{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://daemez.com/security/vex/itraze.openvex.json",
  "author": "security@daemez.com",
  "role": "Security Officer, Daemez Solucions S.L.",
  "timestamp": "2026-09-03T14:00:00Z",
  "version": 12,
  "tooling": "Customer-facing OpenVEX for daemez.io/x/itraze, authored in x/compliance and published at https://daemez.com/security/vex/itraze.openvex.json. Scope (recorder model, 2026-09-01): statements a customer scanner needs - base-OS findings assessed not_affected with their verification and machine guard, and module-level advisories whose code is not present in the shipped binary. Findings inside our own binary are never dispositioned: they are fixed, and the evidence of a fix is the committed scan delta in the product repo release record (present in the last served digest, absent in the new), not a VEX statement. v11 removed every digest-pinned statement (v4-v10: one affected on 0.84.1, fixed statements re-pinned across four voided release takes); the ledger of what affected which digest lives in products/itraze/vulnerability-dispositions.md. Version jumps in this file are documented there. v12 adds the openssl and util-linux findings first seen on the 0.84.3 scan, dispositioned from a structural check run inside the served image (commands and output recorded as evidence in the release record); the check is re-run per release and an image that links a util-linux library or spawns a program voids these statements.",
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2026-13221"
      },
      "products": [
        {
          "@id": "pkg:oci/itraze?repository_url=daemez.io/x",
          "subcomponents": [
            {
              "@id": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "perl-base is a Debian essential package (dpkg Essential=yes) that apt cannot remove. Nothing executes it: ENTRYPOINT is the Go binary, no shell scripts, no cron, no hooks. Exploitation would require code already running inside the container."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-12087"
      },
      "products": [
        {
          "@id": "pkg:oci/itraze?repository_url=daemez.io/x",
          "subcomponents": [
            {
              "@id": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "As CVE-2026-13221: perl is never executed in this image."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-48959"
      },
      "products": [
        {
          "@id": "pkg:oci/itraze?repository_url=daemez.io/x",
          "subcomponents": [
            {
              "@id": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "As CVE-2026-13221: perl is never executed in this image."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-48962"
      },
      "products": [
        {
          "@id": "pkg:oci/itraze?repository_url=daemez.io/x",
          "subcomponents": [
            {
              "@id": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "As CVE-2026-13221: perl is never executed in this image."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54874"
      },
      "products": [
        {
          "@id": "pkg:oci/itraze?repository_url=daemez.io/x",
          "subcomponents": [
            {
              "@id": "pkg:deb/debian/openssl@3.0.20-1~deb12u2"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "openssl is present only as a dependency of ca-certificates. ldd /usr/local/bin/itraze resolves libc.so.6 and ld-linux only; the binary contains no libssl/libcrypto reference; no dlopen'd shared objects exist in the image; Go's crypto/tls is pure Go. The library is never loaded."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-63072"
      },
      "products": [
        {
          "@id": "pkg:oci/itraze?repository_url=daemez.io/x",
          "subcomponents": [
            {
              "@id": "pkg:deb/debian/openssl@3.0.20-1~deb12u2"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "As CVE-2026-54874: libssl/libcrypto are never loaded."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-63076"
      },
      "products": [
        {
          "@id": "pkg:oci/itraze?repository_url=daemez.io/x",
          "subcomponents": [
            {
              "@id": "pkg:deb/debian/openssl@3.0.20-1~deb12u2"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "As CVE-2026-54874: libssl/libcrypto are never loaded."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54063"
      },
      "products": [
        {
          "@id": "pkg:oci/itraze?repository_url=daemez.io/x",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com/xuri/excelize/v2@v2.6.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "DoS on OPENING a crafted XLSX (unbounded allocation in checkSheet). iTraze only WRITES spreadsheets (pkg/export/excel.go: NewFile, SetCellValue, NewStyle); no OpenFile/OpenReader call in the tree, no XLSX upload endpoint. Structural — re-verify the grep at every bump; the statement is withdrawn the day a reader is added."
    },
    {
      "vulnerability": {
        "name": "GO-2026-5932"
      },
      "products": [
        {
          "@id": "pkg:oci/itraze?repository_url=daemez.io/x",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org/x/crypto"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "The advisory covers golang.org/x/crypto/openpgp, an unmaintained package with no fixed version. openpgp is not in the shipped binary — three independent proofs: (1) the binary's own function table (pclntab) lists 40,328 functions, none from openpgp, and the byte string 'openpgp' appears nowhere in the file; the x/crypto packages present match `go list -deps` exactly; (2) govulncheck source-mode call-graph analysis reports no calls; (3) controlled reproduction shows govulncheck binary mode on a `-s -w` stripped binary degrades to module-level precision and, for symbol-less advisories, prints placeholder 'symbols' synthesized from the advisory's package list (x/vuln internal/vulncheck/binary.go, golang/go#57764; present through v1.4.0). Auditor note: scans of the shipped (stripped) binaries show this artifact — govulncheck -mode=binary WILL print 'Vulnerable symbols found'; the release evidence scans unstripped twins (twin-witness gated) and is symbol-precise. Guard: govulncheck source mode runs in every scan and release — an openpgp import anywhere starts reporting immediately.",
      "timestamp": "2026-09-01T00:30:00Z"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-75803"
      },
      "products": [
        {
          "@id": "pkg:oci/itraze?repository_url=daemez.io/x",
          "subcomponents": [
            {
              "@id": "pkg:deb/debian/openssl@3.0.20-1~deb12u2"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The openssl package is present only as a dependency of ca-certificates. Verified on the served digest 672ea68cb17b (2026-09-03): `ldd` on the shipped binary lists libc, the loader and vdso only — no libssl or libcrypto; an image-wide `find / -xdev` + `ldd` sweep shows libssl/libcrypto referenced by nothing except the openssl program, libssl itself and its own engine/module objects; ENTRYPOINT is the Go binary as uid 65532 with no init, cron or supervisor, and `update-ca-certificates` runs only at image build time. The vulnerable code is present in the image and never executed.",
      "timestamp": "2026-09-03T14:00:00Z"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-78408"
      },
      "products": [
        {
          "@id": "pkg:oci/itraze?repository_url=daemez.io/x",
          "subcomponents": [
            {
              "@id": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "util-linux is Debian Essential and cannot be removed from bookworm-slim. Verified on the served digest 672ea68cb17b (2026-09-03), both halves of the claim: no util-linux PROGRAM is executed — ENTRYPOINT is the Go binary, the source at tag v0.84.3 contains no `exec.Command`/`exec.LookPath`/`syscall.Exec`, and no init, cron or supervisor runs (the base image's cron and init.d files exist but nothing runs them); and no util-linux LIBRARY is loaded — `ldd` on the shipped binary shows libc only, and an image-wide sweep finds libuuid/libblkid/libmount/libsmartcols referenced solely by util-linux and e2fsprogs programs, never by our binary. The vulnerable code is present in the image and never executed.",
      "timestamp": "2026-09-03T14:00:00Z"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-78409"
      },
      "products": [
        {
          "@id": "pkg:oci/itraze?repository_url=daemez.io/x",
          "subcomponents": [
            {
              "@id": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "util-linux is Debian Essential and cannot be removed from bookworm-slim. Verified on the served digest 672ea68cb17b (2026-09-03), both halves of the claim: no util-linux PROGRAM is executed — ENTRYPOINT is the Go binary, the source at tag v0.84.3 contains no `exec.Command`/`exec.LookPath`/`syscall.Exec`, and no init, cron or supervisor runs (the base image's cron and init.d files exist but nothing runs them); and no util-linux LIBRARY is loaded — `ldd` on the shipped binary shows libc only, and an image-wide sweep finds libuuid/libblkid/libmount/libsmartcols referenced solely by util-linux and e2fsprogs programs, never by our binary. The vulnerable code is present in the image and never executed.",
      "timestamp": "2026-09-03T14:00:00Z"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-78410"
      },
      "products": [
        {
          "@id": "pkg:oci/itraze?repository_url=daemez.io/x",
          "subcomponents": [
            {
              "@id": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "util-linux is Debian Essential and cannot be removed from bookworm-slim. Verified on the served digest 672ea68cb17b (2026-09-03), both halves of the claim: no util-linux PROGRAM is executed — ENTRYPOINT is the Go binary, the source at tag v0.84.3 contains no `exec.Command`/`exec.LookPath`/`syscall.Exec`, and no init, cron or supervisor runs (the base image's cron and init.d files exist but nothing runs them); and no util-linux LIBRARY is loaded — `ldd` on the shipped binary shows libc only, and an image-wide sweep finds libuuid/libblkid/libmount/libsmartcols referenced solely by util-linux and e2fsprogs programs, never by our binary. The vulnerable code is present in the image and never executed.",
      "timestamp": "2026-09-03T14:00:00Z"
    }
  ]
}