Repository navigation
Scan published Server images for actionable vulnerabilities #802
Description
Problem
The Server release workflow verifies the published image's trust stores, readiness, Compose behavior, database TLS, and protocol behavior, but it does not currently inventory vulnerabilities in the final multi-architecture image. A source dependency scan alone cannot see distribution packages added by the production Dockerfile.
Current release evidence
Security scanned the exact published Server 2.11.5 manifests at 2026-10-28 15:10 UTC. The complete receipt and dispositions supersede the earlier 2.11.3/2.11.4 inventories.
- Multi-architecture index:
sha256:f4f2ec64a6522ee18a31542a30554873dbaa2f5d3af3ccb52deb914591699c20. - amd64:
sha256:bcc672859a399d1df234fc304531ab06b7bfa8acad7cb2c9da95f8e7ab5c98b4. - arm64:
sha256:3160f4f58ab9b144705c3e4d5d97b0881b0891c1f00e9ab6b99b3245a8c3b26a. - Pinned Trivy:
0.76.1@sha256:2e6c00d711ab4ae41d8a30c2c1fd3bd3b62704c177bb120f95012e939edfb3df. - Vulnerability DB v2 updated
2026-10-28T13:01:10.618103814Z.
Both platforms have the same Debian 13.7 inventory: 147 high/critical OS-package rows, 86 unique advisory IDs, three critical and 144 high, with zero supported fixed versions. Composer, Node and Cargo inventory has zero high/critical findings. The receipt includes the identical normalized inventory fingerprint.
The three critical rows currently have no identified reachable critical path in this image: CVE-2026-6653 in libxml2 has no identified non-test parser use in the exact source; CVE-2026-93221 and CVE-2026-99083 concern host-kernel services and are attributed to userspace headers in linux-libc-dev. These dispositions are specific to the scanned image and current evidence.
Security found no actionable fixed-version high/critical finding and added no incident, rollback, release hold or Rust gate. This is read-only inventory evidence, not completed scan automation.
General retains implementation of exact-manifest release scans and scheduled rescans of the latest stable image. Next: add the repository-owned scan command and thin Actions integration, retain compact receipts, and qualify the actionable-risk policy before closing this issue.
Acceptance criteria
- Scan the exact amd64 and arm64 platform digests of a release candidate or newly published stable image with a pinned scanner and current vulnerability database.
- Retain a compact, metadata-only receipt containing platform digest, scanner/database version and time, advisory IDs, packages, installed versions, fix status, and disposition. Do not retain large image exports or redundant full reports.
- Distinguish OS packages from language dependencies and build/header packages from reachable runtime code.
- Use a risk-tiered policy: hold promotion for an actionable fixed-version high/critical finding or an explicitly reachable unpatched critical finding. Do not make supported-distribution, no-fix inventory a permanent release failure.
- Schedule a rescan of the latest stable image so newly published advisories or fixes are detected after release.
- Update one owning issue with the latest disposition rather than opening a new issue for every unchanged scanner row.
- If a package appears unnecessary at runtime, evaluate removing it separately with conformance and production-runtime qualification; do not remove packages speculatively.
References
- Debian tracker: https://security-tracker.debian.org/tracker/CVE-2026-6653
- Debian tracker: https://security-tracker.debian.org/tracker/CVE-2026-93221
Activity
rmcdaniel commentedon Oct 27, 2026
Latest-stable receipt: Server
2.11.4was published at source commitad3ac5fda0a30a58084b2d68569f2d91e23fabf3on 2026-10-27. I scanned both exact platform manifests with the same pinned Trivy 0.76.1 image and vulnerability database used for the 2.11.3 baseline (database updated2026-10-27T01:25:30Z):sha256:9dd7e5fc8382c0bbdda106ffac86ab8edc4264545e2df3c7e43209884fb8091dsha256:bee30cde5b70a429561a49f25daf4ef71a1e405d43322f78ff1b8137029c80f3sha256:cc297aa7d1f81b8bfa1169de6980dabe58d9776dcf513f379dcba2a51b1f5cc7Both platforms again report Debian 13.7, 144 high/critical package rows, 83 unique advisory IDs, two critical rows, zero rows with a supported
FixedVersion, and zero high/critical language-package findings. The normalized advisory/package/version/fix-status set has SHA-256 fingerprint3fc4d75b89623837df3f0110f2caa54dfd3891711bd7bbd52baf721961cb459don both platforms and matches 2.11.3 exactly.The critical dispositions therefore remain unchanged:
CVE-2026-6653is the Debian stablelibxml2no-DSA/minor item with no identified Server parser reachability, andCVE-2026-93221is thenfsdkernel race attributed to the image'slinux-libc-devheaders rather than a kernel supplied or run by the container. No incident, rollback, or 2.11.4/Rust work hold is indicated by this scan.rmcdaniel commentedon Oct 28, 2026
Latest-stable receipt: Server
2.11.5was published at source commit721b2831975cc898cc39d7528c5ba7e8441fe744. At 2026-10-28 15:10 UTC I scanned both exact platform manifests with pinned Trivy0.76.1@sha256:2e6c00d711ab4ae41d8a30c2c1fd3bd3b62704c177bb120f95012e939edfb3dfand vulnerability DB v2 updated2026-10-28T13:01:10.618103814Z:sha256:f4f2ec64a6522ee18a31542a30554873dbaa2f5d3af3ccb52deb914591699c20sha256:bcc672859a399d1df234fc304531ab06b7bfa8acad7cb2c9da95f8e7ab5c98b4sha256:3160f4f58ab9b144705c3e4d5d97b0881b0891c1f00e9ab6b99b3245a8c3b26aBoth platform results are identical: Debian 13.7, 147 high/critical OS-package rows representing 86 unique advisory IDs, 3 critical and 144 high. Zero rows have a supported
FixedVersion; Composer, Node and Cargo inventory have zero high/critical findings. The normalized advisory/package/installed-version/fix-status set has SHA-256 fingerprint47a15aa2b29cf58b5ecccd4fe3635183c66039966caa94a5b9bfabb9023dd786on both platforms.The current-DB counts are three rows and three unique IDs higher than the 2.11.4 receipt. The two prior critical dispositions remain unchanged. The new critical row is
CVE-2026-99083onlinux-libc-dev 6.12.113-1: Debian identifies aksmbdkernel heap out-of-bounds write, lists Trixie security as vulnerable with no stable fixed version, and fixes it only in unstablelinux 7.2.12-1(tracker). As with the existingnfsdrow, the container contains userspace kernel headers; it does not supply or run the host kernel orksmbd. Thelibxml2row still has no identified non-test parser reachability in the exact Server source.Disposition: no actionable fixed-version high/critical finding, no explicitly reachable unpatched critical path, and no incident, rollback, release hold, or Rust #325 gate. This was a read-only image inventory; neither platform image was executed and no source or schedule was changed. General retains the scan-automation implementation.
rmcdaniel commentedon Oct 30, 2026
Latest-stable runtime-image receipt: I scanned both exact
2.11.7platform manifests at 2026-10-30 02:56–02:57 UTC.Identity:
f55f90e54a213872f1c164a1b22c082d859c18aasha256:96e3e7de8c58f31bfb1ef4d5bddddc2678f4684f5cb3505e6e9ddc6fa3f7f625sha256:be7c2288ff935396262d743590530b204fac11b76582e56a525cc81a8da840d3sha256:7dbc3db050fec05ea5cd10e07ac8399ecf3e285d593bca32979a2320f02a104faquasec/trivy:0.76.1@sha256:2e6c00d711ab4ae41d8a30c2c1fd3bd3b62704c177bb120f95012e939edfb3df2026-10-30T01:01:11.134360213Z, downloaded2026-10-30T02:51:55.649556823ZBoth architectures report Debian 13.7 and have the same normalized high/critical inventory fingerprint,
b339c784d6b5337328a165efe3b3b3513af151d22480e529670dcf89d51d3ddc: 151 OS-package rows, 90 unique advisory IDs, 2 critical and 149 high. Zero rows report a supportedFixedVersion. Cargo, Composer-vendor and Node inventories contain zero high/critical findings.Critical dispositions:
CVE-2026-6653,libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3: Debian still marks Trixie vulnerable but explicitlyno-dsa/ minor, with the fix only in unstable. Exact release-source search again found no non-test Server use of DOM/SimpleXML/XMLReader/XMLWriter/libxml/XSLT/SOAP APIs. No reachable critical path is identified. https://security-tracker.debian.org/tracker/CVE-2026-6653CVE-2026-99083,linux-libc-dev 6.12.113-1: Debian describes aksmbdkernel heap write and has no Trixie fixed package. The container inventory is userspace kernel headers; this image neither supplies nor runs the host kernel orksmbd. https://security-tracker.debian.org/tracker/CVE-2026-99083The prior 2.11.5 counts used an older DB, so count movement is not treated as an image regression. Under this issue's accepted policy there is no actionable fixed-version high/critical result and no explicitly reachable unpatched critical path: no incident, rollback, release hold, or Rust #325 gate. This is read-only current-stable inventory evidence, not the still-open repository-owned release/scheduled scan automation.
rmcdaniel commentedon Nov 1, 2026
Latest-stable read-only rescan: Server 2.11.7, 2026-11-01 11:37–11:38 UTC.
Identity:
2.11.7peels to sourcef55f90e54a213872f1c164a1b22c082d859c18aa;sha256:be7c2288ff935396262d743590530b204fac11b76582e56a525cc81a8da840d3and arm64sha256:7dbc3db050fec05ea5cd10e07ac8399ecf3e285d593bca32979a2320f02a104f;aquasec/trivy:0.76.1@sha256:2e6c00d711ab4ae41d8a30c2c1fd3bd3b62704c177bb120f95012e939edfb3df;2026-11-01T07:08:40.846369079Z, downloaded2026-11-01T11:38:02.050768137Z.Both exact platform manifests report the same normalized inventory: Debian 13.7, 150 high/critical OS-package rows representing 89 unique advisory IDs, 2 critical / 148 high, and zero rows with a supported
FixedVersion. Cargo, Composer-vendor and Node inventories contain zero high/critical findings. The sorted advisory/package/installed-version/fix-status fingerprint isf4582c43f0ea29be5cff15fc58cd9c6f9b4bb6dc75bc60c09cfa5e16f9678221on both architectures.Compared with the October 30 receipt against the same immutable image, the current database has one fewer high row and one fewer unique advisory ID (151/90 → 150/89). This is database movement, not an image change. There is no new critical finding. The two critical rows remain:
CVE-2026-6653onlibxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3; andCVE-2026-99083onlinux-libc-dev 6.12.113-1.Their existing exact-image dispositions remain applicable: the release-source review found no non-test libxml parser path, while
linux-libc-devsupplies userspace headers rather than the host kernel orksmbd. The current database provides no supported fix for either row.Disposition: no actionable fixed-version high/critical finding, no newly identified reachable unpatched critical path, and no incident, rollback, release hold, or Rust #325 gate. This was inventory-only; neither image was executed and no product, workflow, publication, or production state changed.
General still owns repository-managed release/scheduled scan automation. To avoid repetitive manual checks, the next manual rescan is due no earlier than 2026-11-03 after the database refresh, unless a new stable Server image, a relevant advisory/fix signal, or automation lands first.
rmcdaniel commentedon Nov 1, 2026
New-stable trigger for the next bounded inventory: PHP Server2.11.8 is published at source
fa3fc2f2f6b8935ea4a6eea47f6a9221e2adafff, indexsha256:3848d5d5cd1b23bd2881e3fdecea64cc44b72e6fb812e577c2db6d0872d065dd. This meets the new-stable exception in the preceding cadence; it does not justify repeating the old2.11.7 scan. Publisher/matching chart41304149748 and installed functional acceptance pass.Next: one exact2.11.8 amd64+arm64 inventory against the current advisory DB, preserving the existing reachability/fixability policy and exact artifact identity. The last accepted2.11.7 counts remain historical; no2.11.8 vulnerability counts are claimed yet. General retains automation and is coordinating the bounded manual inventory with Security. No incident or unrelated release gate is inferred from a pending inventory.
rmcdaniel commentedon Nov 1, 2026
Latest-stable read-only inventory: Server 2.11.8, 2026-11-01 14:42 UTC.
Identity:
fa3fc2f2f6b8935ea4a6eea47f6a9221e2adafff;sha256:3848d5d5cd1b23bd2881e3fdecea64cc44b72e6fb812e577c2db6d0872d065dd;sha256:980fe0a052089ced34ec3fcd2be2ea4e77436861d8fb537fb6654cb652a53e07;sha256:cea163f8fcedf3a17302acf0141b073a85fbdb395ebbcd59e5af6f5fa9ad75e1;aquasec/trivy:0.76.1@sha256:2e6c00d711ab4ae41d8a30c2c1fd3bd3b62704c177bb120f95012e939edfb3df;2026-11-01T13:02:34.671548954Z, downloaded2026-11-01T14:42:40.096798114Z.Both exact platform manifests report the same normalized inventory: Debian 13.7, 152 high/critical OS-package rows representing 91 unique advisory IDs, 2 critical / 150 high, and zero rows with a supported
FixedVersion. Cargo, Composer-vendor and Node inventories contain zero high/critical findings. The sorted advisory/package/installed-version/fix-status fingerprint is37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570on both architectures.The November 1 2.11.7 receipt reported 150 rows / 89 IDs against the earlier 07:08 UTC database. This inventory uses the later 13:02 UTC database, so the two-row/two-ID movement is not evidence of an image regression. There is no new critical result. The two critical rows and installed packages are unchanged:
CVE-2026-6653onlibxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3; andCVE-2026-99083onlinux-libc-dev 6.12.113-1.The exact 2.11.8 source still has no non-test use of DOM/SimpleXML/XMLReader/XMLWriter/libxml/XSLT/SOAP APIs.
linux-libc-devremains userspace kernel headers; this image does not supply or run the host kernel orksmbd. The current database gives neither critical row a supported fixed version.Disposition: no actionable fixed-version high/critical result, no newly identified reachable unpatched critical path, and no incident, rollback, release hold, or Rust #325 gate. This was a remote inventory of immutable manifests; neither Server image was executed and no product, workflow, publication, or production state changed.
General retains repository-managed release/scheduled scan automation. The accepted manual cadence resumes: no repeat before 2026-11-03 after the database refresh, unless a new stable Server image, a relevant advisory/fix signal, or automation lands first.
rmcdaniel commentedon Nov 1, 2026
Native-final scope confirmation from #919
Read-only source review of Server #919 exact head
a7046050c7f9f04649d20f99fa25332d5cf7330aconfirms that the native final publisher:Cargo.lockandcargo build --release --locked;The attestation is therefore provenance evidence only; do not describe it as an SBOM or vulnerability inventory. This is the existing #802 automation gap, not a new #919 source defect.
Apply this issue's already accepted risk-tiered policy to the native release line:
No image was pulled, executed or scanned in this review, and no registry, source, workflow or credential state changed. This adds no pre-RC or #919 hold. General retains #802 implementation and cadence ownership.
rmcdaniel commentedon Nov 4, 2026
Server open-item pass, 2026-11-04.
General retains scan-command/cadence ownership and Security owns fixability/reachability disposition; Server owns exact native artifact/workflow binding. The latest read PHP2.11.8 inventory is historical evidence, and no scan/SBOM is inferred from native provenance (#792, now completed for its own scope).
Next source artifact is a pinned-scanner exact-index/platform command with bounded metadata receipts and current vulnerability-DB identity, followed by thin release/rescan integration. Security/General: return any newer exact native stable inventory and select the next authorized immutable tuple if one is due. Preserve the existing actionable fixed-version/reachable-critical policy; unchanged no-fix distro rows do not become a permanent gate. This pass starts no pull, scan, build or registry action.
rmcdaniel commentedon Nov 11, 2026
Triage 2026-11-11: no workflow scans the published native image for vulnerabilities; native-release.yml records provenance only. Next: add one pinned scanner step for the native amd64/arm64 index in native-release.yml and attach the report. Owner: server; Security owns finding dispositions.