fix(ci): waive three tarfile interpreter CVEs as Group A-2 and label the waiver blocks - #117
Merged
Merged
Conversation
…the waiver blocks CVE-2026-11940 and CVE-2026-11972 (both HIGH, both tarfile) began tripping the dogfood gate on 2026-07-30 when they reached Grype's DB. CVE-2026-0864 is a non-gating Medium in the same module, waived alongside them for a clean report. Verified at the source per CLAUDE.md § Dependency hygiene, not from Grype's FIXED IN column — which reports 3.15.0b4 for all three and does not record the 3.14 backports. All three fixes are merged to the 3.14 maintenance branch and absent from released v3.14.6 (commit c63aec6, 2026-06-10), so all three close on 3.14.7: CVE-2026-11972 e86666c gh-151981/#151992 2026-06-23 (+13d) CVE-2026-11940 79c06bd gh-151558/GH-151559 2026-06-23 (+13d) 5e0ef3f gh-151987/#152609 2026-06-29 (+19d) CVE-2026-0864 2cf26d0 gh-151497/GH-151979 2026-06-24 (+14d) None is an ancestor of v3.14.6, confirmed with git merge-base --is-ancestor. No 3.15 move is warranted and none should be scoped off the back of this. Scrye does not use tarfile — the string appears nowhere in the repo and backup bundles are a JSON envelope — so the residual risk is unreachable stdlib code in the image, the same rationale the poplib acceptance rests on. Tracked in a new issue rather than appended to #98, because #98 carries its own dated verification scoped to its own trio. The blocks are now labelled A-1 (#98) / A-2 (#116) / B (#52) with an index at the top of the section, so the block-to-issue mapping is legible from the file — a single shared "tracked in #NN" header is what previously made two unrelated decisions look like one. See docs/ARCHIVE.md § Deviations for the dated entry.
tyler-rich
added a commit
that referenced
this pull request
Jul 31, 2026
Brings in the Group A-2 tarfile CVE waivers (#117), which is what the image dogfood gate needs to pass on this branch. Resolves the docs/ARCHIVE.md §14 conflict by keeping both entries and setting the index count to 113: the 2026-07-30 tarfile waiver entry sits above the 2026-07-29 version-bump entry, per §14's newest-first ordering for regime 1. Verified the net effect in both directions: against dev this branch adds only the version-bump work, and against its own pre-merge tip it adds only ci/grype.yaml's waiver and the tarfile §14 entry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two newly-disclosed HIGH CPython CVEs in
tarfilebegan tripping the dogfood gate on 2026-07-30 when they reached Grype's DB, turning CI red on any open PR. This waives them as Group A-2, tracked in #116, with source-verification evidence.These are new advisories, not a regression. They first appeared on a docs-only commit in #115: no dependency, base-image digest, or lockfile moved, the only
docker/Dockerfilechange was a comment, and the same job passed on the prior commit a day earlier.The three CVEs
mode="r|") mishandles EOF —_Stream.seek()discardedread()'s result, so a truncated archive parses in an infinite loop. CWE-252.Verification
Confirmed at the source per
CLAUDE.md§ Dependency hygiene — not from Grype'sFIXED INcolumn. Method: shallow blobless clone ofpython/cpython,git log -- Lib/tarfile.pyfor the commits,git merge-base --is-ancestor COMMIT v3.14.6for release membership, plus a direct3.14-vs-v3.14.6file diff.v3.14.6= commitc63aec6, released 2026-06-10.v3.14.6?e86666c(#151992)79c06bd(GH-151559)5e0ef3f(#152609)2cf26d0(GH-151979)Every backport merged after the 3.14.6 cut, so 3.14.7 is the first release carrying any of them.
3.14patchlevel reads"3.14.6+"; nov3.14.7tag exists.Grype is wrong in the pessimistic direction, again — it reports
FIXED IN 3.15.0b4for all three and does not record the 3.14 backports. Read literally that argues for a runtime bump, which is the exact mistake the source-verification rule exists to prevent. No 3.15 move is warranted here.Does Scrye use
tarfile?No — the string appears nowhere in the repository; backup bundles are a JSON envelope (
app/backup/bundle.py), not tar. The residual risk is unreachable stdlib code present in the image, the same rationale thepoplibacceptance (#52) rests on. Recorded per-CVE because the poplib precedent showed module reachability materially changes the acceptance.Why a new issue instead of extending #98
#98 carries its own source-verification evidence dated 2026-07-26, scoped to its specific trio. Appending CVEs verified on a different date against different files would leave that issue's evidence section not covering half its own contents. Both are Group A, share the 3.14.7 trigger, and now share a 2026-10-25 review date — deliberately aligned so one review covers both — and each issue cross-references the other so the split reads as intentional rather than as duplicate trackers.
The blocks are now labelled A-1 (#98) / A-2 (#116) / B (#52) with a mapping index at the top of the interpreter section, so the block→issue relationship is legible from
ci/grype.yamlwithout opening GitHub. A single shared "tracked in #NN" header is what previously made two unrelated decisions look like one.Verification of this change
ci/grype.yamlparses (yaml.safe_load); 10 ignore entries, 7 waived CVE IDs as intended.ci/grype.yaml, and this PR changes only YAML and Markdown — no code paths affected.Merge-order note
Both this PR and #115 add an entry to
docs/ARCHIVE.md§14 and bump the index count from 111. Whichever merges second will conflict on the index heading and needs it set to 113, keeping both entries.See
docs/ARCHIVE.md§ Deviations for the dated entry. Closes nothing automatically — #116 is closed by hand once 3.14.7 is in the pinned base image.