Compare commits
7 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
fbd16365eb | ||
|
|
559eb1224e | ||
|
|
e602665a11 | ||
|
|
3dd517d8c9 | ||
|
|
41f05d9ecf | ||
|
|
0cd397afbf | ||
|
|
463f27e2d8 |
Vendored
+1
-1
@@ -1,7 +1,7 @@
|
||||
name: "build"
|
||||
on: [push, pull_request]
|
||||
env:
|
||||
TRIVY_VERSION: 0.42.0
|
||||
TRIVY_VERSION: 0.45.0
|
||||
BATS_LIB_PATH: '/usr/lib/'
|
||||
jobs:
|
||||
build:
|
||||
|
||||
Vendored
+40
@@ -0,0 +1,40 @@
|
||||
name: Bump trivy
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
trivy_version:
|
||||
required: true
|
||||
type: string
|
||||
description: the trivy version
|
||||
|
||||
run-name: Bump trivy to v${{ inputs.trivy_version }}
|
||||
|
||||
jobs:
|
||||
bump:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: Update Trivy versions
|
||||
run: |
|
||||
sed -r -i "s/ghcr.io\/aquasecurity\/trivy:[0-9]+\.[0-9]+\.[0-9]+/ghcr.io\/aquasecurity\/trivy:${{ inputs.trivy_version }}/" Dockerfile
|
||||
sed -r -i "s/TRIVY_VERSION: [0-9]+\.[0-9]+\.[0-9]+/TRIVY_VERSION: ${{ inputs.trivy_version }}/" .github/workflows/build.yaml
|
||||
find test/data -type f -name '*.test' | xargs sed -r -i 's/"version": "[0-9]+\.[0-9]+\.[0-9]+"/"version": "${{ inputs.trivy_version }}"/'
|
||||
|
||||
- name: Create PR
|
||||
id: create-pr
|
||||
uses: peter-evans/create-pull-request@v5
|
||||
with:
|
||||
token: ${{ secrets.ORG_REPO_TOKEN }}
|
||||
title: "chore(deps): Update trivy to v${{ inputs.trivy_version }}"
|
||||
commit-message: "chore(deps): Update trivy to v${{ inputs.trivy_version }}"
|
||||
committer: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
|
||||
author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
|
||||
branch-suffix: timestamp
|
||||
branch: bump-trivy
|
||||
delete-branch: true
|
||||
|
||||
- name: Check outputs
|
||||
run: |
|
||||
echo "Pull Request Number - ${{ steps.create-pr.outputs.pull-request-number }}"
|
||||
echo "Pull Request URL - ${{ steps.create-pr.outputs.pull-request-url }}"
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
FROM ghcr.io/aquasecurity/trivy:0.42.0
|
||||
FROM ghcr.io/aquasecurity/trivy:0.45.0
|
||||
COPY entrypoint.sh /
|
||||
RUN apk --no-cache add bash curl npm
|
||||
RUN chmod +x /entrypoint.sh
|
||||
|
||||
@@ -26,7 +26,7 @@ name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- main
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
@@ -56,7 +56,7 @@ name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- main
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
@@ -99,7 +99,7 @@ name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- main
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
@@ -128,7 +128,7 @@ name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- main
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
@@ -163,7 +163,7 @@ name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- main
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
@@ -202,7 +202,7 @@ name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- main
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
@@ -236,7 +236,7 @@ name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- main
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
@@ -271,7 +271,7 @@ name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- main
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
@@ -311,7 +311,7 @@ name: Pull Request
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- main
|
||||
|
||||
## GITHUB_TOKEN authentication, add only if you're not going to use a PAT
|
||||
permissions:
|
||||
@@ -346,7 +346,7 @@ name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- main
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
@@ -382,7 +382,7 @@ name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- main
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
@@ -418,7 +418,7 @@ name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- main
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
@@ -451,7 +451,7 @@ name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- main
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
|
||||
+1
-1
@@ -180,7 +180,7 @@ if [ "${format}" == "sarif" ] && [ "${limitSeveritiesForSARIF}" != "true" ]; the
|
||||
trivy --quiet ${scanType} --format sarif --output ${output} $SARIF_ARGS ${artifactRef}
|
||||
elif [ $trivyConfig ]; then
|
||||
echo "Running Trivy with trivy.yaml config from: " $trivyConfig
|
||||
trivy --config $trivyConfig ${ARGS} ${scanType} ${artifactRef}
|
||||
trivy --config $trivyConfig ${scanType} ${artifactRef}
|
||||
returnCode=$?
|
||||
else
|
||||
echo "Running trivy with options: trivy ${scanType} ${ARGS}" "${artifactRef}"
|
||||
|
||||
@@ -64,7 +64,7 @@
|
||||
}
|
||||
}
|
||||
],
|
||||
"version": "0.42.0"
|
||||
"version": "0.45.0"
|
||||
}
|
||||
},
|
||||
"results": [
|
||||
|
||||
@@ -37,7 +37,7 @@
|
||||
}
|
||||
}
|
||||
],
|
||||
"version": "0.42.0"
|
||||
"version": "0.43.1"
|
||||
}
|
||||
},
|
||||
"results": [
|
||||
|
||||
@@ -3,87 +3,72 @@ knqyf263/vuln-image:1.2.3 (alpine 3.7.1)
|
||||
========================================
|
||||
Total: 19 (CRITICAL: 19)
|
||||
|
||||
┌─────────────┬────────────────┬──────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
|
||||
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
|
||||
├─────────────┼────────────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ curl │ CVE-2018-14618 │ CRITICAL │ 7.61.0-r0 │ 7.61.1-r0 │ curl: NTLM password overflow via integer overflow │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-14618 │
|
||||
│ ├────────────────┤ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16839 │ │ │ 7.61.1-r1 │ curl: Integer overflow leading to heap-based buffer overflow │
|
||||
│ │ │ │ │ │ in Curl_sasl_create_plain_message() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16839 │
|
||||
│ ├────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16840 │ │ │ │ curl: Use-after-free when closing "easy" handle in │
|
||||
│ │ │ │ │ │ Curl_close() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16840 │
|
||||
│ ├────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16842 │ │ │ │ curl: Heap-based buffer over-read in the curl tool warning │
|
||||
│ │ │ │ │ │ formatting │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16842 │
|
||||
│ ├────────────────┤ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-3822 │ │ │ 7.61.1-r2 │ curl: NTLMv2 type-3 header stack buffer overflow │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-3822 │
|
||||
│ ├────────────────┤ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5481 │ │ │ 7.61.1-r3 │ curl: double free due to subsequent call of realloc() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5481 │
|
||||
│ ├────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5482 │ │ │ │ curl: heap buffer overflow in function tftp_receive_packet() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5482 │
|
||||
├─────────────┼────────────────┤ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ git │ CVE-2018-17456 │ │ 2.15.2-r0 │ 2.15.3-r0 │ git: arbitrary code execution via .gitmodules │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-17456 │
|
||||
│ ├────────────────┤ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-1353 │ │ │ 2.15.4-r0 │ git: NTFS protections inactive when running Git in the │
|
||||
│ │ │ │ │ │ Windows Subsystem for... │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-1353 │
|
||||
├─────────────┼────────────────┤ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ libbz2 │ CVE-2019-12900 │ │ 1.0.6-r6 │ 1.0.6-r7 │ bzip2: out-of-bounds write in function BZ2_decompress │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-12900 │
|
||||
├─────────────┼────────────────┤ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ libcurl │ CVE-2018-16839 │ │ 7.61.1-r0 │ 7.61.1-r1 │ curl: Integer overflow leading to heap-based buffer overflow │
|
||||
│ │ │ │ │ │ in Curl_sasl_create_plain_message() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16839 │
|
||||
│ ├────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16840 │ │ │ │ curl: Use-after-free when closing "easy" handle in │
|
||||
│ │ │ │ │ │ Curl_close() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16840 │
|
||||
│ ├────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16842 │ │ │ │ curl: Heap-based buffer over-read in the curl tool warning │
|
||||
│ │ │ │ │ │ formatting │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16842 │
|
||||
│ ├────────────────┤ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-3822 │ │ │ 7.61.1-r2 │ curl: NTLMv2 type-3 header stack buffer overflow │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-3822 │
|
||||
│ ├────────────────┤ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5481 │ │ │ 7.61.1-r3 │ curl: double free due to subsequent call of realloc() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5481 │
|
||||
│ ├────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5482 │ │ │ │ curl: heap buffer overflow in function tftp_receive_packet() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5482 │
|
||||
├─────────────┼────────────────┤ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ musl │ CVE-2019-14697 │ │ 1.1.18-r3 │ 1.1.18-r4 │ musl libc through 1.1.23 has an x87 floating-point stack │
|
||||
│ │ │ │ │ │ adjustment im ...... │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-14697 │
|
||||
├─────────────┤ │ │ │ │ │
|
||||
│ musl-utils │ │ │ │ │ │
|
||||
│ │ │ │ │ │ │
|
||||
│ │ │ │ │ │ │
|
||||
├─────────────┼────────────────┤ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ sqlite-libs │ CVE-2019-8457 │ │ 3.21.0-r1 │ 3.25.3-r1 │ sqlite: heap out-of-bound read in function rtreenode() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-8457 │
|
||||
└─────────────┴────────────────┴──────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘
|
||||
|
||||
rust-app/Cargo.lock (cargo)
|
||||
===========================
|
||||
Total: 2 (CRITICAL: 2)
|
||||
|
||||
┌──────────┬────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
|
||||
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
|
||||
├──────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
|
||||
│ openssl │ CVE-2018-20997 │ CRITICAL │ 0.8.3 │ 0.10.9 │ Use after free in openssl │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-20997 │
|
||||
├──────────┼────────────────┤ ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
|
||||
│ smallvec │ CVE-2021-25900 │ │ 0.6.9 │ 1.6.1, 0.6.14 │ An issue was discovered in the smallvec crate before 0.6.14 │
|
||||
│ │ │ │ │ │ and 1.x... │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-25900 │
|
||||
└──────────┴────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘
|
||||
┌─────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
|
||||
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
|
||||
├─────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ curl │ CVE-2018-14618 │ CRITICAL │ fixed │ 7.61.0-r0 │ 7.61.1-r0 │ curl: NTLM password overflow via integer overflow │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-14618 │
|
||||
│ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16839 │ │ │ │ 7.61.1-r1 │ curl: Integer overflow leading to heap-based buffer overflow │
|
||||
│ │ │ │ │ │ │ in Curl_sasl_create_plain_message() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16839 │
|
||||
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16840 │ │ │ │ │ curl: Use-after-free when closing "easy" handle in │
|
||||
│ │ │ │ │ │ │ Curl_close() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16840 │
|
||||
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16842 │ │ │ │ │ curl: Heap-based buffer over-read in the curl tool warning │
|
||||
│ │ │ │ │ │ │ formatting │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16842 │
|
||||
│ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-3822 │ │ │ │ 7.61.1-r2 │ curl: NTLMv2 type-3 header stack buffer overflow │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-3822 │
|
||||
│ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5481 │ │ │ │ 7.61.1-r3 │ curl: double free due to subsequent call of realloc() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5481 │
|
||||
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5482 │ │ │ │ │ curl: heap buffer overflow in function tftp_receive_packet() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5482 │
|
||||
├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ git │ CVE-2018-17456 │ │ │ 2.15.2-r0 │ 2.15.3-r0 │ git: arbitrary code execution via .gitmodules │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-17456 │
|
||||
│ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-1353 │ │ │ │ 2.15.4-r0 │ git: NTFS protections inactive when running Git in the │
|
||||
│ │ │ │ │ │ │ Windows Subsystem for... │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-1353 │
|
||||
├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ libbz2 │ CVE-2019-12900 │ │ │ 1.0.6-r6 │ 1.0.6-r7 │ bzip2: out-of-bounds write in function BZ2_decompress │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-12900 │
|
||||
├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ libcurl │ CVE-2018-16839 │ │ │ 7.61.1-r0 │ 7.61.1-r1 │ curl: Integer overflow leading to heap-based buffer overflow │
|
||||
│ │ │ │ │ │ │ in Curl_sasl_create_plain_message() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16839 │
|
||||
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16840 │ │ │ │ │ curl: Use-after-free when closing "easy" handle in │
|
||||
│ │ │ │ │ │ │ Curl_close() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16840 │
|
||||
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16842 │ │ │ │ │ curl: Heap-based buffer over-read in the curl tool warning │
|
||||
│ │ │ │ │ │ │ formatting │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16842 │
|
||||
│ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-3822 │ │ │ │ 7.61.1-r2 │ curl: NTLMv2 type-3 header stack buffer overflow │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-3822 │
|
||||
│ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5481 │ │ │ │ 7.61.1-r3 │ curl: double free due to subsequent call of realloc() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5481 │
|
||||
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5482 │ │ │ │ │ curl: heap buffer overflow in function tftp_receive_packet() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5482 │
|
||||
├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ musl │ CVE-2019-14697 │ │ │ 1.1.18-r3 │ 1.1.18-r4 │ musl libc through 1.1.23 has an x87 floating-point stack │
|
||||
│ │ │ │ │ │ │ adjustment im ...... │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-14697 │
|
||||
├─────────────┤ │ │ │ │ │ │
|
||||
│ musl-utils │ │ │ │ │ │ │
|
||||
│ │ │ │ │ │ │ │
|
||||
│ │ │ │ │ │ │ │
|
||||
├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ sqlite-libs │ CVE-2019-8457 │ │ │ 3.21.0-r1 │ 3.25.3-r1 │ sqlite: heap out-of-bound read in function rtreenode() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-8457 │
|
||||
└─────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘
|
||||
|
||||
+69
-96
@@ -3,99 +3,72 @@ knqyf263/vuln-image:1.2.3 (alpine 3.7.1)
|
||||
========================================
|
||||
Total: 19 (CRITICAL: 19)
|
||||
|
||||
┌─────────────┬────────────────┬──────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
|
||||
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
|
||||
├─────────────┼────────────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ curl │ CVE-2018-14618 │ CRITICAL │ 7.61.0-r0 │ 7.61.1-r0 │ curl: NTLM password overflow via integer overflow │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-14618 │
|
||||
│ ├────────────────┤ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16839 │ │ │ 7.61.1-r1 │ curl: Integer overflow leading to heap-based buffer overflow │
|
||||
│ │ │ │ │ │ in Curl_sasl_create_plain_message() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16839 │
|
||||
│ ├────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16840 │ │ │ │ curl: Use-after-free when closing "easy" handle in │
|
||||
│ │ │ │ │ │ Curl_close() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16840 │
|
||||
│ ├────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16842 │ │ │ │ curl: Heap-based buffer over-read in the curl tool warning │
|
||||
│ │ │ │ │ │ formatting │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16842 │
|
||||
│ ├────────────────┤ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-3822 │ │ │ 7.61.1-r2 │ curl: NTLMv2 type-3 header stack buffer overflow │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-3822 │
|
||||
│ ├────────────────┤ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5481 │ │ │ 7.61.1-r3 │ curl: double free due to subsequent call of realloc() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5481 │
|
||||
│ ├────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5482 │ │ │ │ curl: heap buffer overflow in function tftp_receive_packet() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5482 │
|
||||
├─────────────┼────────────────┤ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ git │ CVE-2018-17456 │ │ 2.15.2-r0 │ 2.15.3-r0 │ git: arbitrary code execution via .gitmodules │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-17456 │
|
||||
│ ├────────────────┤ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-1353 │ │ │ 2.15.4-r0 │ git: NTFS protections inactive when running Git in the │
|
||||
│ │ │ │ │ │ Windows Subsystem for... │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-1353 │
|
||||
├─────────────┼────────────────┤ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ libbz2 │ CVE-2019-12900 │ │ 1.0.6-r6 │ 1.0.6-r7 │ bzip2: out-of-bounds write in function BZ2_decompress │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-12900 │
|
||||
├─────────────┼────────────────┤ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ libcurl │ CVE-2018-16839 │ │ 7.61.1-r0 │ 7.61.1-r1 │ curl: Integer overflow leading to heap-based buffer overflow │
|
||||
│ │ │ │ │ │ in Curl_sasl_create_plain_message() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16839 │
|
||||
│ ├────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16840 │ │ │ │ curl: Use-after-free when closing "easy" handle in │
|
||||
│ │ │ │ │ │ Curl_close() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16840 │
|
||||
│ ├────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16842 │ │ │ │ curl: Heap-based buffer over-read in the curl tool warning │
|
||||
│ │ │ │ │ │ formatting │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16842 │
|
||||
│ ├────────────────┤ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-3822 │ │ │ 7.61.1-r2 │ curl: NTLMv2 type-3 header stack buffer overflow │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-3822 │
|
||||
│ ├────────────────┤ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5481 │ │ │ 7.61.1-r3 │ curl: double free due to subsequent call of realloc() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5481 │
|
||||
│ ├────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5482 │ │ │ │ curl: heap buffer overflow in function tftp_receive_packet() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5482 │
|
||||
├─────────────┼────────────────┤ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ musl │ CVE-2019-14697 │ │ 1.1.18-r3 │ 1.1.18-r4 │ musl libc through 1.1.23 has an x87 floating-point stack │
|
||||
│ │ │ │ │ │ adjustment im ...... │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-14697 │
|
||||
├─────────────┤ │ │ │ │ │
|
||||
│ musl-utils │ │ │ │ │ │
|
||||
│ │ │ │ │ │ │
|
||||
│ │ │ │ │ │ │
|
||||
├─────────────┼────────────────┤ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ sqlite-libs │ CVE-2019-8457 │ │ 3.21.0-r1 │ 3.25.3-r1 │ sqlite: heap out-of-bound read in function rtreenode() │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-8457 │
|
||||
└─────────────┴────────────────┴──────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘
|
||||
|
||||
rust-app/Cargo.lock (cargo)
|
||||
===========================
|
||||
Total: 5 (CRITICAL: 5)
|
||||
|
||||
┌───────────┬────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
|
||||
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
|
||||
├───────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
|
||||
│ openssl │ CVE-2018-20997 │ CRITICAL │ 0.8.3 │ 0.10.9 │ Use after free in openssl │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-20997 │
|
||||
├───────────┼────────────────┤ ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
|
||||
│ rand_core │ CVE-2020-25576 │ │ 0.4.0 │ 0.3.1, 0.4.2 │ An issue was discovered in the rand_core crate before 0.4.2 │
|
||||
│ │ │ │ │ │ for Rust.... │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-25576 │
|
||||
├───────────┼────────────────┤ ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
|
||||
│ smallvec │ CVE-2019-15551 │ │ 0.6.9 │ 0.6.10 │ An issue was discovered in the smallvec crate before 0.6.10 │
|
||||
│ │ │ │ │ │ for Rust.... │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-15551 │
|
||||
│ ├────────────────┤ │ │ ├─────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-15554 │ │ │ │ An issue was discovered in the smallvec crate before 0.6.10 │
|
||||
│ │ │ │ │ │ for Rust.... │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-15554 │
|
||||
│ ├────────────────┤ │ ├───────────────┼─────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2021-25900 │ │ │ 1.6.1, 0.6.14 │ An issue was discovered in the smallvec crate before 0.6.14 │
|
||||
│ │ │ │ │ │ and 1.x... │
|
||||
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-25900 │
|
||||
└───────────┴────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘
|
||||
┌─────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
|
||||
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
|
||||
├─────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ curl │ CVE-2018-14618 │ CRITICAL │ fixed │ 7.61.0-r0 │ 7.61.1-r0 │ curl: NTLM password overflow via integer overflow │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-14618 │
|
||||
│ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16839 │ │ │ │ 7.61.1-r1 │ curl: Integer overflow leading to heap-based buffer overflow │
|
||||
│ │ │ │ │ │ │ in Curl_sasl_create_plain_message() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16839 │
|
||||
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16840 │ │ │ │ │ curl: Use-after-free when closing "easy" handle in │
|
||||
│ │ │ │ │ │ │ Curl_close() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16840 │
|
||||
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16842 │ │ │ │ │ curl: Heap-based buffer over-read in the curl tool warning │
|
||||
│ │ │ │ │ │ │ formatting │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16842 │
|
||||
│ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-3822 │ │ │ │ 7.61.1-r2 │ curl: NTLMv2 type-3 header stack buffer overflow │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-3822 │
|
||||
│ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5481 │ │ │ │ 7.61.1-r3 │ curl: double free due to subsequent call of realloc() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5481 │
|
||||
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5482 │ │ │ │ │ curl: heap buffer overflow in function tftp_receive_packet() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5482 │
|
||||
├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ git │ CVE-2018-17456 │ │ │ 2.15.2-r0 │ 2.15.3-r0 │ git: arbitrary code execution via .gitmodules │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-17456 │
|
||||
│ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-1353 │ │ │ │ 2.15.4-r0 │ git: NTFS protections inactive when running Git in the │
|
||||
│ │ │ │ │ │ │ Windows Subsystem for... │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-1353 │
|
||||
├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ libbz2 │ CVE-2019-12900 │ │ │ 1.0.6-r6 │ 1.0.6-r7 │ bzip2: out-of-bounds write in function BZ2_decompress │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-12900 │
|
||||
├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ libcurl │ CVE-2018-16839 │ │ │ 7.61.1-r0 │ 7.61.1-r1 │ curl: Integer overflow leading to heap-based buffer overflow │
|
||||
│ │ │ │ │ │ │ in Curl_sasl_create_plain_message() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16839 │
|
||||
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16840 │ │ │ │ │ curl: Use-after-free when closing "easy" handle in │
|
||||
│ │ │ │ │ │ │ Curl_close() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16840 │
|
||||
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2018-16842 │ │ │ │ │ curl: Heap-based buffer over-read in the curl tool warning │
|
||||
│ │ │ │ │ │ │ formatting │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-16842 │
|
||||
│ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-3822 │ │ │ │ 7.61.1-r2 │ curl: NTLMv2 type-3 header stack buffer overflow │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-3822 │
|
||||
│ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5481 │ │ │ │ 7.61.1-r3 │ curl: double free due to subsequent call of realloc() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5481 │
|
||||
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
|
||||
│ │ CVE-2019-5482 │ │ │ │ │ curl: heap buffer overflow in function tftp_receive_packet() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5482 │
|
||||
├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ musl │ CVE-2019-14697 │ │ │ 1.1.18-r3 │ 1.1.18-r4 │ musl libc through 1.1.23 has an x87 floating-point stack │
|
||||
│ │ │ │ │ │ │ adjustment im ...... │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-14697 │
|
||||
├─────────────┤ │ │ │ │ │ │
|
||||
│ musl-utils │ │ │ │ │ │ │
|
||||
│ │ │ │ │ │ │ │
|
||||
│ │ │ │ │ │ │ │
|
||||
├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
|
||||
│ sqlite-libs │ CVE-2019-8457 │ │ │ 3.21.0-r1 │ 3.25.3-r1 │ sqlite: heap out-of-bound read in function rtreenode() │
|
||||
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-8457 │
|
||||
└─────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
vulnerability:
|
||||
type: os
|
||||
output: yamlconfig.test
|
||||
@@ -64,6 +64,7 @@
|
||||
"PkgName": "apk-tools",
|
||||
"InstalledVersion": "2.10.6-r0",
|
||||
"FixedVersion": "2.10.7-r0",
|
||||
"Status": "fixed",
|
||||
"Layer": {
|
||||
"Digest": "sha256:396c31837116ac290458afcb928f68b6cc1c7bdd6963fc72f52f365a2a89c1b5",
|
||||
"DiffID": "sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635"
|
||||
@@ -75,6 +76,7 @@
|
||||
"Name": "Alpine Secdb",
|
||||
"URL": "https://secdb.alpinelinux.org/"
|
||||
},
|
||||
"Title": "an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash",
|
||||
"Description": "libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\\0' terminator one byte too late.",
|
||||
"Severity": "CRITICAL",
|
||||
"CweIDs": [
|
||||
@@ -86,15 +88,22 @@
|
||||
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
||||
"V2Score": 6.4,
|
||||
"V3Score": 9.1
|
||||
},
|
||||
"redhat": {
|
||||
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
||||
"V3Score": 9.1
|
||||
}
|
||||
},
|
||||
"References": [
|
||||
"https://access.redhat.com/security/cve/CVE-2021-36159",
|
||||
"https://github.com/freebsd/freebsd-src/commits/main/lib/libfetch",
|
||||
"https://gitlab.alpinelinux.org/alpine/apk-tools/-/issues/10749",
|
||||
"https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E",
|
||||
"https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E",
|
||||
"https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E",
|
||||
"https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E"
|
||||
"https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E",
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2021-36159",
|
||||
"https://www.cve.org/CVERecord?id=CVE-2021-36159"
|
||||
],
|
||||
"PublishedDate": "2021-08-03T14:15:00Z",
|
||||
"LastModifiedDate": "2021-10-18T12:19:00Z"
|
||||
|
||||
@@ -81,11 +81,3 @@ bats_load_library bats-file
|
||||
echo "$output"
|
||||
assert_files_equal yamlconfig.test ./test/data/yamlconfig.test
|
||||
}
|
||||
|
||||
@test "trivy image with trivy.yaml config and args" {
|
||||
# trivy --config=./test/data/trivy-reduced.yaml image alpine:3.10
|
||||
run ./entrypoint.sh "-v ./test/data/trivy-reduced.yaml" "-a image" "-i alpine:3.10" "-b json" "-g CRITICAL"
|
||||
run diff yamlconfig.test ./test/data/yamlconfig.test
|
||||
echo "$output"
|
||||
assert_files_equal yamlconfig.test ./test/data/yamlconfig.test
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user