cbdq-io / docker-grype Goto Github PK

View Code? Open in Web Editor NEW

6.0 6.0 1.0 292 KB

Wrap Anchore Grype Inside Docker

License: Apache License 2.0

Makefile 6.44% Dockerfile 5.03% Shell 4.56% Gherkin 5.18% Python 78.80%

docker grype hacktoberfest

docker-grype's People

Contributors

Stargazers

Watchers

Forkers

deepakv81

docker-grype's Issues

GHSA-25xm-hr59-7c27

Vulnerability GHSA-25xm-hr59-7c27 was identified while working on #50.

NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High

Grype 0.24.0 Available

Describe the solution you'd like
Our image has Grype 0.23.0 installed and this should be updated.

New Version of Grype is Available

Describe the solution you'd like
In the latest version of this image 1.14.0, Gype version 0.28.0 is installed. Grype have release 0.31.1.

Additional context
https://github.com/anchore/grype/releases

Allow Generation of Missing Common Platform Enumerations

Describe the solution you'd like
Grype can optionally generate CPEs for packages that are missing them.

Describe alternatives you've considered
Having the option set as on by default, but this should probably be left to the user (as it is in the underlying Grype command).

Additional context
See https://cpe.mitre.org/about/ for notes about CPEs.

An example of an occurrence can be seen in https://github.com/cbdq-io/docker-grype/runs/7037310023?check_suite_focus=true#step:9:872

Tag Not Created During Continuous Deployment

Describe the bug
During the creation of 1.13.0 of the image, the git tag was not created as it should have been. It was subsequently completed manually.

Expected behavior
The correct tag should be created at deploy time automatically.

Additional context
The problem is in https://github.com/cbdq-io/docker-grype/blob/1.13.0/.github/workflows/cd.yml#L45

New Version of Anchore Grype

Describe the solution you'd like
A new version of Anchore Grype is available (see https://github.com/anchore/grype/releases).

CVE-2021-33574

Describe the bug
A new vulnerability has been found in our image CVE-2021-33574 specifically in libc-bin version 2.28-10.

DEBUG:Tolerance is Medium (3)
DEBUG:Grype version 0.13.0
DEBUG:Max severity level found was 4.
NAME,INSTALLED,VULNERABILITY,SEVERITY
libc-bin,2.28-10,CVE-2021-33574,High

See https://github.com/cbdq-io/docker-grype/runs/2780583554?check_suite_focus=true for the full run.

As this version of that package is the latest version available for Debian 10 (Buster), we'll have to add this vulnerability to the allowed list.

Fix "method_complexity" issue in docker-grype/pygrype/parser.py

Function report has a Cognitive Complexity of 31 (exceeds 5 allowed). Consider refactoring.

https://codeclimate.com/github/cbdq-io/docker-grype/docker-grype/pygrype/parser.py#issue_62b4c80f3ad9180001000022

CVE-2021-29921

Describe the bug
A new vulnerability has been found in our image CVE-2021-29921 specifically in libpython3.9-minimal version 3.9.2-1.

DEBUG:Tolerance is Medium (3)
DEBUG:Grype version 0.17.0
DEBUG:Max severity level found was 4.
NAME,INSTALLED,VULNERABILITY,SEVERITY
libpython3.9-minimal,3.9.2-1,CVE-2021-29921,High

See https://github.com/cbdq-io/docker-grype/runs/3482917551?check_suite_focus=true for the full run.

As this version of that package is the latest version available for Debian 11 (Bullseye), we'll have to add this vulnerability to the allowed list.

Fix "file_lines" issue in docker-grype/parse-grype-json.py

File parse-grype-json.py has 290 lines of code (exceeds 250 allowed). Consider refactoring.

https://codeclimate.com/github/cbdq-io/docker-grype/docker-grype/parse-grype-json.py#issue_62b0724a1d9a3a000100001f

Docker Login

As a user,
I should be able to provide user credentials,
So that I can login to a Docker server if required.

CVE-2021-3177

Describe the bug
The latest version of the vulnerability database (released today) has identified
CVE-2021-3177.

To Reproduce
Steps to reproduce the behaviour:

Run make

Expected behaviour
The project should build cleanly

Additional context
[CVE-2021-3177 concerned a bad implementation of the sprintf function. As we don't use that function we can safely add this vulnerability to our allowed list.

CVE-2022-29458

CI/CD pipelines failing due to CVE-2022-29458.

ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.

See https://github.com/cbdq-io/docker-grype/runs/6243314666?check_suite_focus=true

New Version of Docker Grype Available

Describe the bug
Our latest Docker image runs version 0.39.0 of Grype. This has now been superseded.

Expected behavior
The latest Grype binary is used by the software.

Additional context
https://github.com/anchore/grype/releases/tag/v0.40.0.

New Version of Anchore Grype Released

Describe the solution you'd like
We should include v0.33.1 in our deployed image (see https://github.com/anchore/grype/releases/tag/v0.33.1).

Additional context
See https://github.com/anchore/grype/releases in case there are subsequent updates.

VULNERABILITY

I misfire from my first attempt at using the gh cli tool 😵‍💫

CVE-2019-5736

Vulnerability CVE-2019-5736 was identified while working on #50.

NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High

Fix "method_complexity" issue in docker-grype/parse-grype-json.py

Function report has a Cognitive Complexity of 31 (exceeds 5 allowed). Consider refactoring.

https://codeclimate.com/github/cbdq-io/docker-grype/docker-grype/parse-grype-json.py#issue_62b0724a1d9a3a0001000020

Fix "argument_count" issue in docker-grype/parse-grype-json.py

Function add has 5 arguments (exceeds 4 allowed). Consider refactoring.

https://codeclimate.com/github/cbdq-io/docker-grype/docker-grype/parse-grype-json.py#issue_62b0724a1d9a3a000100001e

Documentation Link Broken on Docker Hub

A link to the example Docker Compose file doesn't work. Works fine in GitHub, but as it's a relative link, it doesn't work on Docker Hub.

Warn of Unnecessary Allowed Vulnerabilities

As a user,
I want to be warned if a vulnerability in the allowed list is not found during the scan,
So that I can keep the allowed list relevant.

Documentation

Provide documentation for the image. Should consist of:

Describe the options one can provide to the image (701fb44).
An example cookbook for Docker Compose (c788ca9).
A change log (35df094).

CVE-2021-20231 & CVE-2021-20232

Describe the bug
A clear and concise description of what the bug is.

Additional context

NAME	INSTALLED	VULNERABILITY	SEVERITY
libgnutls30	3.6.7-4+deb10u6	CVE-2021-20231	High
libgnutls30	3.6.7-4+deb10u6	CVE-2021-20232	High

Implement Continuous Integration

On branch pushes and merge requests, ensure tests are run in GitHub Workflow.

Describe the bug
Vulnerability report headers are showing NAME,INSTALLED,VULNERABILITY,SEVERITY but then a sample line is libcrypt,2.26-35.amzn2,ALAS-2021-1605,High,no which has an extra column (allowed) which isn't being shown in the header.

Expected behavior
The number of columns in the output lines should match the number of columns in the header.

Screenshots
The output was:

NAME,INSTALLED,VULNERABILITY,SEVERITY
libcrypt,2.26-35.amzn2,ALAS-2021-1605,High,no
libcrypt,2.26-35.amzn2,ALAS-2021-1599,High,no

Additional context
When this was observed, the following environment variables were being provided:

DOCKER_HOST
IMAGE_NAME
VULNERABILITIES_ALLOWED_LIST

Duplicate Vulnerability Reports

Describe the bug
During the extraction from the Grype XML report, we are duplicating the bug reports.

To Reproduce
Will need to setup our test data to emulate a vulnerability being found twice but reported only once.

Found in version 1.3.1.

Expected behavior
Vulnerabilities are reported only once.

Screenshots
Example output:

NAME,INSTALLED,VULNERABILITY,SEVERITY
openssl-libs,1.0.2k-19.amzn2.0.3,ALAS-2020-1573,High,no
openssl-libs,1.0.2k-19.amzn2.0.3,ALAS-2020-1573,High,no

Additional context
Add any other context about the problem here.

Implement Continuous Deployment

When there is a push to the main branch, deploy the image to Docker Hub.

Documentation Improvements

Improvements should be:

Use https://github.com/cbdq-io/docker-grype/community to add:
- A contributing guide
- Issue templates
- A code of conduct
Move the release section from the PR template to the contributing guide
Add data persistence to the README for the downloaded vulnerabilities DB
Check the volumes being used in the Docker Compose example and see if they are actually necessary.
Perhaps (clear with client first) include Drone CI (K8s pipeline) example.

CVE-2017-7297

Vulnerability CVE-2017-7297 was identified while working on #50.

NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High

Build Process Still Installs Latest Grype Version

Describe the bug
Our last release was supposed to allow us to peg to a specific release of Grype (in this cast it was 0.30.0). However our regression test failed as the installed version was the newly released 0.30.1

To Reproduce
See https://github.com/cbdq-io/docker-grype/runs/5367993691?check_suite_focus=true

Expected behavior
The release configured should be followed until we specify to pick up the new version.

Feature: As a user, I want to provide an allowed list of vulnerabilities.

User Story

As a user, I want to provide an allowed list for vulnerabilities, so that I can specify what risks are acceptable.

Acceptance Criteria

Output from the report looks similar to the Sample Output below.
When a vulnerability ID is specified in the environment variable VULNERABILITIES_ALLOWED_LIST it will not be included in the report.

Sample Output

NAME                          INSTALLED VULNERABILITY     SEVERITY   
apt                           1.8.2.2 CVE-2011-3374     Negligible  
apt-transport-https           1.8.2.2 CVE-2011-3374     Negligible

CVE-2019-13139

Vulnerability CVE-2019-13139 was identified while working on #50.

NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High

Grype has been upgraded from 0.7.0 to 0.8.0.

There is a new version of Grype and this should be tested against.

Feature: As a user, I want to run Anchore Grype Inside Docker

User Story

As a User, I want to run Anchore Grype inside Docker, so that I can scan Docker images that I produce for vulnerabilities as part of a Docker based pipeline.

Acceptance Criteria

The Grype command is executed within a Docker container.
There are tests that the version of Grype matches the expected version (as of 2020-12-31 this is 0.6.1).

Error found with client

Describe the bug
Python error message on latest Grype.

To Reproduce
Steps to reproduce the behavior:

Run against the latest (1.14.1)

Expected behavior
The Python script should run without throwing exceptions.

Screenshots

[0000]  INFO grype version: 0.31.1
accepts at most 1 arg(s), received 2
Traceback (most recent call last):
  File "/usr/local/bin/parse-grype-json.py", line 358, in <module>
    main()
  File "/usr/local/bin/parse-grype-json.py", line 354, in main
    sys.exit(widget.report())
  File "/usr/local/bin/parse-grype-json.py", line 103, in report
    grype_data = json.load(sys.stdin)
  File "/usr/local/lib/python3.10/json/__init__.py", line 293, in load
    return loads(fp.read(),
  File "/usr/local/lib/python3.10/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
  File "/usr/local/lib/python3.10/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/local/lib/python3.10/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

GHSA-c3xm-pvg7-gh7r

Describe the bug

The vulnerability GHSA-c3xm-pvg7-gh7r is found in our scans, even when the ONLY_FIXED flag is set.

NAME	INSTALLED	VULNERABILITY	SEVERITY	ALLOWED
github.com/opencontainers/runc	(devel)	GHSA-c3xm-pvg7-gh7r	High	yes

CVE-2019-25013, CVE-2020-27843 & CVE-2020-27844

Subsequent tests are throwing warnings of vulnerabilities (that were not being identified before) with the following output:

DEBUG:Tolerance is Medium (3)
DEBUG:Grype version 0.6.1
NAME,INSTALLED,VULNERABILITY,SEVERITY
libc6,2.28-10,CVE-2019-25013,High
libc-dev-bin,2.28-10,CVE-2019-25013,High
libopenjp2-7,2.3.0-2+deb10u1,CVE-2020-27844,High
libopenjp2-7,2.3.0-2+deb10u1,CVE-2020-27843,High
libc-bin,2.28-10,CVE-2019-25013,High
libopenjp2-7-dev,2.3.0-2+deb10u1,CVE-2020-27844,High
libopenjp2-7-dev,2.3.0-2+deb10u1,CVE-2020-27843,High

DEBUG:Max severity level found was 4.

Update Version of Anchore Grype

Describe the solution you'd like
Update to the latest version of Anchore Grype:

v0.33.0 (2022-02-15)

CVE-2021-43396

Vulnerability CVE-2021-43396 was identified while working on #50.

NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
libc-bin,2.31-13+deb11u2,CVE-2021-43396,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High

Option to Show All Vulnerabilities Discovered

As a user,
I want to be able to see all vulnerabilities found (allowed or not),
So that I can appraise all of the vulnerabilities of the system.

CVE-2019-16884

Vulnerability CVE-2019-16884 was identified while working on #50.

NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High

CVE-2021-3520

Describe the bug
Scheduled build has failed due to vulnerability CVE-2021-3520 with the following error:

Name	Installed	Vulnerability	Severity
liblz4-1	1.8.3-1	CVE-2021-3520	High

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

Additional context
See https://github.com/cbdq-io/docker-grype/runs/2957632086?check_suite_focus=true

Grype 0.17.0

Describe the solution you'd like
The current version of Grype in the image is 0.15.0. 0.16.0 was released 2020-08-18 and 0.17.0 was released on the 25th of last month. We need to cut a new version with 0.17.0.

CVE-2019-13509

Vulnerability CVE-2019-13509 was identified while working on #50.

NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High

Anchore Grype 0.25.0

Describe the solution you'd like
Anchore have release Grype 0.25.0.

CVE-2021-20305

Describe the bug
While attempting to deploy 1.5.0 of this product (see https://github.com/cbdq-io/docker-grype/runs/2322075405?check_suite_focus=true) our image was found to be susceptible to
CVE-2021-20305.

To Reproduce
Build the image and then scan it with Grype. The following report is given:

DEBUG:Tolerance is Medium (3)
DEBUG:Grype version 0.9.0
DEBUG:Max severity level found was 4.
NAME,INSTALLED,VULNERABILITY,SEVERITY
libhogweed4,3.4.1-1,CVE-2021-20305,High

Expected behaviour
After the image has been built, it should have no vulnerabilities found in it with a severity of High or above.

Additional context
libhogweed is the companion library for nettle.

GHSA-c3xm-pvg7-gh7r

Vulnerability GHSA-c3xm-pvg7-gh7r was identified while working on #50.

NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High

Fix "argument_count" issue in docker-grype/pygrype/vulnerabilities.py

Function add has 5 arguments (exceeds 4 allowed). Consider refactoring.

https://codeclimate.com/github/cbdq-io/docker-grype/docker-grype/pygrype/vulnerabilities.py#issue_62b4c80f3ad9180001000023

Unexpected shell diagnostic message being displayed

Describe the bug
Customer site having (what seems to be a diagnostic) message. Grype still executes and provides a report.

Expected behavior
No warning/error messages from the shell should be present.

Screenshots
Output line is:

/usr/local/bin/docker-grype-cmd.sh: 24: [: -eq: unexpected operator

CVE-2015-5237

Vulnerability CVE-2015-5237 was identified while working on #50.

NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High