OCPBUGS-92747: CVE-2026-46597 openshift4/ose-console: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs [openshift-4.15.z]

.work/compliance/analyze-cve/CVE-2026-13149/jira-comment-template.md

@@ -0,0 +1,109 @@
+### CVE-2026-13149 Impact Analysis — OpenShift Console {BRANCH}
+
+**Risk Assessment: LOW RISK** ⚠️
+
+Full independent analysis for OpenShift Console on {BRANCH}.
+
+---
+
+#### Repository Details
+- Component: openshift/console
+- Repository: https://github.com/openshift/console
+- Branch: {BRANCH}
+- Commit: {COMMIT}
+- Vulnerable dependency: brace-expansion (npm, transitive via minimatch/glob)
+- Patched versions: 1.x >= 1.1.16 | 2.x >= 2.1.2 | 5.x >= 5.0.7
+
+---
+
+#### Installed Vulnerable Versions
+
+| Installed | Range | Patched | Via |
+|-----------|-------|---------|-----|
+| {1.x VERSION} | 1.x | >= 1.1.16 | minimatch 3.1.5 |
+| {2.x VERSION or N/A} | 2.x | >= 2.1.2 | minimatch 9.0.9 |
+| {5.x VERSION} | 5.x | >= 5.0.7 | minimatch 10.2.5 |
+
+---
+
+#### Evidence 1: Source Code Import Analysis
+
+No direct imports of brace-expansion or minimatch in any production source code:
+
+```
+$ grep -rn "brace-expansion\|minimatch" frontend/packages/*/src/
+(no results)
+```
+
+glob is imported in 3 build-time-only files:
+- console-dynamic-plugin-sdk/src/utils/dynamic-module-parser.ts (webpack build tool)
+- console-dynamic-plugin-sdk/src/webpack/ConsoleRemotePlugin.ts (webpack plugin)
+- console-plugin-sdk/src/codegen/plugin-resolver.ts (codegen utility)
+
+All are Node.js build tools. None are included in the browser bundle.
+
+---
+
+#### Evidence 2: Glob Pattern Analysis (User Input Reachability)
+
+All glob patterns are hardcoded static strings — no user-controlled input reaches brace-expansion:
+
+| File | Pattern | User Input? |
+|------|---------|-------------|
+| dynamic-module-parser.ts | `${basePath}/${dynamicModuleDir}/**/package.json` | No — fixed filesystem paths |
+| ConsoleRemotePlugin.ts | `${baseDir}/node_modules/@patternfly/react-styles/**/*.css` | No — process.cwd() |
+| plugin-resolver.ts | `packages/*/package.json` | No — literal constant |
+
+None of these patterns contain brace expansion syntax ({a,b}). Only * and ** glob wildcards are used.
+
+---
+
+#### Evidence 3: Runtime Exposure Check
+
+- Browser bundle: brace-expansion is NOT included in the webpack browser bundle. All consumers are Node.js-only build tools.
+- Go backend: No reference to brace-expansion, minimatch, or glob in pkg/ or cmd/.
+
+```
+$ grep -rn "brace.expansion\|minimatch" pkg/ cmd/
+(no results)
+```
+
+---
+
+#### Evidence 4: Attack Vector Assessment
+
+CVE-2026-13149 requires an attacker to supply a crafted brace pattern (e.g., a{},{},{},{}...) to the expand() function. This is not possible because:
+
+1. All usage is build-time only — runs during yarn build, not at runtime in the browser
+2. All glob patterns are hardcoded string literals — no user-controlled input
+3. An attacker would need access to the CI/CD build system to exploit this
+
+---
+
+#### Risk Classification: LOW RISK ⚠️
+
+**Why LOW:**
+- Vulnerable versions ARE present in the dependency tree
+- BUT all usage is confined to build-time tooling (webpack plugins, linting, codegen)
+- No browser runtime exposure — code is never bundled into the served application
+- No user-controlled input reaches any glob/minimatch/brace-expansion call
+- Attack vector (AV:N) does not apply — build tooling is not network-accessible to end users
+- Production exploitability: NONE
+
+---
+
+#### Recommendation
+**Action:** Update brace-expansion to patched versions for compliance, not active threat mitigation.
+```
+# Add to frontend/package.json "resolutions":
+"brace-expansion@^1": "1.1.16"
+"brace-expansion@^2": "2.1.2"
+"brace-expansion@^5": "5.0.7"
+
+yarn install
+```
+**Priority:** Normal — update in next regular maintenance cycle.
+
+---
+
+**Analysis methodology:** npm dependency analysis + source code import tracing + runtime exposure check + attack vector assessment

.work/compliance/analyze-cve/CVE-2026-13149/report.md

@@ -0,0 +1,170 @@
+# CVE-2026-13149 Impact Analysis — OpenShift Console (release-4.22)
+
+## Executive Summary
+
+**Risk Level: LOW** — Vulnerable versions of `brace-expansion` are present as transitive dependencies, but all usage is confined to build-time tooling. No user-controlled input can reach the vulnerable `expand()` function. The vulnerability is **not exploitable at runtime**.
+
+**Recommendation:** Update `brace-expansion` to patched versions for compliance. No urgent action needed.
+
+---
+
+## CVE Context
+
+| Field | Value |
+|-------|-------|
+| **CVE ID** | CVE-2026-13149 |
+| **GHSA** | GHSA-3jxr-9vmj-r5cp |
+| **Package** | brace-expansion (npm) |
+| **Type** | Denial of Service (ReDoS-like exponential recursion) |
+| **CVSS v4.0** | 7.7 (High) |
+| **CWE** | CWE-400 (Uncontrolled Resource Consumption) |
+| **Attack Vector** | Network (AV:N), No privileges (PR:N), No user interaction (UI:N) |
+| **Impact** | Availability only (DoS) |
+
+### Patched Versions (from GHSA)
+
+| Version Range | Patched |
+|---------------|---------|
+| 1.x | >= 1.1.16 |
+| 2.x | >= 2.1.2 |
+| 5.x | >= 5.0.7 |
+
+### Vulnerability Details
+
+The `expand()` function in brace-expansion makes unconditional recursive calls before checking whether a brace pattern would produce output. Input like `a{},{},{}` causes O(2^n) recursion — ~90 bytes / 30 groups can block a thread for minutes. The `max` option only caps output size, not recursion depth.
+
+---
+
+## Repository Details
+
+| Field | Value |
+|-------|-------|
+| Component | OpenShift Console |
+| Repository | github.com/openshift/console |
+| Branch | release-4.22 |
+| Commit | 314b59ab95 |
+
+---
+
+## Dependency Analysis
+
+### Installed Versions (ALL VULNERABLE)
+
+| Installed Version | Required By | Patched Version | Status |
+|-------------------|------------|-----------------|--------|
+| **1.1.12** | minimatch 3.1.5 | >= 1.1.16 | VULNERABLE |
+| **2.1.0** | minimatch 9.0.9 | >= 2.1.2 | VULNERABLE |
+| **5.0.5** | minimatch 10.2.5 | >= 5.0.7 | VULNERABLE |
+
+### Dependency Chain
+
+```
+brace-expansion ← minimatch ← glob/eslint/webpack-plugins (all dev/build tools)
+```
+
+**Full minimatch consumers** (all build-time/dev tools):
+- eslint, eslint-plugin-import, eslint-plugin-node (linting)
+- @graphql-codegen/cli, graphql-config (code generation)
+- fork-ts-checker-webpack-plugin, html-webpack-skip-assets-plugin (webpack build)
+- glob 7.x, 10.x, 13.x (file system patterns)
+- test-exclude (test tooling)
+- jake, filelist, walk-sync, matcher-collection (build/task tooling)
+
+---
+
+## Evidence 1: Source Code Import Analysis
+
+**No direct imports** of `brace-expansion` or `minimatch` found in any production source code:
+
+```bash
+$ grep -rn "brace-expansion\|minimatch" frontend/packages/*/src/ frontend/public/
+(no results)
+```
+
+`glob` is imported in 3 files — all build-time tooling:
+
+| File | Purpose | Runtime? |
+|------|---------|----------|
+| `console-dynamic-plugin-sdk/src/utils/dynamic-module-parser.ts` | Parses PatternFly dynamic modules during webpack build | **No** — Node.js build tool |
+| `console-dynamic-plugin-sdk/src/webpack/ConsoleRemotePlugin.ts` | Webpack plugin for dynamic plugin federation | **No** — webpack plugin |
+| `console-plugin-sdk/src/codegen/plugin-resolver.ts` | Resolves monorepo plugin packages at build time | **No** — Node.js codegen |
+
+---
+
+## Evidence 2: Glob Pattern Analysis (User Input Reachability)
+
+All glob patterns are **hardcoded static strings** — no user-controlled input reaches `brace-expansion`:
+
+| Location | Glob Pattern | User Input? |
+|----------|-------------|-------------|
+| `dynamic-module-parser.ts:80` | `` `${basePath}/${dynamicModuleDir}/**/package.json` `` | **No** — basePath is a filesystem path, dynamicModuleDir defaults to `dist/dynamic` |
+| `ConsoleRemotePlugin.ts:54` | `` `${baseDir}/node_modules/@patternfly/react-styles/**/*.css` `` | **No** — baseDir is `process.cwd()` |
+| `plugin-resolver.ts:11` | `packages/*/package.json` | **No** — literal constant |
+
+None of these patterns contain brace expansion syntax (`{a,b}`). They use only `*` and `**` glob wildcards.
+
+---
+
+## Evidence 3: Runtime Exposure Check
+
+**Browser bundle:** `brace-expansion` is NOT included in the webpack browser bundle. All consumers are Node.js-only build tools (webpack plugins, codegen, linting).
+
+**Go backend:** No reference to `brace-expansion`, `minimatch`, or `glob` in `pkg/` or `cmd/`.
+
+```bash
+$ grep -rn "brace.expansion\|minimatch\|from 'glob'" pkg/ cmd/
+(no results)
+```
+
+---
+
+## Evidence 4: Attack Vector Assessment
+
+The CVE requires an attacker to supply a crafted brace pattern (e.g., `a{},{},{},{}...`) to the `expand()` function. For this to be exploitable:
+
+1. **The vulnerable code must run in a context accepting network input** — It does NOT. All usage is build-time only.
+2. **User input must reach the glob/minimatch pattern** — It does NOT. All patterns are hardcoded string literals.
+3. **The code must run during normal application operation** — It does NOT. It only runs during `yarn build` on the build server.
+
+---
+
+## Risk Classification: LOW RISK
+
+**Why LOW (not HIGH or CRITICAL):**
+- Vulnerable versions ARE present in the dependency tree (3 versions)
+- BUT all usage is confined to **build-time tooling** (webpack plugins, linting, codegen)
+- **No browser runtime exposure** — code is never bundled into the served application
+- **No user-controlled input** reaches any glob/minimatch/brace-expansion call
+- All glob patterns are **static string literals** with no brace expansion syntax
+- Attack vector (AV:N) does not apply — build tooling is not network-accessible to end users
+
+**Exploitability in production: NONE**
+- An attacker would need access to the CI/CD build system AND the ability to modify source code glob patterns
+- At that point, the attacker already has far more powerful attack vectors available
+
+---
+
+## Recommendation
+
+**Action:** Update `brace-expansion` to patched versions for **compliance** purposes, not for active threat mitigation.
+
+```bash
+cd frontend
+
+# Option 1: Add resolutions to package.json to force patched versions
+# In frontend/package.json "resolutions" field:
+#   "brace-expansion@^1": "1.1.16"
+#   "brace-expansion@^2": "2.1.2"
+#   "brace-expansion@^5": "5.0.7"
+
+# Then regenerate lockfile:
+yarn install
+```
+
+**Priority:** Normal — update in next regular maintenance cycle.
+
+---
+
+**Analysis methodology:** Source code import analysis + glob pattern analysis + runtime exposure check + attack vector assessment
+
+**Note:** This is an npm (JavaScript) vulnerability, not a Go vulnerability. The standard Go-focused quad-verification methodology (govulncheck + call graph + vendor check) does not apply. Analysis was performed using JavaScript/Node.js-appropriate methods: dependency chain tracing, source code import analysis, bundle inclusion analysis, and attack surface assessment.

.work/compliance/analyze-cve/CVE-2026-44289/jira-comment-template.md

@@ -0,0 +1,110 @@
+### CVE-2026-44289 Complete Analysis ✅
+
+**Risk Assessment: LOW RISK** ⚠️
+
+Full independent analysis with comprehensive evidence for OpenShift Console OCP {VERSION}.
+
+---
+
+#### Repository Details
+- **Component:** openshift/console
+- **Repository:** github.com/openshift/console
+- **Branch:** release-{VERSION}
+- **Commit:** {COMMIT}
+- **Vulnerable dependency:** protobufjs 6.10.2 (npm, transitive)
+- **Fixed version:** 7.5.6 / 8.0.2 (no 6.x patch — GHSA-685m-2w69-288q)
+
+---
+
+#### Evidence 1: Dependency Version Check
+
+```
+protobufjs@6.10.2 resolved in frontend/yarn.lock
+Affected range: all versions <= 7.5.5
+Status: VULNERABLE (6.10.2 < 7.5.6)
+
+Dependency chain:
+  openshift-console@0.0.0
+    └── gherkin-lint@4.1.3        (production dep, functionally dev-only CLI tool)
+        └── gherkin@9.0.0
+            └── cucumber-messages@8.0.0
+                └── protobufjs@6.10.2   ← VULNERABLE
+```
+
+protobufjs is a deep transitive dependency of `gherkin-lint`, a CLI tool for linting Gherkin/BDD feature files. It is not a direct dependency of the application.
+
+---
+
+#### Evidence 2: Production Bundle Analysis
+
+```bash
+$ grep -rl "protobufjs" frontend/public/dist/ | wc -l
+0
+```
+
+✅ protobufjs is **NOT present** in any production browser bundle. The OpenShift Console ships as webpack-compiled JavaScript bundles; protobufjs is excluded from all of them.
+
+---
+
+#### Evidence 3: Source Code Usage Verification
+
+```bash
+$ grep -r "protobufjs\|from.*protobuf\|require.*protobuf" \
+    --include="*.ts" --include="*.tsx" --include="*.js" --include="*.jsx" \
+    frontend/ | grep -v node_modules | grep -v "public/dist"
+(no results)
+```
+
+✅ **No application source code** imports or uses protobufjs. The only "protobuf" references in source files are API documentation strings in kubevirt-plugin type definitions describing the Kubernetes protobuf serialization format — comments, not library usage.
+
+---
+
+#### Evidence 4: Runtime Reachability Analysis
+
+**Exploitation prerequisites (from GHSA-685m-2w69-288q):**
+- Application must decode attacker-controlled protobuf binary data
+- Crafted input must contain deeply nested protobuf structures
+
+**Console architecture analysis:**
+- ❌ Console frontend communicates with Kubernetes API via **JSON** (`application/json`), not protobuf binary
+- ❌ No gRPC endpoints, no `application/x-protobuf` handlers, no protobuf message queue consumers
+- ❌ `cucumber-messages` (the only consumer of protobufjs) is used internally by `gherkin-lint` for Gherkin AST serialization — internal IPC, never exposed to external input
+- ❌ `gherkin-lint` is invoked only as a CLI tool during development/CI, never at application runtime
+
+✅ **No runtime path** reaches protobufjs decode functions with untrusted data. Exploitation prerequisites are NOT met.
+
+---
+
+#### Risk Classification: LOW RISK ⚠️
+
+**Why LOW RISK:**
+
+All four verification methods confirm the vulnerability is not exploitable:
+
+1. **Vulnerable dependency present** — protobufjs 6.10.2 is in the dependency tree (within affected range ≤7.5.5)
+2. **Not in production bundle** — 0 files in `public/dist/` contain protobufjs code
+3. **No source code usage** — no application code imports the library
+4. **Not reachable at runtime** — only reachable via gherkin-lint CLI (dev tool), no untrusted protobuf decoding occurs
+
+The dependency exists solely as a transitive requirement of a development linting tool that was placed in `dependencies` instead of `devDependencies`.
+
+---
+
+#### Recommendation
+
+**Action:** Update as best practice for compliance — not urgent.
+
+```bash
+# Option 1: Add yarn resolutions override in frontend/package.json
+"resolutions": {
+  "protobufjs": "^7.5.6"
+}
+
+# Option 2: Move gherkin-lint to devDependencies (reduces false-positive scan noise)
+```
+
+**Priority:** Normal — no production exposure, compliance-only concern.
+
+---
+
+**Analysis methodology:** Dependency version check + production bundle analysis + source code verification + runtime reachability analysis