Windows Image: OS-Level is not scanned
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- docker
- Domain
- operating-systems, security
Research direction
Start by running the example command against the Windows Nano Server image and review the linked article on reading Windows container versions. Trace how the scan identifies the existing curl package and determine where Windows OS build information and Microsoft Security Response Center data would fit. Done means outdated Windows base-image versions are detected and surfaced with relevant vulnerability information.
Written by the indexing model from the issue text.
Description
Thank you that it is already possible to scan Windows images even if it is still very slow.
However, I miss the OS level in the scan.
If an image is scanned with an outdated base image, at least a warning should be displayed.
It might also be possible to display the CVE directly from sources such as https://msrc.microsoft.com/update-guide/vulnerability
Example:
docker scout cves mcr.microsoft.com/windows/nanoserver:1809-KB4464455
Only finds the outdated curl package in the image but that the Windows version is from November 13, 2018 (operating system build 17763.107) is not detected and displayed.
It is possible to read the Windows version from the image. Described e.g. in this article
https://jamiemagee.co.uk/blog/scanning-windows-container-images-is-surprisingly-easy/
- Dominant language
- Shell
- Stars
- 454
- Forks
- 134
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker/scout-cli
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
allstar
Difficulty 2/5 1-3 hours Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
panic: nil deref in createVCS() scanning multi-arch image by tag when no attestation sidecar exists Open
Difficulty 4/5 3-5 days Newbie friendliness 64/100
All issues in docker/scout-cli
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
danielmiessler/LifeOS#2218 ·
-
docs(agents): strengthen the no-backslash-escaped-backticks rule with an issue-creation example Open
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
technical-debt
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
ll7/robot_sf_ll7#9560 ·
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
oSoWoSo/vOid_Community_repOsitory#148 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100