From 345cc88e0a8f39a8456c6ffda5dd35b4584e5647 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Wed, 19 Aug 2026 10:23:56 +0200 Subject: [PATCH 1/2] fix: ignore CVE-2026-69246 for 10.16.4 and 11.0.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Docker CI has been red on master since the 2026-08-09 nightly. The Trivy scan step fails on GHSA-v5mv-p594-2x33 / CVE-2026-69246, "Guzzle: Noncanonical host can bypass host-based checks" (HIGH, CVSS 7.2), published 2026-08-03 -- one day after the last green run on 2026-08-02. Nothing in this repo changed; the new advisory simply started matching the guzzlehttp/guzzle copies vendored inside the pinned ownCloud release tarballs. The scan runs with severity HIGH,CRITICAL and exit-code 1, so the step exits 1 and matrix fail-fast cancels the sibling job. That is why only the 10.16.4 job ever reported a failure while the 11.0.0 job showed up as cancelled. 10.16.4 hits the CVE in four bundles: lib/composer (core) 7.10.0 apps/graphapi 7.4.5 apps/files_external_dropbox 7.8.1 updater 7.9.2 11.0.0 is also affected, which the cancelled job had never revealed. Its core lib already ships the fixed 7.15.2, but apps/files_external_dropbox vendors 7.15.1, so it would have gone red as soon as 10.16.4 stopped shadowing it. Verified by extracting the composer installed.json files from the pinned v11.0.0 tarball. Both matrix entries therefore need the ignore, not just 10.16.4. ignore-unfixed does not help here: the CVE is fixed upstream in 7.15.2 and 8.0.1, just not in ownCloud's bundle. Since this repo builds from an immutable, tag-pinned release tarball it cannot bump the vendored library, so the ignore follows the existing precedent in these files for GHSA-27qh-8cxx-2cr5 (aws-sdk-php) and CVE-2026-44167. The comments record the affected bundles and versions so the entries can be dropped once ownCloud ships the bump. This is a first mitigation to get the pipeline moving again, not a fix. The advisory is a genuine host-check bypass, exploitable where an application builds a request URI from untrusted input and makes a host decision before handing it to Guzzle. The intent is to carry the guzzle bump in a 10.16.5. There is currently no issue or PR in the owncloud org tracking it. Note the suppression itself could not be verified locally: the local Trivy vulnerability DB is frozen at 2026-06-05, two months before this CVE was published, so it does not know the ID at all. Both files were confirmed to parse under trivy --ignorefile and to satisfy the editorconfig lint; the green CI run on this PR is the actual verification. Co-Authored-By: Claude Opus 5 Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- v22.04/10.16.4/.trivyignore | 4 ++++ v24.04/11.0.0/.trivyignore | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/v22.04/10.16.4/.trivyignore b/v22.04/10.16.4/.trivyignore index 5974b17a..932598e8 100644 --- a/v22.04/10.16.4/.trivyignore +++ b/v22.04/10.16.4/.trivyignore @@ -6,3 +6,7 @@ GHSA-27qh-8cxx-2cr5 # fixed in oc 10.16.3, but still a false positive in the openidconnect app CVE-2026-44167 + +# fix requires ownCloud to update bundled guzzlehttp/guzzle (-> 7.15.2) in core lib +# (7.10.0), graphapi (7.4.5), files_external_dropbox (7.8.1) and updater (7.9.2) +CVE-2026-69246 diff --git a/v24.04/11.0.0/.trivyignore b/v24.04/11.0.0/.trivyignore index 91164a26..7f414f6b 100644 --- a/v24.04/11.0.0/.trivyignore +++ b/v24.04/11.0.0/.trivyignore @@ -1,2 +1,6 @@ # vulnerability is affecting windows only CVE-2024-51736 + +# fix requires ownCloud to update bundled guzzlehttp/guzzle (7.15.1 -> 7.15.2) in +# files_external_dropbox; core lib already ships the fixed 7.15.2 +CVE-2026-69246 From 78ebfbf0ad62a969c40ca9fc3d4f76c567525cde Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Wed, 19 Aug 2026 10:33:32 +0200 Subject: [PATCH 2/2] fix: ignore CVE-2026-54133 for 10.16.4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The guzzle ignore turned all four affected targets green, but the Trivy scan still fails, now on a second and unrelated advisory that reached the scanner's DB in the meantime: GHSA-pcw8-m77r-2528 / CVE-2026-54133, "jmespath.php has CompilerRuntime code injection via unescaped function names" (CRITICAL, CVSS 9.8), published 2026-08-18 20:16 UTC -- three hours before yesterday's failing run, whose DB had not yet picked it up. It matches mtdowling/jmespath.php 2.8.0, pulled in by the aws-sdk-php 3.337.3 that files_primary_s3 vendors. Only 10.16.4 is affected: 11.0.0 ships aws-sdk-php 3.388.9 with jmespath.php 2.9.2, already above the fixed 2.9.1, so its ignore file is deliberately left alone. Despite the 9.8 score the finding is not reachable in this image: - JmesPath\Env::createRuntime() returns the unaffected AstRuntime unless the JP_PHP_COMPILE environment variable is set. It is set nowhere in the Dockerfiles or overlays, so reaching the vulnerable CompilerRuntime at all requires an operator to inject it deliberately. - Every search() call site in the bundled SDK passes an SDK-internal literal or a service-model-derived expression -- 'Parts[0].Size', waiter acceptor arguments, paginator output tokens -- never caller input, let alone attacker input. - The advisory itself states the default AstRuntime "is not affected unless JP_PHP_COMPILE is enabled", and that the searched data document alone is insufficient: the attacker must control the expression string. The comment in the ignore file records that reasoning so the entry is not mistaken for a blanket suppression of a critical. The real fix is the same one the neighbouring GHSA-27qh-8cxx-2cr5 entry is already waiting on: ownCloud updating the bundled aws-sdk-php, which 11.0.0 has done and 10.16.x has not. Worth flagging separately: two independent new CVEs have now landed against dependencies frozen inside a tag-pinned tarball within twelve hours of each other, and each one takes the whole publish pipeline down until an ignore is added by hand. That cadence is a property of gating publishes on a scanner whose input this repo cannot change, and it will recur. Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- v22.04/10.16.4/.trivyignore | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/v22.04/10.16.4/.trivyignore b/v22.04/10.16.4/.trivyignore index 932598e8..b1d14817 100644 --- a/v22.04/10.16.4/.trivyignore +++ b/v22.04/10.16.4/.trivyignore @@ -10,3 +10,10 @@ CVE-2026-44167 # fix requires ownCloud to update bundled guzzlehttp/guzzle (-> 7.15.2) in core lib # (7.10.0), graphapi (7.4.5), files_external_dropbox (7.8.1) and updater (7.9.2) CVE-2026-69246 + +# not reachable in this image: mtdowling/jmespath.php 2.8.0 in files_primary_s3 is +# only vulnerable via CompilerRuntime, which Env::createRuntime() selects solely when +# JP_PHP_COMPILE is set (it is not), and the bundled aws-sdk-php passes only its own +# literal expressions -- never user input. Fix requires ownCloud to update bundled +# aws-sdk-php (3.337.3 -> 3.388.9, which carries jmespath.php 2.9.2) +CVE-2026-54133