Tags · jetstack/jetstack-secure

Bump x/crypto, x/net and cel-go to clear trivy image findings (#834)

Trivy reports three fixable vulnerabilities in all three images we
publish, venafi-agent, disco-agent and discovery-agent:

  golang.org/x/crypto v0.52.0 CRITICAL CVE-2026-56854 fixed in 0.56.0
  golang.org/x/net    v0.55.0 HIGH     CVE-2026-46600 fixed in 0.56.0
  github.com/google/cel-go v0.28.1 MEDIUM GHSA-gcjh-h69q-9w9g fixed in 0.30.0

None of them appears to be reachable, which is why govulncheck reports
zero. Only x/crypto/pbkdf2 is linked, not x/crypto/ssh, and the x/net
packages we link are idna, httpguts, http2 and html, not dns/dnsmessage.
cel-go/ext is linked, so the cel-go advisory is the one that is at least
plausibly reachable, but govulncheck does not see the vulnerable symbols
being called.

Trivy works from the module versions recorded in the binary rather than
from reachability, so it flags all three regardless. That is also what
Artifact Hub and customer scanners do, so a released image would be
reported as containing a CRITICAL whether or not it can be exploited.
Better to bump before tagging than to explain afterwards.

Two of the fixed versions are not the obvious ones:

- cel-go needs v0.30.0, not the v0.29.0 the GitHub advisory names.
  ext/native.go is byte identical between v0.28.1 and v0.29.0; the
  isSkippedFieldName guard that fixes it first appears in v0.30.0, and
  the Go vulnerability database agrees (GO-2026-6094). Trivy resolves Go
  advisories against the GitHub database, so v0.29.0 makes the scanner
  report this as fixed when it is not.
- x/crypto needs at least v0.56.0, which fixes two further ssh
  advisories published on 2026-09-02: CVE-2026-78662 (GO-2026-6354) and
  CVE-2026-56855 (GO-2026-6355).

Going to x/crypto v0.57.0 pulls x/net to v0.58.0 by minimal version
selection, past the 0.56.0 that fixes CVE-2026-46600, and brings sync,
sys, term and text forward. All are indirect dependencies and there is
no source change.

Both version corrections were found by Felix Phipps in review and
verified against the module source and the Go vulnerability database.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Richard Wall <richard.wall@cyberark.com>