VEXcalico-node
calico-node
7 declaraciones, emitidas el .Cada una es un hallazgo del escáner que no es explotable en esta imagen, y el motivo.
@id https://quench-works.com/vex/calico-node/2026-10-08
CVE-2026-54332
no afectado · código vulnerable ausente- pkg:apk/wolfi/calico-node-3.32
PROVEN false-positive, measured 2026-10-08 on calico-node 3.32.0. The advisory is Wolfi's, keyed to the package calico-node-3.32 3.32.0-r4 (fixed in 3.32.2-r3, a revision not in the public APKINDEX on 2026-10-08), and its vulnerable code is the Go module github.com/gopacket/gopacket linked into that package's Go binaries. Listing every ELF file of calico-node-3.32-3.32.0-r4.apk and checking each for Go build info showed exactly two Go binaries, /usr/bin/calico-node and /usr/bin/mountns; the rest are the C BIRD daemons and BPF objects in /usr/lib/calico/bpf. This image replaces both binaries with quench-calico-node (melange `replaces: calico-node-3.32`), built from the v3.32.0 tag with the floor pass. Verified by the build itself: melange.yaml runs `go version -m` on both replacement binaries and fails if github.com/gopacket/gopacket is below v1.6.1; and the gate's binary scan of /usr/bin/calico-node (run 37707336807) reported none of these advisories, only cel-go, since floored. The vulnerable github.com/gopacket/gopacket code is therefore not present in the image; only the package record of the replaced apk still carries the version.
CVE-2026-54345
no afectado · código vulnerable ausente- pkg:apk/wolfi/calico-node-3.32
PROVEN false-positive, measured 2026-10-08 on calico-node 3.32.0. The advisory is Wolfi's, keyed to the package calico-node-3.32 3.32.0-r4 (fixed in 3.32.2-r3, a revision not in the public APKINDEX on 2026-10-08), and its vulnerable code is the Go module github.com/gopacket/gopacket linked into that package's Go binaries. Listing every ELF file of calico-node-3.32-3.32.0-r4.apk and checking each for Go build info showed exactly two Go binaries, /usr/bin/calico-node and /usr/bin/mountns; the rest are the C BIRD daemons and BPF objects in /usr/lib/calico/bpf. This image replaces both binaries with quench-calico-node (melange `replaces: calico-node-3.32`), built from the v3.32.0 tag with the floor pass. Verified by the build itself: melange.yaml runs `go version -m` on both replacement binaries and fails if github.com/gopacket/gopacket is below v1.6.1; and the gate's binary scan of /usr/bin/calico-node (run 37707336807) reported none of these advisories, only cel-go, since floored. The vulnerable github.com/gopacket/gopacket code is therefore not present in the image; only the package record of the replaced apk still carries the version.
CVE-2026-65819
no afectado · código vulnerable ausente- pkg:apk/wolfi/calico-node-3.32
PROVEN false-positive, measured 2026-10-08 on calico-node 3.32.0. The advisory is Wolfi's, keyed to the package calico-node-3.32 3.32.0-r4 (fixed in 3.32.2-r3, a revision not in the public APKINDEX on 2026-10-08), and its vulnerable code is the Go module github.com/gopacket/gopacket linked into that package's Go binaries. Listing every ELF file of calico-node-3.32-3.32.0-r4.apk and checking each for Go build info showed exactly two Go binaries, /usr/bin/calico-node and /usr/bin/mountns; the rest are the C BIRD daemons and BPF objects in /usr/lib/calico/bpf. This image replaces both binaries with quench-calico-node (melange `replaces: calico-node-3.32`), built from the v3.32.0 tag with the floor pass. Verified by the build itself: melange.yaml runs `go version -m` on both replacement binaries and fails if github.com/gopacket/gopacket is below v1.6.1; and the gate's binary scan of /usr/bin/calico-node (run 37707336807) reported none of these advisories, only cel-go, since floored. The vulnerable github.com/gopacket/gopacket code is therefore not present in the image; only the package record of the replaced apk still carries the version.
CVE-2026-84303
no afectado · código vulnerable ausente- pkg:apk/wolfi/calico-node-3.32
PROVEN false-positive, measured 2026-10-08 on calico-node 3.32.0. The advisory is Wolfi's, keyed to the package calico-node-3.32 3.32.0-r4 (fixed in 3.32.2-r3, a revision not in the public APKINDEX on 2026-10-08), and its vulnerable code is the Go module google.golang.org/grpc linked into that package's Go binaries. Listing every ELF file of calico-node-3.32-3.32.0-r4.apk and checking each for Go build info showed exactly two Go binaries, /usr/bin/calico-node and /usr/bin/mountns; the rest are the C BIRD daemons and BPF objects in /usr/lib/calico/bpf. This image replaces both binaries with quench-calico-node (melange `replaces: calico-node-3.32`), built from the v3.32.0 tag with the floor pass. Verified by the build itself: melange.yaml runs `go version -m` on both replacement binaries and fails if google.golang.org/grpc is below v1.83.2; and the gate's binary scan of /usr/bin/calico-node (run 37707336807) reported none of these advisories, only cel-go, since floored. The vulnerable google.golang.org/grpc code is therefore not present in the image; only the package record of the replaced apk still carries the version.
CVE-2026-84304
no afectado · código vulnerable ausente- pkg:apk/wolfi/calico-node-3.32
PROVEN false-positive, measured 2026-10-08 on calico-node 3.32.0. The advisory is Wolfi's, keyed to the package calico-node-3.32 3.32.0-r4 (fixed in 3.32.2-r3, a revision not in the public APKINDEX on 2026-10-08), and its vulnerable code is the Go module google.golang.org/grpc linked into that package's Go binaries. Listing every ELF file of calico-node-3.32-3.32.0-r4.apk and checking each for Go build info showed exactly two Go binaries, /usr/bin/calico-node and /usr/bin/mountns; the rest are the C BIRD daemons and BPF objects in /usr/lib/calico/bpf. This image replaces both binaries with quench-calico-node (melange `replaces: calico-node-3.32`), built from the v3.32.0 tag with the floor pass. Verified by the build itself: melange.yaml runs `go version -m` on both replacement binaries and fails if google.golang.org/grpc is below v1.83.2; and the gate's binary scan of /usr/bin/calico-node (run 37707336807) reported none of these advisories, only cel-go, since floored. The vulnerable google.golang.org/grpc code is therefore not present in the image; only the package record of the replaced apk still carries the version.
CVE-2026-84445
no afectado · código vulnerable ausente- pkg:apk/wolfi/calico-node-3.32
PROVEN false-positive, measured 2026-10-08 on calico-node 3.32.0. The advisory is Wolfi's, keyed to the package calico-node-3.32 3.32.0-r4 (fixed in 3.32.2-r3, a revision not in the public APKINDEX on 2026-10-08), and its vulnerable code is the Go module google.golang.org/grpc linked into that package's Go binaries. Listing every ELF file of calico-node-3.32-3.32.0-r4.apk and checking each for Go build info showed exactly two Go binaries, /usr/bin/calico-node and /usr/bin/mountns; the rest are the C BIRD daemons and BPF objects in /usr/lib/calico/bpf. This image replaces both binaries with quench-calico-node (melange `replaces: calico-node-3.32`), built from the v3.32.0 tag with the floor pass. Verified by the build itself: melange.yaml runs `go version -m` on both replacement binaries and fails if google.golang.org/grpc is below v1.83.2; and the gate's binary scan of /usr/bin/calico-node (run 37707336807) reported none of these advisories, only cel-go, since floored. The vulnerable google.golang.org/grpc code is therefore not present in the image; only the package record of the replaced apk still carries the version.
CVE-2026-81870
no afectado · código vulnerable ausente- pkg:apk/wolfi/calico-node-3.32
PROVEN false-positive, measured 2026-10-08 on calico-node 3.32.0. The advisory is Wolfi's, keyed to the package calico-node-3.32 3.32.0-r4 (fixed in 3.32.2-r3, a revision not in the public APKINDEX on 2026-10-08), and its vulnerable code is the Go module go.opentelemetry.io/otel/exporters/otlp/otlptrace linked into that package's Go binaries. Listing every ELF file of calico-node-3.32-3.32.0-r4.apk and checking each for Go build info showed exactly two Go binaries, /usr/bin/calico-node and /usr/bin/mountns; the rest are the C BIRD daemons and BPF objects in /usr/lib/calico/bpf. This image replaces both binaries with quench-calico-node (melange `replaces: calico-node-3.32`), built from the v3.32.0 tag with the floor pass. Verified by the build itself: melange.yaml runs `go version -m` on both replacement binaries and fails if go.opentelemetry.io/otel/exporters/otlp/otlptrace is below v1.45.0; and the gate's binary scan of /usr/bin/calico-node (run 37707336807) reported none of these advisories, only cel-go, since floored. The vulnerable go.opentelemetry.io/otel/exporters/otlp/otlptrace code is therefore not present in the image; only the package record of the replaced apk still carries the version.