Merge pull request #11 from mlimardo1984/msr4-trivy

Add Advisory 0014 (MSR4 Trivy Vuln)

Author: mlimardo1984

advisories/0014.md

@@ -0,0 +1,29 @@
+# Mirantis Secure Registry 4 and CVE-2026-33634: Not Vulnerable
+
+### Release Date
+2026-03-26
+
+### Overview
+In March 2026, a supply chain compromise was identified within the Trivy ecosystem, where malicious actors gained unauthorized access to the release pipeline. This resulted in the publication of compromised Trivy binaries (v0.69.4, v0.69.5, and v0.69.6) and the poisoning of associated GitHub Action tags. These malicious versions contained code designed to exfiltrate credentials from CI/CD environments. 
+
+Mirantis has verified that **Mirantis Secure Registry (MSR) 4** does not utilize any of the compromised Trivy versions. MSR 4 releases are built using stable, verified versions of Trivy that predate the incident, ensuring the integrity of the registry's internal vulnerability scanning engine.
+
+### Unaffected Products
+**No versions of MSR 4 (Mirantis Secure Registry) are affected by CVE-2026-33634.** Internal audits of the dependency tree for all MSR 4 branches confirm that the software remains on secure, non-compromised versions of the scanning binary. Security scanners or automated dependency trackers may flag the presence of Trivy as a general category; however, MSR 4 specifically utilizes versions released prior to the window of compromise.
+
+* **MSR 4.13.0:** Utilizes Trivy **v0.69.3** (Unaffected).
+* **MSR 4.0.0:** Utilizes Trivy **v0.52.2** (Unaffected).
+
+### Vulnerability Information
+
+**CVE Identifier** [CVE-2026-33634](https://nvd.nist.gov/vuln/detail/CVE-2026-33634), [GHSA-69fq-xp46-6x23](https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23)
+
+**CVSSv3.1** 9.8 (Critical) `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
+
+**CWEs** CWE-506 (Embedded Malicious Code), CWE-912 (Managed Third-Party Compromise)
+
+### Disclosure Timeline
+* **2026-03-17:** Trivy v0.69.4 is released with unauthorized malicious code injected into the binary.
+* **2026-03-19:** The vulnerability is publicly disclosed; malicious versions (v0.69.4 - v0.69.6) are pulled from distribution.
+* **2026-03-20:** Mirantis begins an impact analysis of MSR product utilizing the Trivy scanning engine.
+* **2026-03-22:** Analysis confirms that MSR 4.13 and MSR 4.0 utilize Trivy v0.69.3 and v0.52.2, respectively, and were never updated to the compromised versions.

advisories/advisories.md

@@ -1,5 +1,6 @@
 ## Security Advisories
 
+* [0014](/advisories/0014.md): Mirantis Secure Registry 4 and CVE-2026-33634: Not Vulnerable
 * [0013](/advisories/0013.md): Mirantis Container Products and CVE-2024-41110: Not Vulnerable
 * [0012](/advisories/0012.md): Mirantis Container Products and CVE-2024-3094: Not Vulnerable
 * [0011](/advisories/0011.md): Mirantis Kubernetes Engine (MKE) and CVE-2024-21626: Understanding the Potential Impact and Mitigation