Stackrox/ACS reporting vulns in packages removed in later layers

Đang mở
  • Có gì không ổn?
#7,033 5 bình luận 1 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
35/100
Loại issue
Lỗi
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Đình trệ
Công nghệ
docker, go, node.js
Lĩnh vực
cli, devops, security

Hướng nghiên cứu

Start with the roxctl image scan command and the reported Dockerfile using node:18.16.1 and [email protected]. Compare how Stackrox handles the final image versus packages present in earlier layers, using the Grype AllLayers and squashed results as a reference. Done means the scan behavior is explained and, if it is incorrect, covered by an appropriate fix or documented expectation.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Hi,

When scanning image node:18.16.1 with ACS it will give this violation:

      "violatedPolicies": [
        {
          "name": "Fixable Severity at least Important",
          "severity": "HIGH",
          "description": "Alert on deployments with fixable vulnerabilities with a Severity Rating at least Important",
          "violation": [
            "Fixable CVE-2022-25883 (CVSS 7.5) (severity Important) found in component 'semver' (version 7.3.8), resolved by version 7.5.2"
          ],
          "remediation": "Use your package manager to update to a fixed version in future builds or speak with your security team to mitigate the vulnerabilities.",
          "failingCheck": true
        },

The image has npm version 9.5.1:

$ podman run -it --entrypoint=/bin/bash node:18.16.1
root@37d1a308c700:/# npm --version
9.5.1

and it clearly uses semver 7.3.8:

root@37d1a308c700:/# npm -g list --depth=20 | grep semver
  | | `-- [email protected] deduped
  | | `-- [email protected] deduped
  | +-- [email protected] deduped
  | +-- [email protected] deduped
  | +-- [email protected] deduped
  | +-- [email protected] deduped
  | | +-- [email protected] deduped
  | +-- [email protected] deduped
  | | +-- [email protected] deduped
  | `-- [email protected] deduped
  | | | | `-- [email protected] deduped
  | +-- [email protected] deduped
  | `-- [email protected] deduped
  | +-- [email protected] deduped
  | `-- [email protected] deduped
  +-- [email protected]
  |   `-- [email protected] deduped

I therefore upgrade npm to 9.8.0 to update semver to 7.5.2:

root@37d1a308c700:/# npm -g install [email protected]

removed 17 packages, and changed 67 packages in 6s

28 packages are looking for funding
  run `npm fund` for details

root@37d1a308c700:/# npm --version
9.8.0

root@37d1a308c700:/# npm -g list --depth=20 | grep semver
  | | `-- [email protected] deduped
  | | `-- [email protected] deduped
  | +-- [email protected] deduped
  | +-- [email protected] deduped
  | | +-- [email protected] deduped
  | | +-- [email protected] deduped
  | +-- [email protected] deduped
  | +-- [email protected] deduped
  | +-- [email protected] deduped
  | `-- [email protected] deduped
  | +-- [email protected] deduped
  | `-- [email protected] deduped
  | +-- [email protected] deduped
  | `-- [email protected] deduped
  +-- [email protected]
  |   `-- [email protected] deduped

And that aligns to where ACS says the fix is: "Fixable CVE-2022-25883 (CVSS 7.5) (severity Important) found in component 'semver' (version 7.3.8), resolved by version 7.5.2".

I create a new container with the npm upgrade within it and scan this with ACS. And the finding is still present:
image

image

If I check the package.json in the container, it shows it's version 7.5.2:

$ podman run namloc2001/nodesem:a cat /usr/local/lib/node_modules/npm/node_modules/semver/package.json | grep version
  "version": "7.5.2",
  "description": "The semantic version parser used by npm.",
    "version": "4.15.1",

And if I check globally the version of semver in the container, I get:

$ podman run namloc2001/nodesem:a npm list -g --depth=20 | grep semver
  | | `-- [email protected] deduped
  | | `-- [email protected] deduped
  | +-- [email protected] deduped
  | +-- [email protected] deduped
  | | +-- [email protected] deduped
  | | +-- [email protected] deduped
  | +-- [email protected] deduped
  | +-- [email protected] deduped
  | +-- [email protected] deduped
  | `-- [email protected] deduped
  | +-- [email protected] deduped
  | `-- [email protected] deduped
  | +-- [email protected] deduped
  | `-- [email protected] deduped
  +-- [email protected]
  |   `-- [email protected] deduped

So it looks like ACS is finding something in a layer in the container, which is then resolved by a later layer

When I scan the updated image with trivy and grype, I don't get any semver alerts. And when I create an SBOM with syft, I get:

...
safe-buffer                         5.2.1                           npm
safer-buffer                        2.1.2                           npm
sed                                 4.9-1                           deb
semver                              7.5.2                           npm          <<<------------------- note it is showing at the correct 7.5.2 version
sensible-utils                      0.0.17+nmu1                     deb
set-blocking                        2.0.0                           npm
shared-mime-info                    2.2-1                           deb
shebang-command                     2.0.0                           npm
shebang-regex                       3.0.0                           npm
...

If I then scan again with Grype, using the -s AllLayers flag (otherwise default is "Squashed"), I get:

$ grype namloc2001/nodesem:a -s AllLayers
 ✔ Vulnerability DB        [updated]
 ✔ Parsed image
 ✔ Cataloged packages      [1282 packages]
 ✔ Scanning image...       [726 vulnerabilities]
   ├── 1 critical, 63 high, 144 medium, 30 low, 445 negligible (43 unknown)
   └── 34 fixed
NAME                          INSTALLED             FIXED-IN     TYPE  VULNERABILITY        SEVERITY
...
python3.11-minimal            3.11.2-6              (won't fix)  deb   CVE-2023-27043       Medium
semver                        7.3.8                 7.5.2        npm   GHSA-c2qf-rxjj-qqgw  Medium
tar                           1.34+dfsg-1.2                      deb   CVE-2005-2541        Negligible
...

I can't see a similar option for roxctl and I also don't now why roxctl wouldn't default to squashed too; the vulnerability isn't in my image if I've removed/upgraded the package. Here is the roxctl command I used:

roxctl image scan --force --endpoint https://localhost:8443 --image namloc2001/nodesem:a --insecure-skip-tls-verify

Here's the Dockerfile I've used:

FROM node:18.16.1
RUN npm install -g [email protected]
Ngôn ngữ chính
Go
Star
1.3k
Fork
194
Merge trung bình
2 ngày 20 giờ
Pull request đã merge (30 ngày)
392

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của stackrox/stackrox

Tất cả issue của stackrox/stackrox

Issue tương tự

Thêm issue về Go

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.