Advisory for zellij package: GHSA-c2f5-jxjv-2hh8 (#11060)

* Add advisory for zellij package, related to wasmtime dependency: GHSA-c2f5-jxjv-2hh8. This relates to windows and thus is not affected. Signed-off-by: Mark McCormick <[email protected]> * fix typo in timestamp Signed-off-by: Mark McCormick <[email protected]> --------- Signed-off-by: Mark McCormick <[email protected]>
wolfi-dev · Jan 2, 2025 · f22fb2d · f22fb2d
1 parent 03688b9
commit f22fb2d
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1,2 @@
+
+.codegpt
diff --git a/zellij.advisories.yaml b/zellij.advisories.yaml
@@ -217,6 +217,16 @@ advisories:
             componentType: rust-crate
             componentLocation: /usr/bin/zellij
             scanner: grype
+      - timestamp: 2025-01-02T11:05:49Z
+        type: false-positive-determination
+        data:
+          type: vulnerable-code-not-included-in-package
+          note: |
+            This vulnerability relates to the 'wasmtime' dependency, used by zellij.
+            This only affects windows. zellij does not support windows, and neither does our Chainguard package builds.
+            Upstream maintainers are working at upgrading this dependency in any event. Ref:
+             - https://github.com/advisories/GHSA-c2f5-jxjv-2hh8
+             - https://github.com/zellij-org/zellij/pull/3902#issuecomment-2565894058
 
   - id: CGA-wwr7-2chc-98v2
     aliases: