STAC-25374 VEX Jetty digest-authentication false positive

[LouisLotter]

Summary

• publish a package-scoped not_affected statement for CVE-2026-10050 / GHSA-2fvj-hgj9-j2gr
• cover pkg:maven/org.eclipse.jetty/jetty-security@9.4.60.sts1 across the HBase-derived StackGraph images, including branch *-test image names
• document the internal-first workflow: merge reviewed judgment-driven statements here, then migrate the same evidence through rancher/image-scanning

Why this is not affected

Trivy maps the advisory to org.eclipse.jetty:jetty-security:9.4.60.sts1 from the Maven metadata embedded in the HBase shaded Jetty JAR. The upstream advisory, however, identifies the vulnerable implementation as org.eclipse.jetty.client.util.DigestAuthentication.apply() in the separate jetty-client module.

hbase-thirdparty/hbase-shaded-jetty assembles an explicit set of Jetty server modules and does not depend on jetty-client. This statement is package-scoped because the vulnerable client implementation is absent from the reported jetty-security Maven component itself; the conclusion does not depend on an individual image name or registry.

Packaged-artifact evidence

Inspected the current public image quay.io/stackstate/hbase-master:2.5-8.1.11:

• amd64 manifest: sha256:71e711f7559fd03ecbb78f06f6b43c929a1391548bb203210c9312c20d625afa
• application layer containing hbase-server.tar: sha256:5834bba67881038485521a04dfe24feb3513f64b51015d473a1c19aeec6d79a5
• exact shipped artifact: hbase-shaded-jetty-4.1.14.sts.20260717.b8d71bd.jar
• total JAR entries: 1,256
• Jetty security-package entries: 64
• DigestAuthentication entries: 0
• Jetty client-package entries: 0

This proves the scanner can see the reported security package metadata while the vulnerable client code is absent.

Validation

• python3 tools/build_index.py --check
• jq empty pkg/maven/org.eclipse.jetty/jetty-security/scan.openvex.json index.json
• fresh Trivy 0.70.0 vulnerability and Java databases
• Trivy rootfs scan of the exact shaded JAR without VEX: 1 active CVE-2026-10050 finding
• the same Trivy scan with this OpenVEX document: 0 active CVE-2026-10050 findings
• current StackGraph branch CI reports no corresponding Grype finding

Follow-up

After internal review and merge, migrate the same evidence through a rancher/image-scanning issue and track the generated image-scanning and rancher/vexhub PRs to completion. The migration remains required, but it does not block StackGraph PR #44.

Tickets

• STAC-25374