CVE is only detected when package is installed, not when it's built from source
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
Reproduce the two Dockerfile cases from the issue and compare the Scout CLI vulnerability results for the installed package and source-built PMIx image. Trace the CLI's image vulnerability detection entry point to determine whether the missing CVE is expected or a defect; done means the behavior is explained and, if defective, covered by a regression test.
Written by the indexing model from the issue text.
Description
Example CVE:
Compare:
- Installing package
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y libpmix2
CVE is detected.
- Building from source
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y \
wget \
tar \
libevent-dev \
libhwloc-dev \
build-essential \
python3
ARG DOCKER_PMIX_VERSION=4.1.2
RUN wget https://github.com/openpmix/openpmix/releases/download/v${DOCKER_PMIX_VERSION}/pmix-${DOCKER_PMIX_VERSION}.tar.gz && \
tar -xzvf pmix-${DOCKER_PMIX_VERSION}.tar.gz && \
cd pmix-${DOCKER_PMIX_VERSION} && \
./configure --prefix=/usr/local && \
make && \
make install
RUN apt purge -y build-essential linux-libc-dev && apt autoremove -y
CVE is not detected
Is this expected?
- Dominant language
- Shell
- Stars
- 454
- Forks
- 134
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker/scout-cli
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
allstar
Difficulty 2/5 1-3 hours Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
panic: nil deref in createVCS() scanning multi-arch image by tag when no attestation sidecar exists Open
Difficulty 4/5 3-5 days Newbie friendliness 64/100
All issues in docker/scout-cli
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
danielmiessler/LifeOS#2218 ·
-
docs(agents): strengthen the no-backslash-escaped-backticks rule with an issue-creation example Open
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
oSoWoSo/vOid_Community_repOsitory#148 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
chore
Difficulty 1/5 Under an hour Newbie friendliness 91/100
alunduil/alunduil-chezmoi#792 ·