gitea-mirror/trivy
1
0
Fork 0
mirror of https://github.com/aquasecurity/trivy.git synced 2025-12-12 07:40:48 -08:00
Code Issues Packages Projects Releases Wiki Activity

fix(vex): add CVE-2025-66564 as not_affected into Trivy VEX file (#9924)

Browse Source
This commit is contained in:
DmitriyLewen
2025-12-10 18:16:31 +06:00
committed by GitHub
parent 879e4fca12
commit 335cc993fa
1 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
.vex/trivy.openvex.json
View File

@@ -599,6 +599,36 @@
"status": "not_affected",
"justification": "vulnerable_code_not_in_execute_path",
"impact_statement": "Govulncheck determined that the vulnerable code isn't called"
},
{
"vulnerability": {
"@id": "https://pkg.go.dev/vuln/GO-2025-4192",
"name": "GO-2025-4192",
"description": "Sigstore Timestamp Authority allocates excessive memory during request parsing in github.com/sigstore/timestamp-authority",
"aliases": [
"CVE-2025-66564",
"GHSA-4qg8-fj49-pxjh"
]
},
"products": [
{
"@id": "pkg:golang/github.com/aquasecurity/trivy",
"identifiers": {
"purl": "pkg:golang/github.com/aquasecurity/trivy"
},
"subcomponents": [
{
"@id": "pkg:golang/github.com/sigstore/timestamp-authority@v1.2.2",
"identifiers": {
"purl": "pkg:golang/github.com/sigstore/timestamp-authority@v1.2.2"
}
}
]
}
],
"status": "not_affected",
"justification": "vulnerable_code_not_present",
"impact_statement": "Govulncheck determined that the vulnerable code isn't called"
}
]
}