Cam Proudlock
d49b421914
scripts/scan_sbom.py checks the generated SBOM against OSV.dev by purl. The SBOM shipped to every server and nothing read it, so 'are we exposed to this advisory' was still a person going and looking. Shipped and build-only findings are both reported, but only shipped components can fail a build - the highest-severity match in the tree today is against the test runner, and a gate that fails a release over that gets bypassed and then catches nothing. Severity is taken from the advisory rather than derived from a CVSS vector, and an advisory with no recorded word is reported UNKNOWN and never gates. scripts/vulnerability-allowlist.json records reviewed advisories with the reason, the accepter, the date, and what would invalidate the reasoning. Documented in docs/DEPENDENCY-SECURITY.md.
28 lines
1.5 KiB
JSON
28 lines
1.5 KiB
JSON
{
|
|
"_comment": [
|
|
"Advisories reviewed and accepted, with the reason and the date.",
|
|
"This is a RECORD, not a mute button: an entry says somebody looked at",
|
|
"the advisory and worked out why it does not apply here. Anyone can",
|
|
"re-read the reason and disagree.",
|
|
"",
|
|
"An entry needs an id, a reason that names the precondition that is",
|
|
"absent, who accepted it, and when. 'reviewuntil' is when the reasoning",
|
|
"should be checked again - a reason stops being true when the code that",
|
|
"made it true changes.",
|
|
"",
|
|
"Do NOT add an entry to make a build pass. Upgrading the dependency is",
|
|
"almost always cheaper than defending a decision to skip it."
|
|
],
|
|
"accepted": [
|
|
{
|
|
"id": "GHSA-xgmm-8j9v-c9wx",
|
|
"component": "pyjwt",
|
|
"reason": "Needs a verifier configured with BOTH symmetric and asymmetric algorithms and a raw JSON JWK passed as key=. Neither is present: auth goes through flask-jwt-extended with no JWT_ALGORITHM or JWT_DECODE_ALGORITHMS override anywhere in the tree, so it is HS256-only, and the key is the JWT_SECRET_KEY string. Upstream rates the attack complexity High for exactly this reason. Upgrade to pyjwt 2.13.0 anyway at the next dependency bump; this entry only says it is not urgent.",
|
|
"acceptedby": "DT team, reference site",
|
|
"accepted": "2026-08-29",
|
|
"reviewuntil": "2026-11-29",
|
|
"invalidatedby": "Setting JWT_ALGORITHM or JWT_DECODE_ALGORITHMS to anything asymmetric, or moving to SSO-issued tokens verified against a JWK."
|
|
}
|
|
]
|
|
}
|