Ivan Sim ihcsim
ihcsim
/ vexscan-report.txt
Created
August 7, 2026 04:46
vexscan image report for docker.io/rancher/rke2-runtime:v1.36.3-rc5-rke2r1, docker.io/rancher/hardened-kubernetes:v1.36.3-rke2r1-build20260723, docker.io/rancher/hardened-coredns:v1.14.6-build20260722, docker.io/rancher/hardened-cluster-autoscaler:v1.10.3-build20260717, docker.io/rancher/hardened-dns-node-cache:1.26.8-build20260722, docker.io/ra…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| vexscan report (image) for docker.io/rancher/rke2-runtime:v1.36.3-rc5-rke2r1 | |
| scanned by: vexscan (devel) -- 2026-08-07 04:44 UTC, 1m39.9s -- advisories from https://api.osv.dev/v1 | |
| golang Go 1 components 2 findings | |
| affected by severity: 1 unknown | |
| 1 affected: 1 with no fix yet | |
| AFFECTED (1) - vulnerable code is present and can be loaded | |
| SEVERITY ADVISORY PACKAGE VERSION BASIS | |
| UNKNOWN GO-2026-5932 golang.org/x/crypto v0.53.0 |
ihcsim
/ vexscan-report.txt
Created
August 7, 2026 04:41
vexscan image report for docker.io/rancher/rke2-runtime:v1.36.3-rc5-rke2r1, docker.io/rancher/hardened-kubernetes:v1.36.3-rke2r1-build20260723, docker.io/rancher/hardened-coredns:v1.14.6-build20260722, docker.io/rancher/hardened-cluster-autoscaler:v1.10.3-build20260717, docker.io/rancher/hardened-dns-node-cache:1.26.8-build20260722, docker.io/ra…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| vexscan report (image) for docker.io/rancher/rke2-runtime:v1.36.3-rc5-rke2r1 | |
| scanned by: vexscan (devel) -- 2026-08-07 04:39 UTC, 1m46.6s -- advisories from https://api.osv.dev/v1 | |
| golang Go 1 components 2 findings | |
| affected by severity: 1 unknown | |
| 1 affected: 1 with no fix yet | |
| AFFECTED (1) - vulnerable code is present and can be loaded | |
| SEVERITY ADVISORY PACKAGE VERSION BASIS | |
| UNKNOWN GO-2026-5932 golang.org/x/crypto v0.53.0 |
ihcsim
/ vexscan-report.txt
Created
August 7, 2026 04:30
vexscan image report for docker.io/rancher/rke2-runtime:v1.36.3-rc5-rke2r1, docker.io/rancher/hardened-kubernetes:v1.36.3-rke2r1-build20260723, docker.io/rancher/hardened-coredns:v1.14.6-build20260722, docker.io/rancher/hardened-cluster-autoscaler:v1.10.3-build20260717, docker.io/rancher/hardened-dns-node-cache:1.26.8-build20260722, docker.io/ra…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| vexscan report (image) for docker.io/rancher/rke2-runtime:v1.36.3-rc5-rke2r1 | |
| scanned by: vexscan (devel) -- 2026-08-07 04:28 UTC, 1m44.8s -- advisories from https://api.osv.dev/v1 | |
| golang Go 1 components 2 findings | |
| affected by severity: 1 unknown | |
| 1 affected: 1 with no fix yet | |
| AFFECTED (1) - vulnerable code is present and can be loaded | |
| SEVERITY ADVISORY PACKAGE VERSION BASIS | |
| UNKNOWN GO-2026-5932 golang.org/x/crypto v0.53.0 |
ihcsim
/ gomod-vex-report.txt
Created
August 3, 2026 05:54
gomod-vex image report for rancher/rancher:latest,rancher/rancher:head (module stdlib)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| gomod-vex report (image) for rancher/rancher:latest | |
| module: stdlib | |
| summary: 0 not_present, 0 not_in_execute_path, 0 linked, 0 reachable, 15 undetermined | |
| [UNDETERMINED] stdlib@1.25.5 | |
| cve: CVE-2025-22870 | |
| binary: /opt/drivers/management-state/bin/docker-machine-driver-harvester (stripped) | |
| reason: no_osv_package_mapping |
ihcsim
/ gomod-vex-report.txt
Created
August 3, 2026 05:49
gomod-vex image report for rancher/rancher:latest,rancher/rancher:head (module golang.org/x/crypto)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| gomod-vex report (image) for rancher/rancher:latest | |
| module: golang.org/x/crypto | |
| summary: 87 not_present, 0 not_in_execute_path, 31 linked, 0 reachable, 0 undetermined | |
| [NOT PRESENT] golang.org/x/crypto@v0.40.0 | |
| cve: GO-2025-4116 | |
| binary: /opt/drivers/management-state/bin/docker-machine-driver-harvester (stripped) | |
| packages: golang.org/x/crypto/ssh/agent (package) | |
| vex: vulnerable_code_not_present [pclntab] |
ihcsim
/ gomod-vex-report.json
Created
August 3, 2026 05:37
gomod-vex image report for longhornio/backing-image-manager:v1.12.0,longhornio/longhorn-engine:v1.12.0,longhornio/longhorn-instance-manager:v1.12.0,longhornio/longhorn-manager:v1.12.0,longhornio/longhorn-share-manager:v1.12.0,longhornio/longhorn-ui:v1.12.0,longhornio/longhorn-cli:v1.12.0,longhornio/csi-attacher:v4.12.0,longhornio/csi-provisioner…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [ | |
| { | |
| "target": "longhornio/backing-image-manager:v1.12.0", | |
| "mode": "image", | |
| "module": "golang.org/x/crypto", | |
| "findings": null | |
| }, | |
| { | |
| "target": "longhornio/longhorn-engine:v1.12.0", | |
| "mode": "image", |
ihcsim
/ gomod-vex-report.txt
Created
August 3, 2026 05:29
gomod-vex image report for longhornio/backing-image-manager:v1.12.0,longhornio/longhorn-engine:v1.12.0,longhornio/longhorn-instance-manager:v1.12.0,longhornio/longhorn-manager:v1.12.0,longhornio/longhorn-share-manager:v1.12.0,longhornio/longhorn-ui:v1.12.0,longhornio/longhorn-cli:v1.12.0,longhornio/csi-attacher:v4.12.0,longhornio/csi-provisioner…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| gomod-vex report (image) for longhornio/backing-image-manager:v1.12.0 | |
| module: golang.org/x/crypto | |
| No findings: the module was not linked into any Go binary in this image, | |
| or no matching advisories were found. | |
| gomod-vex report (image) for longhornio/longhorn-engine:v1.12.0 | |
| module: golang.org/x/crypto | |
| No findings: the module was not linked into any Go binary in this image, |
ihcsim
/ gomod-vex-report.txt
Created
August 3, 2026 05:24
gomod-vex image report for docker.io/rancher/klipper-helm:v0.11.1-build20260615,docker.io/rancher/klipper-lb:v0.4.17,docker.io/rancher/local-path-provisioner:v0.0.36,docker.io/rancher/mirrored-coredns-coredns:1.14.4,docker.io/rancher/mirrored-library-busybox:1.37.0,docker.io/rancher/mirrored-library-traefik:3.7.4,docker.io/rancher/mirrored-metri…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| gomod-vex report (image) for docker.io/rancher/klipper-helm:v0.11.1-build20260615 | |
| module: golang.org/x/crypto | |
| summary: 42 not_present, 0 not_in_execute_path, 0 linked, 0 reachable, 0 undetermined | |
| [NOT PRESENT] golang.org/x/crypto@v0.47.0 | |
| cve: GO-2026-5005 | |
| binary: /home/klipper-helm/.local/share/helm/plugins/helm-mapkubeapis/bin/mapkubeapis | |
| packages: golang.org/x/crypto/ssh/agent (package) | |
| vex: vulnerable_code_not_present [pclntab] |
ihcsim
/ gomod-vex-report.txt
Created
August 3, 2026 05:21
gomod-vex image report for docker.io/rancher/rke2-runtime:v1.36.3-rc5-rke2r1,docker.io/rancher/hardened-kubernetes:v1.36.3-rke2r1-build20260723,docker.io/rancher/hardened-coredns:v1.14.6-build20260722,docker.io/rancher/hardened-cluster-autoscaler:v1.10.3-build20260717,docker.io/rancher/hardened-dns-node-cache:1.26.8-build20260722,docker.io/ranch…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| gomod-vex report (image) for docker.io/rancher/rke2-runtime:v1.36.3-rc5-rke2r1 | |
| module: golang.org/x/crypto | |
| summary: 1 not_present, 0 not_in_execute_path, 1 linked, 0 reachable, 0 undetermined | |
| [LINKED] golang.org/x/crypto@v0.53.0 | |
| cve: GO-2026-5932 | |
| binary: /bin/containerd (stripped) | |
| packages: golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) |
ihcsim
/ gomod-vex-report.json
Created
August 3, 2026 04:46
gomod-vex image report for docker.io/rancher/klipper-helm:v0.11.1-build20260615,docker.io/rancher/klipper-lb:v0.4.17,docker.io/rancher/local-path-provisioner:v0.0.36,docker.io/rancher/mirrored-coredns-coredns:1.14.4,docker.io/rancher/mirrored-library-busybox:1.37.0,docker.io/rancher/mirrored-library-traefik:3.7.4,docker.io/rancher/mirrored-metri…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [ | |
| { | |
| "target": "docker.io/rancher/klipper-helm:v0.11.1-build20260615", | |
| "mode": "image", | |
| "module": "golang.org/x/crypto", | |
| "findings": [ | |
| { | |
| "binary": "/home/klipper-helm/.local/share/helm/plugins/helm-mapkubeapis/bin/mapkubeapis", | |
| "module": "golang.org/x/crypto", | |
| "version": "v0.47.0", |