security(oci): track 12 unfixed Debian HIGH/CRITICAL findings in v0.2.0 RC

[gnanirahulnutakki]

Status

Parked upstream/base-image dependency follow-up. This is not a claim that the image is vulnerability-free, and the package records below do not establish runtime reachability. The release approver should treat this as explicit residual-risk evidence for #140 and #147.

Reproduced candidate evidence

Verified on 2026-07-23T01:29:55Z (2026-07-22 CDT):

• image: ardur-proxy:rc-local-0.2.0-7b88e69
• image ID: sha256:960f8b41f5f145df17fcc9a4896494cba20864446d28c32a9d9697558740f836
• platform/base: Linux amd64, Debian 13.5, non-root 65532:65532
• source label: 7b88e693f1228afa94584d3f997e92414eb892c8-uncommitted (therefore the exact committed release image still requires a fresh scan)
• pinned base: python:3.13.14-slim-trixie@sha256:eb43ff125d8d58d7449dcba7d336c23bcac412f526d861db493b9994d8010280
• scanner: Trivy 0.72.0, freshly downloaded DB
• full vuln,secret scan: 169 vulnerability records = 4 CRITICAL, 19 HIGH, 55 MEDIUM, 63 LOW, 28 UNKNOWN; 0 secret records reported
• HIGH/CRITICAL subset: 12 distinct CVEs across 23 package records; every Trivy FixedVersion field was empty
• workflow-equivalent gate, --ignore-unfixed --severity HIGH,CRITICAL --exit-code 1, exited 0 because all 23 records were marked unfixed. That policy result must not be described as a clean full scan.

The current official python:3.13.14-slim-trixie amd64 manifest (sha256:afe189875f1d2f9b45e287834fb9f2c273a5d59d354ae4050ab9affbf0a6ba06) was also inspected. It still contains the same affected Debian package versions, so refreshing the pin alone does not clear these records today.

Exact HIGH/CRITICAL records

CVE	Trivy	Candidate package record(s)	Debian 13 / applicability evidence
CVE-2025-69720	HIGH	libncursesw6, libtinfo6, ncurses-base, ncurses-bin 6.5+20250216-2	Trixie remains vulnerable; the flaw is in infocmp, which is present. No Ardur invocation or crafted-input reachability was established.
CVE-2026-13221	CRITICAL	perl-base 5.40.1-6	Debian unstable is also unfixed. Trigger requires a Perl regex trie with more than 65,535 fixed-string alternatives; no Ardur-controlled Perl regex path was established.
CVE-2026-41992	HIGH	gzip 1.13-1	Debian unstable is unfixed. Trigger requires crafted LZW then LZH inputs in one gzip -d invocation; gzip is present, but application invocation/reachability was not established.
CVE-2026-42496	CRITICAL	perl-base 5.40.1-6	Trixie/unstable remain vulnerable, but Archive::Tar is absent from this image. This appears to be source-package attribution; do not infer reachability.
CVE-2026-42497	HIGH	perl-base 5.40.1-6	Trixie/unstable remain vulnerable, but Archive::Tar is absent from this image. This appears to be source-package attribution; do not infer reachability.
CVE-2026-48962	HIGH	perl-base 5.40.1-6	Trixie is vulnerable; unstable has 5.40.1-8. File::GlobMapper and IO::Compress are absent, so the candidate lacks the named vulnerable module.
CVE-2026-53615	HIGH	bsdutils 1:2.41-5; libblkid1, liblastlog2-2, libmount1, libsmartcols1, libuuid1, mount, util-linux 2.41-5; login 1:4.16.0-2+really2.41-5	Trixie and unstable remain vulnerable; the defect is specifically in the libblkid DOS partition parser. Packages are present, but no block-device parsing path was established in the non-root proxy.
CVE-2026-54369	HIGH	libacl1 2.3.2-2+b1	Trixie is vulnerable; unstable has 2.4.0-1. The advisory requires a privileged pathname-based ACL caller plus attacker-controlled path components; the proxy runs as UID/GID 65532, but reachability was not tested.
CVE-2026-57432	HIGH	perl-base 5.40.1-6	Trixie is vulnerable; unstable has 5.40.1-8. Trigger requires an untrusted Perl pack/unpack template; no such Ardur path was established.
CVE-2026-57433	CRITICAL	perl-base 5.40.1-6	Trixie is vulnerable; unstable Perl has 5.40.1-8, but the named Storable module is absent. This appears to be source-package attribution; do not infer reachability.
CVE-2026-8376	CRITICAL	perl-base 5.40.1-6	Trixie is vulnerable; unstable has 5.40.1-8. The vendor description limits the overflow to 32-bit builds; this image reports x86_64, 64-bit integers, and 8-byte pointers. The generic source-package record appears architecture-inapplicable, but remains tracked pending vendor/scanner disposition.
CVE-2026-9538	HIGH	perl-base 5.40.1-6	Trixie/unstable remain vulnerable, but Archive::Tar is absent from this image. This appears to be source-package attribution; do not infer reachability.

Runtime spot checks also confirmed that the image entrypoint is Python (ardur start), while Archive::Tar, File::GlobMapper, IO::Compress::Base, and Storable cannot be imported by the included Perl. These checks narrow applicability; they are not an exhaustive reachability analysis.

Why this is parked

No fixed package for these records is currently available in Debian trixie. Some fixes exist only in unstable; cross-release package mixing is not a safe release remedy. The remaining paths are to wait for a trixie/Python-base update, remove unnecessary affected binaries/modules where feasible, or make a separately reviewed base-distribution change.

Exit criteria

• Rebuild from the exact committed dev/release SHA (no -uncommitted label) and identify the immutable image digest.
• Upgrade to vendor-fixed trixie packages through a pinned official base, remove the affected component with a regression check, or obtain a documented human security disposition for a demonstrated architecture/component mismatch. Do not mix Debian releases.
• Re-run the full Trivy scan and the release-policy gate with the current DB; attach scanner version, DB timestamp, image digest, severity counts, and exact remaining HIGH/CRITICAL rows.
• Update release: promote dev → main via PR #17 for v0.2.0 (needs one human approval) #140 and packaging: cut immutable v0.2.0 release after dev → main promotion #147 with the residual-risk decision. Close this issue only when every row is fixed, absent with reproducible evidence, or explicitly accepted by the human security/release owner.