[HUM-147] Suppress 3 unfixed docker cp/archive CVEs in govulncheck allow-list - #47
Merged
Conversation
…low-list
govulncheck gates `make sec` and now flags three unfixed github.com/docker/docker
findings (Fixed in: N/A, no version bump resolves them). It cannot do symbol-level
reachability for the +incompatible docker module, so it flags on import alone.
- GO-2026-5668 / GO-2026-5617 (docker cp host-side races): unreachable — human only
streams a tar INTO containers via CopyToContainer, never copies content out to a
host path and never uses the `docker cp` CLI.
- GO-2026-5746 (PUT /containers/{id}/archive executes a container binary on the host):
reachable (CopyToContainer is used in internal/devcontainer/feature.go), but the
exploit needs a malicious base image; operator-declared images plus the daemon's
existing host Docker access put a hostile image outside the trust boundary already.
Documented as an explicit residual-risk acceptance, not a "not reachable" claim.
Each ID carries a per-finding justification and the existing review-date reminder.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds three unfixed
github.com/docker/dockerCVEs to theSUPPRESSEDallow-list inscripts/govulncheck.sh, so themake secgovulncheck gate passes again. Each carries a per-ID justification.Why
These are freshly-disclosed, unfixed upstream (
Fixed in: N/A) —make upgrade-depsis a no-op (deps already current;docker/docker v28.5.2is latest), so there is no version to move to. govulncheck can't do symbol-level reachability for the+incompatibledocker module, so it flags on import alone.Per-CVE rationale (honest, differentiated)
docker cpsymlink-swap race → arbitrary empty host filehumanonly streams a tar into containers viaCopyToContainer; never copies out to a host path, never uses thedocker cpCLIdocker cprace → bind-mount redirection to host pathhumandoes no container→host copyPUT /containers/{id}/archiveexecutes container binary on hosthumanusesCopyToContainer(internal/devcontainer/feature.go) to install devcontainer features. Exploit needs a malicious base image; operator-declareddevcontainer.jsonimages + the daemon's existing host-Docker access already place a hostile image outside the trust boundary. Documented as residual risk, not a false "unreachable" claim.Reviewer note
The only judgment call is suppressing GO-2026-5746 (residual-risk acceptance vs. leaving the gate red until an upstream fix, or hardening the feature-install path). The other two are genuinely unreachable. Re-evaluate the whole allow-list when Moby ships a fix (review date already in the script).
Verification
make sec→ "OK: no vulnerabilities outside the suppression list"bash -n scripts/govulncheck.shclean🤖 Generated with Claude Code