Automate Docker images vulnerability scanning #1531

nodiscc · 2020-08-31T17:21:54Z

nodiscc · 2020-09-20T12:05:00Z

I have setup container scanning for Shaarli Docker images (only the amd64 image for now) on our gitlab mirror: https://gitlab.com/shaarli/Shaarli/-/merge_requests/1146/diffs

Scans report no vulnerabilities: https://gitlab.com/shaarli/Shaarli/-/pipelines?page=1&scope=all&ref=docker-image-scan

I don't remember where we discussed this in the first place, wasn't there reports that the image had some vulnerabilities? Now we need to investigate whether:

this is a false negative caused by wrong pipeline configuration
this is a false negative caused by the tool itself [Gitlab CI uses clair scanner), its vulnerability sources (probably https://secdb.alpinelinux.org/ ?) or incomplete scanning (define what components we need to check)
the results are correct and Shaarli images have no known vulnerability :)

immanuelfodor · 2020-09-20T14:48:01Z

Hi, it was in this PR, you can still find the report there: #1505

ArthurHoaro · 2020-09-22T13:57:52Z

Using trivy, the tool suggested by Immanuel, I still get a bunch of vulnerabilities from our yarn.lock.
This tool is very easy to use locally btw! :)

 ➜ trivy shaarli/shaarli:master                 
2020-09-22T15:49:39.350+0200    INFO    Need to update DB
2020-09-22T15:49:39.352+0200    INFO    Downloading DB...
18.56 MiB / 18.56 MiB [--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 14.55 MiB p/s 1s
2020-09-22T15:49:44.686+0200    INFO    Detecting Alpine vulnerabilities...
2020-09-22T15:49:44.690+0200    INFO    Detecting php vulnerabilities...
2020-09-22T15:49:44.691+0200    INFO    Detecting nodejs vulnerabilities...
2020-09-22T15:49:44.699+0200    WARN    This OS version is no longer supported by the distribution: alpine 3.8.5
2020-09-22T15:49:44.699+0200    WARN    The vulnerability detection may be insufficient because security updates are not provided

shaarli/shaarli:master (alpine 3.8.5)
=====================================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)


var/www/shaarli/composer.lock
=============================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)


var/www/shaarli/yarn.lock
=========================
Total: 17 (UNKNOWN: 0, LOW: 4, MEDIUM: 9, HIGH: 4, CRITICAL: 0)

+--------------+---------------------+----------+-------------------+------------------------+--------------------------------+
|   LIBRARY    |  VULNERABILITY ID   | SEVERITY | INSTALLED VERSION |     FIXED VERSION      |             TITLE              |
+--------------+---------------------+----------+-------------------+------------------------+--------------------------------+
| acorn        | GHSA-6chw-6frg-f759 | MEDIUM   | 5.7.3             | 5.7.4, 7.1.1, 6.4.1    | Regular Expression Denial of   |
|              |                     |          |                   |                        | Service in Acorn               |
+--------------+---------------------+          +-------------------+------------------------+--------------------------------+
| elliptic     | CVE-2020-13822      |          | 6.4.1             | 6.5.3                  | nodejs-elliptic: improper      |
|              |                     |          |                   |                        | encoding checks allows a       |
|              |                     |          |                   |                        | certain degree of signature    |
|              |                     |          |                   |                        | malleability in...             |
+--------------+---------------------+----------+-------------------+------------------------+--------------------------------+
| js-yaml      | GHSA-8j8c-7jfh-h6hx | HIGH     | 3.7.0             | 3.13.1                 | Code Injection in js-yaml      |
+              +---------------------+----------+                   +------------------------+--------------------------------+
|              | GHSA-2pr6-76vf-7546 | MEDIUM   |                   | 3.13.0                 | Denial of Service in js-yaml   |
+--------------+---------------------+          +-------------------+------------------------+--------------------------------+
| kind-of      | CVE-2019-20149      |          | 6.0.2             | 6.0.3                  | Validation Bypass in kind-of   |
+--------------+---------------------+----------+-------------------+------------------------+--------------------------------+
| lodash       | NSWG-ECO-516        | HIGH     | 4.17.15           | >=4.17.19              | Allocation of Resources        |
|              |                     |          |                   |                        | Without Limits or Throttling   |
+              +---------------------+----------+                   +------------------------+--------------------------------+
|              | CVE-2020-8203       | MEDIUM   |                   | 4.17.19                | nodejs-lodash: prototype       |
|              |                     |          |                   |                        | pollution in zipObjectDeep     |
|              |                     |          |                   |                        | function                       |
+--------------+---------------------+----------+-------------------+------------------------+--------------------------------+
| mem          | GHSA-4xcv-9jjx-gfj3 | LOW      | 1.1.0             | 4.0.0                  | Denial of Service in mem       |
+--------------+---------------------+----------+-------------------+------------------------+--------------------------------+
| minimist     | CVE-2020-7598       | MEDIUM   | 1.2.0             | 1.2.3, 0.2.1           | nodejs-minimist: prototype     |
|              |                     |          |                   |                        | pollution allows adding        |
|              |                     |          |                   |                        | or modifying properties of     |
|              |                     |          |                   |                        | Object.prototype using a...    |
+              +                     +          +-------------------+                        +                                +
|              |                     |          | 0.0.8             |                        |                                |
|              |                     |          |                   |                        |                                |
|              |                     |          |                   |                        |                                |
|              |                     |          |                   |                        |                                |
+              +                     +          +-------------------+                        +                                +
|              |                     |          | 1.1.3             |                        |                                |
|              |                     |          |                   |                        |                                |
|              |                     |          |                   |                        |                                |
|              |                     |          |                   |                        |                                |
+              +---------------------+          +-------------------+------------------------+--------------------------------+
|              | GHSA-7fhm-mqm4-2wp7 |          | 0.0.8             | 0.2.1                  | Withdrawn: ESLint dependencies |
|              |                     |          |                   |                        | are vulnerable (ReDoS and      |
|              |                     |          |                   |                        | Prototype Pollution)           |
+--------------+---------------------+----------+-------------------+------------------------+--------------------------------+
| node-sass    | GHSA-9v62-24cr-58cx | LOW      | 4.12.0            | 4.13.1                 | Denial of Service in node-sass |
+--------------+---------------------+----------+-------------------+------------------------+--------------------------------+
| set-value    | CVE-2019-10747      | HIGH     | 0.4.3             | 3.0.1, 2.0.1           | nodejs-set-value: prototype    |
|              |                     |          |                   |                        | pollution in function          |
|              |                     |          |                   |                        | set-value                      |
+              +                     +          +-------------------+                        +                                +
|              |                     |          | 2.0.0             |                        |                                |
|              |                     |          |                   |                        |                                |
|              |                     |          |                   |                        |                                |
+--------------+---------------------+----------+-------------------+------------------------+--------------------------------+
| yargs-parser | GHSA-p9pc-299p-vxgp | LOW      | 5.0.0             | 18.1.2, 15.0.1, 13.1.2 | Prototype Pollution in         |
|              |                     |          |                   |                        | yargs-parser                   |
+              +                     +          +-------------------+                        +                                +
|              |                     |          | 7.0.0             |                        |                                |
|              |                     |          |                   |                        |                                |
+--------------+---------------------+----------+-------------------+------------------------+--------------------------------+

Mostly in order to get rid of deprecated deps, and upgrade vulnerable ones. - Upgrade webpack from 3.x to 4.x - Moved babel package to main repo - Replaced deprecated extract-text-webpack-plugin with extract-text-webpack-plugin - Replaced deprecated babel-minify-webpack-plugin with terser-webpack-plugin - Replaced deprecated node-sass with (dart) sass package - Replaced deprecated sass-lint with stylelint (the rules might be a bit different Related to shaarli#1531: trivy doesn't raise any more issue

immanuelfodor · 2020-09-28T05:28:45Z

I retested the image after I've rebuilt my Docker image with plugins added over shaarli/shaarli:master and no vulnerabilities found this time. It seems #1561 fixed them all.

nodiscc · 2020-10-04T11:44:18Z

Trivy runs much more extensive tests than Clair. I'll have a look at adding it to the Travis CI pipeline.

nodiscc · 2020-11-22T12:25:57Z

https://hub.docker.com/repository/docker/shaarli/shaarli ->

In the mean time, should we enable it?

ArthurHoaro · 2020-11-24T10:34:39Z

It's not available in the free tier.

- run trivy from makefile so that it can be run both locally and through github actions - usage: make test_trivy TRIVY_TARGET_DOCKER_IMAGE=regist.ry/user/image:tag - tested by downgrading the base image to alpine 3.15.7 and verifying that vulnerabilities are reported (https://github.com/nodiscc/Shaarli/actions/runs/4860040980/jobs/8663400103) - TEMP/TESTING only push image to ghcr.io, run trivy on trivy branch/docker tag as well as master - ref. shaarli#1531

nodiscc · 2023-05-02T10:31:22Z

PR #1980 mostly fixes this by running trivy vulnerability scanner on the Docker image built from master. Possible improvements:

~~cache downloaded trivy tarball (35MB) to speed up build times?~~
run trivy periodically on the latest release image?
exit with error when vulnerabilities are found (currently the build log needs to be checked manually)

…poser.lock) - run scan on each push/pull request update - can be run locally using make test_trivy_repo - exit with error code 0/success when vulnerabilities are found, as not to make the workflow fail, a separate periodic run that exits with code 1 should be added in parallel - update trivy to v0.43.0 - https://github.com/aquasecurity/trivy/releases/tag/v0.43.0 - also consider TRIVY_EXIT_CODE when running trivy on the latest docker image - ref. shaarli#1531

…e, composer/yarn dependencies - add badge to README - any time a new vulnerability is found by this workflow, means it is probably time to update Shaarli's base docker image and perform a new release, and/or update npm dependencies (npm audit fix) or composer dependencies (composer update) - similar jobs already exist in the pipeline for master/latest docker image but will not raise an error - fixes shaarli#1531

nodiscc · 2023-11-26T14:31:02Z

run trivy periodically on the latest release image?

#2047

nodiscc · 2023-12-03T13:21:14Z

A daily security scan is now in place, the status will be displayed in the README through this badge

As expected it is currently failing, #2050 should improve this.

nodiscc added enhancement security tools developer tools docker containers & cloud labels Aug 31, 2020

nodiscc added this to the 1.0.0 milestone Sep 12, 2020

ArthurHoaro mentioned this issue Sep 22, 2020

Upgrade front end dependencies #1561

Merged

nodiscc self-assigned this May 25, 2021

nodiscc mentioned this issue May 2, 2023

tools: run trivy vulnerability scanner on the 'latest' docker image #1980

Merged

nodiscc mentioned this issue Jun 30, 2023

tools/CI: scan repository with trivy security scanner (yarn.lock, composer.lock) #1998

Merged

nodiscc mentioned this issue Sep 20, 2023

dockerfile: update base alpine image to v3.18 #2019

Closed

nodiscc mentioned this issue Nov 26, 2023

github actions: run daily trivy security scans on release docker image, composer/yarn dependencies #2047

Merged

nodiscc modified the milestones: 1.0.0, 0.14.0 Nov 26, 2023

nodiscc removed their assignment Nov 26, 2023

nodiscc mentioned this issue Dec 3, 2023

docker: update base Alpine image to 3.18.x #2050

Closed

nodiscc closed this as completed in #2047 Dec 3, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Automate Docker images vulnerability scanning #1531

Automate Docker images vulnerability scanning #1531

nodiscc commented Aug 31, 2020

nodiscc commented Sep 20, 2020

immanuelfodor commented Sep 20, 2020

ArthurHoaro commented Sep 22, 2020

immanuelfodor commented Sep 28, 2020

nodiscc commented Oct 4, 2020

nodiscc commented Nov 22, 2020

ArthurHoaro commented Nov 24, 2020

nodiscc commented May 2, 2023 •

edited

Loading

nodiscc commented Nov 26, 2023

nodiscc commented Dec 3, 2023

Automate Docker images vulnerability scanning #1531

Automate Docker images vulnerability scanning #1531

Comments

nodiscc commented Aug 31, 2020

nodiscc commented Sep 20, 2020

immanuelfodor commented Sep 20, 2020

ArthurHoaro commented Sep 22, 2020

immanuelfodor commented Sep 28, 2020

nodiscc commented Oct 4, 2020

nodiscc commented Nov 22, 2020

ArthurHoaro commented Nov 24, 2020

nodiscc commented May 2, 2023 • edited Loading

nodiscc commented Nov 26, 2023

nodiscc commented Dec 3, 2023

nodiscc commented May 2, 2023 •

edited

Loading