diff --git a/.github/dapper-headers.json b/.github/dapper-headers.json index b68d9985..4fc97321 100644 --- a/.github/dapper-headers.json +++ b/.github/dapper-headers.json @@ -3157,6 +3157,228 @@ "CVE-2026-98867", "CVE-2026-98868", "CVE-2026-98869", + "CVE-2026-98871", + "CVE-2026-98872", + "CVE-2026-98873", + "CVE-2026-98874", + "CVE-2026-98875", + "CVE-2026-98876", + "CVE-2026-98877", + "CVE-2026-98878", + "CVE-2026-98879", + "CVE-2026-98880", + "CVE-2026-98881", + "CVE-2026-98882", + "CVE-2026-98883", + "CVE-2026-98884", + "CVE-2026-98885", + "CVE-2026-98886", + "CVE-2026-98887", + "CVE-2026-98888", + "CVE-2026-98889", + "CVE-2026-98890", + "CVE-2026-98891", + "CVE-2026-98892", + "CVE-2026-98893", + "CVE-2026-98894", + "CVE-2026-98895", + "CVE-2026-98896", + "CVE-2026-98897", + "CVE-2026-98898", + "CVE-2026-98899", + "CVE-2026-98900", + "CVE-2026-98901", + "CVE-2026-98902", + "CVE-2026-98903", + "CVE-2026-98904", + "CVE-2026-98905", + "CVE-2026-98906", + "CVE-2026-98907", + "CVE-2026-98908", + "CVE-2026-98909", + "CVE-2026-98910", + "CVE-2026-98911", + "CVE-2026-98912", + "CVE-2026-98913", + "CVE-2026-98914", + "CVE-2026-98915", + "CVE-2026-98916", + "CVE-2026-98917", + "CVE-2026-98918", + "CVE-2026-98919", + "CVE-2026-98921", + "CVE-2026-98923", + "CVE-2026-98924", + "CVE-2026-98925", + "CVE-2026-98926", + "CVE-2026-98927", + "CVE-2026-98928", + "CVE-2026-98929", + "CVE-2026-98930", + "CVE-2026-98931", + "CVE-2026-98932", + "CVE-2026-98933", + "CVE-2026-98934", + "CVE-2026-98935", + "CVE-2026-98936", + "CVE-2026-98937", + "CVE-2026-98938", + "CVE-2026-98939", + "CVE-2026-98940", + "CVE-2026-98941", + "CVE-2026-98942", + "CVE-2026-98944", + "CVE-2026-98945", + "CVE-2026-98946", + "CVE-2026-98947", + "CVE-2026-98948", + "CVE-2026-98949", + "CVE-2026-98950", + "CVE-2026-98951", + "CVE-2026-98952", + "CVE-2026-98953", + "CVE-2026-98954", + "CVE-2026-98955", + "CVE-2026-98956", + "CVE-2026-98957", + "CVE-2026-98958", + "CVE-2026-98959", + "CVE-2026-98960", + "CVE-2026-98961", + "CVE-2026-98962", + "CVE-2026-98963", + "CVE-2026-98964", + "CVE-2026-98965", + "CVE-2026-98966", + "CVE-2026-98967", + "CVE-2026-98968", + "CVE-2026-98969", + "CVE-2026-98970", + "CVE-2026-98971", + "CVE-2026-98972", + "CVE-2026-98973", + "CVE-2026-98974", + "CVE-2026-98975", + "CVE-2026-98977", + "CVE-2026-98978", + "CVE-2026-98979", + "CVE-2026-98980", + "CVE-2026-98981", + "CVE-2026-98982", + "CVE-2026-98983", + "CVE-2026-98984", + "CVE-2026-98985", + "CVE-2026-98986", + "CVE-2026-98987", + "CVE-2026-98988", + "CVE-2026-98989", + "CVE-2026-98990", + "CVE-2026-98991", + "CVE-2026-98992", + "CVE-2026-98993", + "CVE-2026-98994", + "CVE-2026-98995", + "CVE-2026-98996", + "CVE-2026-98997", + "CVE-2026-98999", + "CVE-2026-99000", + "CVE-2026-99001", + "CVE-2026-99002", + "CVE-2026-99003", + "CVE-2026-99004", + "CVE-2026-99005", + "CVE-2026-99006", + "CVE-2026-99007", + "CVE-2026-99008", + "CVE-2026-99009", + "CVE-2026-99010", + "CVE-2026-99011", + "CVE-2026-99012", + "CVE-2026-99013", + "CVE-2026-99014", + "CVE-2026-99015", + "CVE-2026-99016", + "CVE-2026-99017", + "CVE-2026-99018", + "CVE-2026-99019", + "CVE-2026-99020", + "CVE-2026-99021", + "CVE-2026-99022", + "CVE-2026-99023", + "CVE-2026-99024", + "CVE-2026-99025", + "CVE-2026-99026", + "CVE-2026-99027", + "CVE-2026-99028", + "CVE-2026-99029", + "CVE-2026-99030", + "CVE-2026-99031", + "CVE-2026-99032", + "CVE-2026-99033", + "CVE-2026-99034", + "CVE-2026-99035", + "CVE-2026-99036", + "CVE-2026-99037", + "CVE-2026-99038", + "CVE-2026-99039", + "CVE-2026-99040", + "CVE-2026-99041", + "CVE-2026-99043", + "CVE-2026-99044", + "CVE-2026-99045", + "CVE-2026-99046", + "CVE-2026-99047", + "CVE-2026-99048", + "CVE-2026-99049", + "CVE-2026-99050", + "CVE-2026-99051", + "CVE-2026-99052", + "CVE-2026-99053", + "CVE-2026-99054", + "CVE-2026-99055", + "CVE-2026-99056", + "CVE-2026-99057", + "CVE-2026-99058", + "CVE-2026-99059", + "CVE-2026-99060", + "CVE-2026-99061", + "CVE-2026-99062", + "CVE-2026-99063", + "CVE-2026-99064", + "CVE-2026-99065", + "CVE-2026-99066", + "CVE-2026-99067", + "CVE-2026-99068", + "CVE-2026-99069", + "CVE-2026-99070", + "CVE-2026-99071", + "CVE-2026-99072", + "CVE-2026-99073", + "CVE-2026-99074", + "CVE-2026-99075", + "CVE-2026-99076", + "CVE-2026-99077", + "CVE-2026-99078", + "CVE-2026-99079", + "CVE-2026-99080", + "CVE-2026-99081", + "CVE-2026-99082", + "CVE-2026-99083", + "CVE-2026-99085", + "CVE-2026-99086", + "CVE-2026-99087", + "CVE-2026-99088", + "CVE-2026-99089", + "CVE-2026-99090", + "CVE-2026-99091", + "CVE-2026-99092", + "CVE-2026-99093", + "CVE-2026-99094", + "CVE-2026-99095", + "CVE-2026-99096", + "CVE-2026-99097", + "CVE-2026-99098", + "CVE-2026-99099", "CVE-2026-99999" ], "additionalReviews": { @@ -3167,5 +3389,6008 @@ "checkedAt": "2026-10-23", "fixedVersion": "none in current report; any future FixedVersion remains rejected" } + }, + "mediumRefresh": { + "checkedAt": "2026-10-30", + "reviewAfter": "2026-11-06", + "officialSnapshot": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "reviewEvidenceSha256": "66ec99b4b8a01b0bd5cfc7f4a1fef9e35b2f1bfd4f8368c277ea6299e62d97f3", + "status": "unfixed_medium_header_only", + "entries": [ + { + "id": "CVE-2026-98871", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98871.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "1847fd5936d83118ffe5b91c943b151564ae8e8a3b5f52dec5534b3ca1cfd2d6", + "officialModified": "2026-10-28T17:49:38Z" + }, + { + "id": "CVE-2026-98872", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98872.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "19ce3d29c80651132d244a5327d52f383123f153629dfecb6d029587588da83d", + "officialModified": "2026-10-28T17:49:38Z" + }, + { + "id": "CVE-2026-98873", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98873.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "6316338bcb378e88142476ca6caa69c7f65933bb27b699485ba15fa5a98bcc2d", + "officialModified": "2026-10-28T17:49:39Z" + }, + { + "id": "CVE-2026-98874", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98874.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "cf2a3511773e8f769cdb867b66b4b85b33dfb4148e84536e4b7008dd399a5baa", + "officialModified": "2026-10-28T17:49:39Z" + }, + { + "id": "CVE-2026-98875", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98875.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "b8ea6d95fc67bc2aaf3109e9cc048f778e03409239b01e0102a7fe3bb28ce026", + "officialModified": "2026-10-28T17:49:39Z" + }, + { + "id": "CVE-2026-98876", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98876.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "abf07f92aa631e6590c6bbedfb9d719183fa8ac8f94aaf36f64d3e353786eecc", + "officialModified": "2026-10-28T17:49:39Z" + }, + { + "id": "CVE-2026-98877", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98877.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "089c67e1f6f7f8b8b80bb4b236b4284aa8c62afe6f295412853ab493d970430b", + "officialModified": "2026-10-28T17:49:39Z" + }, + { + "id": "CVE-2026-98878", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98878.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "90052a16a49ea19fd70498138686e540b49943438672a0bae377fa4c9bf8be42", + "officialModified": "2026-10-28T17:49:40Z" + }, + { + "id": "CVE-2026-98879", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98879.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "99dba74042e19b13ae8fd81130da4700418df6e1ed74e9daca9fc4795c132e93", + "officialModified": "2026-10-28T17:49:40Z" + }, + { + "id": "CVE-2026-98880", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98880.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "034f3ceddb77eb4d00f59b6d09ee46007e797b554d17ec155d8961c672ad0cb9", + "officialModified": "2026-10-28T17:49:40Z" + }, + { + "id": "CVE-2026-98881", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98881.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "af1afe40485f0fc321a2282bce182b5659ce411742a04a11efa98eadf06374fe", + "officialModified": "2026-10-28T17:49:40Z" + }, + { + "id": "CVE-2026-98882", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98882.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "31acccc42d053153853653b1e46d9281934eb2447a88c8cb2369ed8a609245a3", + "officialModified": "2026-10-28T17:49:41Z" + }, + { + "id": "CVE-2026-98883", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98883.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "752263a08fe921e0672b386d5850c49963afa42962b6edb3efcf3124ab711704", + "officialModified": "2026-10-28T17:49:41Z" + }, + { + "id": "CVE-2026-98884", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98884.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "3efe92b6058c8f57a6daeba994b673ee7e23dfcc44d3b2d6fc3421f59ee8e2a7", + "officialModified": "2026-10-28T17:49:41Z" + }, + { + "id": "CVE-2026-98885", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98885.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "f9e6958e9dfc3fe6dab5b394631cc2f143c92ea5b2052f4d168647dcaa148239", + "officialModified": "2026-10-28T17:49:41Z" + }, + { + "id": "CVE-2026-98886", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98886.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "cdf99eb61c6db8d604974582e53d95e56e09dd627dbaa2001d5e0cf10d8fc76b", + "officialModified": "2026-10-28T17:49:41Z" + }, + { + "id": "CVE-2026-98887", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98887.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "cb4da39effc172a39923e2af2bccb81bcf2c78c6c76eff1a59d5df6cb6905e05", + "officialModified": "2026-10-28T17:49:42Z" + }, + { + "id": "CVE-2026-98888", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98888.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "a2d2cb5b3ef7937ef40ee93bc63a2676c0d89b056a4ea6dee922c28665aada76", + "officialModified": "2026-10-28T17:49:42Z" + }, + { + "id": "CVE-2026-98889", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98889.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "3911d767c2f5dc758a760c7770d02544034c6d8ff3267eec1e0705dac1a0861b", + "officialModified": "2026-10-28T17:49:42Z" + }, + { + "id": "CVE-2026-98890", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98890.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "a77b4119e45d076d25810e756f3df8f13275f25018a52ada9ff47fbd73e48897", + "officialModified": "2026-10-28T23:51:41Z" + }, + { + "id": "CVE-2026-98891", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98891.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "dc28d24883221627ac87317fd687f960456fdfbd6858d00caca4284e193ee46f", + "officialModified": "2026-10-28T17:49:43Z" + }, + { + "id": "CVE-2026-98892", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98892.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "c4e65098705abc2ae5d78be293a757df49a1e979d0c665a7023ceb14ef5fe189", + "officialModified": "2026-10-28T17:49:43Z" + }, + { + "id": "CVE-2026-98893", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98893.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "a3b6f3dbca74fc3df3fe63c221389fb1e5c5b55339df2bbc84e2032f9824f97b", + "officialModified": "2026-10-28T17:49:43Z" + }, + { + "id": "CVE-2026-98894", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98894.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "f011cdab476d4fbab6b373b700a258114e5cdc5613b7e5638aae553d7119ce5b", + "officialModified": "2026-10-28T17:49:43Z" + }, + { + "id": "CVE-2026-98895", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98895.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "8ab092ef7f2cfab49ab67df9ec66438d08fdfbda2abf8b54d1f7b0a9e376f28c", + "officialModified": "2026-10-28T17:49:44Z" + }, + { + "id": "CVE-2026-98896", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98896.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "cb5572c6767da8b8156af2b2652d143575a5f72d2311533f7357a02764f1ce3e", + "officialModified": "2026-10-28T17:49:44Z" + }, + { + "id": "CVE-2026-98897", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98897.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "91dc3bfc58b2acf71e73c0c891627ed3a79c159e54b19499d2e13aba7c55d1d5", + "officialModified": "2026-10-28T17:49:44Z" + }, + { + "id": "CVE-2026-98898", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98898.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "c7a53d775e3313758428ac21ffa946b7fe429fbba95c05c08cae35d93adc4e2e", + "officialModified": "2026-10-28T17:49:44Z" + }, + { + "id": "CVE-2026-98899", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98899.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "1a9bd3b2c11412384f62e4e13b435933b07bf75814e47a5ba7b09408fd463cb0", + "officialModified": "2026-10-28T17:49:44Z" + }, + { + "id": "CVE-2026-98900", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98900.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "56712e06185089cd7b4990f6d1cdbdd864408bec12033a1b2a37d31197f83785", + "officialModified": "2026-10-28T17:49:45Z" + }, + { + "id": "CVE-2026-98901", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98901.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "ceffc099f60668dce2f87dc440b597cbf35fbe3bb90b58e4c5fb4e7005072700", + "officialModified": "2026-10-28T17:49:45Z" + }, + { + "id": "CVE-2026-98902", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98902.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "aa8fc8b9a9010b134abd57909ba5f3e924c1be87cdbd1556145c180fef4e1858", + "officialModified": "2026-10-28T17:49:45Z" + }, + { + "id": "CVE-2026-98903", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98903.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "cf7b49c930217cd56c12c96b5c7fe3ad898b4500434384ac21bc1aba18cecd31", + "officialModified": "2026-10-28T17:49:45Z" + }, + { + "id": "CVE-2026-98904", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98904.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "7da2a72ed46ce1e5ae80cc972bdc14e160eca7972b1b55254fbc4eae624d34c3", + "officialModified": "2026-10-28T17:49:46Z" + }, + { + "id": "CVE-2026-98905", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98905.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "713fc676fd6388d8b633b13519020e20c7e2061b7d54501392563e5d8b1cd59f", + "officialModified": "2026-10-28T17:49:46Z" + }, + { + "id": "CVE-2026-98906", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98906.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "b03045bbc62e952db24235c75f70e23418fb7b9d6e49e3a0c610e73dde62e81d", + "officialModified": "2026-10-28T17:49:46Z" + }, + { + "id": "CVE-2026-98907", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98907.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "2f4af452859d3297f938e3816e99aafd2a13421f95d7fb484687d493e1e7cdcc", + "officialModified": "2026-10-28T17:49:46Z" + }, + { + "id": "CVE-2026-98908", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98908.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "08eb0fb48322df2330f65b6092ab5f82be64d83dbe707058f75748e9734433ab", + "officialModified": "2026-10-28T17:49:46Z" + }, + { + "id": "CVE-2026-98909", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98909.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "450771f0a1eef33d1334a62fed9f4cc7ad22f9646f62defe19a9c9b808278a72", + "officialModified": "2026-10-28T17:49:47Z" + }, + { + "id": "CVE-2026-98910", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98910.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "e2c0394a2d2106c3dff07bde74ab17cdaf53102ce1970942feb59271abf8e2dc", + "officialModified": "2026-10-28T17:49:47Z" + }, + { + "id": "CVE-2026-98911", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98911.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "30b6516cbcfdf45519b9b030609c5fe078cdeac653e2c03d19e43665f7da1a24", + "officialModified": "2026-10-28T17:49:47Z" + }, + { + "id": "CVE-2026-98912", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98912.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "1624108702552b675439d733b0bf95b6fca9ef10fcc160b91381466fa9f27e54", + "officialModified": "2026-10-28T17:49:47Z" + }, + { + "id": "CVE-2026-98913", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98913.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "8c30a3c49251b2387d10d13c3143c23ab21a6d091c9a8e7d8eba7c3bcd78fe1b", + "officialModified": "2026-10-28T17:49:48Z" + }, + { + "id": "CVE-2026-98914", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98914.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "0b5ca36463714019667b2634d90e1bde182f9ab2b1e58e64a80a93afb0ca113e", + "officialModified": "2026-10-28T17:49:48Z" + }, + { + "id": "CVE-2026-98915", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98915.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "c67c4eb5b752ae8059b780b032c523b4c447d497fc2d774523ef3419a0231321", + "officialModified": "2026-10-28T17:49:48Z" + }, + { + "id": "CVE-2026-98916", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98916.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "4226c599948c7ba90b8f3b9687f3cd6ee0131c0317fddd290c0eba6fc70ea733", + "officialModified": "2026-10-28T17:49:48Z" + }, + { + "id": "CVE-2026-98917", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98917.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "4d91343e7ccd7baf550b13b104da0060ca86501aff69970e89feb2f59591e865", + "officialModified": "2026-10-28T17:49:49Z" + }, + { + "id": "CVE-2026-98918", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98918.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "dfc5194f1138c965f17f42536de0a9745fbf8cb5755b7cb045646d601a4c6445", + "officialModified": "2026-10-28T17:49:49Z" + }, + { + "id": "CVE-2026-98919", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98919.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "a77ab396009e9efc565b546eb94c7a58e3c872b5267bea9c92014dc4c6565c45", + "officialModified": "2026-10-28T17:49:49Z" + }, + { + "id": "CVE-2026-98921", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98921.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "b8c4e685f28609ee44d3244d6921331b87472ae2174d19071ad6b0d31da0fa6e", + "officialModified": "2026-10-28T17:49:49Z" + }, + { + "id": "CVE-2026-98923", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98923.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "1d2151dda0306070f45839a8bbd4759d9eac7519013137d693f350229785f3a0", + "officialModified": "2026-10-28T17:49:49Z" + }, + { + "id": "CVE-2026-98924", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98924.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "6bb493bfc8586fc58b2a22803ca38eca32f9f429f5829fe331775c0ac1df8d5b", + "officialModified": "2026-10-28T17:49:50Z" + }, + { + "id": "CVE-2026-98925", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98925.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "3456325b8521795866408c20cc486498ba4c458d8d5e0ecf49c9af9514c40946", + "officialModified": "2026-10-28T17:49:50Z" + }, + { + "id": "CVE-2026-98926", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98926.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "207a20549d7dbdcb9f1e3cec7bb33958607c5adfb07064d10bf398f8ff96ffb6", + "officialModified": "2026-10-28T17:49:50Z" + }, + { + "id": "CVE-2026-98927", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98927.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "bbf147699bfefedcac827cb550560339c177624e84926583de758d56b54073f7", + "officialModified": "2026-10-28T17:49:50Z" + }, + { + "id": "CVE-2026-98928", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98928.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "e8cdcfb5403bd1dcaa51d62f9b673a107d6d36d4eb71f4f38859db637fe48824", + "officialModified": "2026-10-28T17:49:50Z" + }, + { + "id": "CVE-2026-98929", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98929.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "d2b4cc3a0779addc656830a919e7fe94f019b301f071e69345ed1a816df74eb4", + "officialModified": "2026-10-28T17:49:51Z" + }, + { + "id": "CVE-2026-98930", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98930.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "ba7ef24c175f59735a2bfd42647be45ae51ce1e4fecf6c0ae729f41d2c291c3c", + "officialModified": "2026-10-28T17:49:51Z" + }, + { + "id": "CVE-2026-98931", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98931.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "0032af5cd2db04f4340a263ffe586fa8da1faa637cb582a1509184e9bc329686", + "officialModified": "2026-10-28T17:49:51Z" + }, + { + "id": "CVE-2026-98932", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98932.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "9daf0833114174b57d030855ee3de0f03b2af1aff7200b99d5f92a8181b7b10a", + "officialModified": "2026-10-28T17:49:51Z" + }, + { + "id": "CVE-2026-98933", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98933.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "78fe7041538e213288403c54cd61dab604f69534c67fd906b5ed558ed93e89f0", + "officialModified": "2026-10-28T17:49:52Z" + }, + { + "id": "CVE-2026-98934", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98934.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "ee514859c5357d845fedbe70702886b038cf71bbaa16465114178a512bf8bc69", + "officialModified": "2026-10-28T17:49:52Z" + }, + { + "id": "CVE-2026-98935", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98935.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "97efc38177d1a5972591cefb5cb0f4c612fd0b61dacde636558905249a2a52db", + "officialModified": "2026-10-28T17:49:52Z" + }, + { + "id": "CVE-2026-98936", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98936.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "60143bfd708c293a9aca2163811d96075fb868c0edf062a31df96c2498e5ae42", + "officialModified": "2026-10-28T17:49:52Z" + }, + { + "id": "CVE-2026-98937", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98937.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "08ed6e306d873c04ad1a77ae0f69187513b1e9e574298af9eeda0dd959908887", + "officialModified": "2026-10-28T17:49:53Z" + }, + { + "id": "CVE-2026-98938", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98938.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "63dfca0bdcb8e6abc8175ddb5065e209627e87ebe088b5dbb1e96327b4ea46ca", + "officialModified": "2026-10-28T23:51:49Z" + }, + { + "id": "CVE-2026-98939", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98939.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "c4a694b11afde646b9ee188902c853ea3190ddb7e41fe075b204030250c87fa9", + "officialModified": "2026-10-28T17:49:53Z" + }, + { + "id": "CVE-2026-98940", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98940.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "8cf63ed296a0601761a0880fe66f1cccba7da50257009a0cde79b9e51365722e", + "officialModified": "2026-10-28T17:49:53Z" + }, + { + "id": "CVE-2026-98941", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98941.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "0ef4e1622e1b184eaab89ad38936d3460c70465e7dd913517571e69ab64f3ca0", + "officialModified": "2026-10-28T23:51:49Z" + }, + { + "id": "CVE-2026-98942", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98942.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "f7e76e1a99c18ab9972c91a0b1775f6372b0039aa1c8cee3b63fafdac22eefcb", + "officialModified": "2026-10-28T17:49:54Z" + }, + { + "id": "CVE-2026-98944", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98944.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "81878586f6ed64684282220e022f79b9f11e960983ba1be903b51b18647fb28d", + "officialModified": "2026-10-28T17:49:54Z" + }, + { + "id": "CVE-2026-98945", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98945.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "658c276ca5af3f863015b30886e3c11752f3e66ad4398971c54b193a5a7e6292", + "officialModified": "2026-10-28T17:49:54Z" + }, + { + "id": "CVE-2026-98946", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98946.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "f038d8f8494751c39bd225e7133ffaff41e3719415d3a82ff29b1c70e262dad4", + "officialModified": "2026-10-28T23:51:50Z" + }, + { + "id": "CVE-2026-98947", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98947.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "67695f42b581930b7ce10765dec057b53bb2dda406793b350efb1a83b21fff6d", + "officialModified": "2026-10-28T23:51:50Z" + }, + { + "id": "CVE-2026-98948", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98948.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "fbd08a4371fcd76cc5c3b363ccc2b85f387b7399a4bbe142ea7340105654d6f7", + "officialModified": "2026-10-28T23:51:51Z" + }, + { + "id": "CVE-2026-98949", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98949.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "77d70805d5b810743c48e38dd831291359cdfa4ee50f6c68c863e67b97f2114c", + "officialModified": "2026-10-28T23:51:51Z" + }, + { + "id": "CVE-2026-98950", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98950.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "c6c7ae8f233101db70f9dbcb57120d4c92343efedc080d6005f344a277dc3b44", + "officialModified": "2026-10-28T23:51:51Z" + }, + { + "id": "CVE-2026-98951", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98951.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "ceb78d811ad8b2740bea08374913abdfac12b6d5c442cac42def657d62d20ee0", + "officialModified": "2026-10-28T23:51:51Z" + }, + { + "id": "CVE-2026-98952", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98952.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "91fb12cde1158af87e75ffd37e7a6623099a05d1f40ccb002bc2ebc1c2f501cf", + "officialModified": "2026-10-28T23:51:51Z" + }, + { + "id": "CVE-2026-98953", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98953.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "50dde6133b17cecb58c6c95aec25d69b4272f1272e8d1489014597e9cda3f0a4", + "officialModified": "2026-10-28T23:51:52Z" + }, + { + "id": "CVE-2026-98954", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98954.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "906ea2a791b28ca94c34b552d54cb0d1d4495a804dbd27a2cf2d8cf07dbcd34b", + "officialModified": "2026-10-28T23:51:52Z" + }, + { + "id": "CVE-2026-98955", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98955.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "0d372c06fbce3c91a5565cc6b82c54d9f0810ce293c01a81d21a70f2794c3b5f", + "officialModified": "2026-10-28T23:51:52Z" + }, + { + "id": "CVE-2026-98956", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98956.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "67003a74a8654070a093e4f1f1eed2c78ed677855d3852317e1e671e4903b608", + "officialModified": "2026-10-28T23:51:52Z" + }, + { + "id": "CVE-2026-98957", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98957.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "fe3ad0ea0961d3535b3ece8c5e50adf26a4b43084ca7e310764cd9774ee7cb86", + "officialModified": "2026-10-28T23:51:52Z" + }, + { + "id": "CVE-2026-98958", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98958.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "a3ecee68e79f8e41eee7d3dccc607db5c4ac0eb6a622e309cc8b5873d15e2b70", + "officialModified": "2026-10-28T23:51:53Z" + }, + { + "id": "CVE-2026-98959", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98959.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "03ca7a210f638f4d2b62353e48b7d2ad93f6389e79b0448cd0f6344f6692ab7d", + "officialModified": "2026-10-28T23:51:53Z" + }, + { + "id": "CVE-2026-98960", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98960.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "634a96985e0d97f3418ad58591790aeed4115a835a28b5aff9bb1d6e4448cf55", + "officialModified": "2026-10-28T23:51:53Z" + }, + { + "id": "CVE-2026-98961", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98961.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "ac87f02c47bd19f61dcb9d32dfd00846872d37b2567b2c412f7c6b5f0254e7da", + "officialModified": "2026-10-28T23:51:53Z" + }, + { + "id": "CVE-2026-98962", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98962.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "64ef8f02291de3ba2c9c74b58b27bfde4794c5c43e1335cb03919218f856b2f3", + "officialModified": "2026-10-28T23:51:53Z" + }, + { + "id": "CVE-2026-98963", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98963.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "b1781a74789403ffa447870f06420c44edd8a30ef9c1e844e66319e1aab35dda", + "officialModified": "2026-10-28T23:51:54Z" + }, + { + "id": "CVE-2026-98964", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98964.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "aca6357b64d104991a6cbc55200337dd1345817bbe6c9efb1573a544aedd6a7b", + "officialModified": "2026-10-28T23:51:54Z" + }, + { + "id": "CVE-2026-98965", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98965.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "0d0598a2d4f02558888a47d01dad6e4c9a04cd978aba39c4136233f8b1987b62", + "officialModified": "2026-10-28T23:51:54Z" + }, + { + "id": "CVE-2026-98966", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98966.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "7cf63b1c2379919d1ecc68b2c9cb2e61bdba68ea487331adf1b6dd67e7e60b81", + "officialModified": "2026-10-28T23:51:54Z" + }, + { + "id": "CVE-2026-98967", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98967.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "499440812d604b15e9f166b9b86da5cba7a4a7f40e3323d366f712bc7bbaeb06", + "officialModified": "2026-10-28T23:51:54Z" + }, + { + "id": "CVE-2026-98968", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98968.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "b3d09f2f8ef655199ec287c30f97cdf152c6bb846c8963d64db828c112077817", + "officialModified": "2026-10-28T23:51:55Z" + }, + { + "id": "CVE-2026-98969", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98969.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "901dbd68a3ac55cd50d138405bc3cddc4172155ae90061741048af25b83ba227", + "officialModified": "2026-10-28T23:51:55Z" + }, + { + "id": "CVE-2026-98970", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98970.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "2f1d0d2907eeb9d1c864105ac997ca08266566c4779ed76bf9d4dcb8b7b4fecb", + "officialModified": "2026-10-28T23:51:55Z" + }, + { + "id": "CVE-2026-98971", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98971.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "f3abf7a7fe674b1cfbc9114bf452ab3aac5ba49276e2c9548add1f8b47a7b6cf", + "officialModified": "2026-10-28T23:51:55Z" + }, + { + "id": "CVE-2026-98972", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98972.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "df1f891978ccd971b7a5824fe13d2a52d9994d88bea0544c5e6a20d60fbb1585", + "officialModified": "2026-10-28T23:51:55Z" + }, + { + "id": "CVE-2026-98973", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98973.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "d49f65eb361627af264754f3232a033c3d8cb53880edac6fae9ffa4c6f1c7fac", + "officialModified": "2026-10-28T23:51:56Z" + }, + { + "id": "CVE-2026-98974", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98974.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "3a760d6acabb85a7f4d2dce381eb2c99c5a30b716b85a66ed82d1a240a0d10bf", + "officialModified": "2026-10-28T23:51:56Z" + }, + { + "id": "CVE-2026-98975", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98975.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "270996766ab49833c4e27b6b17e9ff515bb8144676b596a8372dc262d32ac926", + "officialModified": "2026-10-28T23:51:56Z" + }, + { + "id": "CVE-2026-98977", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98977.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "903115595594cbdefe6896c7d6421c78a135596f21fab235446dca2f3fee6545", + "officialModified": "2026-10-28T23:51:56Z" + }, + { + "id": "CVE-2026-98978", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98978.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "ff31faa76f69ca180bbfa19322bafbc3382994e5216fcfe163a6aea8d66231e6", + "officialModified": "2026-10-28T23:51:56Z" + }, + { + "id": "CVE-2026-98979", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98979.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "c9886b38a883e9caae180547d744103723a2c9a8956dde79705dc15e8de4ab03", + "officialModified": "2026-10-28T23:51:57Z" + }, + { + "id": "CVE-2026-98980", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98980.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "1f10a5fbfd2b6e40e45ae903221b396cca53611f4b4045143d0c936ad050dc3e", + "officialModified": "2026-10-28T23:51:57Z" + }, + { + "id": "CVE-2026-98981", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98981.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "6062424f1e2c8d365906e676c3392cf26be27269cb5985f3951c30254e01752e", + "officialModified": "2026-10-28T23:51:57Z" + }, + { + "id": "CVE-2026-98982", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98982.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "f6b6348ba04f1e07b9efecbc99cb7a8bcbf0a4d8d4d31fb64e86d677ee608100", + "officialModified": "2026-10-28T23:51:57Z" + }, + { + "id": "CVE-2026-98983", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98983.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "e1d18e47d214a05c2c229fe7f4101640c91317f04e57870d14369978d8f43dfd", + "officialModified": "2026-10-28T23:51:57Z" + }, + { + "id": "CVE-2026-98984", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98984.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "69cdb3d3c41240861efb58b227e646423d1392e8a470a0abd0417658a7b3f2cd", + "officialModified": "2026-10-28T23:51:58Z" + }, + { + "id": "CVE-2026-98985", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98985.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "d3c28b3d9ed707f2bbe1733839054f3b8d6da46fd4d5fcb0277d0f608b95ceef", + "officialModified": "2026-10-28T23:51:58Z" + }, + { + "id": "CVE-2026-98986", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98986.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "34a112104de64b5425e3cc2a3a9355ace7068c82dddff4311d04abc7e431aa42", + "officialModified": "2026-10-28T23:51:58Z" + }, + { + "id": "CVE-2026-98987", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98987.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "8b1813a52875658234ecc5042b9af75a2adcb6d7f4b988d72c35253f31ab06bd", + "officialModified": "2026-10-28T23:51:58Z" + }, + { + "id": "CVE-2026-98988", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98988.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "7f9985b03e45b7c81ae864197763430bc7b77efa0d634dcf452fef5af8717cc2", + "officialModified": "2026-10-28T23:51:58Z" + }, + { + "id": "CVE-2026-98989", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98989.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "cf5a58fb45fcd84e8bbd7f6a15e1a239a2e10d4680f3d552296805e9eae6c952", + "officialModified": "2026-10-28T23:51:58Z" + }, + { + "id": "CVE-2026-98990", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98990.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "b8c35f46ad0f37b8259c7967c9be374c06bf86db06c87a20197a34ce9854f55d", + "officialModified": "2026-10-28T23:51:59Z" + }, + { + "id": "CVE-2026-98991", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98991.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "f2d544f6208605b680130db1c2bdae4ac09d770a8819477b6b274cbd170ac920", + "officialModified": "2026-10-28T23:51:59Z" + }, + { + "id": "CVE-2026-98992", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98992.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "d8e51d2b02db9a514cd20613ee990dbde58eeda029b29bb8d5c073ce3ad25fa5", + "officialModified": "2026-10-28T23:51:59Z" + }, + { + "id": "CVE-2026-98993", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98993.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "bfce5260c4587cb699d844fb748d151296ddf798faf18b320e27d22271073329", + "officialModified": "2026-10-28T23:51:59Z" + }, + { + "id": "CVE-2026-98994", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98994.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "45f59a9863ad0aeaea65e0e757fabb8d9471968774a9df96586fa91febcb0569", + "officialModified": "2026-10-28T23:51:59Z" + }, + { + "id": "CVE-2026-98995", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98995.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "9bec9ca2c9df7e9468a890ecd5b94ecf2bb394559332f1ba5368e14b7304b63b", + "officialModified": "2026-10-28T23:51:59Z" + }, + { + "id": "CVE-2026-98996", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98996.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "9fd480fa9a80cb88ec4489c67ef382e8c3e2d833a16cbcb797418bac1bb9cff4", + "officialModified": "2026-10-28T23:52:00Z" + }, + { + "id": "CVE-2026-98997", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98997.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "6babf3249e82784608fcdcaaf182efc1462521ebeba0c1e4d3af77faf80e8963", + "officialModified": "2026-10-28T23:52:00Z" + }, + { + "id": "CVE-2026-98999", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-98999.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "a8d701e74fb3a11d3e7aa2b7e22efc8cdc10abe10ed2c973b4834ac8630be380", + "officialModified": "2026-10-28T23:52:00Z" + }, + { + "id": "CVE-2026-99000", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99000.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "7a7781d8927d6f12635b58e0350e991c9bc8f3bb6d3386d937480d7a9ec481e3", + "officialModified": "2026-10-28T23:52:00Z" + }, + { + "id": "CVE-2026-99001", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99001.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "e9cd133f28ea51640bc13f475f315f10fa9dec876ce13acc21aebcadcfc7c835", + "officialModified": "2026-10-28T23:52:00Z" + }, + { + "id": "CVE-2026-99002", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99002.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "0f01fdd5521782b87330cf68a2c342295a3981e42e8d0994e905c878237694c9", + "officialModified": "2026-10-28T23:52:01Z" + }, + { + "id": "CVE-2026-99003", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99003.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "1ffbf8fde01a70223fff41ff2eeb14b3cbb00464d22a30d9dd1be370772d01ea", + "officialModified": "2026-10-28T23:52:01Z" + }, + { + "id": "CVE-2026-99004", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99004.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "e0ee13e4ab316190f778a7a5f1bd61657ad130c6b66cf17d4852704985339b9d", + "officialModified": "2026-10-28T23:52:01Z" + }, + { + "id": "CVE-2026-99005", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99005.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "30a39c04543210e398e73a26b3089021140ed32a7b9e7d0091a6e65580eb7e9e", + "officialModified": "2026-10-28T23:52:01Z" + }, + { + "id": "CVE-2026-99006", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99006.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "23287dffda4ec1fd184e6b3ea08c44e0c4886bb1dbe3081709c485c9f28dfe59", + "officialModified": "2026-10-28T23:52:01Z" + }, + { + "id": "CVE-2026-99007", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99007.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "6d9c58c8cf3512a4986a62dd6733c02a79bad5a623a0733059413d8cc8ffe209", + "officialModified": "2026-10-28T23:52:02Z" + }, + { + "id": "CVE-2026-99008", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99008.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "07a50232d4cc98157514d91ae56975945beabd2ddc92a78d45b7e52b09926878", + "officialModified": "2026-10-28T23:52:02Z" + }, + { + "id": "CVE-2026-99009", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99009.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "05653195a8ed0882ca925421ac9e142c9116d72564a62f7c4bfb5d2fc4ae81cf", + "officialModified": "2026-10-28T23:52:02Z" + }, + { + "id": "CVE-2026-99010", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99010.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "0e8ac8393efb1d182b4d4431d5b66c2bead494eaf0eb13c2f60ebbcd27d60082", + "officialModified": "2026-10-28T23:52:02Z" + }, + { + "id": "CVE-2026-99011", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99011.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "df8057a79a54558f3b3e0084dfbc9197d567821a8e5514e29ad91943b3a8382d", + "officialModified": "2026-10-28T23:52:02Z" + }, + { + "id": "CVE-2026-99012", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99012.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "6299cc0924725173cb35274e89bd37d9f6c038d1dd770378bf16f3debb412cb9", + "officialModified": "2026-10-28T23:52:03Z" + }, + { + "id": "CVE-2026-99013", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99013.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "1b355f317f83f63f9d973a0ffb02ece7383beeea8ab96a6029c6f68eba371f08", + "officialModified": "2026-10-28T23:52:03Z" + }, + { + "id": "CVE-2026-99014", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99014.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "e4e15926324bf8e52808c0214f828511eb30480bc10a8ffce372fceaf0db51d0", + "officialModified": "2026-10-28T23:52:03Z" + }, + { + "id": "CVE-2026-99015", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99015.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "580a0fe6193f6e5357bde21ad751f52549eb73801e0cc6f17dad4a4118615b05", + "officialModified": "2026-10-28T23:52:03Z" + }, + { + "id": "CVE-2026-99016", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99016.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "fa56899e2fc5ad3cb63a286f673a28cc5760de5c9b7cdce5c0e4155824dadca9", + "officialModified": "2026-10-28T23:52:03Z" + }, + { + "id": "CVE-2026-99017", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99017.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "38fa2bf7293d28987481dd8e14ba14393b3fd5865b36e48795344fc536e06d19", + "officialModified": "2026-10-28T23:52:04Z" + }, + { + "id": "CVE-2026-99018", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99018.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "2749619eb997ff7cdb545fcf977a347fd8ae1aa5b64e4cd32559e4be09fe7016", + "officialModified": "2026-10-28T23:52:04Z" + }, + { + "id": "CVE-2026-99019", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99019.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "bc527ba981cafa9f04e5b555a384cad6d60871b74f535ea276ddcb5e4c5f12dc", + "officialModified": "2026-10-28T23:52:04Z" + }, + { + "id": "CVE-2026-99020", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99020.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "5ffd720fb6907ff40fbf8fcd195bb9f0e25e4ebe78e97985fbd69e203d092f65", + "officialModified": "2026-10-28T23:52:04Z" + }, + { + "id": "CVE-2026-99021", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99021.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "282b9fd2834232ae28bc85224c03f70188f7b0a1dbab305276859ae5085c459d", + "officialModified": "2026-10-28T23:52:04Z" + }, + { + "id": "CVE-2026-99022", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99022.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "c9bb1626c2d987cd1ffc4b08eecc803c6640a711aae630e5c32272e96e050ce6", + "officialModified": "2026-10-28T23:52:04Z" + }, + { + "id": "CVE-2026-99023", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99023.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "0f11b8750615583b31b0a6dfd476cd42d389e679c8105912920df1af9f712ba0", + "officialModified": "2026-10-28T23:52:05Z" + }, + { + "id": "CVE-2026-99024", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99024.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "d0dcf852cfbbc89b0304641d94fd6e9ddded3656092cb7024832c98d72c8efb7", + "officialModified": "2026-10-28T23:52:05Z" + }, + { + "id": "CVE-2026-99025", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99025.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "e7b7e25b997b52dfa24840251428d28d5281cf4b603e6d49b1ddf70394ab6d04", + "officialModified": "2026-10-28T23:52:05Z" + }, + { + "id": "CVE-2026-99026", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99026.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "d1adf796cafa7d6a33937ef51493f98a65a8522d2b4218e5e9a658d73411e09c", + "officialModified": "2026-10-28T23:52:05Z" + }, + { + "id": "CVE-2026-99027", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99027.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "df30e3e4dada472796a2b9b7d6aafb25f13729752726bda1e391bab1a64f000c", + "officialModified": "2026-10-28T23:52:06Z" + }, + { + "id": "CVE-2026-99028", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99028.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "c02ea5ab508a0e6284c31fb5ea5a8a5bb89c0ca08a1b0a1e9c44bad453449b9d", + "officialModified": "2026-10-28T23:52:06Z" + }, + { + "id": "CVE-2026-99029", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99029.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "7f372dbea4a7fdd47df2137559468a7e9f14a205c316ec57e1e178104cccc623", + "officialModified": "2026-10-28T23:52:06Z" + }, + { + "id": "CVE-2026-99030", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99030.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "4da4a01761b27a291ab6622bfc9352f5fbf3299dbaeb0cf0fad6a8a2ef4b12ad", + "officialModified": "2026-10-28T23:52:06Z" + }, + { + "id": "CVE-2026-99031", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99031.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "c85655ded49616c9adeabd46b25375cc27d6b5ffeae299d0ab208334f893c864", + "officialModified": "2026-10-28T23:52:06Z" + }, + { + "id": "CVE-2026-99032", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99032.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "97e0757cd50ceed210941a846f7f7c11caa2e3d752ec04f73eb91d37f334011b", + "officialModified": "2026-10-28T23:52:07Z" + }, + { + "id": "CVE-2026-99033", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99033.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "8560412bf44aa2c529fc8a7f81c0d308fe567c705293933a8c126dba0d9138b2", + "officialModified": "2026-10-28T23:52:07Z" + }, + { + "id": "CVE-2026-99034", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99034.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "12600df898613853d7b3b93e773b8387f53d91081ab9d1b707995f1def950978", + "officialModified": "2026-10-28T23:52:07Z" + }, + { + "id": "CVE-2026-99035", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99035.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "a211d1cbf1a66ce89ce4abae7c7bc1ac41d3682d43b7de02ee770fae4c4f3cd9", + "officialModified": "2026-10-28T23:52:07Z" + }, + { + "id": "CVE-2026-99036", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99036.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "9467cb8e87cbd6172c6bd168d9a0980f237680b22b69d42cfe77a95e30842f64", + "officialModified": "2026-10-28T23:52:07Z" + }, + { + "id": "CVE-2026-99037", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99037.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "e0f578e535aaea42accb47c8a12e195288123c213e8ae6ef050db20d2a3179c2", + "officialModified": "2026-10-28T23:52:08Z" + }, + { + "id": "CVE-2026-99038", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99038.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "70f9013fd844ac3ac0d7e6ab2a111b45f16dfd907fff66449bdf5dc883ea5536", + "officialModified": "2026-10-28T23:52:08Z" + }, + { + "id": "CVE-2026-99039", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99039.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "7a35ad78f965362beabb7c987fa87148250e5d3557daa5275b0d3e1772a35813", + "officialModified": "2026-10-28T23:52:08Z" + }, + { + "id": "CVE-2026-99040", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99040.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "9db61bae686982de5e0779c797a1ff2cc36048d0b1f903c0db56dcb4042673d1", + "officialModified": "2026-10-28T23:52:08Z" + }, + { + "id": "CVE-2026-99041", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99041.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "0708f7efc263ceb43271a2a835c332dec2de77bd3c0edf4ddb33d7999e7f401d", + "officialModified": "2026-10-28T23:52:09Z" + }, + { + "id": "CVE-2026-99043", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99043.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "18ed17d96be43695286bacb2c6dd22bee18db25f51a19b11e96a9a6d35b9ac22", + "officialModified": "2026-10-28T23:52:09Z" + }, + { + "id": "CVE-2026-99044", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99044.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "0deab7655334ffe1755eef9f8f3754464faeca684fe9b3fd5d82463cc7fbbbb7", + "officialModified": "2026-10-28T23:52:09Z" + }, + { + "id": "CVE-2026-99045", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99045.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "69cec6f0ca286ca478ab3094070ed7e5ef278f1b372484571e964471c3e46c8e", + "officialModified": "2026-10-28T23:52:09Z" + }, + { + "id": "CVE-2026-99046", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99046.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "10ab66e1bc080e14c4692eb3f70ee6954e4a748df67da49e5817b7b60d665488", + "officialModified": "2026-10-28T23:52:09Z" + }, + { + "id": "CVE-2026-99047", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99047.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "5b84f816bf3dc3a3e0375fb0a46b17d2a16f7b20f135016a6716f2def101bde9", + "officialModified": "2026-10-28T23:52:09Z" + }, + { + "id": "CVE-2026-99048", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99048.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "7ec420e26b20ac111dc1eec475d289b577f2f1884daee136e591e7e64a79e00d", + "officialModified": "2026-10-28T23:52:10Z" + }, + { + "id": "CVE-2026-99049", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99049.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "faa8d54d833d567615940598f06241dd4a12283c3cb132ee0134ff82593cacb0", + "officialModified": "2026-10-28T23:52:10Z" + }, + { + "id": "CVE-2026-99050", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99050.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "1c05263a18afc7eff557a7e684643d13b8bd0a42d02aa5f3a8db7ba26e2cffec", + "officialModified": "2026-10-28T23:52:10Z" + }, + { + "id": "CVE-2026-99051", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99051.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "c26721712d082bfa2bda0d11e0e4c8da5e693e4109b1b628503cffbfcca91317", + "officialModified": "2026-10-28T23:52:10Z" + }, + { + "id": "CVE-2026-99052", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99052.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "7fa7ff4cdf81c2484983cbab8e5e4516deaaf10e6d55b7f800a0032f5d3f2ef3", + "officialModified": "2026-10-28T23:52:10Z" + }, + { + "id": "CVE-2026-99053", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99053.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "7e0478d8147360f7c1d5794f0a79b87d1d6acab813fc91ce71e0f0e88ceebdeb", + "officialModified": "2026-10-28T23:52:10Z" + }, + { + "id": "CVE-2026-99054", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99054.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "102d9885b389a42eb28ecd2753eba2e28c07f4b4082e5605d5759b70a70257b0", + "officialModified": "2026-10-28T23:52:11Z" + }, + { + "id": "CVE-2026-99055", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99055.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "61a3ad0733071b8efa6161d7f3b35c56f1c54f569137efcc294ba32dfa85e0e4", + "officialModified": "2026-10-28T23:52:11Z" + }, + { + "id": "CVE-2026-99056", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99056.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "505b5d6d10b716500f425c439f3eb80a398091d4bdcb3df0427137a1cfd59287", + "officialModified": "2026-10-28T23:52:11Z" + }, + { + "id": "CVE-2026-99057", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99057.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "0dcbce7db88ad80ae5d1a864d6c54233e53b23b0d66a527e0d2422fff776f339", + "officialModified": "2026-10-28T23:52:11Z" + }, + { + "id": "CVE-2026-99058", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99058.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "279845ca1cf281c7fdf99891f6dad93ee8229f7115cef3bbc585cf3aa5365d34", + "officialModified": "2026-10-28T23:52:12Z" + }, + { + "id": "CVE-2026-99059", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99059.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "75abd3e59879acd43496b8d5c1c475db72bc30d96fcd06ab976c1ed97ce01d6e", + "officialModified": "2026-10-28T23:52:12Z" + }, + { + "id": "CVE-2026-99060", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99060.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "27b7362840901d5ae2cfe42fa5b2e669e4ee9d8fe507931fd922689bc0639c0b", + "officialModified": "2026-10-28T23:52:12Z" + }, + { + "id": "CVE-2026-99061", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99061.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "f87c553939fac10a69773ab2c0136f3aa70901954575ff65ade9f70911ac56f7", + "officialModified": "2026-10-28T23:52:12Z" + }, + { + "id": "CVE-2026-99062", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99062.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "1fac50a4628077e8f34bb3baad650d1801fd675b5bb240239fc6afc909e38a2f", + "officialModified": "2026-10-28T23:52:12Z" + }, + { + "id": "CVE-2026-99063", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99063.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "d529e8a705fb6a2a7a3897537520f58644165793208a33bbc527a5b6579fde64", + "officialModified": "2026-10-28T23:52:13Z" + }, + { + "id": "CVE-2026-99064", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99064.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "2798e03a0cd3acab9f3e0d547e13cf86a647399b97c7305de3d082a7b39e9993", + "officialModified": "2026-10-28T23:52:13Z" + }, + { + "id": "CVE-2026-99065", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99065.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "c68dd8f8208828995b7cd50cdb2b6566836709378cefd1feb072b6fb3946bba2", + "officialModified": "2026-10-28T23:52:13Z" + }, + { + "id": "CVE-2026-99066", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99066.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "398f4486a3a82e943d81a97133b760ac422ad9d9b637efa11d322e226050a579", + "officialModified": "2026-10-28T23:52:13Z" + }, + { + "id": "CVE-2026-99067", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99067.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "122d99d069d89924f009e870dd631c2c34d3b14d05b8b4334ebe10f390cc06af", + "officialModified": "2026-10-28T23:52:13Z" + }, + { + "id": "CVE-2026-99068", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99068.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "5a89d9ffa9cc02c1173a0a30afc928612d95865a915f3c417955fddc34f9f521", + "officialModified": "2026-10-28T23:52:13Z" + }, + { + "id": "CVE-2026-99069", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99069.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "be421b42ace1cfa70b339da7b7585b7d6870d42ca2c9167fb3e731004f927753", + "officialModified": "2026-10-28T23:52:14Z" + }, + { + "id": "CVE-2026-99070", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99070.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "40dae5d3dd3a104196c6d20302b55ecb284e912c3ea51225953245b200605cda", + "officialModified": "2026-10-28T23:52:14Z" + }, + { + "id": "CVE-2026-99071", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99071.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "3f87f7349eebba4817a4ce0c72b352edb5c61661691404b13c4e339f91bc910d", + "officialModified": "2026-10-28T23:52:14Z" + }, + { + "id": "CVE-2026-99072", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99072.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "5665a9113bfa9bd7878f6f7ff9cb4d27083cf986aa9ffc447df6cfc99a5b8c70", + "officialModified": "2026-10-28T23:52:14Z" + }, + { + "id": "CVE-2026-99073", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99073.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "981ba9403eb5eb26643407b58cfedb4cf19453bf39d5958999220321a68c60ba", + "officialModified": "2026-10-28T23:52:14Z" + }, + { + "id": "CVE-2026-99074", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99074.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "1ef4855f0b20b8607aeec5a49a0d175cab9606cff67a79cffe0f035a70d8de55", + "officialModified": "2026-10-28T23:52:15Z" + }, + { + "id": "CVE-2026-99075", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99075.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "7afe93ea559a0b838d00df886717dddf71cac636e59c52169a540f78638231f1", + "officialModified": "2026-10-28T17:50:19Z" + }, + { + "id": "CVE-2026-99076", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99076.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "9e9e10ced0e48653ff5201e3adb406a98b87e7f696316816c1ffd1a6dc111b9d", + "officialModified": "2026-10-28T17:50:19Z" + }, + { + "id": "CVE-2026-99077", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99077.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "8af9c3f2cdf6d926c352fc73a48f08dba0e38e88e3e5ccb872f7aa6cf787e3ee", + "officialModified": "2026-10-28T17:50:20Z" + }, + { + "id": "CVE-2026-99078", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99078.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "359e06b1da0d25ed8ceec699c3fd12580051b270f6df6f0ebc5de94597f286bd", + "officialModified": "2026-10-28T17:50:20Z" + }, + { + "id": "CVE-2026-99079", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99079.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "683be6da504b14e796405f51becc9829d2ef1b703e2b68c772c4ac66e5204700", + "officialModified": "2026-10-28T17:50:20Z" + }, + { + "id": "CVE-2026-99080", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99080.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "428ec2bf112a9a9ade2207702d63b8379bddc7777e209a5e744fd394c97443c2", + "officialModified": "2026-10-28T17:50:20Z" + }, + { + "id": "CVE-2026-99081", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99081.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "7a9f76a2ecce4f5992947e2388d34bef625b719a9c320a2efc7ba4cbe2bba1c0", + "officialModified": "2026-10-28T23:52:16Z" + }, + { + "id": "CVE-2026-99082", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99082.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "65a85ade7ccf7f9927fac27b6280b3025b32cd535f8c02b3d6299bd274b347e9", + "officialModified": "2026-10-28T23:52:16Z" + }, + { + "id": "CVE-2026-99083", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99083.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "0361fb28617f77cad0030add639e911ad2e8f4dffb318dc8803b62efc83d03f0", + "officialModified": "2026-10-28T17:50:21Z" + }, + { + "id": "CVE-2026-99085", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99085.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "da7eb768f7bb2c479ad7b7626c78b4953e5a983dabdde746f7fbc22d4e0f51a2", + "officialModified": "2026-10-28T23:52:17Z" + }, + { + "id": "CVE-2026-99086", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99086.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "3c7cd4925185fdf9d7f3853035a7fd1d2b8c61da4f0ac11d47ee4223014b257c", + "officialModified": "2026-10-28T23:52:17Z" + }, + { + "id": "CVE-2026-99087", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99087.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "b2f02bfcc0e66ab4ba971026918e630fc7ccce15dd15f92908d2e4284d91d029", + "officialModified": "2026-10-28T17:50:22Z" + }, + { + "id": "CVE-2026-99088", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99088.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "c80e6d9f1b9f161d96e7ee17dab80e01674a9e8ec19b72482e7ac8d2a81f9111", + "officialModified": "2026-10-28T23:52:17Z" + }, + { + "id": "CVE-2026-99089", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99089.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "20cb50cc0d18814df6d776410ce1ba0c1352609a1ecfe73131bd63914c6dafc5", + "officialModified": "2026-10-28T23:52:17Z" + }, + { + "id": "CVE-2026-99090", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99090.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "3ced1ba07863ef46b1a48d003a4e11ba4686ed148e45d957ae9a1e568c479c6a", + "officialModified": "2026-10-28T23:52:17Z" + }, + { + "id": "CVE-2026-99091", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99091.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "3f24308a9b46b73fcea94074f39c959f72eb8ee5f2a030ad9229009abf0d9080", + "officialModified": "2026-10-28T23:52:18Z" + }, + { + "id": "CVE-2026-99092", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99092.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "a265a55bb914602f3ad827404c5af4343c1aeb078fd82f3e146d63559c04e493", + "officialModified": "2026-10-28T23:52:18Z" + }, + { + "id": "CVE-2026-99093", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99093.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "3b5d87cbd3491ea51c960321ead661223c85e7d5acc33c616260514c7dd9ce7d", + "officialModified": "2026-10-28T23:52:18Z" + }, + { + "id": "CVE-2026-99094", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99094.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "53a76d85a419997ea9536b1327eabd37e95185fec7a5f11d9b315a143299969a", + "officialModified": "2026-10-28T23:52:18Z" + }, + { + "id": "CVE-2026-99095", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99095.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "7ed09abeccfafe48a2cf58e95b2b351bc5de1c0be9b4e023697678b6d322799a", + "officialModified": "2026-10-28T23:52:18Z" + }, + { + "id": "CVE-2026-99096", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99096.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "4154a8faab510b13313c0be4524b514a904cff9112a530fef5a7e4517d5a7e8a", + "officialModified": "2026-10-28T23:52:18Z" + }, + { + "id": "CVE-2026-99097", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99097.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "fd6a3b3fe9df98b8028eb9504ec33f9a6b4e813309f822979bcb8ab8d7d7b50f", + "officialModified": "2026-10-28T23:52:19Z" + }, + { + "id": "CVE-2026-99098", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99098.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "662303484227e580e8de7a3fd943ba12dd69ae72eede192c8dbab67d3550dbc7", + "officialModified": "2026-10-28T23:52:19Z" + }, + { + "id": "CVE-2026-99099", + "package": "linux-libc-dev", + "version": "7.0.0-38.38", + "purl": "pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04", + "target": "pasturestack/compose-cli-builder-audit:2a4a331a499d6937a1a18d473c9d4b3916685012 (ubuntu 26.04)", + "severity": "MEDIUM", + "officialPriority": [ + "medium" + ], + "sourcePackage": { + "ecosystem": "Ubuntu:26.04:LTS", + "name": "linux", + "purl": "pkg:deb/ubuntu/linux@7.0.0-42.42?arch=source&distro=resolute" + }, + "officialRangeEvents": [ + { + "introduced": "0" + } + ], + "officialFixedVersions": [], + "decision": "UNFIXED_MEDIUM_HEADER_ONLY", + "officialUrl": "https://raw.githubusercontent.com/canonical/ubuntu-security-notices/90bee5d308a23c63efd692d59fb39e5f05dfdb61/osv/cve/2026/UBUNTU-CVE-2026-99099.json", + "officialRevision": "90bee5d308a23c63efd692d59fb39e5f05dfdb61", + "rawSha256": "596dd2d34dd9eb6384e99bab549567374de2010f856340601a3dabb9958f39e0", + "officialModified": "2026-10-28T23:52:19Z" + } + ] } } diff --git a/.github/scripts/enforce-builder-vulnerabilities.py b/.github/scripts/enforce-builder-vulnerabilities.py index be9245a9..25cd543d 100644 --- a/.github/scripts/enforce-builder-vulnerabilities.py +++ b/.github/scripts/enforce-builder-vulnerabilities.py @@ -27,6 +27,23 @@ def violations(report, ledger, boundary, headers): if (headers.get("package") != "linux-libc-dev" or headers.get("version") != HEADER_VERSION or headers.get("purl") != HEADER_PURL): raise ValueError("Changed exact header review") + refresh = headers.get("mediumRefresh", {}) + refreshed = {} + for entry in refresh.get("entries", []): + identifier = entry.get("id") + official = ("https://raw.githubusercontent.com/canonical/ubuntu-security-notices/" + + str(refresh.get("officialSnapshot")) + "/osv/cve/2026/UBUNTU-" + + str(identifier) + ".json") + if (identifier in refreshed or identifier not in headers.get("ids", []) + or entry.get("package") != "linux-libc-dev" or entry.get("version") != HEADER_VERSION + or entry.get("purl") != HEADER_PURL or entry.get("severity") != "MEDIUM" + or entry.get("decision") != "UNFIXED_MEDIUM_HEADER_ONLY" + or entry.get("officialFixedVersions") != [] + or entry.get("officialRangeEvents") != [{"introduced": "0"}] + or entry.get("officialUrl") != official + or not entry.get("rawSha256") or not entry.get("target")): + raise ValueError("Invalid exact medium header refresh") + refreshed[identifier] = entry reviewed = {} for entry in ledger.get("unfixed", []): key = (entry["id"], entry["package"], entry["version"], entry["purl"]) @@ -54,7 +71,8 @@ def violations(report, ledger, boundary, headers): if boundary != expected: raise ValueError("Missing exact installed header-only proof") if (not fixed and key[0] in headers.get("ids", []) - and key[2] == HEADER_VERSION and key[3] == HEADER_PURL): + and key[2] == HEADER_VERSION and key[3] == HEADER_PURL + and (key[0] not in refreshed or finding.get("Severity") == "MEDIUM")): continue severity = finding.get("Severity", "UNKNOWN") entry = reviewed.get(key) diff --git a/.github/scripts/test_builder_vulnerability_policy.py b/.github/scripts/test_builder_vulnerability_policy.py index 70c851c8..11741fe0 100644 --- a/.github/scripts/test_builder_vulnerability_policy.py +++ b/.github/scripts/test_builder_vulnerability_policy.py @@ -1,4 +1,6 @@ import importlib.util +import json +from copy import deepcopy import unittest from pathlib import Path spec = importlib.util.spec_from_file_location("gate", Path(__file__).with_name("enforce-builder-vulnerabilities.py")) @@ -69,6 +71,28 @@ def test_fixed_header_rejected(self): self.header()["FixedVersion"] = "7.0.0-99"; self.assertTrue(self.check()) def test_new_header_advisory_rejected(self): self.header()["VulnerabilityID"] = "NEW"; self.assertTrue(self.check()) + def refreshed_header(self): + self.headers = json.loads((Path(__file__).resolve().parents[1] / "dapper-headers.json").read_text()) + f = self.header() + f.update(VulnerabilityID=self.headers["mediumRefresh"]["entries"][0]["id"], Severity="MEDIUM") + return f + def test_refreshed_exact_medium_header(self): + self.refreshed_header() + self.assertEqual(len(self.headers["mediumRefresh"]["entries"]), 222) + self.assertEqual(self.check(), []) + def test_refreshed_headers_cannot_allow_high_unknown_or_available_fix(self): + for severity in ("LOW", "HIGH", "CRITICAL", "UNKNOWN"): + self.refreshed_header()["Severity"] = severity + with self.subTest(severity=severity): self.assertTrue(self.check()) + self.refreshed_header()["FixedVersion"] = "7.0.0-99" + self.assertTrue(self.check()) + def test_refreshed_review_fixed_or_package_drift_rejected(self): + self.refreshed_header() + original = deepcopy(self.headers) + for key, value in (("officialFixedVersions", ["7.0.0-99"]), ("purl", "pkg:generic/other@1")): + self.headers = deepcopy(original) + self.headers["mediumRefresh"]["entries"][0][key] = value + with self.subTest(key=key), self.assertRaises(ValueError): self.check() def test_header_version_or_purl_drift_rejected(self): for field in ("InstalledVersion", "PkgIdentifier"): f = self.header() diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index 7c6ef86a..019ba62e 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -21,7 +21,7 @@ jobs: env: DAPPER_IMAGE: pasturestack/compose-cli-dapper:${{ github.sha }} TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 - VERSION_OVERRIDE: 0.14.39 + VERSION_OVERRIDE: 0.14.40 PLATFORM_COMPAT_JAR_URL: https://github.com/PastureStack/orchestration-engine/releases/download/v0.183.281/orchestration-engine-0.183.281.jar PLATFORM_COMPAT_JAR_SHA256: da2a8a51562ed16e296f7e29e99482bb44042ff0834cca679bbe01d951ba1682 @@ -69,7 +69,7 @@ jobs: } run_ci - artifact="dist/artifacts/compose-executor-0.14.39-linux-amd64.gz" + artifact="dist/artifacts/compose-executor-0.14.40-linux-amd64.gz" test -s "$artifact" cp "$artifact" /tmp/compose-executor-first.gz @@ -81,7 +81,7 @@ jobs: mkdir -p evidence/product gzip -cd "$artifact" > evidence/product/compose-executor chmod +x evidence/product/compose-executor - evidence/product/compose-executor --version | grep -F '0.14.39' >/dev/null + evidence/product/compose-executor --version | grep -F '0.14.40' >/dev/null cp "$artifact" evidence/ ( cd evidence diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index 5742153f..51e34c6d 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -2,6 +2,27 @@ The migration preserves Docker Compose parsing, stack event names, generated stack fields, service labels, catalog question data, upgrade and rollback payloads, and compatibility API behavior. +The v0.14.40 candidate adds one server-private mode, +`compose-executor.real --catalog-launch-preview`, with fixed inspect/finalize +JSON contracts and bounded stdin/stdout. Existing parser, conversion, service +factory, launch-config and secret-reference owners produce the exact graph; +there is no second renderer or model-supplied URL/file/command interface. +Typed templates use the reviewed bounded subset and freeze the approved bytes. + +Only a trusted Engine event may carry `catalogLaunchDelegation`. Its event-local +client uses the fixed delegation header for schema/read/transform/child calls; +missing or invalid proof cannot fall back to service FULL. Control progress and +replies retain the original trusted service channel, and unmarked ordinary +events retain their original client and API behavior. The Engine must recheck +the original actor/Key, source/plan/Stack/event/graph, destination create/update +and references on each request. Completion needs its committed ledger, full +intended links and normal deployment readiness, not only a Stack reply. + +KVM, unsupported provider/host/build/file/dependency/network graphs, external or +cross-Stack links and unsupported typed inputs fail closed in this private mode; +they remain pending typed adapters rather than completed UI features. Component +source/unit and official CI evidence do not establish matching Server runtime. + The archived external Compose implementation is no longer a build dependency. The conversion, collection-copy, logger, and Compose configuration-hash contracts still required by this compatibility client are implemented locally and covered by behavior tests. This does not expand or silently reinterpret the accepted Compose document format. `platform-compose.yml`, `PLATFORM_URL`, `PLATFORM_ACCESS_KEY`, and `PLATFORM_SECRET_KEY` are preferred. The historical companion filename, legacy CLI alias, `RANCHER_*` and `CATTLE_*` variables, `io.rancher.*` labels, generated `RancherCompose` and `RancherClient` types, legacy service-image identifiers, and vendored `github.com/rancher/*` paths remain only as wire, data, or dependency contracts. diff --git a/README.md b/README.md index 52c4d6a2..f6400792 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,20 @@ PastureStack is an independent community effort to preserve, audit, and moderniz The maintained source uses Ubuntu 26.04, Go 1.27.3, and Python 3.14.9 for integration-source verification. Ubuntu build packages, the base image, and Go archives are fixed by snapshot, exact version, and SHA-256. Go dependencies are managed by `go.mod` and a reproducible module vendor tree. AWS access uses AWS SDK for Go v2; container structures use the maintained Moby API module; the command parser uses urfave/cli v3. The abandoned AWS SDK v1, Rancher generated-client modules, event-subscriber module, `docker/libcompose`, and other GOPATH-era dependencies have been removed. The small Rancher 1.6 protocol boundary retained by this compatibility CLI is maintained and tested locally. The Dapper builder does not embed a Docker CLI or mount a Docker socket; Docker is required only on the host to create and run the isolated builder. The maintained binaries are `pasturestack-compose` and `compose-executor`; `platform-compose.yml` is the preferred companion file. Releases are built and verified from the preserved source history; this repository does not enable automated deployment. +The current published component is +[v0.14.39](https://github.com/PastureStack/compose-cli/releases/tag/v0.14.39). +The **v0.14.40** verification candidate adds the private two-phase Catalog launch +materializer and event-local delegated execution. It shares normal service, +volume, launch-config, secret-reference, sidekick and hash owners; ordinary CLI +and executor calls without a delegation marker keep their existing behavior. +See [the owner contract](docs/catalog-launch-owner.md) and +[candidate release note](docs/releases/compose-executor-0.14.40.md). + +The matching Engine owns the original actor/Key ceiling, human approval, +encrypted inputs, exact graph and child-request ledger. Neither a component +build nor a Stack reply proves workload success. This candidate is unpublished; +official gates and complete matching Server runtime acceptance are pending. + ## Configuration Use `PLATFORM_URL`, `PLATFORM_ACCESS_KEY`, and `PLATFORM_SECRET_KEY`. Historical `RANCHER_*` and `CATTLE_*` settings remain compatibility fallbacks. Operator messages support `PASTURESTACK_LOCALE=en-US` and `zh-TW`. @@ -31,7 +45,8 @@ publishes `compose-executor-0.14.39-linux-amd64.gz`. Published tags and assets remain immutable; a later recipe or documentation commit does not replace their bytes or change their producer identity. -Set `VERSION_OVERRIDE=0.14.39` for this recipe. Source changes alone are not +Set `VERSION_OVERRIDE=0.14.40` to verify this candidate; rebuild the published +release only from its numeric tag and original recipe. Source changes alone are not publication proof: verify the official release assets and their SHA-256. Component publication and matching Server acceptance are separate evidence boundaries. The Python integration suite must run against an @@ -66,6 +81,5 @@ proof; this is not a kernel or runtime exemption. Ubuntu security micro-updates apply only to already-installed packages without changing the Python ABI. The focused `Builder full-severity security` workflow validates builder-only -maintenance without rebuilding or republishing the unchanged `v0.14.39` -runtime. Raw distro pip metadata is retained alongside the actual replaced seed +maintenance without rebuilding or replacing published runtime assets. Raw distro pip metadata is retained alongside the actual replaced seed paths, wheel hash, and existing narrow pip-vendor VEX evidence. diff --git a/catalog_launch_main_test.go b/catalog_launch_main_test.go new file mode 100644 index 00000000..cd4aa72e --- /dev/null +++ b/catalog_launch_main_test.go @@ -0,0 +1,31 @@ +package main + +import ( + "bytes" + "os" + "os/exec" + "strings" + "testing" + + "github.com/PastureStack/compose-cli/cataloglaunch" +) + +func TestCatalogLaunchCommandOmitsPrivateParserDiagnostics(t *testing.T) { + if os.Getenv("PST_CATALOG_LAUNCH_TEST_PROCESS") == "1" { + os.Args = []string{"compose-executor", cataloglaunch.Command} + main() + return + } + command := exec.Command(os.Args[0], "-test.run=^TestCatalogLaunchCommandOmitsPrivateParserDiagnostics$") + command.Env = append(os.Environ(), "PST_CATALOG_LAUNCH_TEST_PROCESS=1") + command.Stdin = strings.NewReader(`{"name":"chosen","dockerCompose":"private-parser-answer-marker"}`) + var stdout, stderr bytes.Buffer + command.Stdout = &stdout + command.Stderr = &stderr + if command.Run() == nil { + t.Fatal("malformed input succeeded") + } + if stderr.Len() != 0 || strings.Contains(stdout.String(), "private-parser") || strings.TrimSpace(stdout.String()) != `{"code":"CatalogLaunchUnsupported"}` { + t.Fatal("private diagnostics reached process output") + } +} diff --git a/cataloglaunch/finalize_test.go b/cataloglaunch/finalize_test.go new file mode 100644 index 00000000..3d1715d7 --- /dev/null +++ b/cataloglaunch/finalize_test.go @@ -0,0 +1,34 @@ +package cataloglaunch + +import ( + "encoding/json" + "testing" +) + +func TestCatalogFinalizeRejectsUnknownOrMissingTransformAndUnresolvedReferences(t *testing.T) { + input := exampleInput() + input.Phase = "finalize" + input.TransformedLaunchConfigs = map[string]json.RawMessage{"app": json.RawMessage(`{"imageUuid":"docker:busybox:1.37.0","logConfig":{"config":{}}}`)} + result, err := Prepare(input) + if err != nil || result.Phase != "finalize" || len(result.ServiceRequests) != 1 || result.ServiceRequests[0].ResourceType != "service" { + t.Fatal("finalize failed") + } + for _, change := range []func(*Input){ + func(i *Input) { i.TransformedLaunchConfigs["foreign"] = json.RawMessage(`{}`) }, + func(i *Input) { delete(i.TransformedLaunchConfigs, "app") }, + func(i *Input) { i.TransformedLaunchConfigs["app"] = json.RawMessage(`null`) }, + func(i *Input) { i.ResolvedSecrets = map[string]string{"unrequested": "1se7"} }, + func(i *Input) { i.Phase = "inspect" }, + } { + copy := input + copy.TransformedLaunchConfigs = map[string]json.RawMessage{"app": input.TransformedLaunchConfigs["app"]} + change(©) + if _, err := Prepare(copy); err == nil { + t.Fatal("unbound finalize input admitted") + } + } + input.RancherCompose = "version: '2'\nservices:\n app:\n secrets:\n - chosen\n" + if _, err := Prepare(input); err == nil { + t.Fatal("unresolved secret accepted") + } +} diff --git a/cataloglaunch/prepare.go b/cataloglaunch/prepare.go new file mode 100644 index 00000000..17f3f17c --- /dev/null +++ b/cataloglaunch/prepare.go @@ -0,0 +1,398 @@ +// Package cataloglaunch is the Compose owner's private, non-networking +// materializer. It uses the normal parser and Docker conversion; it never +// authorizes a caller or creates a control-plane resource. +package cataloglaunch + +import ( + "bytes" + "encoding/json" + "errors" + "io" + "regexp" + "sort" + "strings" + + "github.com/PastureStack/compose-cli/config" + "github.com/PastureStack/compose-cli/convert" + client "github.com/PastureStack/compose-cli/internal/rancherclient/v2" + "github.com/PastureStack/compose-cli/lookup" + "github.com/PastureStack/compose-cli/platformapi" + "github.com/PastureStack/compose-cli/project" + "github.com/PastureStack/compose-cli/template" + "github.com/moby/moby/api/types/container" +) + +const MaxInspectInputBytes = 1536 * 1024 +const MaxInputBytes = 10 * 1024 * 1024 +const MaxOutputBytes = 8 * 1024 * 1024 +const MaxExpandedConfigBytes = 1024 * 1024 +const Command = "--catalog-launch-preview" + +var ErrInput = errors.New("CatalogLaunchInputInvalid") +var ErrUnsupported = errors.New("CatalogLaunchUnsupported") +var namePattern = regexp.MustCompile(`^[A-Za-z0-9-]{1,63}$`) + +// All input/output here is server-private, including normalized container +// configuration. Public plans only copy independently allowlisted counts. +type Input struct { + Phase string `json:"phase,omitempty"` + Name string `json:"name"` + EnvironmentName string `json:"environmentName"` + DockerCompose string `json:"dockerCompose"` + RancherCompose string `json:"rancherCompose"` + Variables map[string]interface{} `json:"variables"` + TransformedLaunchConfigs map[string]json.RawMessage `json:"transformedLaunchConfigs,omitempty"` + ResolvedSecrets map[string]string `json:"resolvedSecrets,omitempty"` +} + +type Inspect struct { + Name string `json:"Name"` + Config *convert.DockerConfig `json:"Config"` + HostConfig *container.HostConfig `json:"HostConfig"` +} + +type Service struct { + Name string `json:"name"` + PrimaryName string `json:"primaryName,omitempty"` + ResourceType string `json:"resourceType,omitempty"` + CreateSkeleton *platformapi.CompositeService `json:"createSkeleton,omitempty"` + Config *config.ServiceConfig `json:"config"` + Inspect Inspect `json:"dockerInspect"` +} + +type VolumeRequest struct { + Name string `json:"name"` + ResourceType string `json:"resourceType"` + CreateSkeleton *client.VolumeTemplate `json:"createSkeleton"` +} + +type Output struct { + Phase string `json:"phase"` + FormatVersion int `json:"formatVersion"` + DockerCompose string `json:"dockerCompose"` + RancherCompose string `json:"rancherCompose"` + Variables map[string]interface{} `json:"variables"` + Services []Service `json:"services"` + Volumes map[string]*config.VolumeConfig `json:"volumes"` + Networks map[string]*config.NetworkConfig `json:"networks"` + Secrets map[string]*config.SecretConfig `json:"secrets"` + Hosts map[string]*config.HostConfig `json:"hosts"` + Dependencies map[string]*config.DependencyConfig `json:"dependencies"` + VolumeRequests []VolumeRequest `json:"volumeRequests"` + ServiceRequests []ServiceRequest `json:"serviceRequests"` +} + +type ServiceRequest struct { + Name string `json:"name"` + ResourceType string `json:"resourceType"` + CreateBody interface{} `json:"createBody"` + SetServiceLinks *client.SetServiceLinksInput `json:"setServiceLinks"` +} + +type catalogEnvironment struct { + source *lookup.MapEnvLookup + used int + failed bool +} + +func (e *catalogEnvironment) Variables() map[string]string { return e.source.Variables() } +func (e *catalogEnvironment) Lookup(key string, c *config.ServiceConfig) []string { + values := e.source.Lookup(key, c) + if len(values) == 0 { + e.failed = true + return []string{key + "="} + } + for _, value := range values { + e.used += len(value) + if e.used > MaxExpandedConfigBytes { + e.failed = true + return []string{key + "="} + } + } + return values +} + +func Prepare(input Input) (*Output, error) { + if input.Phase != "" && input.Phase != "inspect" && input.Phase != "finalize" { + return nil, ErrInput + } + if input.Phase != "finalize" && (len(input.TransformedLaunchConfigs) > 0 || len(input.ResolvedSecrets) > 0) { + return nil, ErrInput + } + if !namePattern.MatchString(input.Name) || input.DockerCompose == "" || len(input.DockerCompose)+len(input.RancherCompose) > template.MaxCatalogTemplateBytes || + len(input.Variables) > 100 || len(input.EnvironmentName) > 512 { + return nil, ErrInput + } + for name, value := range input.Variables { + if name == "" || len(name) > 128 || strings.ContainsAny(name, "\x00\r\n") { + return nil, ErrInput + } + switch v := value.(type) { + case string: + if len(v) > 16384 || strings.ContainsRune(v, '\x00') { + return nil, ErrInput + } + case bool, json.Number, float64, int, int64: + default: + return nil, ErrInput + } + } + explicitVariables := map[string]interface{}{} + for name, value := range (&lookup.MapEnvLookup{Env: input.Variables}).Variables() { + explicitVariables[name] = value + } + env := &catalogEnvironment{source: &lookup.MapEnvLookup{Env: explicitVariables}} + catalogInfo, err := lookup.ParseCatalogConfig([]byte(input.RancherCompose)) + if err != nil { + return nil, ErrUnsupported + } + ownerName := platformapi.CatalogProjectName(input.Name) + stack := template.StackInfo{Name: ownerName, Version: catalogInfo.Version} + environment := template.EnvironmentInfo{Name: input.EnvironmentName} + docker, err := template.ApplyCatalog([]byte(input.DockerCompose), stack, environment, env.Variables()) + if err != nil { + return nil, ErrUnsupported + } + rancher, err := template.ApplyCatalog([]byte(input.RancherCompose), stack, environment, env.Variables()) + if err != nil { + return nil, ErrUnsupported + } + declaredSecrets := map[string]bool{} + for _, frozen := range [][]byte{docker, rancher} { + raw, err := config.CreateRawConfig(frozen) + if err != nil { + return nil, ErrUnsupported + } + for name, service := range raw.Services { + // The normal parser does not support every YAML representation of + // extends. Never approve a partially ignored external definition. + if _, found := service["extends"]; found { + return nil, ErrUnsupported + } + if references, found := service["secrets"]; found && references != nil { + declaredSecrets[name] = true + } + } + } + ctx := project.Context{ProjectName: ownerName, EnvironmentName: input.EnvironmentName, Version: catalogInfo.Version, + ComposeBytes: [][]byte{docker, rancher}, EnvironmentLookup: env, ResourceLookup: lookup.NewFileResourceLookup()} + // Use the same parser and environment resolution used by executor projects. + // No service/volume factory is installed, so parsing cannot call the API. + p := project.NewProject(&ctx) + if err := p.Parse(); err != nil { + return nil, ErrUnsupported + } + if env.failed { + return nil, ErrUnsupported + } + if p.ServiceConfigs.Len() == 0 || p.ServiceConfigs.Len() > 100 || p.ContainerConfigs.Len() > 0 || len(p.VolumeConfigs) > 100 || + len(p.NetworkConfigs) > 0 || len(p.SecretConfigs) > 100 || len(p.HostConfigs) > 0 || len(p.DependencyConfigs) > 0 { + return nil, ErrUnsupported + } + for _, secret := range p.SecretConfigs { + if secret == nil || secret.File != "" || secret.External == "" { + return nil, ErrUnsupported + } + } + primaries, err := platformapi.CatalogSidekickPrimaries(p) + if err != nil { + return nil, ErrUnsupported + } + for sidekick, primary := range primaries { + if !p.ServiceConfigs.Has(sidekick) || !p.ServiceConfigs.Has(primary) || primaries[primary] != "" { + return nil, ErrUnsupported + } + } + graphNames := map[string]string{} + for _, name := range p.ServiceConfigs.Keys() { + graphNames[name] = primaries[name] + } + linkSkeletons := map[string]*client.SetServiceLinksInput{} + names := p.ServiceConfigs.Keys() + sort.Strings(names) + result := &Output{Phase: "inspect", FormatVersion: 1, DockerCompose: string(docker), RancherCompose: string(rancher), Variables: explicitVariables, + Services: []Service{}, Volumes: p.VolumeConfigs, Networks: p.NetworkConfigs, Secrets: p.SecretConfigs, Hosts: p.HostConfigs, Dependencies: p.DependencyConfigs, VolumeRequests: []VolumeRequest{}} + volumes := make([]string, 0, len(p.VolumeConfigs)) + for name := range p.VolumeConfigs { + volumes = append(volumes, name) + } + sort.Strings(volumes) + for _, name := range volumes { + if !namePattern.MatchString(name) { + return nil, ErrUnsupported + } + result.VolumeRequests = append(result.VolumeRequests, VolumeRequest{Name: name, ResourceType: "volumeTemplate", CreateSkeleton: platformapi.CatalogVolumeCreateSkeleton(name, p.VolumeConfigs[name])}) + } + for _, name := range names { + if !namePattern.MatchString(name) { + return nil, ErrUnsupported + } + service, _ := p.ServiceConfigs.Get(name) + if service.Labels["io.rancher.service.selector.container"] != "" || service.Labels["io.rancher.service.selector.link"] != "" { + return nil, ErrUnsupported + } + if len(service.ExternalLinks) > 0 { + return nil, ErrUnsupported + } + links, err := platformapi.CatalogServiceLinkSkeleton(service.Links, graphNames) + if err != nil { + return nil, ErrUnsupported + } + linkSkeletons[name] = links + if declaredSecrets[name] && len(service.Secrets) == 0 { + return nil, ErrUnsupported + } + // KVM and external driver/provider lifecycles stay with their human UI. + if service.Image == "" || service.Type != "" && service.Type != "container" || service.StorageDriver != nil || service.NetworkDriver != nil || + config.IsLoadBalancerServiceImage(service.Image) || service.LbConfig != nil || service.LegacyLoadBalancerConfig != nil || service.Build.Context != "" { + return nil, ErrUnsupported + } + copy := *service + copy.Environment = append([]string(nil), service.Environment...) + if primaries[name] != "" { + for _, value := range copy.Environment { + if !strings.Contains(value, "=") { + return nil, ErrUnsupported + } + } + } + if primaries[name] == "" { + copy.Environment = resolveEnvironment(service.Environment, env, service) + } + if env.failed { + return nil, ErrUnsupported + } + canonical, err := platformapi.CatalogCanonicalConfig(©) + if err != nil { + return nil, ErrUnsupported + } + c, h, err := convert.Convert(canonical, ctx) + if err != nil { + return nil, ErrUnsupported + } + // The existing /scripts/transform contract consumes Docker Inspect; + // network launch references are retained separately in normalized config. + h.NetworkMode = "" + entry := Service{Name: name, PrimaryName: primaries[name], Config: canonical, Inspect: Inspect{Name: "/" + name, Config: c, HostConfig: h}} + if entry.PrimaryName == "" { + entry.ResourceType, entry.CreateSkeleton = platformapi.CatalogServiceCreateSkeleton(name, ©) + } + result.Services = append(result.Services, entry) + } + if input.Phase == "finalize" { + if len(input.TransformedLaunchConfigs) != len(result.Services) { + return nil, ErrInput + } + parts := map[string]platformapi.CatalogLaunchPart{} + neededSecrets := map[string]bool{} + for _, entry := range result.Services { + transformed, ok := input.TransformedLaunchConfigs[entry.Name] + if !ok || len(transformed) == 0 || string(transformed) == "null" { + return nil, ErrInput + } + parts[entry.Name] = platformapi.CatalogLaunchPart{Name: entry.Name, Config: entry.Config, Transform: transformed, VolumeDriver: entry.Inspect.HostConfig.VolumeDriver} + if entry.PrimaryName == "" { + for _, reference := range entry.Config.Secrets { + neededSecrets[reference.Source] = true + } + } + } + if len(input.ResolvedSecrets) != len(neededSecrets) { + return nil, ErrInput + } + for name, id := range input.ResolvedSecrets { + if !neededSecrets[name] || id == "" || len(id) > 128 || strings.ContainsAny(id, "/\\: \t\r\n\x00") { + return nil, ErrInput + } + } + result.ServiceRequests = []ServiceRequest{} + for _, entry := range result.Services { + if entry.PrimaryName != "" { + continue + } + order, err := platformapi.CatalogSidekickOrder(p, entry.Name) + if err != nil { + return nil, ErrUnsupported + } + secondary := []platformapi.CatalogLaunchPart{} + for _, name := range order { + secondary = append(secondary, parts[name]) + } + kind, body, err := platformapi.CatalogFinalizeService(parts[entry.Name], secondary, input.ResolvedSecrets) + if err != nil { + return nil, ErrUnsupported + } + links := linkSkeletons[entry.Name] + if kind == "externalService" { + links = nil + } + result.ServiceRequests = append(result.ServiceRequests, ServiceRequest{Name: entry.Name, ResourceType: kind, CreateBody: platformapi.CatalogServiceRequestPayload(kind, body), SetServiceLinks: links}) + } + result.Phase = "finalize" + } + encoded, err := json.Marshal(result) + if err != nil || len(encoded) > MaxOutputBytes { + return nil, ErrUnsupported + } + return result, nil +} + +func resolveEnvironment(source []string, env config.EnvironmentLookup, service *config.ServiceConfig) []string { + result := []string{} + for _, entry := range source { + if strings.Contains(entry, "=") { + result = append(result, entry) + } else { + result = append(result, env.Lookup(entry, service)...) + } + } + return result +} + +// Run has no URL, path, credential or arbitrary command parameter. Its caller +// must enforce a subprocess deadline and discard stderr. Every failure has a +// fixed code, with no YAML, answer, parser text or host path echoed. +func Run(reader io.Reader, writer io.Writer) (status int) { + defer func() { + if recover() != nil { + status = writeFailure(writer, ErrUnsupported) + } + }() + raw, err := io.ReadAll(io.LimitReader(reader, MaxInputBytes+1)) + if err != nil || len(raw) > MaxInputBytes { + return writeFailure(writer, ErrInput) + } + decoder := json.NewDecoder(bytes.NewReader(raw)) + decoder.DisallowUnknownFields() + decoder.UseNumber() + var input Input + if decoder.Decode(&input) != nil { + return writeFailure(writer, ErrInput) + } + if input.Phase != "finalize" && len(raw) > MaxInspectInputBytes { + return writeFailure(writer, ErrInput) + } + var extra interface{} + if decoder.Decode(&extra) != io.EOF { + return writeFailure(writer, ErrInput) + } + result, err := Prepare(input) + if err != nil { + return writeFailure(writer, err) + } + if json.NewEncoder(writer).Encode(result) != nil { + return 1 + } + return 0 +} + +func writeFailure(writer io.Writer, err error) int { + code := ErrUnsupported.Error() + if errors.Is(err, ErrInput) { + code = ErrInput.Error() + } + _ = json.NewEncoder(writer).Encode(struct { + Code string `json:"code"` + }{code}) + return 1 +} diff --git a/cataloglaunch/prepare_test.go b/cataloglaunch/prepare_test.go new file mode 100644 index 00000000..de0df840 --- /dev/null +++ b/cataloglaunch/prepare_test.go @@ -0,0 +1,153 @@ +package cataloglaunch + +import ( + "bytes" + "encoding/json" + "fmt" + "sort" + "strings" + "testing" + + "github.com/PastureStack/compose-cli/config" + "github.com/PastureStack/compose-cli/convert" + "github.com/PastureStack/compose-cli/lookup" + "github.com/PastureStack/compose-cli/project" + "github.com/PastureStack/compose-cli/template" +) + +func exampleInput() Input { + return Input{Name: "chosen-stack", EnvironmentName: "project", DockerCompose: `version: '2' +services: + app: + image: busybox:1.37.0 + command: ['sh', '-c', 'sleep 3600'] + environment: + FLAG: '${flag}' + COUNT: '${count}' + PRIVATE: '{{ .Values.password }}' + volumes: + - proof:/proof + ports: + - '18080:80' +volumes: + proof: {} +`, RancherCompose: `version: '2' +services: + app: + scale: 2 +`, Variables: map[string]interface{}{"flag": false, "count": json.Number("0"), "password": "private-answer-marker"}} +} + +func TestCatalogPrepareBoundsInterpolationBeforeGraphAllocation(t *testing.T) { + var source strings.Builder + source.WriteString("version: '2'\nservices:\n") + for i := 0; i < 100; i++ { + fmt.Fprintf(&source, " app%d:\n image: busybox:1.37.0\n environment:\n TEXT: '${text}'\n", i) + } + input := Input{Name: "chosen", DockerCompose: source.String(), Variables: map[string]interface{}{"text": strings.Repeat("x", 16384)}} + if _, err := Prepare(input); err == nil { + t.Fatal("unbounded interpolation accepted before graph allocation") + } + input.DockerCompose = "version: '2'\nservices:\n app:\n image: busybox\n environment:\n TEXT: '${undeclared}'\n" + input.Variables = nil + if _, err := Prepare(input); err == nil { + t.Fatal("undeclared interpolation could reach ordinary warning logs") + } +} + +func TestCatalogPrepareUsesNormalMergeConvertAndPreservesPrivateVariables(t *testing.T) { + input := exampleInput() + result, err := Prepare(input) + if err != nil { + t.Fatalf("prepare failed: %v", err) + } + if result.FormatVersion != 1 || len(result.Services) != 1 || len(result.Volumes) != 1 || result.Services[0].Config.Scale != 2 { + t.Fatal("normal graph changed") + } + if result.Variables["flag"] != "false" || result.Variables["count"] != "0" { + t.Fatal("variables differ from normal Stack map[string] schema") + } + service := result.Services[0] + for _, entry := range []string{"FLAG=false", "COUNT=0", "PRIVATE=private-answer-marker"} { + found := false + for _, value := range service.Inspect.Config.Env { + if value == entry { + found = true + } + } + if !found { + t.Fatal("explicit private/false/zero value lost") + } + } + // Parse the frozen result through the exact ordinary owner, then compare + // Docker conversion. A second template context cannot change the config. + env := &lookup.MapEnvLookup{Env: result.Variables} + ctx := project.Context{ProjectName: input.Name, EnvironmentLookup: env, ResourceLookup: lookup.NewFileResourceLookup()} + merged, err := config.Merge(config.NewServiceConfigs(), env, ctx.ResourceLookup, template.StackInfo{Name: "different"}, template.EnvironmentInfo{}, "", []byte(result.DockerCompose)) + if err != nil { + t.Fatal("frozen normal parse failed") + } + c, _, err := convert.Convert(merged.Services["app"], ctx) + if err != nil { + t.Fatal("normal conversion failed") + } + sort.Strings(c.Env) + sort.Strings(service.Inspect.Config.Env) + got, _ := json.Marshal(c) + want, _ := json.Marshal(service.Inspect.Config) + if !bytes.Equal(got, want) { + t.Fatal("preview and normal owner Docker config differ") + } +} + +func TestCatalogPrepareRejectsHostFileProviderKVMAndUnboundedGraphs(t *testing.T) { + for index, source := range []string{ + "version: '2'\nservices:\n app:\n image: busybox\n env_file: /etc/private\n", + "version: '2'\nservices:\n app:\n extends:\n file: /etc/private\n service: other\n", + "version: '2'\nservices:\n app:\n image: busybox\n type: virtual_machine\n", + "version: '2'\nservices: {}\n", + "version: '2'\nservices:\n app:\n image: '{{ env \"HOST_SECRET\" }}'\n", + } { + input := exampleInput() + input.DockerCompose = source + if _, err := Prepare(input); err == nil { + t.Fatalf("unsupported or host input accepted at fixture %d", index) + } + } + input := exampleInput() + input.Variables["rawNested"] = map[string]interface{}{"password": "never-echo"} + if _, err := Prepare(input); err != ErrInput { + t.Fatal("nested arbitrary input accepted") + } +} + +func TestCatalogPrepareUsesOrdinaryExecutorProjectAndCatalogVersionContext(t *testing.T) { + input := exampleInput() + input.Name = "-Chosen" + input.DockerCompose = "version: '2'\nservices:\n app:\n image: '{{ .Stack.Name }}:{{ .Stack.Version }}'\n" + input.RancherCompose = "version: '2'\ncatalog:\n version: '2.3'\n" + result, err := Prepare(input) + if err != nil || len(result.Services) != 1 || result.Services[0].Config.Image != "x-chosen:2.3" { + t.Fatal("preflight used a different context than normal executor") + } +} + +func TestCatalogPrivateProtocolHasClosedCommandBodyAndSafeFailureCodes(t *testing.T) { + var output bytes.Buffer + input := exampleInput() + raw, _ := json.Marshal(input) + if Run(bytes.NewReader(raw), &output) != 0 || !strings.Contains(output.String(), `"formatVersion":1`) { + t.Fatal("private owner protocol failed") + } + for _, body := range []string{ + `{"name":"chosen","url":"https://remote","dockerCompose":"private-source-marker"}`, + `{"name":"chosen","dockerCompose":"private-invalid-yaml-marker"} {}`, + `{"name":"chosen","dockerCompose":"private-invalid-yaml-marker"}`, + strings.Repeat("x", MaxInputBytes+1), + } { + output.Reset() + if Run(strings.NewReader(body), &output) == 0 || strings.Contains(output.String(), "private-") || output.Len() > 80 { + t.Fatal("invalid body succeeded or private error leaked") + } + } +} diff --git a/docs/catalog-launch-owner.md b/docs/catalog-launch-owner.md new file mode 100644 index 00000000..16fab3a5 --- /dev/null +++ b/docs/catalog-launch-owner.md @@ -0,0 +1,21 @@ +# Typed Catalog launch owner（未發行） + +這是隔離的 Compose owner 實作，尚未代表正式 Go 1.27.3 CI、Engine 整合或 runtime 驗收通過。一般 CLI／executor 行為沿原路。 + +Engine 固定呼叫 `/usr/bin/compose-executor.real --catalog-launch-preview`，只透過 stdin/stdout 傳 server-private JSON，不接 URL、檔案路徑、服務憑證或任意命令。caller 必須限制執行期限、清除繼承憑證／debug 環境、限制 stdout 並丟棄 stderr。 + +* `phase=inspect`（省略時相同）：`name/environmentName/dockerCompose/rancherCompose/variables`，最多 1.5 MiB。回傳 frozen Compose、顯式 string variables、normal parser 的 config、Docker Inspect、primary/sidekick 關係與建立 skeleton。 +* `phase=finalize`：同一來源／變數，另加完整且精確的 `transformedLaunchConfigs` 與 `resolvedSecrets`，最多 10 MiB。Engine 使用原 DockerTransformer／schema projection 提供前者，並以真正 owner／Key/reference 准入提供後者。多餘、缺漏、未知 name 或未解析 reference 均拒絕。 +* 所有輸出最多 8 MiB；Compose 原始檔合計最多 1 MiB，插值總量在解析過程限制為 1 MiB，未宣告變數拒絕。錯誤只有固定 code；私有 parser/API body 不回印。 + +不在 Auth 重寫 YAML 或建立規則：使用既有 `project.Parse/config.Merge/convert.Convert`。Go template 採 bounded、無 host environment／DNS／random／檔案功能的子集，執行錯誤不吞掉；render 後加 `# notemplating` 固定核准內容。context name/version 取原 owner 的 normalization／Catalog config。finalize 與普通 `NormalFactory` 共用 service/volume skeleton、launch config 補值、secret resolver、sidekick、ports 與 service hash。 + +finalize 的 `serviceRequests[].createBody` 是正常 POST 的精確 DTO；`volumeRequests[].createSkeleton` 沿正常 VolumeTemplate owner。`$createdStack`／`$service:` 只容許 Engine 綁本計畫實際建立的 ID，不能接受模型 ID。`setServiceLinks` 沿同一 parser／DTO，只支援此 graph 內部服務；順序視為集合。正常 owner 會跑兩次 Create 以完成循環 links，因此可先送已存在 targets 的 subset，再送完整 intended links；完成判定仍需完整關聯收斂。 + +此 candidate 明確拒絕 KVM、provider/driver、host/dependency、build、外部檔案、ignored extends/secret 形狀、外部或跨 Stack／region links、動態 service selectors、未支援的 network graph。這些是尚待 typed adapter 的功能，不能因已有工具就標成完整 Catalog UI 通過。 + +跨程序授權只使用 Engine 私有 event：`data.catalogLaunchDelegation={planId,stackId,eventId,proof}`。它綁定實際 event/resource，經事件專屬 client 將 proof 放入固定 `X-PastureStack-Catalog-Launch-Delegation` header，含 schema/read/transform/child requests；不修改 router 的共用服務 client。已有 marker 而缺／錯 proof 不退回服務 FULL。delegated context 直接綁已讀回的 exact Stack，避免 name normalization 另建 Stack。 + +Engine 必須逐 request 驗 nonce/hash、claim plan、Stack/event/frozen graph、原 actor／Key revision／撤權與權限，並在正常 manager 執行前後保留 scope。缺 proof 的拒絕只限 active delegated execution 與真正 launcher caller；真人與一般 Key 後續操作維持原有 RBAC。verified requests 採 metadata-only audit，不能序列化私有 request/response payload。proof 不進模型、公開工具、log 或 WebStorage。 + +進度與最終 event reply 維持原有 trusted service channel，只送固定文字與該 event 的 reply binding。原 Owner Key 不取得 `publish` 權限；Stack 收到 reply／active 也不是完成證明，Engine 還必須驗 exact graph、ledger、完整 links 與正常 deployment readiness。 diff --git a/docs/releases/compose-executor-0.14.40.md b/docs/releases/compose-executor-0.14.40.md new file mode 100644 index 00000000..250e9441 --- /dev/null +++ b/docs/releases/compose-executor-0.14.40.md @@ -0,0 +1,27 @@ +# Compose Executor v0.14.40 candidate + +Status: unpublished verification candidate. The current immutable component is +[v0.14.39](https://github.com/PastureStack/compose-cli/releases/tag/v0.14.39). +The existing Go 1.27.3 build/test/race/reproducibility/security/CodeQL gates remain +required. Matching Engine/Web/Server launch acceptance is not yet established. + +The fixed private inspect/finalize mode produces frozen Compose and exact +service/volume/links DTOs through the normal owner functions. It accepts bounded +server-private JSON, not a URL, local file, service credential or arbitrary +command. Finalize requires complete transformed launch configs and verified +secret references; unknown, missing, extra or unsupported graph shapes fail +closed. The normal CLI parser and unmarked executor behavior remain in place. + +The trusted launch event creates only an event-local proof-bearing API client. +It binds the exact event and Stack; shared service clients and control replies +are unchanged. The Engine must validate original live account/Key permissions, +revision/revocation, claimed plan, Stack/event/graph and each normal child +request. It must commit business mutation plus ledger before responding and +verify full intended links and deployment readiness before reporting success. +The proof, private Compose, answers and credentials must not enter public tools, +logs or browser storage. + +No Go module/vendor/toolchain or compatibility-artifact pin is changed. Existing +ordinary compatibility tests remain required; the old compatibility Server does +not establish new delegated Catalog launch acceptance. Unsupported typed graph +features remain partial, and published 0.14.39 bytes are never overwritten. diff --git a/executor/handlers/catalog_delegation.go b/executor/handlers/catalog_delegation.go new file mode 100644 index 00000000..b77235eb --- /dev/null +++ b/executor/handlers/catalog_delegation.go @@ -0,0 +1,56 @@ +package handlers + +import ( + "encoding/base64" + "errors" + "regexp" + "strings" + + "github.com/PastureStack/compose-cli/internal/events" + client "github.com/PastureStack/compose-cli/internal/rancherclient/v2" +) + +var catalogPlanID = regexp.MustCompile(`^aicataloglaunch-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`) +var catalogProofID = regexp.MustCompile(`^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`) +var errCatalogDelegation = errors.New("CatalogLaunchDelegationInvalid") + +func catalogLaunchProof(event *events.Event) (string, bool, error) { + if event == nil { + return "", true, errCatalogDelegation + } + value, marked := event.Data["catalogLaunchDelegation"] + if !marked { + return "", false, nil + } + proof, ok := value.(map[string]interface{}) + if !ok || len(proof) != 4 { + return "", true, errCatalogDelegation + } + plan, planOK := proof["planId"].(string) + stack, stackOK := proof["stackId"].(string) + id, idOK := proof["eventId"].(string) + token, tokenOK := proof["proof"].(string) + if !planOK || !stackOK || !idOK || !tokenOK || !catalogPlanID.MatchString(plan) || stack == "" || len(stack) > 128 || stack != event.ResourceID || id == "" || len(id) > 128 || id != event.ID { + return "", true, errCatalogDelegation + } + parts := strings.Split(token, ".") + if len(parts) != 3 || parts[0] != "cld1" || !catalogProofID.MatchString(parts[1]) || len(parts[2]) != 43 { + return "", true, errCatalogDelegation + } + nonce, err := base64.RawURLEncoding.DecodeString(parts[2]) + if err != nil || len(nonce) != 32 { + return "", true, errCatalogDelegation + } + return token, true, nil +} + +func catalogLaunchClient(event *events.Event, original *client.RancherClient) (*client.RancherClient, error) { + proof, marked, err := catalogLaunchProof(event) + if err != nil { + return nil, err + } + if !marked { + return original, nil + } + return client.WithCatalogLaunchDelegation(original, proof) +} diff --git a/executor/handlers/catalog_delegation_test.go b/executor/handlers/catalog_delegation_test.go new file mode 100644 index 00000000..8fe4305f --- /dev/null +++ b/executor/handlers/catalog_delegation_test.go @@ -0,0 +1,83 @@ +package handlers + +import ( + "encoding/base64" + "fmt" + "net/http" + "net/http/httptest" + "strings" + "testing" + + "github.com/PastureStack/compose-cli/internal/events" + client "github.com/PastureStack/compose-cli/internal/rancherclient/v2" + "github.com/sirupsen/logrus" +) + +func catalogEvent() *events.Event { + return &events.Event{ID: "event-one", ResourceID: "1st7", Data: map[string]interface{}{"catalogLaunchDelegation": map[string]interface{}{ + "planId": "aicataloglaunch-11111111-2222-3333-4444-555555555555", "stackId": "1st7", "eventId": "event-one", + "proof": "cld1.11111111-2222-3333-4444-555555555555." + base64.RawURLEncoding.EncodeToString(make([]byte, 32)), + }}} +} + +func TestCatalogControlReplyUsesOriginalServiceChannelWithoutOwnerPublishGrant(t *testing.T) { + readsWithProof, publishesWithoutProof := 0, 0 + var server *httptest.Server + server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + switch r.URL.Path { + case "/schemas": + w.Header().Set("X-API-Schemas", server.URL+"/schemas") + fmt.Fprintf(w, `{"data":[{"id":"stack","resourceMethods":["GET"],"links":{"collection":%q}},{"id":"publish","collectionMethods":["POST"],"links":{"collection":%q}}]}`, server.URL+"/stacks", server.URL+"/publish") + case "/stacks/1st7": + if r.Header.Get(client.CatalogLaunchDelegationHeader) != "" { + readsWithProof++ + } + fmt.Fprint(w, `{"id":"1st7","dockerCompose":""}`) + case "/publish": + if r.Header.Get(client.CatalogLaunchDelegationHeader) == "" { + publishesWithoutProof++ + } + fmt.Fprint(w, `{}`) + default: + t.Error("unexpected owner control route") + } + })) + defer server.Close() + c, err := client.NewRancherClient(&client.ClientOpts{Url: server.URL + "/schemas"}) + if err != nil { + t.Fatal("fake service channel failed") + } + event := catalogEvent() + event.ReplyTo = "reply.one" + if err := createStack(logrus.NewEntry(logrus.New()), event, c); err != nil { + t.Fatal("control fixture failed") + } + if readsWithProof != 1 || publishesWithoutProof != 1 || c.GetOpts().CatalogLaunchDelegation != "" { + t.Fatal("domain ceiling or control identity mixed") + } +} + +func TestCatalogDelegationBindsExactEventAndStackBeforeAnyServiceClient(t *testing.T) { + proof, marked, err := catalogLaunchProof(catalogEvent()) + if err != nil || !marked || !strings.HasPrefix(proof, "cld1.") { + t.Fatal("valid Engine event rejected") + } + for _, change := range []func(*events.Event){ + func(e *events.Event) { e.ResourceID = "1st8" }, func(e *events.Event) { e.ID = "different-event" }, + func(e *events.Event) { e.Data["catalogLaunchDelegation"] = nil }, + func(e *events.Event) { delete(e.Data["catalogLaunchDelegation"].(map[string]interface{}), "proof") }, + func(e *events.Event) { e.Data["catalogLaunchDelegation"].(map[string]interface{})["proof"] = "forged" }, + func(e *events.Event) { + e.Data["catalogLaunchDelegation"].(map[string]interface{})["url"] = "http://foreign" + }, + } { + event := catalogEvent() + change(event) + if c, err := catalogLaunchClient(event, nil); err == nil || c != nil { + t.Fatal("marked event fell back to service client") + } + } + if c, err := catalogLaunchClient(&events.Event{}, nil); err != nil || c != nil { + t.Fatal("ordinary event changed") + } +} diff --git a/executor/handlers/create_handler.go b/executor/handlers/create_handler.go index 51da9fed..aa2e53fa 100644 --- a/executor/handlers/create_handler.go +++ b/executor/handlers/create_handler.go @@ -21,6 +21,9 @@ func CreateStack(event *events.Event, apiClient *client.RancherClient) error { logger.Info("Stack Create Event Received") if err := createStack(logger, event, apiClient); err != nil { + if _, marked := event.Data["catalogLaunchDelegation"]; marked { + err = errors.New("CatalogLaunchDispatchFailed") + } logger.Errorf("Stack Create Event Failed: %s", logging.SafeLogValue(err)) publishTransitioningReply(err.Error(), event, apiClient, true) return err @@ -31,6 +34,11 @@ func CreateStack(event *events.Event, apiClient *client.RancherClient) error { } func createStack(logger *logrus.Entry, event *events.Event, apiClient *client.RancherClient) error { + replyClient := apiClient + apiClient, err := catalogLaunchClient(event, apiClient) + if err != nil { + return err + } stack, err := apiClient.Stack.ById(event.ResourceID) if err != nil { return err @@ -41,15 +49,15 @@ func createStack(logger *logrus.Entry, event *events.Event, apiClient *client.Ra } if stack.DockerCompose == "" { - return emptyReply(event, apiClient) + return emptyReply(event, replyClient) } - _, project, err := constructProject(logger, stack, apiClient.GetOpts().Url, apiClient.GetOpts().AccessKey, apiClient.GetOpts().SecretKey) + _, project, err := constructProjectWithOptions(logger, stack, apiClient.GetOpts()) if err != nil { return err } - publishTransitioningReply("Creating stack", event, apiClient, false) + publishTransitioningReply("Creating stack", event, replyClient, false) if err := project.Create(context.Background(), options.Create{}); err != nil { return err @@ -77,5 +85,5 @@ func createStack(logger *logrus.Entry, event *events.Event, apiClient *client.Ra } } - return emptyReply(event, apiClient) + return emptyReply(event, replyClient) } diff --git a/executor/handlers/project.go b/executor/handlers/project.go index 217bdb26..3cf27ccf 100644 --- a/executor/handlers/project.go +++ b/executor/handlers/project.go @@ -62,6 +62,10 @@ func constructProjectUpgrade(logger *logrus.Entry, stack *client.Stack, upgradeO } func constructProject(logger *logrus.Entry, stack *client.Stack, url, accessKey, secretKey string) (*platformapi.Context, *project.Project, error) { + return constructProjectWithOptions(logger, stack, &client.ClientOpts{Url: url, AccessKey: accessKey, SecretKey: secretKey}) +} + +func constructProjectWithOptions(logger *logrus.Entry, stack *client.Stack, opts *client.ClientOpts) (*platformapi.Context, *project.Project, error) { variables, err := createVariableMap(stack, stack.RancherCompose) if err != nil { return nil, nil, err @@ -87,9 +91,13 @@ func constructProject(logger *logrus.Entry, stack *client.Stack, url, accessKey, }, Version: catalogInfo.Version, }, - Url: fmt.Sprintf("%s/projects/%s/schemas", url, stack.AccountId), - AccessKey: accessKey, - SecretKey: secretKey, + Url: fmt.Sprintf("%s/projects/%s/schemas", opts.Url, stack.AccountId), + AccessKey: opts.AccessKey, + SecretKey: opts.SecretKey, + CatalogLaunchDelegation: opts.CatalogLaunchDelegation, + } + if opts.CatalogLaunchDelegation != "" { + context.Stack = stack } p, err := platformapi.NewProject(&context) diff --git a/internal/rancherclient/v2/catalog_delegation_test.go b/internal/rancherclient/v2/catalog_delegation_test.go new file mode 100644 index 00000000..8cd1a6bf --- /dev/null +++ b/internal/rancherclient/v2/catalog_delegation_test.go @@ -0,0 +1,88 @@ +package client + +import ( + "fmt" + "net/http" + "net/http/httptest" + "strings" + "testing" +) + +func TestCatalogProofIsEventLocalAndIncludedOnBootstrapReadTransformAndChild(t *testing.T) { + observed := []string{} + var server *httptest.Server + server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + observed = append(observed, r.Method+" "+r.URL.Path+" "+r.Header.Get(CatalogLaunchDelegationHeader)) + if r.URL.Path == "/v2-beta/schemas" { + w.Header().Set("X-API-Schemas", server.URL+"/v2-beta/schemas") + fmt.Fprint(w, `{"data":[]}`) + return + } + fmt.Fprint(w, `{}`) + })) + defer server.Close() + original, err := NewRancherClient(&ClientOpts{Url: server.URL + "/v2-beta/schemas", AccessKey: "service-key", SecretKey: "private-service-secret"}) + if err != nil { + t.Fatal("original client failed") + } + proof := "server-only-proof" + delegated, err := WithCatalogLaunchDelegation(original, proof) + if err != nil { + t.Fatal("event client failed") + } + var result map[string]interface{} + if delegated.GetLink(Resource{Links: map[string]string{"self": server.URL + "/v2-beta/stacks/1st7"}}, "self", &result) != nil { + t.Fatal("read failed") + } + for _, path := range []string{"/v2-beta/scripts/transform", "/v2-beta/projects/1a5/services"} { + if delegated.Post(server.URL+path, map[string]interface{}{}, &result) != nil { + t.Fatal("child failed") + } + } + if original.GetOpts().CatalogLaunchDelegation != "" || original.GetOpts() == delegated.GetOpts() { + t.Fatal("shared router client changed") + } + if !strings.HasSuffix(observed[0], " ") { + t.Fatal("ordinary bootstrap gained proof") + } + for _, request := range observed[1:] { + if !strings.HasSuffix(request, " "+proof) { + t.Fatal("proof lost on event request") + } + } +} + +func TestCatalogProofCannotFollowCrossOriginOrEchoPrivateFailureBodies(t *testing.T) { + foreignCalls := 0 + foreign := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { foreignCalls++; fmt.Fprint(w, `{}`) })) + defer foreign.Close() + var server *httptest.Server + server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path == "/schemas" { + w.Header().Set("X-API-Schemas", server.URL+"/schemas") + fmt.Fprint(w, `{"data":[]}`) + return + } + if r.URL.Path == "/redirect" { + http.Redirect(w, r, foreign.URL, http.StatusFound) + return + } + w.WriteHeader(403) + fmt.Fprint(w, `{"message":"private-human-answer-and-proof"}`) + })) + defer server.Close() + c, err := NewRancherClient(&ClientOpts{Url: server.URL + "/schemas", CatalogLaunchDelegation: "server-only-proof"}) + if err != nil { + t.Fatal("client failed") + } + var result map[string]interface{} + for _, path := range []string{"/redirect", "/deny"} { + err := c.GetLink(Resource{Links: map[string]string{"self": server.URL + path}}, "self", &result) + if err == nil || strings.Contains(err.Error(), "private-human") || strings.Contains(err.Error(), "server-only-proof") { + t.Fatal("unsafe delegated response") + } + } + if foreignCalls != 0 { + t.Fatal("proof crossed origin") + } +} diff --git a/internal/rancherclient/v2/common.go b/internal/rancherclient/v2/common.go index 48e9e10e..8c51f1e4 100644 --- a/internal/rancherclient/v2/common.go +++ b/internal/rancherclient/v2/common.go @@ -36,6 +36,8 @@ type ClientOpts struct { AccessKey string SecretKey string Timeout time.Duration + // Server-only, event-local proof. It is never a CLI flag or resource body. + CatalogLaunchDelegation string } type ApiError struct { @@ -98,6 +100,21 @@ func newApiError(resp *http.Response, url string) *ApiError { } } +func apiErrorForOpts(resp *http.Response, url string, opts *ClientOpts) *ApiError { + if opts != nil && opts.CatalogLaunchDelegation != "" { + return &ApiError{StatusCode: resp.StatusCode, Msg: "CatalogLaunchRequestDenied"} + } + return newApiError(resp, url) +} + +func decodeForOpts(raw []byte, target interface{}, opts *ClientOpts) error { + err := json.Unmarshal(raw, target) + if err != nil && opts != nil && opts.CatalogLaunchDelegation != "" { + return errors.New("CatalogLaunchResponseInvalid") + } + return err +} + func contains(array []string, item string) bool { for _, check := range array { if check == item { @@ -248,7 +265,7 @@ func setupRancherBaseClient(rancherClient *RancherBaseClientImpl, opts *ClientOp return err } - req.SetBasicAuth(opts.AccessKey, opts.SecretKey) + applyClientIdentity(req, opts) resp, err := client.Do(req) if err != nil { @@ -258,7 +275,7 @@ func setupRancherBaseClient(rancherClient *RancherBaseClientImpl, opts *ClientOp defer resp.Body.Close() if resp.StatusCode != 200 { - return newApiError(resp, opts.Url) + return apiErrorForOpts(resp, opts.Url, opts) } schemasUrls := resp.Header.Get("X-API-Schemas") @@ -271,7 +288,7 @@ func setupRancherBaseClient(rancherClient *RancherBaseClientImpl, opts *ClientOp if err != nil { return err } - req.SetBasicAuth(opts.AccessKey, opts.SecretKey) + applyClientIdentity(req, opts) resp, err = client.Do(req) if err != nil { @@ -281,7 +298,7 @@ func setupRancherBaseClient(rancherClient *RancherBaseClientImpl, opts *ClientOp defer resp.Body.Close() if resp.StatusCode != 200 { - return newApiError(resp, opts.Url) + return apiErrorForOpts(resp, opts.Url, opts) } } @@ -291,7 +308,7 @@ func setupRancherBaseClient(rancherClient *RancherBaseClientImpl, opts *ClientOp return err } - err = json.Unmarshal(bytes, &schemas) + err = decodeForOpts(bytes, &schemas, opts) if err != nil { return err } @@ -313,7 +330,27 @@ func NewListOpts() *ListOpts { } func (rancherClient *RancherBaseClientImpl) setupRequest(req *http.Request) { - req.SetBasicAuth(rancherClient.Opts.AccessKey, rancherClient.Opts.SecretKey) + applyClientIdentity(req, rancherClient.Opts) +} + +const CatalogLaunchDelegationHeader = "X-PastureStack-Catalog-Launch-Delegation" + +func applyClientIdentity(req *http.Request, opts *ClientOpts) { + req.SetBasicAuth(opts.AccessKey, opts.SecretKey) + if opts.CatalogLaunchDelegation != "" { + req.Header.Set(CatalogLaunchDelegationHeader, opts.CatalogLaunchDelegation) + } +} + +// WithCatalogLaunchDelegation returns an independent client, preserving the +// shared router client's credentials, options and ordinary event behavior. +func WithCatalogLaunchDelegation(original *RancherClient, proof string) (*RancherClient, error) { + if original == nil || original.GetOpts() == nil || proof == "" { + return nil, errors.New("CatalogLaunchDelegationInvalid") + } + opts := *original.GetOpts() + opts.CatalogLaunchDelegation = proof + return NewRancherClient(&opts) } func (rancherClient *RancherBaseClientImpl) newHttpClient() *http.Client { @@ -341,7 +378,7 @@ func (rancherClient *RancherBaseClientImpl) doDelete(url string) error { _, _ = io.Copy(io.Discard, resp.Body) if resp.StatusCode >= 300 { - return newApiError(resp, url) + return apiErrorForOpts(resp, url, rancherClient.Opts) } return nil @@ -397,7 +434,7 @@ func (rancherClient *RancherBaseClientImpl) doGet(url string, opts *ListOpts, re defer resp.Body.Close() if resp.StatusCode != 200 { - return newApiError(resp, url) + return apiErrorForOpts(resp, url, rancherClient.Opts) } byteContent, err := io.ReadAll(resp.Body) @@ -410,6 +447,9 @@ func (rancherClient *RancherBaseClientImpl) doGet(url string, opts *ListOpts, re } if err := json.Unmarshal(byteContent, respObject); err != nil { + if rancherClient.Opts.CatalogLaunchDelegation != "" { + return errors.New("CatalogLaunchResponseInvalid") + } return fmt.Errorf("failed to parse response %q: %w", byteContent, err) } @@ -482,7 +522,7 @@ func (rancherClient *RancherBaseClientImpl) doModify(method string, url string, defer resp.Body.Close() if resp.StatusCode >= 300 { - return newApiError(resp, url) + return apiErrorForOpts(resp, url, rancherClient.Opts) } byteContent, err := io.ReadAll(resp.Body) @@ -494,7 +534,7 @@ func (rancherClient *RancherBaseClientImpl) doModify(method string, url string, if debug { fmt.Printf("Response <= %d bytes\n", len(byteContent)) } - return json.Unmarshal(byteContent, respObject) + return decodeForOpts(byteContent, respObject, rancherClient.Opts) } return nil @@ -677,7 +717,7 @@ func (rancherClient *RancherBaseClientImpl) doAction(schemaType string, action s defer resp.Body.Close() if resp.StatusCode >= 300 { - return newApiError(resp, actionUrl) + return apiErrorForOpts(resp, actionUrl, rancherClient.Opts) } byteContent, err := io.ReadAll(resp.Body) @@ -689,7 +729,7 @@ func (rancherClient *RancherBaseClientImpl) doAction(schemaType string, action s fmt.Printf("Response <= %d bytes\n", len(byteContent)) } - return json.Unmarshal(byteContent, respObject) + return decodeForOpts(byteContent, respObject, rancherClient.Opts) } func (rancherClient *RancherBaseClientImpl) GetOpts() *ClientOpts { diff --git a/main.go b/main.go index cfa65747..d0928b5f 100644 --- a/main.go +++ b/main.go @@ -2,10 +2,12 @@ package main import ( "fmt" + "io" "os" "path" composeApp "github.com/PastureStack/compose-cli/app" + "github.com/PastureStack/compose-cli/cataloglaunch" "github.com/PastureStack/compose-cli/executor" cli "github.com/PastureStack/compose-cli/internal/legacycli" "github.com/PastureStack/compose-cli/version" @@ -25,6 +27,12 @@ func beforeApp(c *cli.Context) error { } func main() { + if len(os.Args) == 2 && os.Args[1] == cataloglaunch.Command { + // Existing parser diagnostics may contain private input. This fixed + // server-only mode emits only its bounded protocol on stdout. + logrus.SetOutput(io.Discard) + os.Exit(cataloglaunch.Run(os.Stdin, os.Stdout)) + } base := path.Base(os.Args[0]) if base == "compose-executor" || base == "rancher-compose-executor" { if requestsVersion(os.Args) { diff --git a/platformapi/catalog_context.go b/platformapi/catalog_context.go new file mode 100644 index 00000000..f1019de1 --- /dev/null +++ b/platformapi/catalog_context.go @@ -0,0 +1,32 @@ +package platformapi + +import "github.com/PastureStack/compose-cli/project" + +// CatalogProjectName exposes the existing executor's context normalization to +// its private preflight. It performs no client initialization or API request. +func CatalogProjectName(name string) string { + context := &Context{Context: project.Context{ProjectName: name}} + return context.sanitizedProjectName() +} + +func CatalogSidekickOrder(p *project.Project, name string) ([]string, error) { + info, err := NewSidekickInfo(p) + if err != nil { + return nil, err + } + return append([]string(nil), info.primariesToSidekicks[name]...), nil +} + +func CatalogSidekickPrimaries(p *project.Project) (map[string]string, error) { + info, err := NewSidekickInfo(p) + if err != nil { + return nil, err + } + result := map[string]string{} + for name, primaries := range info.sidekickToPrimaries { + if len(primaries) == 1 { + result[name] = primaries[0] + } + } + return result, nil +} diff --git a/platformapi/catalog_finalize.go b/platformapi/catalog_finalize.go new file mode 100644 index 00000000..453514b1 --- /dev/null +++ b/platformapi/catalog_finalize.go @@ -0,0 +1,69 @@ +package platformapi + +import ( + "encoding/json" + "errors" + + "github.com/PastureStack/compose-cli/config" + client "github.com/PastureStack/compose-cli/internal/rancherclient/v2" + "github.com/PastureStack/compose-cli/utils" +) + +var errCatalogGraph = errors.New("CatalogLaunchGraphInvalid") + +type CatalogLaunchPart struct { + Name string + Config *config.ServiceConfig + Transform json.RawMessage + VolumeDriver string +} + +// CatalogFinalizeService uses the same completion and digest owner as normal +// creation. Engine supplies only its existing Docker transform and verified +// resource IDs, never Java copies of Compose business rules. +func CatalogFinalizeService(primary CatalogLaunchPart, secondaries []CatalogLaunchPart, secrets map[string]string) (string, *CompositeService, error) { + decode := func(part CatalogLaunchPart) (client.LaunchConfig, error) { + var result client.LaunchConfig + if len(part.Transform) == 0 || json.Unmarshal(part.Transform, &result) != nil { + return result, errCatalogGraph + } + if err := appendResolvedSecrets(&result, primary.Config.Secrets, func(name string) (string, error) { + id, ok := secrets[name] + if !ok || id == "" { + return "", errCatalogGraph + } + return id, nil + }); err != nil { + return result, err + } + finishLaunchConfig(&result, part.Config, part.VolumeDriver) + result.HealthCheck = part.Config.HealthCheck + return result, nil + } + launch, err := decode(primary) + if err != nil { + return "", nil, err + } + secondaryLaunches := []client.SecondaryLaunchConfig{} + for _, part := range secondaries { + value, err := decode(part) + if err != nil { + return "", nil, err + } + var secondary client.SecondaryLaunchConfig + if utils.Convert(value, &secondary) != nil { + return "", nil, errCatalogGraph + } + secondary.Name = part.Name + if secondary.Labels == nil { + secondary.Labels = map[string]interface{}{} + } + secondaryLaunches = append(secondaryLaunches, secondary) + } + typeName, body := CatalogServiceCreateSkeleton(primary.Name, primary.Config) + if err := populateLbFields(&PlatformService{name: primary.Name, serviceConfig: primary.Config}, &launch, body); err != nil { + return "", nil, err + } + _, body, err = serviceConfigAndHash(body, &launch, secondaryLaunches) + return typeName, body, err +} diff --git a/platformapi/catalog_finalize_test.go b/platformapi/catalog_finalize_test.go new file mode 100644 index 00000000..dbcd61c9 --- /dev/null +++ b/platformapi/catalog_finalize_test.go @@ -0,0 +1,130 @@ +package platformapi + +import ( + "encoding/json" + "fmt" + "net/http" + "net/http/httptest" + "reflect" + "strings" + "testing" + + "github.com/PastureStack/compose-cli/config" + client "github.com/PastureStack/compose-cli/internal/rancherclient/v2" + "github.com/PastureStack/compose-cli/project" + "github.com/PastureStack/compose-cli/yaml" +) + +func TestCatalogFinalizeBodyEqualsActualOrdinaryServicePost(t *testing.T) { + assertCatalogBody(t, false) +} + +func TestCatalogFinalizeSidekickSecretAndHashBodyEqualsActualOrdinaryPost(t *testing.T) { + assertCatalogBody(t, true) +} + +func assertCatalogBody(t *testing.T, sidekick bool) { + t.Helper() + posted := map[string]interface{}{} + transformed := map[string]json.RawMessage{} + for _, name := range []string{"app", "helper"} { + raw, _ := json.Marshal(map[string]interface{}{"imageUuid": "docker:busybox:1.37.0", "labels": map[string]string{"source": "preserved"}, "environment": map[string]string{"private": "private-owner-input"}, "logConfig": map[string]interface{}{"config": map[string]string{}}, "ports": []string{"discarded-by-owner-primary"}, "unexpectedCoreField": "must-not-copy"}) + transformed[name] = raw + } + var server *httptest.Server + server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + switch r.URL.Path { + case "/schemas": + w.Header().Set("X-API-Schemas", server.URL+"/schemas") + fmt.Fprintf(w, `{"links":{"self":%q},"data":[{"id":"service","collectionMethods":["POST"],"links":{"collection":%q}},{"id":"secret","collectionMethods":["GET"],"links":{"collection":%q}}]}`, server.URL+"/schemas", server.URL+"/services", server.URL+"/secrets") + case "/scripts/transform": + var input struct{ Name string } + _ = json.NewDecoder(r.Body).Decode(&input) + _, _ = w.Write(transformed[strings.TrimPrefix(input.Name, "/")]) + case "/secrets": + fmt.Fprint(w, `{"data":[{"id":"1se7","name":"chosen"}]}`) + case "/services": + _ = json.NewDecoder(r.Body).Decode(&posted) + fmt.Fprint(w, `{}`) + default: + t.Errorf("unexpected owner route %s", r.URL.Path) + w.WriteHeader(404) + } + })) + defer server.Close() + c, err := client.NewRancherClient(&client.ClientOpts{Url: server.URL + "/schemas"}) + if err != nil { + t.Fatal("fake owner API unavailable") + } + primary := &config.ServiceConfig{Image: "busybox:1.37.0", Ports: []string{"18080:80"}, Expose: []string{"81"}, Environment: yaml.MaporEqualSlice{"Z=z", "A=a"}, Labels: yaml.SliceorMap{}, MilliCpuReservation: 100, NetworkMode: "managed", VolumeDriver: "driver"} + primary.Metadata = map[string]interface{}{"owned": "value"} + primary.Scale = 2 + secondary := &config.ServiceConfig{Image: "busybox:1.37.0", Environment: yaml.MaporEqualSlice{"Q=q"}, Labels: yaml.SliceorMap{}} + secondary.HealthCheck = &client.InstanceHealthCheck{Port: 81} + if sidekick { + primary.Labels["io.rancher.sidekicks"] = "helper" + primary.Secrets = config.SecretReferences{{Source: "chosen", Target: "target", Uid: "1", Gid: "2", Mode: yaml.StringorOctalInt("0444")}} + } + ctx := &Context{Client: c, Stack: &client.Stack{Resource: client.Resource{Id: "$createdStack"}}, CatalogLaunchDelegation: "event-proof"} + if !sidekick { + ctx.CatalogLaunchDelegation = "" + } + p := project.NewProject(&ctx.Context) + ctx.Project = p + p.ServiceConfigs.Add("app", primary) + if sidekick { + p.ServiceConfigs.Add("helper", secondary) + } + ctx.SidekickInfo, err = NewSidekickInfo(p) + if err != nil { + t.Fatal("sidekick owner failed") + } + if err := (&NormalFactory{}).Create(NewService("app", primary, ctx)); err != nil { + t.Fatal("ordinary owner failed") + } + parts := []CatalogLaunchPart{} + resolved := map[string]string{} + if sidekick { + parts = append(parts, CatalogLaunchPart{Name: "helper", Config: secondary, Transform: transformed["helper"]}) + resolved["chosen"] = "1se7" + } + kind, body, err := CatalogFinalizeService(CatalogLaunchPart{Name: "app", Config: primary, Transform: transformed["app"], VolumeDriver: "driver"}, parts, resolved) + if err != nil { + t.Fatal("private owner finalize failed") + } + raw, _ := json.Marshal(CatalogServiceRequestPayload(kind, body)) + var expected map[string]interface{} + _ = json.Unmarshal(raw, &expected) + if !reflect.DeepEqual(posted, expected) { + t.Fatal("final graph differs from ordinary POST (private bodies omitted)") + } + if posted["unexpectedCoreField"] != nil || kind != "service" || len(posted) == 0 { + t.Fatal("transform projection or service type changed") + } +} + +func TestCatalogFinalizeRequiresResolvedSecretAndPreservesDelegationInContextClient(t *testing.T) { + config := &config.ServiceConfig{Secrets: config.SecretReferences{{Source: "chosen"}}} + if _, _, err := CatalogFinalizeService(CatalogLaunchPart{Name: "app", Config: config, Transform: json.RawMessage(`{}`)}, nil, nil); err == nil { + t.Fatal("missing verified reference admitted") + } + seen := false + var server *httptest.Server + server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + seen = r.Header.Get(client.CatalogLaunchDelegationHeader) == "private-proof" + w.Header().Set("X-API-Schemas", server.URL+"/schemas") + fmt.Fprint(w, `{"data":[]}`) + })) + defer server.Close() + ctx := &Context{Url: server.URL + "/schemas", CatalogLaunchDelegation: "private-proof"} + c, err := ctx.loadClient() + if err != nil || !seen || c.GetOpts().CatalogLaunchDelegation != "private-proof" { + t.Fatal("normal project context lost event ceiling proof") + } + ctx.AccessKey = "private-access-key-marker" + ctx.ProjectName = "chosen" + if err := ctx.open(); err == nil || strings.Contains(err.Error(), ctx.AccessKey) { + t.Fatal("delegated local permission failure leaked service credential") + } +} diff --git a/platformapi/catalog_links.go b/platformapi/catalog_links.go new file mode 100644 index 00000000..282022a5 --- /dev/null +++ b/platformapi/catalog_links.go @@ -0,0 +1,63 @@ +package platformapi + +import ( + "sort" + "strings" + + client "github.com/PastureStack/compose-cli/internal/rancherclient/v2" + "github.com/PastureStack/compose-cli/utils" +) + +func parseServiceLink(raw string) Link { + parts := strings.SplitN(raw, ":", 2) + value := Link{ServiceName: strings.TrimSpace(parts[0])} + if len(parts) == 2 { + value.Alias = strings.TrimSpace(parts[1]) + } + return value +} + +func serviceLinksFromResolved(links map[Link]string) []client.ServiceLink { + result := []client.ServiceLink{} + for link, id := range links { + if utils.IsRegionService(link.ServiceName) { + result = append(result, client.ServiceLink{Name: link.Alias, Service: link.ServiceName}) + } else { + result = append(result, client.ServiceLink{Name: link.Alias, ServiceId: id}) + } + } + return result +} + +func sortCatalogLinks(links []client.ServiceLink) { + sort.Slice(links, func(i, j int) bool { + if links[i].ServiceId != links[j].ServiceId { + return links[i].ServiceId < links[j].ServiceId + } + if links[i].Name != links[j].Name { + return links[i].Name < links[j].Name + } + return links[i].Service < links[j].Service + }) +} + +// Same parser and request DTO as normal setservicelinks. Only this new graph's +// services are supported; external/region/cross-stack links require a later +// typed reference adapter rather than broader service-Key reads. +func CatalogServiceLinkSkeleton(raw []string, graph map[string]string) (*client.SetServiceLinksInput, error) { + resolved := map[Link]string{} + for _, value := range raw { + link := parseServiceLink(value) + primary, exists := graph[link.ServiceName] + if !exists || utils.IsRegionService(link.ServiceName) || len(link.Alias) > 128 || strings.ContainsAny(link.Alias, "\x00\r\n") { + return nil, errCatalogGraph + } + if primary != "" { + continue + } // Sidekicks have no independent service row. + resolved[link] = "$service:" + link.ServiceName + } + links := serviceLinksFromResolved(resolved) + sortCatalogLinks(links) + return &client.SetServiceLinksInput{ServiceLinks: links}, nil +} diff --git a/platformapi/catalog_links_test.go b/platformapi/catalog_links_test.go new file mode 100644 index 00000000..2a281437 --- /dev/null +++ b/platformapi/catalog_links_test.go @@ -0,0 +1,58 @@ +package platformapi + +import ( + "encoding/json" + "fmt" + "net/http" + "net/http/httptest" + "reflect" + "testing" + + "github.com/PastureStack/compose-cli/config" + client "github.com/PastureStack/compose-cli/internal/rancherclient/v2" + "github.com/PastureStack/compose-cli/project" +) + +func TestCatalogLinkSkeletonUsesNormalParserAndRejectsExternalScope(t *testing.T) { + var server *httptest.Server + server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path == "/schemas" { + w.Header().Set("X-API-Schemas", server.URL+"/schemas") + fmt.Fprintf(w, `{"data":[{"id":"service","collectionMethods":["GET"],"links":{"collection":%q}}]}`, server.URL+"/services") + return + } + if r.URL.Path != "/services" || r.URL.Query().Get("stackId") != "1st7" || r.URL.Query().Get("name") != "db" { + t.Error("unexpected link lookup") + } + fmt.Fprint(w, `{"data":[{"id":"1s8","name":"db"}]}`) + })) + defer server.Close() + c, err := client.NewRancherClient(&client.ClientOpts{Url: server.URL + "/schemas"}) + if err != nil { + t.Fatal("owner client failed") + } + cfg := &config.ServiceConfig{Links: []string{" db : chosen "}} + ctx := &Context{Client: c, Stack: &client.Stack{Resource: client.Resource{Id: "1st7"}}, CatalogLaunchDelegation: "proof"} + ctx.Project = project.NewProject(&ctx.Context) + actual, err := NewService("app", cfg, ctx).getServiceLinks() + if err != nil { + t.Fatal("normal links failed") + } + skeleton, err := CatalogServiceLinkSkeleton(cfg.Links, map[string]string{"db": "", "helper": "app"}) + if err != nil { + t.Fatal("typed links failed") + } + for i := range skeleton.ServiceLinks { + skeleton.ServiceLinks[i].ServiceId = "1s8" + } + a, _ := json.Marshal(actual) + b, _ := json.Marshal(skeleton.ServiceLinks) + if !reflect.DeepEqual(a, b) { + t.Fatal("normal and typed link bodies differ") + } + for _, links := range [][]string{{"other/db"}, {"missing"}} { + if _, err := CatalogServiceLinkSkeleton(links, map[string]string{"db": ""}); err == nil { + t.Fatal("unbound link scope admitted") + } + } +} diff --git a/platformapi/configs.go b/platformapi/configs.go index ee3bdd8f..c903ddbf 100644 --- a/platformapi/configs.go +++ b/platformapi/configs.go @@ -3,6 +3,7 @@ package platformapi import ( "encoding/json" "fmt" + "sort" "strings" "time" @@ -52,6 +53,13 @@ func createLaunchConfigs(r *PlatformService) (client.LaunchConfig, []client.Seco func createLaunchConfig(r *PlatformService, name string, serviceConfig *config.ServiceConfig) (client.LaunchConfig, error) { var result client.LaunchConfig + if r.context.CatalogLaunchDelegation != "" { + copy, err := CatalogCanonicalConfig(serviceConfig) + if err != nil { + return result, err + } + serviceConfig = copy + } schemasUrl := strings.SplitN(r.Context().Client.GetSchemas().Links["self"], "/schemas", 2)[0] scriptsUrl := schemasUrl + "/scripts/transform" @@ -105,19 +113,21 @@ func createLaunchConfig(r *PlatformService, name string, serviceConfig *config.S return result, err } - result.VolumeDriver = hostConfig.VolumeDriver - result.MilliCpuReservation = int64(serviceConfig.MilliCpuReservation) - - setupNetworking(serviceConfig.NetworkMode, &result) - setupVolumesFrom(serviceConfig.VolumesFrom, &result) - if err = setupBuild(r, name, &result, serviceConfig); err != nil { return result, err } if err = setupSecrets(r, name, &result, serviceConfig); err != nil { return result, err } + finishLaunchConfig(&result, serviceConfig, hostConfig.VolumeDriver) + return result, err +} +func finishLaunchConfig(result *client.LaunchConfig, serviceConfig *config.ServiceConfig, volumeDriver string) { + result.VolumeDriver = volumeDriver + result.MilliCpuReservation = int64(serviceConfig.MilliCpuReservation) + setupNetworking(serviceConfig.NetworkMode, result) + setupVolumesFrom(serviceConfig.VolumesFrom, result) if result.Labels == nil { result.Labels = map[string]interface{}{} } @@ -133,11 +143,30 @@ func createLaunchConfig(r *PlatformService, name string, serviceConfig *config.S result.Kind = "virtualMachine" } + if result.LogConfig == nil { + result.LogConfig = &client.LogConfig{} + } if result.LogConfig.Config == nil { result.LogConfig.Config = map[string]interface{}{} } - return result, err +} + +// Only delegated, prevalidated creation canonicalizes the semantically keyed +// environment list. Ordinary Compose order and duplicate behavior is unchanged. +func CatalogCanonicalConfig(source *config.ServiceConfig) (*config.ServiceConfig, error) { + copy := *source + copy.Environment = append([]string(nil), source.Environment...) + seen := map[string]bool{} + for _, entry := range copy.Environment { + key := strings.SplitN(entry, "=", 2)[0] + if seen[key] { + return nil, fmt.Errorf("CatalogLaunchUnsupported") + } + seen[key] = true + } + sort.Strings(copy.Environment) + return ©, nil } func setupNetworking(netMode string, launchConfig *client.LaunchConfig) { @@ -194,20 +223,30 @@ func setupBuild(r *PlatformService, name string, result *client.LaunchConfig, se } func setupSecrets(r *PlatformService, name string, result *client.LaunchConfig, serviceConfig *config.ServiceConfig) error { - for _, secret := range r.serviceConfig.Secrets { + return appendResolvedSecrets(result, r.serviceConfig.Secrets, func(source string) (string, error) { existingSecrets, err := r.Client().Secret.List(&client.ListOpts{ Filters: map[string]interface{}{ - "name": secret.Source, + "name": source, }, }) if err != nil { - return err + return "", err } if len(existingSecrets.Data) == 0 { - return fmt.Errorf("Failed to find secret %s", secret.Source) + return "", fmt.Errorf("Failed to find secret %s", source) + } + return existingSecrets.Data[0].Id, nil + }) +} + +func appendResolvedSecrets(result *client.LaunchConfig, references config.SecretReferences, resolve func(string) (string, error)) error { + for _, secret := range references { + id, err := resolve(secret.Source) + if err != nil { + return err } result.Secrets = append(result.Secrets, client.SecretReference{ - SecretId: existingSecrets.Data[0].Id, + SecretId: id, Name: secret.Target, Uid: secret.Uid, Gid: secret.Gid, diff --git a/platformapi/context.go b/platformapi/context.go index 09abf1f1..153bec20 100644 --- a/platformapi/context.go +++ b/platformapi/context.go @@ -16,19 +16,20 @@ var projectRegexp = regexp.MustCompile("[^a-zA-Z0-9-]") type Context struct { project.Context - Url string - AccessKey string - SecretKey string - Client *client.RancherClient - Stack *client.Stack - isOpen bool - SidekickInfo *SidekickInfo - Uploader Uploader - PullCached bool - Pull bool - Prune bool - Args []string - Description string + Url string + AccessKey string + SecretKey string + CatalogLaunchDelegation string + Client *client.RancherClient + Stack *client.Stack + isOpen bool + SidekickInfo *SidekickInfo + Uploader Uploader + PullCached bool + Pull bool + Prune bool + Args []string + Description string Upgrade bool ForceUpgrade bool @@ -55,9 +56,10 @@ func (c *Context) loadClient() (*client.RancherClient, error) { } if client, err := client.NewRancherClient(&client.ClientOpts{ - Url: c.Url, - AccessKey: c.AccessKey, - SecretKey: c.SecretKey, + Url: c.Url, + AccessKey: c.AccessKey, + SecretKey: c.SecretKey, + CatalogLaunchDelegation: c.CatalogLaunchDelegation, }); err != nil { return nil, err } else { @@ -80,6 +82,9 @@ func (c *Context) open() error { } if stackSchema, ok := c.Client.GetTypes()["stack"]; !ok || !utils.Contains(stackSchema.CollectionMethods, "POST") { + if c.CatalogLaunchDelegation != "" { + return fmt.Errorf("CatalogLaunchOwnerPermissionDenied") + } return fmt.Errorf("Can not create a stack, check API key [%s] for [%s]", c.AccessKey, c.Url) } diff --git a/platformapi/create_skeleton.go b/platformapi/create_skeleton.go new file mode 100644 index 00000000..3d31ad89 --- /dev/null +++ b/platformapi/create_skeleton.go @@ -0,0 +1,69 @@ +package platformapi + +import ( + "github.com/PastureStack/compose-cli/config" + client "github.com/PastureStack/compose-cli/internal/rancherclient/v2" + "github.com/PastureStack/compose-cli/utils" +) + +// serviceCreateFields is shared by ordinary creation and the typed preflight. +// Launch configs are supplied by the existing Docker transform owner later. +func serviceCreateFields(name string, c *config.ServiceConfig, stackID string) *CompositeService { + scale := int64(c.Scale) + if scale <= 0 { + scale = 1 + } + service := &CompositeService{Service: client.Service{Name: name, Metadata: utils.NestedMapsToMapInterface(c.Metadata), Scale: scale, ScalePolicy: c.ScalePolicy, + RetainIp: c.RetainIp, StackId: stackID, SelectorContainer: c.Labels["io.rancher.service.selector.container"], SelectorLink: c.Labels["io.rancher.service.selector.link"]}, + ExternalIpAddresses: c.ExternalIps, Hostname: c.Hostname, HealthCheck: c.HealthCheck, StorageDriver: c.StorageDriver, NetworkDriver: c.NetworkDriver} + if service.NetworkDriver != nil { + service.NetworkDriver.CniConfig = convertNestedMapKeysToStrings(service.NetworkDriver.CniConfig) + } + return service +} + +func serviceCreateType(r *PlatformService) string { + switch FindServiceType(r) { + case ExternalServiceType: + return client.EXTERNAL_SERVICE_TYPE + case DnsServiceType: + return client.DNS_SERVICE_TYPE + case LegacyLbServiceType, LbServiceType: + return client.LOAD_BALANCER_SERVICE_TYPE + case StorageDriverType: + return client.STORAGE_DRIVER_SERVICE_TYPE + case NetworkDriverType: + return client.NETWORK_DRIVER_SERVICE_TYPE + default: + return client.SERVICE_TYPE + } +} + +// CatalogServiceCreateSkeleton has a closed symbolic Stack slot. Engine must +// bind it to the Stack created by this exact claimed plan, never a caller ID. +func CatalogServiceCreateSkeleton(name string, c *config.ServiceConfig) (string, *CompositeService) { + return serviceCreateType(&PlatformService{serviceConfig: c}), serviceCreateFields(name, c, "$createdStack") +} + +func volumeCreateFields(name string, c *config.VolumeConfig, stackID string) *client.VolumeTemplate { + options := map[string]interface{}{} + for key, value := range c.DriverOpts { + options[key] = value + } + return &client.VolumeTemplate{Name: name, Driver: c.Driver, DriverOpts: options, External: c.External.External, PerContainer: c.PerContainer, StackId: stackID} +} + +func CatalogVolumeCreateSkeleton(name string, c *config.VolumeConfig) *client.VolumeTemplate { + return volumeCreateFields(name, c, "$createdStack") +} + +func serviceCreatePayload(kind string, body *CompositeService) interface{} { + if kind == client.SERVICE_TYPE { + return &body.Service + } + return body +} + +func CatalogServiceRequestPayload(kind string, body *CompositeService) interface{} { + return serviceCreatePayload(kind, body) +} diff --git a/platformapi/normal.go b/platformapi/normal.go index 63c1c69e..69661724 100644 --- a/platformapi/normal.go +++ b/platformapi/normal.go @@ -22,7 +22,10 @@ func (f *NormalFactory) configAndHash(r *PlatformService) (digest.ServiceHash, * if err != nil { return digest.ServiceHash{}, nil, err } + return serviceConfigAndHash(platformService, launchConfig, secondaryLaunchConfigs) +} +func serviceConfigAndHash(platformService *CompositeService, launchConfig *client.LaunchConfig, secondaryLaunchConfigs []client.SecondaryLaunchConfig) (digest.ServiceHash, *CompositeService, error) { hash, err := digest.CreateServiceHash(platformService, launchConfig, secondaryLaunchConfigs) if err != nil { return digest.ServiceHash{}, nil, err @@ -46,27 +49,8 @@ func (f *NormalFactory) config(r *PlatformService) (*CompositeService, *client.L return nil, nil, nil, err } - service := &CompositeService{ - Service: client.Service{ - Name: r.name, - Metadata: r.Metadata(), - Scale: int64(r.getConfiguredScale()), - ScalePolicy: r.serviceConfig.ScalePolicy, - RetainIp: r.serviceConfig.RetainIp, - StackId: r.Context().Stack.Id, - SelectorContainer: r.SelectorContainer(), - SelectorLink: r.SelectorLink(), - }, - ExternalIpAddresses: r.serviceConfig.ExternalIps, - Hostname: r.serviceConfig.Hostname, - HealthCheck: r.HealthCheck(""), - StorageDriver: r.serviceConfig.StorageDriver, - NetworkDriver: r.serviceConfig.NetworkDriver, - } - - if service.NetworkDriver != nil { - service.NetworkDriver.CniConfig = convertNestedMapKeysToStrings(service.NetworkDriver.CniConfig) - } + service := serviceCreateFields(r.name, r.serviceConfig, r.Context().Stack.Id) + service.HealthCheck = r.HealthCheck("") if err := populateLbFields(r, &launchConfig, service); err != nil { return nil, nil, nil, err @@ -82,21 +66,12 @@ func (f *NormalFactory) Create(r *PlatformService) error { } logrus.Debugf("Creating service %s with hash: %#v", r.name, hash) - switch FindServiceType(r) { - case ExternalServiceType: - return r.context.Client.Create(client.EXTERNAL_SERVICE_TYPE, &service, nil) - case DnsServiceType: - return r.context.Client.Create(client.DNS_SERVICE_TYPE, &service, nil) - case LegacyLbServiceType: - fallthrough - case LbServiceType: - return r.context.Client.Create(client.LOAD_BALANCER_SERVICE_TYPE, &service, nil) - case StorageDriverType: - return r.context.Client.Create(client.STORAGE_DRIVER_SERVICE_TYPE, &service, nil) - case NetworkDriverType: - return r.context.Client.Create(client.NETWORK_DRIVER_SERVICE_TYPE, &service, nil) - default: - _, err = r.context.Client.Service.Create(&service.Service) + resourceType := serviceCreateType(r) + payload := serviceCreatePayload(resourceType, service) + if resourceType == client.SERVICE_TYPE { + _, err = r.context.Client.Service.Create(payload.(*client.Service)) + } else { + return r.context.Client.Create(resourceType, payload, nil) } return err diff --git a/platformapi/service.go b/platformapi/service.go index 2aa1dc29..514292e1 100644 --- a/platformapi/service.go +++ b/platformapi/service.go @@ -328,22 +328,10 @@ func (r *PlatformService) getServiceLinks() ([]client.ServiceLink, error) { if err != nil { return nil, err } - - result := []client.ServiceLink{} - for link, id := range links { - if rUtils.IsRegionService(link.ServiceName) { - result = append(result, client.ServiceLink{ - Name: link.Alias, - Service: link.ServiceName, - }) - } else { - result = append(result, client.ServiceLink{ - Name: link.Alias, - ServiceId: id, - }) - } + result := serviceLinksFromResolved(links) + if r.context.CatalogLaunchDelegation != "" { + sortCatalogLinks(result) } - return result, nil } @@ -351,15 +339,8 @@ func (r *PlatformService) getLinks() (map[Link]string, error) { result := map[Link]string{} for _, link := range append(r.serviceConfig.Links, r.serviceConfig.ExternalLinks...) { - parts := strings.SplitN(link, ":", 2) - name := parts[0] - alias := "" - if len(parts) == 2 { - alias = parts[1] - } - - name = strings.TrimSpace(name) - alias = strings.TrimSpace(alias) + parsed := parseServiceLink(link) + name, alias := parsed.ServiceName, parsed.Alias if rUtils.IsRegionService(name) { result[Link{ diff --git a/platformapi/volume.go b/platformapi/volume.go index dbe0f913..e81add81 100644 --- a/platformapi/volume.go +++ b/platformapi/volume.go @@ -8,6 +8,7 @@ import ( "github.com/PastureStack/compose-cli/config" "github.com/PastureStack/compose-cli/internal/rancherclient/v2" "github.com/PastureStack/compose-cli/project" + "github.com/PastureStack/compose-cli/yaml" "github.com/sirupsen/logrus" ) @@ -112,18 +113,8 @@ func (v *Volume) EnsureItExists(ctx context.Context) error { } func (v *Volume) create(ctx context.Context) error { - driverOptions := map[string]interface{}{} - for k, v := range v.driverOptions { - driverOptions[k] = v - } - _, err := v.context.Client.VolumeTemplate.Create(&client.VolumeTemplate{ - Name: v.name, - Driver: v.driver, - DriverOpts: driverOptions, - External: v.external, - PerContainer: v.perContainer, - StackId: v.context.Stack.Id, - }) + _, err := v.context.Client.VolumeTemplate.Create(volumeCreateFields(v.name, &config.VolumeConfig{ + Driver: v.driver, DriverOpts: v.driverOptions, External: yaml.External{External: v.external}, PerContainer: v.perContainer}, v.context.Stack.Id)) return err } diff --git a/scripts/check-pasturestack-source b/scripts/check-pasturestack-source index 4a7a9129..4329aade 100755 --- a/scripts/check-pasturestack-source +++ b/scripts/check-pasturestack-source @@ -71,7 +71,7 @@ require_line Dockerfile.dapper ' openssl="${UBUNTU_APT_OPENSSL_VERSION}" require_line Dockerfile.dapper ' openssl-provider-legacy="${UBUNTU_APT_OPENSSL_VERSION}" \' require_line .python-version '3.14.9' require_line tests/integration/requirements.txt 'pytest==9.1.1' -require_line tests/integration/requirements.txt 'setuptools==84.0.0' +require_line tests/integration/requirements.txt 'setuptools==84.1.0' require_line .github/workflows/security-release-gate.yml ' PLATFORM_COMPAT_JAR_URL: https://github.com/PastureStack/orchestration-engine/releases/download/v0.183.281/orchestration-engine-0.183.281.jar' require_line .github/workflows/security-release-gate.yml ' PLATFORM_COMPAT_JAR_SHA256: da2a8a51562ed16e296f7e29e99482bb44042ff0834cca679bbe01d951ba1682' require_line lookup/file.go $'\t\troot, err := os.OpenRoot(allowedRoot)' diff --git a/scripts/install-python-security-tools b/scripts/install-python-security-tools index 2076a0db..b4f66248 100644 --- a/scripts/install-python-security-tools +++ b/scripts/install-python-security-tools @@ -30,7 +30,7 @@ else fi "$scratch/venv/bin/python" /opt/python-security/scripts/test-pip-overlay.py if [ -n "${PYTHON_SECURITY_VIRTUALENV_PYTHON:-}" ]; then - "$PYTHON_SECURITY_VIRTUALENV_PYTHON" -m virtualenv --no-download --no-periodic-update --pip="$expected" --extra-search-dir=/usr/share/python-wheels "$scratch/virtualenv" + "$PYTHON_SECURITY_VIRTUALENV_PYTHON" -m virtualenv --app-data "$scratch/virtualenv-app-data" --no-download --no-periodic-update --pip="$expected" --extra-search-dir=/usr/share/python-wheels "$scratch/virtualenv" "$scratch/virtualenv/bin/python" /opt/python-security/scripts/test-pip-overlay.py fi printf 'PYTHON_SECURITY_TOOLS_OK pip=%s certifi=2026.10.19 ensurepip=%s\n' "$expected" "$ensurepip_status" diff --git a/scripts/pip-security/README.md b/scripts/pip-security/README.md index e354536a..9d0a314d 100644 --- a/scripts/pip-security/README.md +++ b/scripts/pip-security/README.md @@ -67,9 +67,23 @@ bash verify-pip-runtime.sh --virtualenv /usr/share/python-wheels `check-pip-vendor-slice.py` 會比對實際載入的全部 299 個 vendor 檔案與 固定 wheel，拒絕額外檔案、其他同版本完整 distribution。只有取得此證據後， -`filter-pip-vendor-findings.py` 才可對上述三個 CVE（含 msgpack GHSA 別名） +`filter-pip-vendor-findings.py` 才可對已驗證的 CVE（含 msgpack GHSA 別名） 產生綁定該映像的 OpenVEX 與有效掃描檔。原始掃描必須另行保存；未知 CVE、 其他版本、非 SBOM 套件來源與 urllib3 finding 全部保留，不做泛用版本排除。 -執行 `python3 test-pip-vex.py` 可驗證以上六組正反控制。 +執行 `python3 test-pip-vex.py` 可驗證以上正反控制。 + +新增公告仍限同一個 wheel 與實際 vendor slice： + +- [CVE-2026-114613／GHSA-j586-36cw-2gc2](https://github.com/msgpack/msgpack-python/security/advisories/GHSA-j586-36cw-2gc2) + 的 C extension 不在固定 wheel，實際載入 pure-Python fallback。 +- [GHSA-xmj3-9gf7-h52w](https://github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w) + 所需 `setuptools/wheel.py` 不在此 slice。 + +每個 Compose builder 都須重新驗證 299 個 live 檔案、固定 seed wheel、 +SHA-256、脆弱模組缺席及整個檔案系統中相關 wheel／SBOM／distribution 來源。 +只有已列明的 Compose 路徑且內容完全一致才可承接此證據；未知位置的同版 +SBOM、額外完整套件或 seed copy 會拒絕。負向 fixtures 包含 sys.path 外完整 +distribution、外來 CycloneDX/SPDX、不同 bytes 與未知 wheel。虛擬環境驗證的 +app-data 放在其自有暫存目錄，不留下另一份未追蹤 seed。 官方政策：https://pip.pypa.io/en/stable/development/vendoring-policy/ diff --git a/scripts/pip-security/check-pip-vendor-slice.py b/scripts/pip-security/check-pip-vendor-slice.py index 789bc280..571d3d4b 100644 --- a/scripts/pip-security/check-pip-vendor-slice.py +++ b/scripts/pip-security/check-pip-vendor-slice.py @@ -9,16 +9,27 @@ import zipfile import pip from pip._vendor import msgpack, urllib3 +from vendor_source_inventory import inventory EXPECTED_SHA = "be5f63d537bbe611dc422fabb6740a44b5997888b592888df5091727f023802a" +BOM_SHA = "3581cb8f0a6128c19ccec4e9aeab0d3ac8212fd19bd19d485b2e24fd4dc10f2a" FINDINGS = { "GHSA-6v7p-g79w-8964": ("msgpack", "1.1.2", "C/Cython unpacker is absent; runtime selects pure Python fallback"), "CVE-2026-57585": ("msgpack", "1.1.2", "C/Cython unpacker is absent; runtime selects pure Python fallback"), + "CVE-2026-114613": ("msgpack", "1.1.2", "_unpacker.pyx/unpack.h strict-map-key C extension is absent; fallback.py is not affected"), + "GHSA-j586-36cw-2gc2": ("msgpack", "1.1.2", "_unpacker.pyx/unpack.h strict-map-key C extension is absent; fallback.py is not affected"), "CVE-2025-47273": ("setuptools", "70.3.0", "setuptools/package_index.py is absent; only pkg_resources is vendored"), "CVE-2026-59890": ("setuptools", "70.3.0", "setuptools/command/egg_info.py and FileList are absent"), + "GHSA-xmj3-9gf7-h52w": ("setuptools", "70.3.0", "setuptools/wheel.py Wheel._fix_namespace_packages is absent; only pkg_resources is vendored"), } +def require_absent_vulnerable_modules(names): + names = tuple(names) + assert not any(name.startswith("pip/_vendor/msgpack/_cmsgpack") for name in names), "Native msgpack module present" + assert not any(name.startswith("pip/_vendor/setuptools/") for name in names), "Full setuptools module present" + + def verify(wheel): assert hashlib.sha256(wheel.read_bytes()).hexdigest() == EXPECTED_SHA assert pip.__version__ == "26.2.2+pasturestack.1" @@ -36,8 +47,7 @@ def verify(wheel): expected_files.add(name.removeprefix("pip/_vendor/")) checked += 1 assert not any(name.startswith("pip/_vendor/") and name.endswith((".so", ".pyd")) for name in names) - assert not any(name.startswith("pip/_vendor/setuptools/") for name in names) - assert not any(name.startswith("pip/_vendor/msgpack/_cmsgpack") for name in names) + require_absent_vulnerable_modules(names) def live_files(directory, prefix=""): for entry in directory.iterdir(): if entry.name == "__pycache__": @@ -47,17 +57,20 @@ def live_files(directory, prefix=""): yield from live_files(entry, relative + "/") else: yield relative - assert set(live_files(live.joinpath("_vendor"))) == expected_files, "Unexpected live vendor files" + observed_files = set(live_files(live.joinpath("_vendor"))) + require_absent_vulnerable_modules("pip/_vendor/" + name for name in observed_files) + assert observed_files == expected_files, "Unexpected live vendor files" # A separate full setuptools installation cannot inherit the vendor-slice VEX. for distribution in importlib.metadata.distributions(): if distribution.metadata.get("Name", "").lower() == "setuptools": assert distribution.version != "70.3.0", "A full setuptools 70.3.0 distribution is installed" if distribution.metadata.get("Name", "").lower() == "msgpack": assert distribution.version != "1.1.2", "A separate msgpack 1.1.2 distribution is installed" - return {"verifiedWheelSha256": EXPECTED_SHA, "pip": pip.__version__, + return {"verifiedWheelSha256": EXPECTED_SHA, "verifiedWheelPath": str(wheel.resolve()), "pip": pip.__version__, "urllib3": urllib3.__version__, "vendorFilesByteCompared": checked, "msgpackImplementation": msgpack.Unpacker.__module__, - "setuptoolsPackageAbsent": True, "scope": "this exact pip vendor slice only", + "setuptoolsPackageAbsent": True, "vulnerableModulesAbsent": ["msgpack._cmsgpack", "setuptools.wheel"], + "scope": "this exact pip vendor slice only", "notAffected": [{"id": key, "package": value[0], "version": value[1], "justification": "vulnerable_code_not_present", "detail": value[2]} for key, value in FINDINGS.items()]} @@ -81,6 +94,7 @@ def live_files(directory, prefix=""): else: with ensurepip._get_pip_whl_path_ctx() as wheel: result = verify(Path(wheel)) + result["vendorSourceInventory"] = inventory(Path("/"), EXPECTED_SHA, BOM_SHA) data = json.dumps(result, indent=2) + "\n" if args.output: args.output.write_text(data) diff --git a/scripts/pip-security/filter-pip-vendor-findings.py b/scripts/pip-security/filter-pip-vendor-findings.py index 5a7c1907..3af899fe 100644 --- a/scripts/pip-security/filter-pip-vendor-findings.py +++ b/scripts/pip-security/filter-pip-vendor-findings.py @@ -5,21 +5,39 @@ from datetime import datetime, timezone import json from pathlib import Path +from vendor_source_inventory import SBOM_PATHS, WHEEL_PATHS WHEEL_SHA = "be5f63d537bbe611dc422fabb6740a44b5997888b592888df5091727f023802a" +WHEEL_NAME = "pip-26.2.2+pasturestack.1-py3-none-any.whl" +BOM_SHA = "3581cb8f0a6128c19ccec4e9aeab0d3ac8212fd19bd19d485b2e24fd4dc10f2a" RULES = { "GHSA-6v7p-g79w-8964": ("msgpack", "1.1.2"), "CVE-2026-57585": ("msgpack", "1.1.2"), + "CVE-2026-114613": ("msgpack", "1.1.2"), + "GHSA-j586-36cw-2gc2": ("msgpack", "1.1.2"), "CVE-2025-47273": ("setuptools", "70.3.0"), "CVE-2026-59890": ("setuptools", "70.3.0"), + "GHSA-xmj3-9gf7-h52w": ("setuptools", "70.3.0"), } def apply(raw, proof, subject): + inventory = proof.get("vendorSourceInventory", {}) + sources = inventory.get("sources", []) + valid_sources = (sources and len({item.get("path") for item in sources}) == len(sources) and + any(item.get("kind") == "sbom" for item in sources) and + any(item.get("kind") == "wheel" and item.get("path") == proof.get("verifiedWheelPath") for item in sources) and + all((item.get("kind") == "wheel" and item.get("path") in WHEEL_PATHS and item.get("sha256") == WHEEL_SHA) or + (item.get("kind") == "sbom" and item.get("path") in SBOM_PATHS and item.get("sha256") == BOM_SHA) + for item in sources)) valid = (proof["verifiedWheelSha256"] == WHEEL_SHA and + proof.get("verifiedWheelPath") in WHEEL_PATHS and proof["pip"] == "26.2.2+pasturestack.1" and proof["urllib3"] == "2.8.0" and proof["msgpackImplementation"] == "pip._vendor.msgpack.fallback" and - proof["setuptoolsPackageAbsent"] is True and proof["vendorFilesByteCompared"] == 299) + proof["setuptoolsPackageAbsent"] is True and proof["vendorFilesByteCompared"] == 299 and + proof.get("vulnerableModulesAbsent") == ["msgpack._cmsgpack", "setuptools.wheel"] and + inventory.get("complete") is True and inventory.get("noForeignMatchingDistribution") is True and + inventory.get("expectedBomSha256") == BOM_SHA and valid_sources) if not valid: raise ValueError("Exact installed pip vendor proof is required") reasons = {item["id"]: item for item in proof["notAffected"]} @@ -31,17 +49,20 @@ def apply(raw, proof, subject): key = item.get("VulnerabilityID") expected = RULES.get(key) actual = (item.get("PkgName"), item.get("InstalledVersion")) + purl = "pkg:pypi/" + str(actual[0]) + "@" + str(actual[1]) packages = [pkg for pkg in section.get("Packages", []) if (pkg.get("Name"), pkg.get("Version")) == actual] reason = reasons.get(key, {}) eligible = (expected == actual and key in reasons and (reason.get("package"), reason.get("version")) == actual and section.get("Type") == "python-pkg" and packages and - all(pkg.get("AnalyzedBy") == "sbom" for pkg in packages)) + all(pkg.get("AnalyzedBy") == "sbom" for pkg in packages) and + (item.get("PkgIdentifier") or {}).get("PURL") == purl and + all(not pkg.get("FilePath") and not pkg.get("PkgPath") for pkg in packages) and + not item.get("PkgPath")) if not eligible: retained.append(item) continue - purl = "pkg:pypi/" + actual[0] + "@" + actual[1] statements.append({ "vulnerability": {"name": key}, "products": [{"@id": subject, "subcomponents": [{"@id": purl}]}], diff --git a/scripts/pip-security/test-pip-vex.py b/scripts/pip-security/test-pip-vex.py index 9baa3e1c..256dd56b 100644 --- a/scripts/pip-security/test-pip-vex.py +++ b/scripts/pip-security/test-pip-vex.py @@ -1,9 +1,16 @@ #!/usr/bin/env python3 """Negative controls for the exact pip-vendor VEX boundary.""" from copy import deepcopy +import ast +import hashlib import importlib.util +import json from pathlib import Path +import tempfile import unittest +from unittest.mock import patch +import zipfile +from vendor_source_inventory import inventory, matching_sbom spec = importlib.util.spec_from_file_location("pip_vex", Path(__file__).with_name("filter-pip-vendor-findings.py")) vex = importlib.util.module_from_spec(spec) @@ -12,27 +19,36 @@ class VexBoundary(unittest.TestCase): def setUp(self): - self.proof = {"verifiedWheelSha256": vex.WHEEL_SHA, "pip": "26.2.2+pasturestack.1", + self.proof = {"verifiedWheelSha256": vex.WHEEL_SHA, "verifiedWheelPath": "/usr/share/python-wheels/" + vex.WHEEL_NAME, + "pip": "26.2.2+pasturestack.1", "urllib3": "2.8.0", "msgpackImplementation": "pip._vendor.msgpack.fallback", "setuptoolsPackageAbsent": True, "vendorFilesByteCompared": 299, + "vulnerableModulesAbsent": ["msgpack._cmsgpack", "setuptools.wheel"], + "vendorSourceInventory": { + "complete": True, "noForeignMatchingDistribution": True, "expectedBomSha256": vex.BOM_SHA, + "sources": [{"kind": "wheel", "path": "/usr/share/python-wheels/" + vex.WHEEL_NAME, "sha256": vex.WHEEL_SHA}, + {"kind": "sbom", "path": "/opt/python-security/pip-vendor.cdx.json", "sha256": vex.BOM_SHA}]}, "notAffected": [{"id": key, "package": value[0], "version": value[1], "detail": "Test fixture only"} for key, value in vex.RULES.items()]} self.raw = {"Results": [{"Type": "python-pkg", "Packages": [ {"Name": name, "Version": version, "AnalyzedBy": "sbom"} for name, version in set(vex.RULES.values())], "Vulnerabilities": [ - {"VulnerabilityID": key, "PkgName": value[0], "InstalledVersion": value[1]} + {"VulnerabilityID": key, "PkgName": value[0], "InstalledVersion": value[1], + "PkgIdentifier": {"PURL": "pkg:pypi/" + value[0] + "@" + value[1]}} for key, value in vex.RULES.items()]}]} def test_exact_slice_only(self): original = deepcopy(self.raw) result, document = vex.apply(self.raw, self.proof, "urn:test:exact-image") self.assertEqual(result["Results"][0]["Vulnerabilities"], []) - self.assertEqual(len(document["statements"]), 4) + self.assertEqual(len(document["statements"]), len(vex.RULES)) self.assertEqual(self.raw, original, "raw evidence must not be mutated") def test_invalid_proof_fails_closed(self): for key, value in [("verifiedWheelSha256", "0" * 64), ("urllib3", "2.7.0"), - ("vendorFilesByteCompared", 300), ("setuptoolsPackageAbsent", False)]: + ("vendorFilesByteCompared", 300), ("setuptoolsPackageAbsent", False), + ("verifiedWheelPath", "/tmp/unverified/" + vex.WHEEL_NAME), + ("pip", "26.2.2"), ("vulnerableModulesAbsent", [])]: proof = dict(self.proof, **{key: value}) with self.subTest(key=key), self.assertRaises(ValueError): vex.apply(self.raw, proof, "urn:test:image") @@ -41,19 +57,19 @@ def test_full_distribution_is_not_excluded(self): for package in self.raw["Results"][0]["Packages"]: package["AnalyzedBy"] = "python-pkg" result, document = vex.apply(self.raw, self.proof, "urn:test:image") - self.assertEqual(len(result["Results"][0]["Vulnerabilities"]), 4) + self.assertEqual(len(result["Results"][0]["Vulnerabilities"]), len(vex.RULES)) self.assertEqual(document["statements"], []) def test_missing_packages_is_not_excluded(self): self.raw["Results"][0]["Packages"] = [] result, _ = vex.apply(self.raw, self.proof, "urn:test:image") - self.assertEqual(len(result["Results"][0]["Vulnerabilities"]), 4) + self.assertEqual(len(result["Results"][0]["Vulnerabilities"]), len(vex.RULES)) def test_wrong_version_is_not_excluded(self): for finding in self.raw["Results"][0]["Vulnerabilities"]: finding["InstalledVersion"] = "999.0" result, document = vex.apply(self.raw, self.proof, "urn:test:image") - self.assertEqual(len(result["Results"][0]["Vulnerabilities"]), 4) + self.assertEqual(len(result["Results"][0]["Vulnerabilities"]), len(vex.RULES)) self.assertEqual(document["statements"], []) def test_unknown_advisory_and_urllib3_are_retained(self): @@ -63,6 +79,90 @@ def test_unknown_advisory_and_urllib3_are_retained(self): result, _ = vex.apply(self.raw, self.proof, "urn:test:image") self.assertEqual(result["Results"][0]["Vulnerabilities"], [unknown, urllib]) + def test_explicit_distribution_path_cannot_inherit_vendor_proof(self): + for item in self.raw["Results"][0]["Vulnerabilities"]: + item["PkgPath"] = "/unrelated/site-packages/" + item["PkgName"] + result, document = vex.apply(self.raw, self.proof, "urn:test:image") + self.assertEqual(len(result["Results"][0]["Vulnerabilities"]), len(vex.RULES)) + self.assertEqual(document["statements"], []) + + def test_wrong_purl_cannot_inherit_vendor_proof(self): + for item in self.raw["Results"][0]["Vulnerabilities"]: + item["PkgIdentifier"]["PURL"] = "pkg:generic/foreign@1" + result, document = vex.apply(self.raw, self.proof, "urn:test:image") + self.assertEqual(len(result["Results"][0]["Vulnerabilities"]), len(vex.RULES)) + self.assertEqual(document["statements"], []) + + def test_missing_or_unrecognized_source_inventory_fails_closed(self): + for change in [None, {"complete": False}, {"sources": []}]: + proof = deepcopy(self.proof) + proof["vendorSourceInventory"] = {} if change is None else dict(proof["vendorSourceInventory"], **change) + with self.subTest(change=change), self.assertRaises(ValueError): + vex.apply(self.raw, proof, "urn:test:image") + proof = deepcopy(self.proof) + proof["vendorSourceInventory"]["sources"][0]["path"] = "/unrelated/" + vex.WHEEL_NAME + with self.assertRaises(ValueError): + vex.apply(self.raw, proof, "urn:test:image") + + def test_vulnerable_module_presence_fails_actual_proof_check(self): + source = Path(__file__).with_name("check-pip-vendor-slice.py").read_text() + tree = ast.parse(source) + function = next(node for node in tree.body if isinstance(node, ast.FunctionDef) + and node.name == "require_absent_vulnerable_modules") + namespace = {} + exec(compile(ast.Module(body=[function], type_ignores=[]), "", "exec"), namespace) + check = namespace["require_absent_vulnerable_modules"] + check(["pip/_vendor/msgpack/fallback.py", "pip/_vendor/pkg_resources/__init__.py"]) + for path in ["pip/_vendor/msgpack/_cmsgpack.so", "pip/_vendor/msgpack/_cmsgpack.pyd", + "pip/_vendor/setuptools/wheel.py"]: + with self.subTest(path=path), self.assertRaises(AssertionError): + check(name for name in [path]) + + def test_actual_source_inventory_rejects_foreign_sbom_distribution_and_wheel(self): + bom = json.dumps({"bomFormat": "CycloneDX", "components": [ + {"name": "msgpack", "version": "1.1.2"}, {"name": "setuptools", "version": "70.3.0"}]}).encode() + with tempfile.TemporaryDirectory(prefix="pip-source-inventory-") as directory: + root = Path(directory) + known = root / "opt/python-security/pip-vendor.cdx.json" + known.parent.mkdir(parents=True); known.write_bytes(bom) + wheel = root / ("usr/share/python-wheels/" + vex.WHEEL_NAME) + wheel.parent.mkdir(parents=True) + with zipfile.ZipFile(wheel, "w") as archive: + archive.writestr("pip/_vendor/bom.cdx.json", bom) + wheel_sha = hashlib.sha256(wheel.read_bytes()).hexdigest() + bom_sha = hashlib.sha256(bom).hexdigest() + self.assertEqual(len(inventory(root, wheel_sha, bom_sha)["sources"]), 2) + bad_inputs = { + "foreign/bom.cdx.json": bom, + "foreign/sbom.spdx.json": json.dumps({"spdxVersion": "SPDX-2.3", "packages": [ + {"name": "setuptools", "versionInfo": "70.3.0"}]}).encode(), + "outside-sys-path/msgpack.dist-info/METADATA": b"Name: msgpack\nVersion: 1.1.2\n", + "foreign/copy.whl": wheel.read_bytes(), + } + for name, content in bad_inputs.items(): + path = root / name; path.parent.mkdir(parents=True, exist_ok=True); path.write_bytes(content) + with self.subTest(path=name), self.assertRaises(ValueError): + inventory(root, wheel_sha, bom_sha) + path.unlink() + known.write_bytes(bom + b" ") + with self.assertRaises(ValueError): + inventory(root, wheel_sha, bom_sha) + + def test_unrelated_or_versionless_sbom_components_do_not_match(self): + unrelated = {"spdxVersion": "SPDX-2.3", "packages": [ + {"name": "other", "externalRefs": [{"referenceLocator": "pkg:pypi/other@1.0"}]}]} + self.assertFalse(matching_sbom(json.dumps(unrelated).encode())) + versionless = {"bomFormat": "CycloneDX", "components": [{"name": "other"}, {}, {"name": "msgpack"}]} + self.assertFalse(matching_sbom(json.dumps(versionless).encode())) + primary = {"bomFormat": "CycloneDX", "metadata": {"component": {"name": "msgpack", "version": "1.1.2"}}} + self.assertTrue(matching_sbom(json.dumps(primary).encode())) + + def test_source_walk_error_cannot_produce_complete_inventory(self): + def unreadable(*args, **kwargs): + kwargs["onerror"](PermissionError("unreadable source path")) + with patch("vendor_source_inventory.os.walk", unreadable), self.assertRaises(PermissionError): + inventory(Path("/"), vex.WHEEL_SHA, vex.BOM_SHA) + if __name__ == "__main__": unittest.main() diff --git a/scripts/pip-security/vendor_source_inventory.py b/scripts/pip-security/vendor_source_inventory.py new file mode 100644 index 00000000..99ec38cb --- /dev/null +++ b/scripts/pip-security/vendor_source_inventory.py @@ -0,0 +1,114 @@ +"""Bind pathless scanner SBOM components to the image's exact pip vendor sources.""" +from email.parser import BytesParser +import hashlib +import json +import os +from pathlib import Path +import xml.etree.ElementTree as ET +import zipfile + + +WHEEL_NAME = "pip-26.2.2+pasturestack.1-py3-none-any.whl" +WHEEL_PATHS = {"/usr/share/python-wheels/" + WHEEL_NAME, + "/opt/python-security/" + WHEEL_NAME} +SBOM_PATHS = {"/usr/local/lib/python3.14/dist-packages/pip/_vendor/bom.cdx.json", + "/usr/lib/python3/dist-packages/pip/_vendor/bom.cdx.json", + "/opt/python-security/pip-vendor.cdx.json"} +TARGETS = {"msgpack": "1.1.2", "setuptools": "70.3.0"} + + +def matches(name, version, purl=""): + normalized = str(name).lower() + return (normalized in TARGETS and TARGETS[normalized] == version) or any( + purl == "pkg:pypi/" + package + "@" + expected for package, expected in TARGETS.items()) + + +def matching_sbom(data): + if data.lstrip().startswith(b"SPDXVersion:"): + package = None + for line in data.decode("utf-8").splitlines(): + if line.startswith("PackageName:"): + package = line.partition(":")[2].strip() + elif line.startswith("PackageVersion:") and matches(package, line.partition(":")[2].strip()): + return True + return False + try: + document = json.loads(data) + except (ValueError, UnicodeError): + try: + root = ET.fromstring(data) + except ET.ParseError: + return False + if root.tag.rsplit("}", 1)[-1] != "bom": + return False + for node in root.iter(): + if node.tag.rsplit("}", 1)[-1] == "component": + values = {child.tag.rsplit("}", 1)[-1]: child.text for child in node} + if matches(values.get("name"), values.get("version"), values.get("purl", "")): + return True + return False + if not isinstance(document, dict): + return False + if document.get("bomFormat") == "CycloneDX": + pending = list(document.get("components", [])) + primary = document.get("metadata", {}).get("component") + if isinstance(primary, dict): + pending.append(primary) + while pending: + item = pending.pop() + if matches(item.get("name"), item.get("version"), item.get("purl", "")): + return True + pending.extend(item.get("components", [])) + if document.get("spdxVersion"): + for item in document.get("packages", []): + if matches(item.get("name"), item.get("versionInfo")) or any( + matches(None, None, ref.get("referenceLocator", "")) for ref in item.get("externalRefs", [])): + return True + return False + + +def matching_distribution(data): + metadata = BytesParser().parsebytes(data) + return matches(metadata.get("Name"), metadata.get("Version")) + + +def inventory(root, wheel_sha, bom_sha): + root = Path(root) + sources = [] + def fail_walk(error): + raise error + for directory, dirs, files in os.walk(root, followlinks=False, onerror=fail_walk): + if Path(directory) == root: + dirs[:] = [name for name in dirs if name not in {"proc", "sys", "dev"}] + for name in files: + path = Path(directory, name) + logical = "/" + path.relative_to(root).as_posix() + if name in {"METADATA", "PKG-INFO"}: + if matching_distribution(path.read_bytes()): + raise ValueError("Full matching distribution outside pip vendor slice: " + logical) + elif name.endswith((".json", ".xml", ".spdx")): + data = path.read_bytes() + if matching_sbom(data): + digest = hashlib.sha256(data).hexdigest() + if logical not in SBOM_PATHS or digest != bom_sha: + raise ValueError("Unverified matching SBOM: " + logical) + sources.append({"path": logical, "kind": "sbom", "sha256": digest}) + elif name.endswith(".whl"): + with zipfile.ZipFile(path) as archive: + matching = False + for member in archive.namelist(): + if member.endswith(("/METADATA", "/PKG-INFO")) and matching_distribution(archive.read(member)): + raise ValueError("Full matching distribution wheel: " + logical) + if member.endswith((".json", ".xml", ".spdx")) and matching_sbom(archive.read(member)): + if member != "pip/_vendor/bom.cdx.json" or hashlib.sha256(archive.read(member)).hexdigest() != bom_sha: + raise ValueError("Unverified matching wheel SBOM: " + logical) + matching = True + if matching: + digest = hashlib.sha256(path.read_bytes()).hexdigest() + if logical not in WHEEL_PATHS or digest != wheel_sha: + raise ValueError("Unverified matching wheel: " + logical) + sources.append({"path": logical, "kind": "wheel", "sha256": digest}) + if not any(item["kind"] == "sbom" for item in sources) or not any(item["kind"] == "wheel" for item in sources): + raise ValueError("Both live SBOM and fixed seed inventory are required") + return {"complete": True, "noForeignMatchingDistribution": True, + "expectedBomSha256": bom_sha, "sources": sorted(sources, key=lambda item: item["path"])} diff --git a/template/catalog.go b/template/catalog.go new file mode 100644 index 00000000..16e6de94 --- /dev/null +++ b/template/catalog.go @@ -0,0 +1,196 @@ +package template + +import ( + "bytes" + "errors" + "fmt" + "reflect" + "strconv" + "strings" + "text/template" + "text/template/parse" + + "github.com/Masterminds/sprig/v3" + "github.com/PastureStack/compose-cli/template/funcs" +) + +var ErrCatalogTemplate = errors.New("CatalogLaunchTemplateUnsupported") + +const MaxCatalogTemplateBytes = 1024 * 1024 + +type catalogWriter struct{ bytes.Buffer } + +func (w *catalogWriter) WriteString(input string) (int, error) { return w.Write([]byte(input)) } + +func (w *catalogWriter) Write(input []byte) (int, error) { + if w.Len()+len(input) > MaxCatalogTemplateBytes { + return 0, ErrCatalogTemplate + } + return w.Buffer.Write(input) +} + +func catalogPrintf(format string, args ...interface{}) (string, error) { + if len(format) > 256 || len(args) > 32 { + return "", ErrCatalogTemplate + } + for i := 0; i < len(format); i++ { + if format[i] != '%' { + continue + } + i++ + if i < len(format) && format[i] == '%' { + continue + } + for i < len(format) && strings.ContainsRune("#0+- ", rune(format[i])) { + i++ + } + for part := 0; part < 2; part++ { + start := i + for i < len(format) && format[i] >= '0' && format[i] <= '9' { + i++ + } + if i > start { + width, err := strconv.Atoi(format[start:i]) + if err != nil || width > 4096 { + return "", ErrCatalogTemplate + } + } + if part == 0 && i < len(format) && format[i] == '.' { + i++ + continue + } + break + } + if i >= len(format) || !strings.ContainsRune("vsqdxXbOocUeEfFgGtT", rune(format[i])) { + return "", ErrCatalogTemplate + } + } + result := fmt.Sprintf(format, args...) + if len(result) > MaxCatalogTemplateBytes { + return "", ErrCatalogTemplate + } + return result, nil +} + +func catalogIndent(spaces int, input string) (string, error) { + if spaces < 0 || spaces > 128 || len(input)+(strings.Count(input, "\n")+1)*spaces > MaxCatalogTemplateBytes { + return "", ErrCatalogTemplate + } + padding := strings.Repeat(" ", spaces) + return padding + strings.ReplaceAll(input, "\n", "\n"+padding), nil +} + +func catalogJoin(separator string, value interface{}) (string, error) { + items := reflect.ValueOf(value) + if !items.IsValid() || (items.Kind() != reflect.Array && items.Kind() != reflect.Slice) || items.Len() > 10000 { + return "", ErrCatalogTemplate + } + length := 0 + result := make([]string, 0, items.Len()) + for i := 0; i < items.Len(); i++ { + text := fmt.Sprint(items.Index(i).Interface()) + length += len(text) + if i > 0 { + length += len(separator) + } + if length > MaxCatalogTemplateBytes { + return "", ErrCatalogTemplate + } + result = append(result, text) + } + return strings.Join(result, separator), nil +} + +func catalogReplace(old, replacement, input string) (string, error) { + count := strings.Count(input, old) + if len(input)+count*(len(replacement)-len(old)) > MaxCatalogTemplateBytes { + return "", ErrCatalogTemplate + } + return strings.ReplaceAll(input, old, replacement), nil +} + +// ApplyCatalog is the opt-in, deterministic subset for a reviewed typed launch. +// The ordinary Apply owner remains unchanged. No host environment, DNS, random, +// crypto key generation, filesystem or caller-supplied function is available. +func ApplyCatalog(contents []byte, stack StackInfo, environment EnvironmentInfo, variables map[string]string) ([]byte, error) { + if len(contents) > MaxCatalogTemplateBytes || len(variables) > 100 { + return nil, ErrCatalogTemplate + } + trimmed := strings.TrimSpace(string(contents)) + if strings.HasPrefix(trimmed, "#notemplating") || strings.HasPrefix(trimmed, "# notemplating") { + return append([]byte(nil), contents...), nil + } + all := sprig.HermeticTxtFuncMap() + allowed := template.FuncMap{} + for _, name := range strings.Fields("default empty coalesce ternary quote squote trim trimAll trimSuffix trimPrefix upper lower title untitle contains hasPrefix hasSuffix splitList first last rest initial reverse uniq without compact list dict get hasKey pick omit add add1 sub div mod mul max min int int64 float64 atoi toString toStrings b64enc b64dec sha256sum") { + if function, ok := all[name]; ok { + allowed[name] = function + } + } + allowed["splitPreserveQuotes"] = funcs.SplitPreserveQuotes + allowed["printf"] = catalogPrintf + allowed["indent"] = catalogIndent + allowed["nindent"] = func(spaces int, input string) (string, error) { + result, err := catalogIndent(spaces, input) + return "\n" + result, err + } + allowed["join"] = catalogJoin + allowed["replace"] = catalogReplace + allowed["print"] = func(args ...interface{}) (string, error) { + return catalogPrintf(strings.Repeat("%v", len(args)), args...) + } + allowed["println"] = func(args ...interface{}) (string, error) { + return catalogPrintf(strings.Repeat("%v ", len(args))+"\n", args...) + } + t, err := template.New("catalog").Option("missingkey=error").Funcs(allowed).Parse(string(contents)) + if err != nil { + return nil, ErrCatalogTemplate + } + nodes := 0 + for _, defined := range t.Templates() { + if !catalogTree(defined.Tree.Root, &nodes) { + return nil, ErrCatalogTemplate + } + } + writer := &catalogWriter{} + if err = t.Execute(writer, map[string]interface{}{"Values": variables, "Release": stack, "Stack": stack, "Environment": environment}); err != nil { + return nil, ErrCatalogTemplate + } + // The normal executor must use this exact approved rendering, not run a + // second evaluation with its ordinary template function set. + result := append([]byte("# notemplating\n"), writer.Bytes()...) + if len(result) > MaxCatalogTemplateBytes { + return nil, ErrCatalogTemplate + } + return result, nil +} + +func catalogTree(node parse.Node, count *int) bool { + if node == nil { + return true + } + *count++ + if *count > 10000 { + return false + } + switch n := node.(type) { + case *parse.ListNode: + if n == nil { + return true + } + for _, child := range n.Nodes { + if !catalogTree(child, count) { + return false + } + } + case *parse.TemplateNode: + return false + case *parse.IfNode: + return catalogTree(n.List, count) && catalogTree(n.ElseList, count) + case *parse.RangeNode: + return catalogTree(n.List, count) && catalogTree(n.ElseList, count) + case *parse.WithNode: + return catalogTree(n.List, count) && catalogTree(n.ElseList, count) + } + return true +} diff --git a/template/catalog_test.go b/template/catalog_test.go new file mode 100644 index 00000000..4165c490 --- /dev/null +++ b/template/catalog_test.go @@ -0,0 +1,50 @@ +package template + +import ( + "bytes" + "strings" + "testing" +) + +func TestCatalogRenderingReusesOwnerContextAndFreezesApprovedBytes(t *testing.T) { + input := []byte("name: {{ .Stack.Name }}\nvalue: {{ .Values.text | quote }}\nflag: {{ if eq .Values.flag \"false\" }}no{{ else }}yes{{ end }}\n") + variables := map[string]string{"text": "hello", "flag": "false"} + result, err := ApplyCatalog(input, StackInfo{Name: "chosen"}, EnvironmentInfo{}, variables) + if err != nil || !strings.Contains(string(result), "name: chosen") || !strings.Contains(string(result), "flag: no") { + t.Fatalf("render failed: %v", err) + } + again, err := Apply(result, StackInfo{Name: "different"}, EnvironmentInfo{}, map[string]string{"text": "changed"}) + if err != nil || !bytes.Equal(result, again) { + t.Fatal("approved content was reevaluated") + } + if text, err := catalogPrintf("[%s]-20261030", "value"); err != nil || text != "[value]-20261030" { + t.Fatal("literal brackets/version mistaken for format width") + } +} + +func TestCatalogRenderingRejectsHostFunctionsRecursionMissingValuesAndExpansion(t *testing.T) { + for _, input := range []string{ + `{{ env "PRIVATE_KEY" }}`, `{{ expandenv "$PRIVATE_KEY" }}`, `{{ getHostByName "example.test" }}`, + `{{ genPrivateKey "rsa" }}`, `{{ randBytes 32 }}`, `{{ repeat 999999999 "a" }}`, + `{{ printf "%1000000000s" "a" }}`, `{{ printf "%*s" 1000000000 "a" }}`, + `{{ indent 1000000000 "a" }}`, `{{ nindent 1000000000 "a" }}`, + `{{ replace "" (printf "%4096s" "x") (printf "%4096s" "a") }}`, + `{{ join (printf "%4096s" "x") (splitList "" (printf "%4096s" "a")) }}`, + `{{ define "again" }}{{ template "again" . }}{{ end }}{{ template "again" . }}`, + `{{ .Values.missing }}`, `{{ .Values.private | invalidFunc }}`, + } { + if _, err := ApplyCatalog([]byte(input), StackInfo{}, EnvironmentInfo{}, map[string]string{"private": "never-echo"}); err != ErrCatalogTemplate { + t.Fatal("unsafe template accepted") + } + } + if _, err := ApplyCatalog([]byte(strings.Repeat("x", MaxCatalogTemplateBytes+1)), StackInfo{}, EnvironmentInfo{}, nil); err != ErrCatalogTemplate { + t.Fatal("unbounded template accepted") + } + variables := map[string]string{} + for i := 0; i < 100; i++ { + variables[strings.Repeat("k", i+1)] = strings.Repeat("x", 16384) + } + if _, err := ApplyCatalog([]byte(`{{range .Values}}{{.}}{{end}}`), StackInfo{}, EnvironmentInfo{}, variables); err != ErrCatalogTemplate { + t.Fatal("expanded output exceeded writer boundary") + } +} diff --git a/tests/integration/requirements.txt b/tests/integration/requirements.txt index 07ab4873..9622e52e 100644 --- a/tests/integration/requirements.txt +++ b/tests/integration/requirements.txt @@ -1,3 +1,3 @@ cattle==0.5.4 pytest==9.1.1 -setuptools==84.0.0 +setuptools==84.1.0