XSS in html/template
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4982
|
||||
Standard library
|
||||
Found in: html/template@go1.24.13
|
||||
Fixed in: html/template@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: template.Template.Execute
|
||||
#2: template.Template.Execute
|
||||
#3: template.Template.Execute
|
||||
#4: template.Template.Execute
|
||||
#5: template.Template.Execute
|
||||
Use '-show traces' to see the other 9 found symbols
|
||||
|
||||
Vulnerability #43: GO-2026-4981
|
||||
Crash when handling long CNAME response in net
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4981
|
||||
Standard library
|
||||
Found in: net@go1.24.13
|
||||
Fixed in: net@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: net.LookupCNAME
|
||||
#2: net.LookupCNAME
|
||||
#3: net.Resolver.LookupCNAME
|
||||
#4: net.Resolver.LookupCNAME
|
||||
|
||||
Vulnerability #44: GO-2026-4980
|
||||
Escaper bypass leads to XSS in html/template
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4980
|
||||
Standard library
|
||||
Found in: html/template@go1.24.13
|
||||
Fixed in: html/template@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: template.Template.Execute
|
||||
#2: template.Template.Execute
|
||||
#3: template.Template.Execute
|
||||
#4: template.Template.Execute
|
||||
#5: template.Template.Execute
|
||||
Use '-show traces' to see the other 9 found symbols
|
||||
|
||||
Vulnerability #45: GO-2026-4977
|
||||
Quadratic string concatenation in consumePhrase in net/mail
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4977
|
||||
Standard library
|
||||
Found in: net/mail@go1.24.13
|
||||
Fixed in: net/mail@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: mail.AddressParser.Parse
|
||||
#2: mail.AddressParser.Parse
|
||||
#3: mail.AddressParser.ParseList
|
||||
#4: mail.AddressParser.ParseList
|
||||
#5: mail.Header.AddressList
|
||||
Use '-show traces' to see the other 5 found symbols
|
||||
|
||||
Vulnerability #46: GO-2026-4976
|
||||
ReverseProxy forwards queries with more than urlmaxqueryparams parameters in
|
||||
net/http/httputil
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4976
|
||||
Standard library
|
||||
Found in: net/http/httputil@go1.24.13
|
||||
Fixed in: net/http/httputil@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: httputil.ReverseProxy.ServeHTTP
|
||||
#2: httputil.ReverseProxy.ServeHTTP
|
||||
|
||||
Vulnerability #47: GO-2026-4971
|
||||
Panic in Dial and LookupPort when handling NUL byte on Windows in net
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4971
|
||||
Standard library
|
||||
Found in: net@go1.24.13
|
||||
Fixed in: net@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: net.Dial
|
||||
#2: net.DialTimeout
|
||||
#3: net.Dialer.Dial
|
||||
#4: net.Dialer.DialContext
|
||||
#5: net.Listen
|
||||
Use '-show traces' to see the other 28 found symbols
|
||||
|
||||
Vulnerability #48: GO-2026-4970
|
||||
Root escape via symlink plus trailing slash in os
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4970
|
||||
Standard library
|
||||
Found in: os@go1.24.13
|
||||
Fixed in: os@go1.25.12
|
||||
Vulnerable symbols found:
|
||||
#1: os.OpenInRoot
|
||||
#2: os.Root.Create
|
||||
#3: os.Root.Open
|
||||
#4: os.Root.OpenFile
|
||||
#5: os.Root.OpenRoot
|
||||
Use '-show traces' to see the other 6 found symbols
|
||||
|
||||
Vulnerability #49: GO-2026-4947
|
||||
Unexpected work during chain building in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4947
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.24.13
|
||||
Fixed in: crypto/x509@go1.25.9
|
||||
Vulnerable symbols found:
|
||||
#1: x509.Certificate.Verify
|
||||
#2: x509.Certificate.Verify
|
||||
#3: x509.Certificate.Verify
|
||||
|
||||
Vulnerability #50: GO-2026-4946
|
||||
Inefficient policy validation in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4946
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.24.13
|
||||
Fixed in: crypto/x509@go1.25.9
|
||||
Vulnerable symbols found:
|
||||
#1: x509.Certificate.Verify
|
||||
#2: x509.Certificate.Verify
|
||||
#3: x509.Certificate.Verify
|
||||
|
||||
Vulnerability #51: GO-2026-4918
|
||||
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in
|
||||
net/http/internal/http2 in golang.org/x/net
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4918
|
||||
Standard library
|
||||
Found in: net/http@go1.24.13
|
||||
Fixed in: net/http@go1.25.10
|
||||
Vulnerable symbols found:
|
||||
#1: http.Client.CloseIdleConnections
|
||||
#2: http.Client.CloseIdleConnections
|
||||
#3: http.Client.CloseIdleConnections
|
||||
#4: http.Client.CloseIdleConnections
|
||||
#5: http.Client.CloseIdleConnections
|
||||
Use '-show traces' to see the other 321 found symbols
|
||||
|
||||
Vulnerability #52: GO-2026-4870
|
||||
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection
|
||||
retention and DoS in crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4870
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.24.13
|
||||
Fixed in: crypto/tls@go1.25.9
|
||||
Vulnerable symbols found:
|
||||
#1: tls.Conn.Handshake
|
||||
#2: tls.Conn.Handshake
|
||||
#3: tls.Conn.Handshake
|
||||
#4: tls.Conn.Handshake
|
||||
#5: tls.Conn.HandshakeContext
|
||||
Use '-show traces' to see the other 34 found symbols
|
||||
|
||||
Vulnerability #53: GO-2026-4869
|
||||
Unbounded allocation for old GNU sparse in archive/tar
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4869
|
||||
Standard library
|
||||
Found in: archive/tar@go1.24.13
|
||||
Fixed in: archive/tar@go1.25.9
|
||||
Vulnerable symbols found:
|
||||
#1: tar.Reader.Next
|
||||
|
||||
Vulnerability #54: GO-2026-4865
|
||||
JsBraceDepth Context Tracking Bugs (XSS) in html/template
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4865
|
||||
Standard library
|
||||
Found in: html/template@go1.24.13
|
||||
Fixed in: html/template@go1.25.9
|
||||
Vulnerable symbols found:
|
||||
#1: template.Error.Error
|
||||
#2: template.HTMLEscaper
|
||||
#3: template.JSEscape
|
||||
#4: template.JSEscapeString
|
||||
#5: template.JSEscaper
|
||||
Use '-show traces' to see the other 27 found symbols
|
||||
|
||||
Vulnerability #55: GO-2026-4864
|
||||
TOCTOU permits root escape on Linux via Root.Chmod in os in
|
||||
internal/syscall/unix
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4864
|
||||
Standard library
|
||||
Found in: internal/syscall/unix@go1.24.13
|
||||
Fixed in: internal/syscall/unix@go1.25.9
|
||||
Platforms: linux
|
||||
Vulnerable symbols found:
|
||||
#1: unix.Fchmodat
|
||||
|
||||
Vulnerability #56: GO-2026-4603
|
||||
URLs in meta content attribute actions are not escaped in html/template
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4603
|
||||
Standard library
|
||||
Found in: html/template@go1.24.13
|
||||
Fixed in: html/template@go1.25.8
|
||||
Vulnerable symbols found:
|
||||
#1: template.Template.Execute
|
||||
#2: template.Template.Execute
|
||||
#3: template.Template.Execute
|
||||
#4: template.Template.Execute
|
||||
#5: template.Template.Execute
|
||||
Use '-show traces' to see the other 9 found symbols
|
||||
|
||||
Vulnerability #57: GO-2026-4602
|
||||
FileInfo can escape from a Root in os
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4602
|
||||
Standard library
|
||||
Found in: os@go1.24.13
|
||||
Fixed in: os@go1.25.8
|
||||
Vulnerable symbols found:
|
||||
#1: os.File.ReadDir
|
||||
#2: os.File.Readdir
|
||||
#3: os.ReadDir
|
||||
#4: os.dirFS.ReadDir
|
||||
#5: os.rootFS.ReadDir
|
||||
Use '-show traces' to see the other 1 found symbols
|
||||
|
||||
Vulnerability #58: GO-2026-4601
|
||||
Incorrect parsing of IPv6 host literals in net/url
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4601
|
||||
Standard library
|
||||
Found in: net/url@go1.24.13
|
||||
Fixed in: net/url@go1.25.8
|
||||
Vulnerable symbols found:
|
||||
#1: url.JoinPath
|
||||
#2: url.Parse
|
||||
#3: url.ParseRequestURI
|
||||
#4: url.URL.Parse
|
||||
#5: url.URL.Parse
|
||||
Use '-show traces' to see the other 1 found symbols
|
||||
|
||||
Vulnerability #59: GO-2025-4135
|
||||
Malformed constraint may cause denial of service in
|
||||
golang.org/x/crypto/ssh/agent
|
||||
More info: https://pkg.go.dev/vuln/GO-2025-4135
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.45.0
|
||||
Vulnerable symbols found:
|
||||
#1: agent.ForwardToAgent
|
||||
#2: agent.ForwardToAgent
|
||||
#3: agent.ServeAgent
|
||||
#4: agent.ServeAgent
|
||||
|
||||
Vulnerability #60: GO-2025-4134
|
||||
Unbounded memory consumption in golang.org/x/crypto/ssh
|
||||
More info: https://pkg.go.dev/vuln/GO-2025-4134
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.45.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.NewServerConn
|
||||
#2: ssh.NewServerConn
|
||||
#3: ssh.NewServerConn
|
||||
#4: ssh.NewServerConn
|
||||
#5: ssh.NewServerConn
|
||||
Use '-show traces' to see the other 7 found symbols
|
||||
|
||||
Vulnerability #61: GO-2025-4116
|
||||
Potential denial of service in golang.org/x/crypto/ssh/agent
|
||||
More info: https://pkg.go.dev/vuln/GO-2025-4116
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.43.0
|
||||
Vulnerable symbols found:
|
||||
#1: agent.agentKeyringSigner.Sign
|
||||
#2: agent.agentKeyringSigner.SignWithAlgorithm
|
||||
#3: agent.client.List
|
||||
#4: agent.client.Sign
|
||||
#5: agent.client.SignWithFlags
|
||||
Use '-show traces' to see the other 1 found symbols
|
||||
|
||||
Vulnerability #62: GO-2025-3487
|
||||
Potential denial of service in golang.org/x/crypto
|
||||
More info: https://pkg.go.dev/vuln/GO-2025-3487
|
||||
Module: golang.org/x/crypto
|
||||
Found in: golang.org/x/crypto@v0.31.0
|
||||
Fixed in: golang.org/x/crypto@v0.35.0
|
||||
Vulnerable symbols found:
|
||||
#1: ssh.Client.Dial
|
||||
#2: ssh.Client.DialContext
|
||||
#3: ssh.Client.DialTCP
|
||||
#4: ssh.Client.Listen
|
||||
#5: ssh.Client.Listen
|
||||
Use '-show traces' to see the other 117 found symbols
|
||||
|
||||
Your code is affected by 62 vulnerabilities from 1 module and the Go standard library.
|
||||
This scan found no other vulnerabilities in packages you import or modules you
|
||||
require.
|
||||
Use '-show verbose' for more details.
|
||||
+794
@@ -0,0 +1,794 @@
|
||||
=== Symbol Results ===
|
||||
|
||||
Vulnerability #1: GO-2026-6617
|
||||
HTTP/2 server crash due to HPACK encoder race in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6617
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.9
|
||||
Example traces found:
|
||||
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
|
||||
#2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
|
||||
#3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
|
||||
#4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
|
||||
#5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
|
||||
#6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
|
||||
#7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
|
||||
#8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
|
||||
#9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
|
||||
#10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
|
||||
#11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
|
||||
#12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
|
||||
#13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
|
||||
#14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
|
||||
#15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
|
||||
#16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
|
||||
#17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
|
||||
#18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
|
||||
#19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
|
||||
#20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
|
||||
#21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
|
||||
#22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
|
||||
#23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
||||
#24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
||||
#25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
|
||||
#26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
|
||||
#27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
|
||||
#28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
|
||||
#29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
|
||||
#30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
|
||||
#31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
|
||||
#32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
|
||||
#33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
|
||||
#34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
|
||||
#35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
|
||||
#36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
|
||||
#37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
|
||||
#38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
|
||||
#39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
|
||||
#40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
|
||||
#41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
|
||||
#42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
|
||||
#43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
|
||||
#44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
|
||||
#45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
|
||||
#46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
|
||||
#47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
||||
#48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
||||
#49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
||||
#50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
||||
#51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
||||
#52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
||||
#53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
||||
#54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
||||
#55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
|
||||
#56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
|
||||
#57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
||||
#58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
||||
#59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
||||
#60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
||||
#61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
|
||||
#62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
|
||||
#63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
|
||||
#64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
|
||||
#65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
|
||||
#66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
|
||||
#67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
|
||||
#68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
|
||||
#69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
|
||||
#70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
|
||||
#71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
|
||||
#72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
|
||||
#73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
|
||||
#74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
|
||||
#75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
|
||||
#76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
|
||||
#77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
|
||||
#78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
|
||||
#79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
|
||||
#80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
|
||||
#81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
|
||||
#82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
|
||||
#83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
|
||||
#84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
|
||||
#85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
|
||||
#86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
|
||||
#87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
|
||||
#88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
|
||||
#89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
|
||||
#90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
|
||||
#91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
|
||||
#92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
|
||||
#93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
||||
#94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
||||
#95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
||||
#96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
||||
#97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
|
||||
#98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
|
||||
#99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
|
||||
#100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
|
||||
#101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
|
||||
#102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
|
||||
#103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
||||
#104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
||||
#105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
|
||||
#106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
|
||||
#107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
||||
#108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
||||
#109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
|
||||
#110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
|
||||
#111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
|
||||
#112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
|
||||
#113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
||||
#114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
||||
#115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
|
||||
#116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
|
||||
#117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
|
||||
#118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
|
||||
#119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
|
||||
#120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
|
||||
|
||||
Vulnerability #2: GO-2026-6613
|
||||
HTTP/1 server connection desynchronization after 2xx CONNECT response in
|
||||
net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6613
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.9
|
||||
Example traces found:
|
||||
#1: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.CanonicalHeaderKey
|
||||
#2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
|
||||
#3: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader, which eventually calls http.Header.Del
|
||||
#4: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.Header.Get
|
||||
#5: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
|
||||
#6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
|
||||
#7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
|
||||
#8: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
|
||||
#9: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
|
||||
#10: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
|
||||
#11: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
|
||||
#12: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
|
||||
#13: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
|
||||
#14: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
|
||||
#15: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
||||
#16: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
|
||||
#17: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
|
||||
#18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
|
||||
#19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
|
||||
#20: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
|
||||
#21: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
|
||||
#22: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
|
||||
#23: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close, which eventually calls http.expectContinueReader.Close
|
||||
#24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
|
||||
#25: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
|
||||
#26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
|
||||
#27: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
|
||||
#28: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
|
||||
#29: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
|
||||
#30: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
||||
#31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
|
||||
#32: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
||||
#33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
|
||||
#34: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close, which eventually calls http.readTrackingBody.Close
|
||||
#35: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
|
||||
#36: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
||||
#37: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
|
||||
#38: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
|
||||
#39: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
|
||||
|
||||
Vulnerability #3: GO-2026-6612
|
||||
Double flow control refund on HTTP/2 server streams in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6612
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.9
|
||||
Example traces found:
|
||||
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
|
||||
#2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
|
||||
#3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
|
||||
#4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
|
||||
#5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
|
||||
#6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
|
||||
#7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
|
||||
#8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
|
||||
#9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
|
||||
#10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
|
||||
#11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
|
||||
#12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
|
||||
#13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
|
||||
#14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
|
||||
#15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
|
||||
#16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
|
||||
#17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
|
||||
#18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
|
||||
#19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
|
||||
#20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
|
||||
#21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
|
||||
#22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
|
||||
#23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
||||
#24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
||||
#25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
|
||||
#26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
|
||||
#27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
|
||||
#28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
|
||||
#29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
|
||||
#30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
|
||||
#31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
|
||||
#32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
|
||||
#33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
|
||||
#34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
|
||||
#35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
|
||||
#36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
|
||||
#37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
|
||||
#38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
|
||||
#39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
|
||||
#40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
|
||||
#41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
|
||||
#42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
|
||||
#43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
|
||||
#44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
|
||||
#45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
|
||||
#46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
|
||||
#47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
||||
#48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
||||
#49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
||||
#50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
||||
#51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
||||
#52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
||||
#53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
||||
#54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
||||
#55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
|
||||
#56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
|
||||
#57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
||||
#58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
||||
#59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
||||
#60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
||||
#61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
|
||||
#62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
|
||||
#63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
|
||||
#64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
|
||||
#65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
|
||||
#66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
|
||||
#67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
|
||||
#68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
|
||||
#69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
|
||||
#70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
|
||||
#71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
|
||||
#72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
|
||||
#73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
|
||||
#74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
|
||||
#75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
|
||||
#76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
|
||||
#77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
|
||||
#78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
|
||||
#79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
|
||||
#80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
|
||||
#81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
|
||||
#82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
|
||||
#83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
|
||||
#84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
|
||||
#85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
|
||||
#86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
|
||||
#87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
|
||||
#88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
|
||||
#89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
|
||||
#90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
|
||||
#91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
|
||||
#92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
|
||||
#93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
||||
#94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
||||
#95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
||||
#96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
||||
#97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
|
||||
#98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
|
||||
#99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
|
||||
#100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
|
||||
#101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
|
||||
#102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
|
||||
#103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
||||
#104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
||||
#105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
|
||||
#106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
|
||||
#107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
||||
#108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
||||
#109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
|
||||
#110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
|
||||
#111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
|
||||
#112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
|
||||
#113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
||||
#114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
||||
#115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
|
||||
#116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
|
||||
#117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
|
||||
#118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
|
||||
#119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
|
||||
#120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
|
||||
|
||||
Vulnerability #4: GO-2026-6611
|
||||
Excessive CPU consumption from repeated initial window changes in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6611
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.9
|
||||
Example traces found:
|
||||
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
|
||||
#2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
|
||||
#3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
|
||||
#4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
|
||||
#5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
|
||||
#6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
|
||||
#7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
|
||||
#8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
|
||||
#9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
|
||||
#10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
|
||||
#11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
|
||||
#12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
|
||||
#13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
|
||||
#14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
|
||||
#15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
|
||||
#16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
|
||||
#17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
|
||||
#18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
|
||||
#19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
|
||||
#20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
|
||||
#21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
|
||||
#22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
|
||||
#23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
||||
#24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
||||
#25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
|
||||
#26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
|
||||
#27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
|
||||
#28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
|
||||
#29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
|
||||
#30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
|
||||
#31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
|
||||
#32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
|
||||
#33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
|
||||
#34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
|
||||
#35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
|
||||
#36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
|
||||
#37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
|
||||
#38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
|
||||
#39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
|
||||
#40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
|
||||
#41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
|
||||
#42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
|
||||
#43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
|
||||
#44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
|
||||
#45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
|
||||
#46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
|
||||
#47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
||||
#48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
||||
#49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
||||
#50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
||||
#51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
||||
#52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
||||
#53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
||||
#54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
||||
#55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
|
||||
#56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
|
||||
#57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
||||
#58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
||||
#59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
||||
#60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
||||
#61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
|
||||
#62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
|
||||
#63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
|
||||
#64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
|
||||
#65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
|
||||
#66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
|
||||
#67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
|
||||
#68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
|
||||
#69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
|
||||
#70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
|
||||
#71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
|
||||
#72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
|
||||
#73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
|
||||
#74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
|
||||
#75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
|
||||
#76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
|
||||
#77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
|
||||
#78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
|
||||
#79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
|
||||
#80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
|
||||
#81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
|
||||
#82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
|
||||
#83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
|
||||
#84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
|
||||
#85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
|
||||
#86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
|
||||
#87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
|
||||
#88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
|
||||
#89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
|
||||
#90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
|
||||
#91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
|
||||
#92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
|
||||
#93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
||||
#94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
||||
#95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
||||
#96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
||||
#97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
|
||||
#98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
|
||||
#99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
|
||||
#100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
|
||||
#101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
|
||||
#102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
|
||||
#103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
||||
#104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
||||
#105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
|
||||
#106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
|
||||
#107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
||||
#108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
||||
#109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
|
||||
#110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
|
||||
#111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
|
||||
#112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
|
||||
#113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
||||
#114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
||||
#115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
|
||||
#116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
|
||||
#117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
|
||||
#118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
|
||||
#119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
|
||||
#120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
|
||||
|
||||
Vulnerability #5: GO-2026-6610
|
||||
HTTP/2 transport accepts malformed framing-related headers in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6610
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.9
|
||||
Example traces found:
|
||||
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
|
||||
#2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
|
||||
|
||||
Vulnerability #6: GO-2026-6608
|
||||
Memory limit bypass when parsing MIME headers in net/textproto,
|
||||
mime/multipart
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6608
|
||||
Standard library
|
||||
Found in: net/textproto@go1.26
|
||||
Fixed in: net/textproto@go1.26.9
|
||||
Example traces found:
|
||||
#1: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader
|
||||
|
||||
Vulnerability #7: GO-2026-6607
|
||||
Reject malformed ECH outer extension references in crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6607
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.26
|
||||
Fixed in: crypto/tls@go1.26.9
|
||||
Example traces found:
|
||||
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext
|
||||
#2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read
|
||||
#3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write
|
||||
#4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext
|
||||
|
||||
Vulnerability #8: GO-2026-6605
|
||||
HTTP/1 client connection desynchronization after CONNECT rejection in
|
||||
net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6605
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.9
|
||||
Example traces found:
|
||||
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
|
||||
|
||||
Vulnerability #9: GO-2026-6603
|
||||
HTTP/2 server memory exhaustion due to Trailer headers in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6603
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.9
|
||||
Example traces found:
|
||||
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
|
||||
#2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
|
||||
#3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
|
||||
#4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
|
||||
#5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
|
||||
#6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
|
||||
#7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
|
||||
#8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
|
||||
#9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
|
||||
#10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
|
||||
#11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
|
||||
#12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
|
||||
#13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
|
||||
#14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
|
||||
#15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
|
||||
#16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
|
||||
#17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
|
||||
#18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
|
||||
#19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
|
||||
#20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
|
||||
#21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
|
||||
#22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
|
||||
#23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
||||
#24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
||||
#25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
|
||||
#26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
|
||||
#27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
|
||||
#28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
|
||||
#29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
|
||||
#30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
|
||||
#31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
|
||||
#32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
|
||||
#33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
|
||||
#34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
|
||||
#35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
|
||||
#36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
|
||||
#37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
|
||||
#38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
|
||||
#39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
|
||||
#40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
|
||||
#41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
|
||||
#42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
|
||||
#43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
|
||||
#44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
|
||||
#45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
|
||||
#46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
|
||||
#47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
||||
#48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
||||
#49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
||||
#50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
||||
#51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
||||
#52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
||||
#53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
||||
#54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
||||
#55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
|
||||
#56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
|
||||
#57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
||||
#58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
||||
#59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
||||
#60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
||||
#61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
|
||||
#62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
|
||||
#63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
|
||||
#64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
|
||||
#65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
|
||||
#66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
|
||||
#67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
|
||||
#68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
|
||||
#69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
|
||||
#70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
|
||||
#71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
|
||||
#72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
|
||||
#73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
|
||||
#74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
|
||||
#75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
|
||||
#76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
|
||||
#77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
|
||||
#78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
|
||||
#79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
|
||||
#80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
|
||||
#81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
|
||||
#82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
|
||||
#83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
|
||||
#84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
|
||||
#85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
|
||||
#86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
|
||||
#87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
|
||||
#88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
|
||||
#89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
|
||||
#90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
|
||||
#91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
|
||||
#92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
|
||||
#93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
||||
#94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
||||
#95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
||||
#96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
||||
#97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
|
||||
#98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
|
||||
#99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
|
||||
#100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
|
||||
#101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
|
||||
#102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
|
||||
#103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
||||
#104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
||||
#105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
|
||||
#106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
|
||||
#107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
||||
#108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
||||
#109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
|
||||
#110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
|
||||
#111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
|
||||
#112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
|
||||
#113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
||||
#114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
||||
#115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
|
||||
#116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
|
||||
#117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
|
||||
#118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
|
||||
#119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
|
||||
#120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
|
||||
|
||||
Vulnerability #10: GO-2026-6218
|
||||
Avoid quadratic complexity in resolvePath in net/url
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6218
|
||||
Standard library
|
||||
Found in: net/url@go1.26
|
||||
Fixed in: net/url@go1.26.6
|
||||
Example traces found:
|
||||
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls url.URL.Parse
|
||||
|
||||
Vulnerability #11: GO-2026-6090
|
||||
Limit handshake messages we are willing to accept post-handshake in
|
||||
crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6090
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.26
|
||||
Fixed in: crypto/tls@go1.26.6
|
||||
Example traces found:
|
||||
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext
|
||||
#2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read
|
||||
#3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write
|
||||
#4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext
|
||||
|
||||
Vulnerability #12: GO-2026-6089
|
||||
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6089
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.6
|
||||
Example traces found:
|
||||
#1: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
|
||||
|
||||
Vulnerability #13: GO-2026-5972
|
||||
Enforce maximum recursion depth in encoding/asn1
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5972
|
||||
Standard library
|
||||
Found in: encoding/asn1@go1.26
|
||||
Fixed in: encoding/asn1@go1.26.6
|
||||
Example traces found:
|
||||
#1: internal/hub/client.go:48:30: hub.NewClient calls x509.CertPool.AppendCertsFromPEM, which eventually calls asn1.Unmarshal
|
||||
|
||||
Vulnerability #14: GO-2026-5856
|
||||
Invoking Encrypted Client Hello privacy leak in crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5856
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.26
|
||||
Fixed in: crypto/tls@go1.26.5
|
||||
Example traces found:
|
||||
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext
|
||||
#2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read
|
||||
#3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write
|
||||
#4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext
|
||||
|
||||
Vulnerability #15: GO-2026-5039
|
||||
Arbitrary inputs are included in errors without any escaping in
|
||||
net/textproto
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5039
|
||||
Standard library
|
||||
Found in: net/textproto@go1.26
|
||||
Fixed in: net/textproto@go1.26.4
|
||||
Example traces found:
|
||||
#1: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader
|
||||
|
||||
Vulnerability #16: GO-2026-5037
|
||||
Inefficient candidate hostname parsing in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5037
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.26
|
||||
Fixed in: crypto/x509@go1.26.4
|
||||
Example traces found:
|
||||
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify
|
||||
#2: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.VerifyHostname
|
||||
#3: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls x509.HostnameError.Error
|
||||
|
||||
Vulnerability #17: GO-2026-5026
|
||||
Invoking failure to reject ASCII-only Punycode-encoded labels in
|
||||
golang.org/x/net/idna
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-5026
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.6
|
||||
Example traces found:
|
||||
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
|
||||
|
||||
Vulnerability #18: GO-2026-4971
|
||||
Panic in Dial and LookupPort when handling NUL byte on Windows in net
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4971
|
||||
Standard library
|
||||
Found in: net@go1.26
|
||||
Fixed in: net@go1.26.3
|
||||
Example traces found:
|
||||
#1: internal/storage/watchdog.go:404:22: storage.HostLiveness.Present calls net.DialTimeout
|
||||
#2: internal/pbs/probe.go:31:27: pbs.ProbeFingerprint calls net.Dialer.DialContext
|
||||
#3: internal/localapi/server.go:617:23: localapi.Server.Run calls net.Listen
|
||||
#4: internal/poke/poke.go:133:28: poke.Listener.serve calls net.ListenConfig.ListenPacket
|
||||
#5: internal/wgtunnel/manager.go:62:40: wgtunnel.netResolver.LookupIPv4 calls net.Resolver.LookupNetIP
|
||||
|
||||
Vulnerability #19: GO-2026-4947
|
||||
Unexpected work during chain building in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4947
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.26
|
||||
Fixed in: crypto/x509@go1.26.2
|
||||
Example traces found:
|
||||
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify
|
||||
|
||||
Vulnerability #20: GO-2026-4946
|
||||
Inefficient policy validation in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4946
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.26
|
||||
Fixed in: crypto/x509@go1.26.2
|
||||
Example traces found:
|
||||
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify
|
||||
|
||||
Vulnerability #21: GO-2026-4918
|
||||
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in
|
||||
net/http/internal/http2 in golang.org/x/net
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4918
|
||||
Standard library
|
||||
Found in: net/http@go1.26
|
||||
Fixed in: net/http@go1.26.3
|
||||
Example traces found:
|
||||
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
|
||||
|
||||
Vulnerability #22: GO-2026-4870
|
||||
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection
|
||||
retention and DoS in crypto/tls
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4870
|
||||
Standard library
|
||||
Found in: crypto/tls@go1.26
|
||||
Fixed in: crypto/tls@go1.26.2
|
||||
Example traces found:
|
||||
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext
|
||||
#2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read
|
||||
#3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write
|
||||
#4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext
|
||||
|
||||
Vulnerability #23: GO-2026-4866
|
||||
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in
|
||||
crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4866
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.26
|
||||
Fixed in: crypto/x509@go1.26.2
|
||||
Example traces found:
|
||||
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify
|
||||
|
||||
Vulnerability #24: GO-2026-4602
|
||||
FileInfo can escape from a Root in os
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4602
|
||||
Standard library
|
||||
Found in: os@go1.26
|
||||
Fixed in: os@go1.26.1
|
||||
Example traces found:
|
||||
#1: internal/storage/netmount.go:512:28: storage.SudoHostOps.MigrateNetworkUnits calls os.ReadDir
|
||||
|
||||
Vulnerability #25: GO-2026-4601
|
||||
Incorrect parsing of IPv6 host literals in net/url
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4601
|
||||
Standard library
|
||||
Found in: net/url@go1.26
|
||||
Fixed in: net/url@go1.26.1
|
||||
Example traces found:
|
||||
#1: internal/config/config.go:999:21: config.HubConfig.Validate calls url.Parse
|
||||
#2: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS, which eventually calls url.ParseRequestURI
|
||||
#3: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls url.URL.Parse
|
||||
|
||||
Vulnerability #26: GO-2026-4600
|
||||
Panic in name constraint checking for malformed certificates in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4600
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.26
|
||||
Fixed in: crypto/x509@go1.26.1
|
||||
Example traces found:
|
||||
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify
|
||||
|
||||
Vulnerability #27: GO-2026-4599
|
||||
Incorrect enforcement of email constraints in crypto/x509
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-4599
|
||||
Standard library
|
||||
Found in: crypto/x509@go1.26
|
||||
Fixed in: crypto/x509@go1.26.1
|
||||
Example traces found:
|
||||
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify
|
||||
|
||||
Your code is affected by 27 vulnerabilities from the Go standard library.
|
||||
This scan also found 10 vulnerabilities in packages you import and 13
|
||||
vulnerabilities in modules you require, but your code doesn't appear to call
|
||||
these vulnerabilities.
|
||||
Use '-show verbose' for more details.
|
||||
+1170
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
@@ -0,0 +1,82 @@
|
||||
=== cloudflare/cloudflared:2026.9.3 13.7 debian
|
||||
cloudflare/cloudflared:2026.9.3 (debian 13.7) debian all={'MEDIUM': 25, 'LOW': 10, 'HIGH': 1} fixable={'HIGH': 1, 'MEDIUM': 10, 'LOW': 2}
|
||||
usr/local/bin/cloudflared gobinary all={'MEDIUM': 9, 'UNKNOWN': 7, 'HIGH': 4, 'LOW': 1} fixable={'MEDIUM': 9, 'HIGH': 4, 'UNKNOWN': 6, 'LOW': 1}
|
||||
go pkgs w/ vulns: [('golang.org/x/crypto', 'v0.55.0'), ('golang.org/x/net', 'v0.58.0'), ('stdlib', 'v1.26.8')]
|
||||
HIGH CVE-2026-78669 golang.org/x/net v0.58.0 -> 0.60.0 | net/http: net/http/internal/http2: golang: golang.org/x/net/
|
||||
HIGH CVE-2026-78667 stdlib v1.26.8 -> 1.26.9, 1.27.2 | net/http: golang: golang: Denial of Service via crafted HTTP
|
||||
HIGH CVE-2026-78669 stdlib v1.26.8 -> 1.26.9, 1.27.2 | net/http: net/http/internal/http2: golang: golang.org/x/net/
|
||||
HIGH CVE-2026-97031 stdlib v1.26.8 -> 1.26.9, 1.27.2 | crypto/tls: golang: crypto/tls: Denial of Service via multip
|
||||
=== gitea.dooplex.hu/admin/felhom-controller:0.307.0 12.15 debian
|
||||
gitea.dooplex.hu/admin/felhom-controller:0.307.0 (debian 12. debian all={'LOW': 215, 'HIGH': 144, 'MEDIUM': 275, 'UNKNOWN': 17, 'CRITICAL': 16} fixable={'HIGH': 23, 'MEDIUM': 27, 'LOW': 1, 'CRITICAL': 12, 'UNKNOWN': 1}
|
||||
CRIT-fixable CVE-2026-13221 libperl5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4
|
||||
CRIT-fixable CVE-2026-42496 libperl5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4
|
||||
CRIT-fixable CVE-2026-8376 libperl5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4
|
||||
CRIT-fixable CVE-2026-13221 perl 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4
|
||||
CRIT-fixable CVE-2026-42496 perl 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4
|
||||
CRIT-fixable CVE-2026-8376 perl 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4
|
||||
CRIT-fixable CVE-2026-13221 perl-base 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4
|
||||
CRIT-fixable CVE-2026-42496 perl-base 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4
|
||||
CRIT-fixable CVE-2026-8376 perl-base 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4
|
||||
CRIT-fixable CVE-2026-13221 perl-modules-5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4
|
||||
CRIT-fixable CVE-2026-42496 perl-modules-5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4
|
||||
CRIT-fixable CVE-2026-8376 perl-modules-5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4
|
||||
usr/bin/docker gobinary all={'HIGH': 3, 'MEDIUM': 5, 'LOW': 1, 'UNKNOWN': 4} fixable={'HIGH': 3, 'MEDIUM': 5, 'LOW': 1, 'UNKNOWN': 4}
|
||||
go pkgs w/ vulns: [('stdlib', 'v1.26.8')]
|
||||
usr/libexec/docker/cli-plugins/docker-compose gobinary all={'MEDIUM': 9, 'UNKNOWN': 7, 'HIGH': 4, 'LOW': 1} fixable={'MEDIUM': 9, 'HIGH': 4, 'UNKNOWN': 6, 'LOW': 1}
|
||||
go pkgs w/ vulns: [('github.com/containerd/containerd/v2', 'v2.3.4'), ('golang.org/x/crypto', 'v0.56.0'), ('golang.org/x/net', 'v0.58.0'), ('stdlib', 'v1.26.6')]
|
||||
HIGH CVE-2026-78667 stdlib v1.26.6 -> 1.26.9, 1.27.2 | net/http: golang: golang: Denial of Service via crafted HTTP
|
||||
HIGH CVE-2026-78669 stdlib v1.26.6 -> 1.26.9, 1.27.2 | net/http: net/http/internal/http2: golang: golang.org/x/net/
|
||||
HIGH CVE-2026-97031 stdlib v1.26.6 -> 1.26.9, 1.27.2 | crypto/tls: golang: crypto/tls: Denial of Service via multip
|
||||
usr/local/bin/felhom-controller gobinary all={'HIGH': 34, 'MEDIUM': 22, 'UNKNOWN': 6, 'LOW': 2} fixable={'HIGH': 34, 'MEDIUM': 22, 'UNKNOWN': 5, 'LOW': 2}
|
||||
go pkgs w/ vulns: [('golang.org/x/crypto', 'v0.31.0'), ('golang.org/x/sys', 'v0.37.0'), ('stdlib', 'v1.24.13')]
|
||||
HIGH CVE-2025-22869 golang.org/x/crypto v0.31.0 -> 0.35.0 | golang.org/x/crypto/ssh: Denial of Service in the Key Exchan
|
||||
HIGH CVE-2025-47913 golang.org/x/crypto v0.31.0 -> 0.43.0 | golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent
|
||||
HIGH CVE-2026-39828 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthoriz
|
||||
HIGH CVE-2026-39829 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of
|
||||
HIGH CVE-2026-39830 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of
|
||||
HIGH CVE-2026-39831 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security k
|
||||
HIGH CVE-2026-39832 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent
|
||||
HIGH CVE-2026-39835 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: De
|
||||
HIGH CVE-2026-42508 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/cry
|
||||
HIGH CVE-2026-46595 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorizat
|
||||
HIGH CVE-2026-46597 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of
|
||||
HIGH CVE-2026-56854 golang.org/x/crypto v0.31.0 -> 0.55.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentica
|
||||
HIGH CVE-2026-25679 stdlib v1.24.13 -> 1.25.8, 1.26.1 | net/url: Incorrect parsing of IPv6 host literals in net/url
|
||||
HIGH CVE-2026-27145 stdlib v1.24.13 -> 1.25.11, 1.26.4 | crypto/x509: golang: golang crypto/x509: Denial of Service v
|
||||
HIGH CVE-2026-32280 stdlib v1.24.13 -> 1.25.9, 1.26.2 | crypto/x509: crypto/tls: golang: Go: Denial of Service vulne
|
||||
HIGH CVE-2026-32281 stdlib v1.24.13 -> 1.25.9, 1.26.2 | crypto/x509: golang: Go crypto/x509: Denial of Service via i
|
||||
HIGH CVE-2026-32283 stdlib v1.24.13 -> 1.25.9, 1.26.2 | crypto/tls: golang: Go crypto/tls: Denial of Service via mul
|
||||
HIGH CVE-2026-33811 stdlib v1.24.13 -> 1.25.10, 1.26.3 | net: golang: Go net package: Denial of Service via long CNAM
|
||||
HIGH CVE-2026-33814 stdlib v1.24.13 -> 1.25.10, 1.26.3 | net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2
|
||||
HIGH CVE-2026-33818 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | encoding/asn1: golang: Go encoding/asn1: Denial of Service v
|
||||
HIGH CVE-2026-39820 stdlib v1.24.13 -> 1.25.10, 1.26.3 | net/mail: golang: Go net/mail: Denial of Service via crafted
|
||||
HIGH CVE-2026-39821 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | golang.org/x/net/idna: golang: net/http: golang.org/x/net/id
|
||||
HIGH CVE-2026-39822 stdlib v1.24.13 -> 1.25.12, 1.26.5, 1.27.0-rc.2 | golang: Go os.Root: Symlink following vulnerability allows d
|
||||
HIGH CVE-2026-39836 stdlib v1.24.13 -> 1.25.10, 1.26.3 | net: golang: Go net package: Denial of Service via NUL byte
|
||||
HIGH CVE-2026-42499 stdlib v1.24.13 -> 1.25.10, 1.26.3 | net/mail: golang: net/mail: Denial of Service via pathologic
|
||||
HIGH CVE-2026-42504 stdlib v1.24.13 -> 1.25.11, 1.26.4 | mime: golang: Golang MIME: Denial of Service via maliciously
|
||||
HIGH CVE-2026-56853 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | net/http: golang: Go net/http: Unencrypted HTTP/2 connection
|
||||
HIGH CVE-2026-56858 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | html/template: golang: Go html/template: Cross-Site Scriptin
|
||||
HIGH CVE-2026-56859 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | encoding/xml: golang: Go: Denial of Service via XML decoding
|
||||
HIGH CVE-2026-56860 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | net/url: golang: golang net/url: Denial of Service from quad
|
||||
HIGH CVE-2026-56862 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | crypto/tls: golang: Golang crypto/tls: Denial of Service via
|
||||
HIGH CVE-2026-78667 stdlib v1.24.13 -> 1.26.9, 1.27.2 | net/http: golang: golang: Denial of Service via crafted HTTP
|
||||
HIGH CVE-2026-78669 stdlib v1.24.13 -> 1.26.9, 1.27.2 | net/http: net/http/internal/http2: golang: golang.org/x/net/
|
||||
HIGH CVE-2026-97031 stdlib v1.24.13 -> 1.26.9, 1.27.2 | crypto/tls: golang: crypto/tls: Denial of Service via multip
|
||||
=== gitea.dooplex.hu/admin/felhom-hub:0.146.0 3.21.8 alpine
|
||||
gitea.dooplex.hu/admin/felhom-hub:0.146.0 (alpine 3.21.8) alpine all={'HIGH': 2, 'MEDIUM': 17, 'LOW': 2} fixable={'HIGH': 2, 'MEDIUM': 17, 'LOW': 2}
|
||||
usr/local/bin/felhom-hub gobinary all={'HIGH': 34, 'MEDIUM': 22, 'UNKNOWN': 6, 'LOW': 2} fixable={'HIGH': 34, 'MEDIUM': 22, 'UNKNOWN': 5, 'LOW': 2}
|
||||
=== gitea.dooplex.hu/admin/felhom-samba:1.1.0 3.21.7 alpine
|
||||
gitea.dooplex.hu/admin/felhom-samba:1.1.0 (alpine 3.21.7) alpine all={'HIGH': 48, 'MEDIUM': 59, 'LOW': 28} fixable={'HIGH': 48, 'MEDIUM': 59, 'LOW': 28}
|
||||
=== gtstef/filebrowser:1.5.6-stable 3.24.1 alpine
|
||||
gtstef/filebrowser:1.5.6-stable (alpine 3.24.1) alpine all={'HIGH': 2, 'MEDIUM': 8, 'LOW': 12, 'CRITICAL': 1} fixable={'HIGH': 2, 'MEDIUM': 8, 'LOW': 12, 'CRITICAL': 1}
|
||||
CRIT-fixable CVE-2026-13221 perl 5.42.2-r0 -> 5.42.2-r1
|
||||
home/filebrowser/filebrowser gobinary all={'UNKNOWN': 7, 'HIGH': 4, 'MEDIUM': 7, 'LOW': 1} fixable={'HIGH': 4, 'MEDIUM': 7, 'UNKNOWN': 6, 'LOW': 1}
|
||||
go pkgs w/ vulns: [('golang.org/x/crypto', 'v0.56.0'), ('golang.org/x/net', 'v0.58.0'), ('stdlib', 'v1.27.1')]
|
||||
HIGH CVE-2026-78667 stdlib v1.27.1 -> 1.26.9, 1.27.2 | net/http: golang: golang: Denial of Service via crafted HTTP
|
||||
HIGH CVE-2026-78669 stdlib v1.27.1 -> 1.26.9, 1.27.2 | net/http: net/http/internal/http2: golang: golang.org/x/net/
|
||||
HIGH CVE-2026-97031 stdlib v1.27.1 -> 1.26.9, 1.27.2 | crypto/tls: golang: crypto/tls: Denial of Service via multip
|
||||
=== traefik:v3.7.13 3.24.2 alpine
|
||||
traefik:v3.7.13 (alpine 3.24.2) alpine all={'MEDIUM': 1} fixable={'MEDIUM': 1}
|
||||
usr/local/bin/traefik gobinary all={'MEDIUM': 9, 'LOW': 5, 'UNKNOWN': 7, 'HIGH': 4} fixable={'MEDIUM': 9, 'LOW': 5, 'HIGH': 4, 'UNKNOWN': 6}
|
||||
go pkgs w/ vulns: [('go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc', 'v0.20.0'), ('go.opentelemetry.io/otel/exporters/otlp/otlptrace', 'v1.44.0'), ('go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc', 'v1.44.0'), ('go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp', 'v1.44.0'), ('go.opentelemetry.io/otel/sdk', 'v1.44.0'), ('go.opentelemetry.io/otel/sdk/log', 'v0.20.0'), ('golang.org/x/crypto', 'v0.56.0'), ('golang.org/x/net', 'v0.58.0')]
|
||||
BIN
Binary file not shown.
Reference in New Issue
Block a user