stevenhorsman 7033d56e2c runtime: ignore false positive CRI-O vulnerabilities ...

Add osv-scanner ignores for GO-2025-3426 (CVE-2025-0750) and
GO-2025-3897 (CVE-2025-4437), which are false positives for
kata-containers.

The vulnerabilities have been open for 10 and 16 months and there
is no indication that the cri-o community have any intension of addressing
the situation. They also only affect the main CRI-O runtime code (log
management and user creation functions), but kata-containers only
imports github.com/cri-o/cri-o/pkg/annotations for string constant
definitions. The vulnerable code paths are not imported or used,
therefore we should just filter these out.

GO-2025-3426: Path traversal in UnMountPodLogs/LinkContainerLogs
GO-2025-3897: Memory exhaustion when reading /etc/passwd

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
Generated-By: IBM Bob

2026-06-05 10:08:06 +01:00

1.2 KiB

Raw Permalink Blame History

View Raw