api/vex/openvex.json at main · simple-container-com/api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://simple-container.com/.well-known/openvex/api.json",
  "author": "Simple Container maintainers <security@simple-container.com>",
  "timestamp": "2026-05-18T19:00:00Z",
  "version": 1,
  "tooling": "Hand-authored. Reachability evidence from `govulncheck -mode=source ./...`.",
  "statements": [
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2022-0635",
        "name": "GO-2022-0635",
        "aliases": ["CVE-2020-8911"],
        "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang. Affected symbols: github.com/aws/aws-sdk-go/service/s3/s3crypto NewDecryptionClient, NewEncryptionClient."
      },
      "products": [
        {
          "@id": "pkg:golang/github.com/simple-container-com/api",
          "subcomponents": [
            { "@id": "pkg:golang/github.com/aws/aws-sdk-go" }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "github.com/aws/aws-sdk-go is required transitively by github.com/pulumi/pulumi/pkg/v3/operations. Neither this codebase nor Pulumi's operations package imports github.com/aws/aws-sdk-go/service/s3/s3crypto. govulncheck -mode=source ./... reports 0 reachable vulnerabilities (and explicitly identifies these two advisories as 'vulnerabilities in modules you require, but your code doesn't appear to call these vulnerabilities')."
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2022-0646",
        "name": "GO-2022-0646",
        "aliases": ["CVE-2020-8912"],
        "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang. Affected symbols: github.com/aws/aws-sdk-go/service/s3/s3crypto NewDecryptionClient, NewEncryptionClient."
      },
      "products": [
        {
          "@id": "pkg:golang/github.com/simple-container-com/api",
          "subcomponents": [
            { "@id": "pkg:golang/github.com/aws/aws-sdk-go" }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Same as GO-2022-0635 — s3crypto subpackage is not imported by this codebase or by any code path Pulumi's operations package reaches. govulncheck reachability scan confirms zero reachable calls to the affected symbols."
    }
  ]
}