Bump klauspost/compress to v1.18.7 and review the expired agent CVE exceptions - #493
Open
ai-collaboration-app[bot] wants to merge 2 commits into
Open
Bump klauspost/compress to v1.18.7 and review the expired agent CVE exceptions#493ai-collaboration-app[bot] wants to merge 2 commits into
ai-collaboration-app[bot] wants to merge 2 commits into
Conversation
GO-2026-5841 is an out-of-bounds read in github.com/klauspost/compress/s2, introduced in 1.16.0 and fixed in 1.18.7. The agent and cluster-agent images both still carried v1.18.5, and the exception covering it expired 2026-08-20. Bumped in the 19 workspace modules that pinned v1.18.5, then re-synced with go work sync and per-module go mod tidy; go work sync added the indirect requirement to two more modules. datadogconnector (v1.18.0) and test/integration/serverless/src (v1.17.11) are outside go.work and ship in neither image, so they are left for separate review. The GO-2026-5841 exceptions are dropped rather than renewed: with the fix in source they would suppress a regression instead of documenting a gap. Verified that the rebuilt cluster-agent and process-agent binaries embed compress v1.18.7 via go version -m, and that a cluster-agent image carrying the rebuilt binary reports zero Trivy and zero Grype findings, down from 9 and 6 on the published tag. Refs: StackVista/cve-reporter#29 Tracking: #492 Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
Every stackstate-k8s-agent and stackstate-k8s-cluster-agent exception expired on 2026-08-20. The SLA requires re-checking upstream at each renewal rather than extending the date, and that re-check changes the answer for most of them. Seven python entries are obsolete. They were written against the embedded 3.13.13 runtime, and the 3.13.15 bump in #463 already carries the fix: Grype now lists 3.13.15 among the fixed versions for CVE-2025-15366, CVE-2026-0864, CVE-2026-11940, CVE-2026-11972, CVE-2026-12003, CVE-2026-15308 and CVE-2026-6879. Renewing them would have asserted an upstream gap that no longer exists, and keeping them would suppress the findings if the interpreter ever moved back. CVE-2025-15367 and CVE-2026-4360 survive the re-check -- the first is fixed only in the 3.15.0a6 pre-release, the second has no fixed version at all -- so they keep a short review deadline and their purl moves to 3.13.15 to match what the image will contain. CVE-2026-14456 is new, and is not a version bump. Scanners name 3.5.8, 3.6.4 and 4.0.2 as fixed, but none of those are released: the newest tags are 3.5.7, 3.6.3 and 4.0.1, and OSV enumerates all three as affected. 3.5.7 is already what we pin. The vulnerable path is the QUIC server listener, which the agent does not run. Without an entry the finding publishes unmanaged. The cryptography entries keep a deadline on the SLA date and now name the actual blocker: the version is pinned in stackstate-agent-integrations at the tag STACKSTATE_INTEGRATIONS_VERSION selects, so it cannot be changed here. Refs: StackVista/cve-reporter#29 Tracking: #492, #489, #484 Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the one remaining compatible patch in the cve-reporter#29 batch and brings
the agent exception set back in line with what is now true.
klauspost/compressv1.18.5 → v1.18.7 (GO-2026-5841, OOB read ins2) acrossthe 19 workspace modules that pinned it, plus
go work syncand per-module tidy.datadogconnectorandtest/integration/serverless/srcare outsidego.workandship in neither image, so they are left for separate review.
Exceptions. All of them expired 2026-08-20, and the required re-check changes
most answers rather than the date:
renewing would assert a gap that no longer exists.
GO-2026-5841on both images — fixed in source here.CVE-2026-14456(openssl). Not a bump: scanners name 3.5.8/3.6.4/4.0.2,none of which are released — newest are 3.5.7/3.6.3/4.0.1 and OSV lists all
three as affected. Without an entry it publishes unmanaged ([stackstate-agent] CVE-2026-14456 (openssl 3.5.7) — no upstream fix published, needs a tracked exception #489).
CVE-2025-15367,CVE-2026-4360, cryptography andx/cryptoon shortdeadlines; the cryptography text now names the real blocker.
Not in this PR:
cryptography48.0.1 → 50.0.0 is pinned instackstate-agent-integrations at the tag
STACKSTATE_INTEGRATIONS_VERSIONselects,so it cannot be changed here until that tag ships (#484 / STAC-25514). Go 1.26.6,
x/modv0.40.0, embedded Python 3.13.15 and etcd v3.6.14 are already on thedefault branch.
Validation
cluster-agent(fullCLUSTER_AGENT_TAGS) andprocess-agentbuild; bothbinaries embed compress v1.18.7 per
go version -m.no new findings. Separate Trivy secret scan: 0 before and after.
versionsmoke test reports go1.26.6.
pkg/util/compressionandpkg/serializerpass with-tags test,zlib,zstd.TestAgentPayloadVersionfails identically on the base commit — it needsldflags a plain
go testdoes not set.Reviewer note: the two
GO-2026-5932files failexception.schema.jsononseverity: UNKNOWN, which the enum does not model. Pre-existing, and the Goevaluator does not enforce the schema.
Batch: https://github.com/StackVista/cve-reporter/issues/29
Finding revision:
sha256:947695f5fdd8967e45a4d27e0b80e2dfb1bb4f8f8f1cff4c719de92eb9af3a0bTracking: #492