Repository navigation
Reduce HIGH findings on clamav/clamav latest + latest_base (1 HIGH each, 0 CRITICAL — pcre2 CVE-2026-103111) #111
Description
Reduce HIGH findings on clamav/clamav (1 HIGH × 2 services, 0 CRITICAL)
Status
Open. Surfaced 2026-10-04 00:24 UTC by the weekly-pattern CI scan when the unpinned :latest/:latest_base tags drifted (September scans showed 0 HIGH). Both services are now digest-pinned in docker-compose.yaml (moved 1fdfd24c.../5a7c486f... -> 7659dcb0.../4bd75811...) so the baseline can no longer move silently.
Pin (2026-10-04, verified by direct pull + scan)
clamav/clamav:latest@sha256:7659dcb0db47941d3cf8336af84bbb63c7e70b76fc00601774358412b42ed186clamav/clamav:latest_base@sha256:4bd758114dbe0964edf6742cd8ddd98ed73eb8fcd70ce8bb4f53b19a79f07fe1
CVEs (Trivy 0.74.0, DB 2026-10-04, HIGH+CRITICAL, ignore-unfixed)
CVE-2026-103111[HIGH]pcre2@10.48-r0->10.49-r0(out-of-bounds write via crafted regular expression) — present in BOTH digests. Status: fixed in the Alpine package feed; awaiting ClamAV image rebuild.
Why NOT in .trivyignore
Deliberate: unlike #83/#84/#87 (no upstream rebuild in flight), ClamAV publishes updated images frequently and the Alpine fix already exists. Suppressing would blind the re-pin signal; the finding should stay visible until the next digest bump clears it.
Resolution path
- Watch https://hub.docker.com/r/clamav/clamav/tags (and https://github.com/Cisco-Talos/ClamAV) for a
latestrebuilt with pcre2 >= 10.49-r0; the weekly Container Image Scan workflow (pinned refs -> digest update PRs via Renovate) will surface it. - Re-pin both services to the new digests, re-scan, and update docs/container_security_scan.md + tests/test_container_security_scan.py::test_compose_clamav_digest_pinned.
Acceptance criteria
- Both clamav services re-pinned to digests with 0 HIGH / 0 CRITICAL, or
- CVE-2026-103111 becomes upstream-unfixable (then document + add to .trivyignore with reason/expiry per Track: remaining 86 HIGH (0 CRITICAL) code-scanning findings on upstream vendor images #82 rules).
Owner
TBD. Active under the scan profile (file-scanning daemon; exposure requires processing a crafted file against a crafted rule path).
Activity
chore(security): digest-pin clamav services, track pcre2 finding (#111)
JJediny commentedon Oct 4, 2026
Pins + guard test + docs shipped in the commit following this issue (#111). CI scan (push-triggered) will now scan the pinned digests directly; expect the clamav/clamav-base jobs to report exactly 1 HIGH (CVE-2026-103111) each until upstream rebuilds with pcre2 >= 10.49-r0, then a Renovate/manual re-pin clears it.
chore(security): digest-pin the grype scanner image; scan the deploye…
fix(ci): scan floating clamav tags as the #111 drift monitor (#113)
JJediny commentedon Oct 11, 2026
Re-pin signal restored: the CI matrix now scans the floating
clamav/clamav:latest+:latest_basetags (merged PR #113) while compose keeps the pinned 2026-10-04 digests as the deployment baseline. Verified 2026-10-10: registry digests are still byte-identical to our pins — upstream fix pending, as expected. Behavior from here: weekly/push scans will report the 1 HIGH (pcre2 CVE-2026-103111) per clamav job on the floating tags; the run where those jobs drop to 0 is the re-pin trigger. Then: bump compose digests + workflow, refresh docs rows 4-5, and this issue can close. 6-day recheck of alert convergence: Security tab now shows exactly one open Trivy HIGH — alert #494 (this CVE) — 43 stale Sept-13 orphans were dismissed asmitigatedwith cross-links.JJediny commentedon Oct 11, 2026
Digest re-check (2026-10-10, live
docker manifest inspect): registryclamav/clamav:latest→sha256:7659dcb0db47…and:latest_base→sha256:4bd758114dbe…— both unchanged since the 2026-10-04 pins. Upstream has not yet published the pcre2 fix (pending10.49-r0), so the wait stays correct and compose pins hold.Post-merge CI corroborates: the floating-
:latestmatrix jobs (clamav,clamav-base) in run38105001331onmainstill report the single 1 HIGH pcre2 finding each — same as the pinned deployments, no new movement. Re-pin trigger unchanged: when the floating scans drop to 0 findings, verify the candidate digest, then bump compose + matrix + guard test + docs together.