cbdq-io / docker-grype Goto Github PK
View Code? Open in Web Editor NEWWrap Anchore Grype Inside Docker
License: Apache License 2.0
Wrap Anchore Grype Inside Docker
License: Apache License 2.0
Vulnerability GHSA-25xm-hr59-7c27 was identified while working on #50.
NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High
Describe the solution you'd like
Our image has Grype 0.23.0 installed and this should be updated.
Describe the solution you'd like
In the latest version of this image 1.14.0, Gype version 0.28.0 is installed. Grype have release 0.31.1.
Additional context
https://github.com/anchore/grype/releases
Describe the solution you'd like
Grype can optionally generate CPEs for packages that are missing them.
Describe alternatives you've considered
Having the option set as on by default, but this should probably be left to the user (as it is in the underlying Grype command).
Additional context
See https://cpe.mitre.org/about/ for notes about CPEs.
An example of an occurrence can be seen in https://github.com/cbdq-io/docker-grype/runs/7037310023?check_suite_focus=true#step:9:872
Describe the bug
During the creation of 1.13.0 of the image, the git tag was not created as it should have been. It was subsequently completed manually.
Expected behavior
The correct tag should be created at deploy time automatically.
Additional context
The problem is in https://github.com/cbdq-io/docker-grype/blob/1.13.0/.github/workflows/cd.yml#L45
Describe the solution you'd like
A new version of Anchore Grype is available (see https://github.com/anchore/grype/releases).
Describe the bug
A new vulnerability has been found in our image CVE-2021-33574 specifically in libc-bin
version 2.28-10.
DEBUG:Tolerance is Medium (3)
DEBUG:Grype version 0.13.0
DEBUG:Max severity level found was 4.
NAME,INSTALLED,VULNERABILITY,SEVERITY
libc-bin,2.28-10,CVE-2021-33574,High
See https://github.com/cbdq-io/docker-grype/runs/2780583554?check_suite_focus=true for the full run.
As this version of that package is the latest version available for Debian 10 (Buster), we'll have to add this vulnerability to the allowed list.
Function report
has a Cognitive Complexity of 31 (exceeds 5 allowed). Consider refactoring.
Describe the bug
A new vulnerability has been found in our image CVE-2021-29921 specifically in libpython3.9-minimal
version 3.9.2-1.
DEBUG:Tolerance is Medium (3)
DEBUG:Grype version 0.17.0
DEBUG:Max severity level found was 4.
NAME,INSTALLED,VULNERABILITY,SEVERITY
libpython3.9-minimal,3.9.2-1,CVE-2021-29921,High
See https://github.com/cbdq-io/docker-grype/runs/3482917551?check_suite_focus=true for the full run.
As this version of that package is the latest version available for Debian 11 (Bullseye), we'll have to add this vulnerability to the allowed list.
File parse-grype-json.py
has 290 lines of code (exceeds 250 allowed). Consider refactoring.
As a user,
I should be able to provide user credentials,
So that I can login to a Docker server if required.
Describe the bug
The latest version of the vulnerability database (released today) has identified
CVE-2021-3177.
To Reproduce
Steps to reproduce the behaviour:
Run make
Expected behaviour
The project should build cleanly
Additional context
[CVE-2021-3177 concerned a bad implementation of the sprintf
function. As we don't use that function we can safely add this vulnerability to our allowed list.
CI/CD pipelines failing due to CVE-2022-29458.
ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.
See https://github.com/cbdq-io/docker-grype/runs/6243314666?check_suite_focus=true
Describe the bug
Our latest Docker image runs version 0.39.0 of Grype. This has now been superseded.
Expected behavior
The latest Grype binary is used by the software.
Additional context
https://github.com/anchore/grype/releases/tag/v0.40.0.
Describe the solution you'd like
We should include v0.33.1 in our deployed image (see https://github.com/anchore/grype/releases/tag/v0.33.1).
Additional context
See https://github.com/anchore/grype/releases in case there are subsequent updates.
I misfire from my first attempt at using the gh cli tool ๐ตโ๐ซ
Vulnerability CVE-2019-5736 was identified while working on #50.
NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High
Function report
has a Cognitive Complexity of 31 (exceeds 5 allowed). Consider refactoring.
Function add
has 5 arguments (exceeds 4 allowed). Consider refactoring.
A link to the example Docker Compose file doesn't work. Works fine in GitHub, but as it's a relative link, it doesn't work on Docker Hub.
As a user,
I want to be warned if a vulnerability in the allowed list is not found during the scan,
So that I can keep the allowed list relevant.
Describe the bug
A clear and concise description of what the bug is.
Additional context
NAME | INSTALLED | VULNERABILITY | SEVERITY |
---|---|---|---|
libgnutls30 | 3.6.7-4+deb10u6 | CVE-2021-20231 | High |
libgnutls30 | 3.6.7-4+deb10u6 | CVE-2021-20232 | High |
On branch pushes and merge requests, ensure tests are run in GitHub Workflow.
Describe the bug
Vulnerability report headers are showing NAME,INSTALLED,VULNERABILITY,SEVERITY
but then a sample line is libcrypt,2.26-35.amzn2,ALAS-2021-1605,High,no
which has an extra column (allowed) which isn't being shown in the header.
Expected behavior
The number of columns in the output lines should match the number of columns in the header.
Screenshots
The output was:
NAME,INSTALLED,VULNERABILITY,SEVERITY
libcrypt,2.26-35.amzn2,ALAS-2021-1605,High,no
libcrypt,2.26-35.amzn2,ALAS-2021-1599,High,no
Additional context
When this was observed, the following environment variables were being provided:
Describe the bug
During the extraction from the Grype XML report, we are duplicating the bug reports.
To Reproduce
Will need to setup our test data to emulate a vulnerability being found twice but reported only once.
Found in version 1.3.1.
Expected behavior
Vulnerabilities are reported only once.
Screenshots
Example output:
NAME,INSTALLED,VULNERABILITY,SEVERITY
openssl-libs,1.0.2k-19.amzn2.0.3,ALAS-2020-1573,High,no
openssl-libs,1.0.2k-19.amzn2.0.3,ALAS-2020-1573,High,no
Additional context
Add any other context about the problem here.
When there is a push to the main
branch, deploy the image to Docker Hub.
Improvements should be:
Vulnerability CVE-2017-7297 was identified while working on #50.
NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High
Describe the bug
Our last release was supposed to allow us to peg to a specific release of Grype (in this cast it was 0.30.0). However our regression test failed as the installed version was the newly released 0.30.1
To Reproduce
See https://github.com/cbdq-io/docker-grype/runs/5367993691?check_suite_focus=true
Expected behavior
The release configured should be followed until we specify to pick up the new version.
As a user, I want to provide an allowed list for vulnerabilities, so that I can specify what risks are acceptable.
VULNERABILITIES_ALLOWED_LIST
it will not be included in the report.NAME INSTALLED VULNERABILITY SEVERITY
apt 1.8.2.2 CVE-2011-3374 Negligible
apt-transport-https 1.8.2.2 CVE-2011-3374 Negligible
Vulnerability CVE-2019-13139 was identified while working on #50.
NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High
There is a new version of Grype and this should be tested against.
User Story
As a User, I want to run Anchore Grype inside Docker, so that I can scan Docker images that I produce for vulnerabilities as part of a Docker based pipeline.
Acceptance Criteria
Describe the bug
Python error message on latest Grype.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
The Python script should run without throwing exceptions.
Screenshots
[0000] INFO grype version: 0.31.1
accepts at most 1 arg(s), received 2
Traceback (most recent call last):
File "/usr/local/bin/parse-grype-json.py", line 358, in <module>
main()
File "/usr/local/bin/parse-grype-json.py", line 354, in main
sys.exit(widget.report())
File "/usr/local/bin/parse-grype-json.py", line 103, in report
grype_data = json.load(sys.stdin)
File "/usr/local/lib/python3.10/json/__init__.py", line 293, in load
return loads(fp.read(),
File "/usr/local/lib/python3.10/json/__init__.py", line 346, in loads
return _default_decoder.decode(s)
File "/usr/local/lib/python3.10/json/decoder.py", line 337, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/usr/local/lib/python3.10/json/decoder.py", line 355, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
Describe the bug
The vulnerability GHSA-c3xm-pvg7-gh7r is found in our scans, even when the ONLY_FIXED
flag is set.
NAME | INSTALLED | VULNERABILITY | SEVERITY | ALLOWED |
---|---|---|---|---|
github.com/opencontainers/runc | (devel) | GHSA-c3xm-pvg7-gh7r | High | yes |
Subsequent tests are throwing warnings of vulnerabilities (that were not being identified before) with the following output:
DEBUG:Tolerance is Medium (3)
DEBUG:Grype version 0.6.1
NAME,INSTALLED,VULNERABILITY,SEVERITY
libc6,2.28-10,CVE-2019-25013,High
libc-dev-bin,2.28-10,CVE-2019-25013,High
libopenjp2-7,2.3.0-2+deb10u1,CVE-2020-27844,High
libopenjp2-7,2.3.0-2+deb10u1,CVE-2020-27843,High
libc-bin,2.28-10,CVE-2019-25013,High
libopenjp2-7-dev,2.3.0-2+deb10u1,CVE-2020-27844,High
libopenjp2-7-dev,2.3.0-2+deb10u1,CVE-2020-27843,High
DEBUG:Max severity level found was 4.
Describe the solution you'd like
Update to the latest version of Anchore Grype:
Vulnerability CVE-2021-43396 was identified while working on #50.
NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
libc-bin,2.31-13+deb11u2,CVE-2021-43396,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High
As a user,
I want to be able to see all vulnerabilities found (allowed or not),
So that I can appraise all of the vulnerabilities of the system.
Vulnerability CVE-2019-16884 was identified while working on #50.
NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High
Describe the bug
Scheduled build has failed due to vulnerability CVE-2021-3520 with the following error:
Name | Installed | Vulnerability | Severity |
---|---|---|---|
liblz4-1 | 1.8.3-1 | CVE-2021-3520 | High |
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
Additional context
See https://github.com/cbdq-io/docker-grype/runs/2957632086?check_suite_focus=true
Describe the solution you'd like
The current version of Grype in the image is 0.15.0. 0.16.0 was released 2020-08-18 and 0.17.0 was released on the 25th of last month. We need to cut a new version with 0.17.0.
Vulnerability CVE-2019-13509 was identified while working on #50.
NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High
Describe the solution you'd like
Anchore have release Grype 0.25.0.
Describe the bug
While attempting to deploy 1.5.0 of this product (see https://github.com/cbdq-io/docker-grype/runs/2322075405?check_suite_focus=true) our image was found to be susceptible to
CVE-2021-20305.
To Reproduce
Build the image and then scan it with Grype. The following report is given:
DEBUG:Tolerance is Medium (3)
DEBUG:Grype version 0.9.0
DEBUG:Max severity level found was 4.
NAME,INSTALLED,VULNERABILITY,SEVERITY
libhogweed4,3.4.1-1,CVE-2021-20305,High
Expected behaviour
After the image has been built, it should have no vulnerabilities found in it with a severity of High or above.
Additional context
libhogweed is the companion library for nettle.
Vulnerability GHSA-c3xm-pvg7-gh7r was identified while working on #50.
NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High
Function add
has 5 arguments (exceeds 4 allowed). Consider refactoring.
Describe the bug
Customer site having (what seems to be a diagnostic) message. Grype still executes and provides a report.
Expected behavior
No warning/error messages from the shell should be present.
Screenshots
Output line is:
/usr/local/bin/docker-grype-cmd.sh: 24: [: -eq: unexpected operator
Vulnerability CVE-2015-5237 was identified while working on #50.
NAME,INSTALLED,VULNERABILITY,SEVERITY
google.golang.org/protobuf,v1.24.0,CVE-2015-5237,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2017-7297,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13139,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-13509,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-16884,High
github.com/docker/docker,v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible,CVE-2019-5736,High
github.com/ulikunitz/xz,v0.5.7,GHSA-25xm-hr59-7c27,High
github.com/opencontainers/runc,v0.1.1,GHSA-c3xm-pvg7-gh7r,High
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.