71 lines
1.8 KiB
HCL
71 lines
1.8 KiB
HCL
# Copyright IBM Corp. 2020, 2026
|
|
# SPDX-License-Identifier: BUSL-1.1
|
|
|
|
container {
|
|
dependencies = true
|
|
alpine_secdb = true
|
|
secrets = false
|
|
|
|
# Triage items that are _safe_ to ignore here. Note that this list should be
|
|
# periodically cleaned up to remove items that are no longer found by the scanner.
|
|
triage {
|
|
suppress {
|
|
vulnerabilities = [
|
|
# busybox@1.37.0-r12 https://nvd.nist.gov/vuln/detail/CVE-2025-46394
|
|
#
|
|
# Boundary does not shell out to the busybox tar program.
|
|
"CVE-2025-46394",
|
|
|
|
# busybox@1.37.0-r12 https://nvd.nist.gov/vuln/detail/CVE-2024-58251
|
|
#
|
|
# Boundary does not shell out to the busybox netstat program.
|
|
"CVE-2024-58251",
|
|
|
|
# gnupg@2.4.7-r0 https://nvd.nist.gov/vuln/detail/CVE-2025-30258
|
|
#
|
|
# Boundary does not utilize GnuPG to import certificates.
|
|
"CVE-2025-30258",
|
|
|
|
# iputils@20240905-r0 https://nvd.nist.gov/vuln/detail/CVE-2025-47268
|
|
#
|
|
# Boundary does not utilize ping in iputils.
|
|
"CVE-2025-47268",
|
|
|
|
# iputils@20240905-r0 https://nvd.nist.gov/vuln/detail/CVE-2025-48964
|
|
#
|
|
# Boundary does not utilize ping in iputils.
|
|
"CVE-2025-48964",
|
|
|
|
# libgcrypt@1.10.3-r1 https://nvd.nist.gov/vuln/detail/CVE-2026-41989
|
|
#
|
|
# There is no fix available in the Alpine Docker image yet.
|
|
"CVE-2026-41989",
|
|
]
|
|
}
|
|
}
|
|
}
|
|
|
|
binary {
|
|
secrets = true
|
|
go_modules = true
|
|
osv = true
|
|
oss_index = true
|
|
nvd = true
|
|
|
|
triage {
|
|
suppress {
|
|
vulnerabilities = [
|
|
# golang.org/x/crypto/openpgp (GO-2026-5932)
|
|
# https://pkg.go.dev/vuln/GO-2026-5932
|
|
#
|
|
# The advisory is specific to openpgp; Boundary does not import this package.
|
|
#
|
|
# $ go mod why golang.org/x/crypto/openpgp
|
|
# # golang.org/x/crypto/openpgp
|
|
# (main module does not need package golang.org/x/crypto/openpgp)
|
|
"GO-2026-5932",
|
|
]
|
|
}
|
|
}
|
|
}
|