{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://thepeoples.io/oci/hardened/argocd/v3.5.4-tpio.3/openvex.json","author":"thepeoples.io","timestamp":"2026-10-09T23:16:59Z","version":1,"statements":[{"vulnerability":{"name":"CVE-2025-5278"},"products":[{"@id":"pkg:deb/ubuntu/coreutils@9.5-1ubuntu2%2B0.0.0~ubuntu25?arch=all&distro=ubuntu-26.04&upstream=coreutils-from%400.0.0~ubuntu25"}],"status":"not_affected","justification":"vulnerable_code_not_present","impact_statement":"Ubuntu26.04 coreutils9.5-1ubuntu2+0.0.0~ubuntu25 is a documentation-only metapackage from source coreutils-from0.0.0~ubuntu25, not GNU Coreutils9.5. Its package file list contains no executables. Active sort/uniq are rust-coreutils0.10.0; the separately installed GNU gnusort/gnuuniq are gnu-coreutils9.7-3ubuntu2.1, the fixed version for both advisories per https://ubuntu.com/security/notices/USN-8697-1. Vendor metapackage/source mapping: https://packages.ubuntu.com/resolute/coreutils and https://packages.ubuntu.com/source/resolute/utils/coreutils-from. Exact image digest sha256:0f0d36559c94d41c544d65c6ead8bd2aa7f29a9d04d9721af9dd29c2558bc2d8. Native package/source/file-list and all four binary implementation/version/ownership/SHA256 evidence document SHA256 5e03bc9ec5a4944f3432e5daf0e89904966a205ccbc84213e9b11faed0bf64ca. VEX applies only to this exact version-qualified metapackage PURL, never to gnu-coreutils or rust-coreutils. Native implementation evidence: coreutils\t9.5-1ubuntu2+0.0.0~ubuntu25\ncoreutils-from-uutils\t0.0.0~ubuntu25\ngnu-coreutils\t9.7-3ubuntu2.1\nrust-coreutils\t0.10.0-1ubuntu2~26.04.1\nsort (uutils coreutils) 0.10.0\n/usr/lib/cargo/bin/coreutils/sort\nrust-coreutils: /usr/lib/cargo/bin/coreutils/sort\nf84e76ea4da1e0c4e92254bd0d7dccdabe2c8b3098e734f27997dae3ee5d8e02  /usr/lib/cargo/bin/coreutils/sort\nuniq (uutils coreutils) 0.10.0\n/usr/lib/cargo/bin/coreutils/uniq\nrust-coreutils: /usr/lib/cargo/bin/coreutils/uniq\nf84e76ea4da1e0c4e92254bd0d7dccdabe2c8b3098e734f27997dae3ee5d8e02  /usr/lib/cargo/bin/coreutils/uniq\nsort (GNU coreutils) 9.7\n/usr/bin/gnusort\ngnu-coreutils: /usr/bin/gnusort\nb0f4d5cfb6075cdc51962cb3abc93fa76cb842e9bbeeec44189992749af8c4ea  /usr/bin/gnusort\nuniq (GNU coreutils) 9.7\n/usr/bin/gnuuniq\ngnu-coreutils: /usr/bin/gnuuniq\ne894b68944a7a807a09effb0299b40971e31e4f9ce7a28acf17bb57a7b5b0aa5  /usr/bin/gnuuniq\n"},{"vulnerability":{"name":"CVE-2026-56391"},"products":[{"@id":"pkg:deb/ubuntu/coreutils@9.5-1ubuntu2%2B0.0.0~ubuntu25?arch=all&distro=ubuntu-26.04&upstream=coreutils-from%400.0.0~ubuntu25"}],"status":"not_affected","justification":"vulnerable_code_not_present","impact_statement":"Ubuntu26.04 coreutils9.5-1ubuntu2+0.0.0~ubuntu25 is a documentation-only metapackage from source coreutils-from0.0.0~ubuntu25, not GNU Coreutils9.5. Its package file list contains no executables. Active sort/uniq are rust-coreutils0.10.0; the separately installed GNU gnusort/gnuuniq are gnu-coreutils9.7-3ubuntu2.1, the fixed version for both advisories per https://ubuntu.com/security/notices/USN-8697-1. Vendor metapackage/source mapping: https://packages.ubuntu.com/resolute/coreutils and https://packages.ubuntu.com/source/resolute/utils/coreutils-from. Exact image digest sha256:0f0d36559c94d41c544d65c6ead8bd2aa7f29a9d04d9721af9dd29c2558bc2d8. Native package/source/file-list and all four binary implementation/version/ownership/SHA256 evidence document SHA256 5e03bc9ec5a4944f3432e5daf0e89904966a205ccbc84213e9b11faed0bf64ca. VEX applies only to this exact version-qualified metapackage PURL, never to gnu-coreutils or rust-coreutils. Native implementation evidence: coreutils\t9.5-1ubuntu2+0.0.0~ubuntu25\ncoreutils-from-uutils\t0.0.0~ubuntu25\ngnu-coreutils\t9.7-3ubuntu2.1\nrust-coreutils\t0.10.0-1ubuntu2~26.04.1\nsort (uutils coreutils) 0.10.0\n/usr/lib/cargo/bin/coreutils/sort\nrust-coreutils: /usr/lib/cargo/bin/coreutils/sort\nf84e76ea4da1e0c4e92254bd0d7dccdabe2c8b3098e734f27997dae3ee5d8e02  /usr/lib/cargo/bin/coreutils/sort\nuniq (uutils coreutils) 0.10.0\n/usr/lib/cargo/bin/coreutils/uniq\nrust-coreutils: /usr/lib/cargo/bin/coreutils/uniq\nf84e76ea4da1e0c4e92254bd0d7dccdabe2c8b3098e734f27997dae3ee5d8e02  /usr/lib/cargo/bin/coreutils/uniq\nsort (GNU coreutils) 9.7\n/usr/bin/gnusort\ngnu-coreutils: /usr/bin/gnusort\nb0f4d5cfb6075cdc51962cb3abc93fa76cb842e9bbeeec44189992749af8c4ea  /usr/bin/gnusort\nuniq (GNU coreutils) 9.7\n/usr/bin/gnuuniq\ngnu-coreutils: /usr/bin/gnuuniq\ne894b68944a7a807a09effb0299b40971e31e4f9ce7a28acf17bb57a7b5b0aa5  /usr/bin/gnuuniq\n"}]}