diff --git a/reweave/BUILDING-OLD.md b/reweave/BUILDING-OLD.md index d9afeed5..947c680e 100644 --- a/reweave/BUILDING-OLD.md +++ b/reweave/BUILDING-OLD.md @@ -50,6 +50,7 @@ The Makefile includes rules to push these images, which involve pushing all arch The Makefile also includes rules to build a Docker plugin, and to run tests. ## Important Makefile parameters + |Name|Description|Default| |---|---|---| |ARCH|The build target architecture. Can be one of: `amd64` `arm` `arm64` `ppc64le` `s390x`|`amd64`| diff --git a/reweave/CHANGELOG.md b/reweave/CHANGELOG.md new file mode 100644 index 00000000..1d49568b --- /dev/null +++ b/reweave/CHANGELOG.md @@ -0,0 +1,13 @@ +# Changelog + +All changes made to the weave net codebase during the reweave effort will be documented in this file. + +## 2.8.1 + +This was the last released version of the weave net images before the reweave effort began. + +### Added + +* Documentation and tools under the `reweave` directory +* Image security scanning tools +* Security scan reports for `weave-kube` and `weave-npc` images. diff --git a/reweave/Makefile b/reweave/Makefile new file mode 100644 index 00000000..895f8423 --- /dev/null +++ b/reweave/Makefile @@ -0,0 +1,15 @@ +IMAGE_VERSION ?= 2.8.1 +REGISTRY_USER ?= weaveworks + +# Targets +.PHONY: scan +scan: + REGISTRY_USER=${REGISTRY_USER} IMAGE_VERSION=${IMAGE_VERSION} \ + tools/scan-images.sh + +.PHONY: clean-scan +clean-scan: + tools/clean-scans.sh + +.PHONY: clean +clean: clean-scan diff --git a/reweave/README.md b/reweave/README.md index 1f1ee954..98c0c37f 100644 --- a/reweave/README.md +++ b/reweave/README.md @@ -13,6 +13,7 @@ The current focus of this effort is running weave net as a CNI plugin on Kuberne ## Tasks * ~~Document the old build process~~Old build process documented in [BUILDING-OLD.md](BUILDING-OLD.md) +* ~~Create a image scanning process and scan current image~~Image scanning process created, scan reports generated for 2.8.1 * Create a new build process * Build, generate and test current images * Upgrade Go compiler version diff --git a/reweave/scans/images-version.txt b/reweave/scans/images-version.txt new file mode 100644 index 00000000..2ff11ebd --- /dev/null +++ b/reweave/scans/images-version.txt @@ -0,0 +1 @@ +Image version: 2.8.1 diff --git a/reweave/scans/scanner-version.txt b/reweave/scans/scanner-version.txt new file mode 100644 index 00000000..9b9ff02a --- /dev/null +++ b/reweave/scans/scanner-version.txt @@ -0,0 +1,10 @@ +Application: grype +Version: 0.59.0 +Syft Version: v0.74.0 +BuildDate: 2023-03-03T21:34:44Z +GitCommit: 5754360376ace11befb1bd9fa4b0f97d79ea2344 +GitDescription: v0.59.0 +Platform: linux/amd64 +GoVersion: go1.19.6 +Compiler: gc +Supported DB Schema: 5 diff --git a/reweave/scans/weave-kube-count-vulns.txt b/reweave/scans/weave-kube-count-vulns.txt new file mode 100644 index 00000000..0f585ac5 --- /dev/null +++ b/reweave/scans/weave-kube-count-vulns.txt @@ -0,0 +1 @@ +weave-kube CVE Count: 163 diff --git a/reweave/scans/weave-kube-list-vulns.txt b/reweave/scans/weave-kube-list-vulns.txt new file mode 100644 index 00000000..fcf41d21 --- /dev/null +++ b/reweave/scans/weave-kube-list-vulns.txt @@ -0,0 +1,165 @@ +NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY +apk-tools 2.10.4-r2 2.10.6-r0 apk CVE-2021-30139 High +apk-tools 2.10.4-r2 2.10.7-r0 apk CVE-2021-36159 Critical +bind-libs 9.14.12-r0 9.16.11-r2 apk CVE-2020-8625 High +bind-libs 9.14.12-r0 9.16.15-r0 apk CVE-2021-25214 Medium +bind-libs 9.14.12-r0 9.16.15-r0 apk CVE-2021-25215 High +bind-libs 9.14.12-r0 9.16.15-r0 apk CVE-2021-25216 Critical +bind-libs 9.14.12-r0 9.16.4-r0 apk CVE-2020-8618 Medium +bind-libs 9.14.12-r0 9.16.4-r0 apk CVE-2020-8619 Medium +bind-libs 9.14.12-r0 9.16.6-r0 apk CVE-2020-8620 High +bind-libs 9.14.12-r0 9.16.6-r0 apk CVE-2020-8621 High +bind-libs 9.14.12-r0 9.16.6-r0 apk CVE-2020-8622 Medium +bind-libs 9.14.12-r0 9.16.6-r0 apk CVE-2020-8623 High +bind-libs 9.14.12-r0 9.16.6-r0 apk CVE-2020-8624 Medium +bind-tools 9.14.12-r0 9.16.11-r2 apk CVE-2020-8625 High +bind-tools 9.14.12-r0 9.16.15-r0 apk CVE-2021-25214 Medium +bind-tools 9.14.12-r0 9.16.15-r0 apk CVE-2021-25215 High +bind-tools 9.14.12-r0 9.16.15-r0 apk CVE-2021-25216 Critical +bind-tools 9.14.12-r0 9.16.4-r0 apk CVE-2020-8618 Medium +bind-tools 9.14.12-r0 9.16.4-r0 apk CVE-2020-8619 Medium +bind-tools 9.14.12-r0 9.16.6-r0 apk CVE-2020-8620 High +bind-tools 9.14.12-r0 9.16.6-r0 apk CVE-2020-8621 High +bind-tools 9.14.12-r0 9.16.6-r0 apk CVE-2020-8622 Medium +bind-tools 9.14.12-r0 9.16.6-r0 apk CVE-2020-8623 High +bind-tools 9.14.12-r0 9.16.6-r0 apk CVE-2020-8624 Medium +busybox 1.30.1-r3 apk CVE-2021-42374 Medium +busybox 1.30.1-r3 apk CVE-2021-42376 Medium +busybox 1.30.1-r3 apk CVE-2021-42378 High +busybox 1.30.1-r3 apk CVE-2021-42379 High +busybox 1.30.1-r3 apk CVE-2021-42380 High +busybox 1.30.1-r3 apk CVE-2021-42381 High +busybox 1.30.1-r3 apk CVE-2021-42382 High +busybox 1.30.1-r3 apk CVE-2021-42384 High +busybox 1.30.1-r3 apk CVE-2021-42385 High +busybox 1.30.1-r3 apk CVE-2021-42386 High +busybox 1.30.1-r3 apk CVE-2022-28391 High +busybox 1.30.1-r3 1.30.1-r5 apk CVE-2021-28831 High +curl 7.66.0-r0 apk CVE-2020-8284 Low +curl 7.66.0-r0 apk CVE-2021-22897 Medium +curl 7.66.0-r0 apk CVE-2021-22922 Medium +curl 7.66.0-r0 apk CVE-2021-22923 Medium +curl 7.66.0-r0 apk CVE-2021-22925 Medium +curl 7.66.0-r0 apk CVE-2021-22926 High +curl 7.66.0-r0 apk CVE-2021-22946 High +curl 7.66.0-r0 apk CVE-2021-22947 Medium +curl 7.66.0-r0 apk CVE-2022-22576 High +curl 7.66.0-r0 apk CVE-2022-27774 Medium +curl 7.66.0-r0 apk CVE-2022-27775 High +curl 7.66.0-r0 apk CVE-2022-27776 Medium +curl 7.66.0-r0 apk CVE-2022-27781 High +curl 7.66.0-r0 apk CVE-2022-27782 High +curl 7.66.0-r0 apk CVE-2022-32206 Medium +curl 7.66.0-r0 apk CVE-2022-32207 Critical +curl 7.66.0-r0 apk CVE-2022-32208 Medium +curl 7.66.0-r0 apk CVE-2022-32221 Critical +curl 7.66.0-r0 apk CVE-2022-35252 Low +curl 7.66.0-r0 apk CVE-2022-43552 Medium +curl 7.66.0-r0 apk CVE-2023-23916 High +curl 7.66.0-r0 7.66.0-r1 apk CVE-2020-8169 High +curl 7.66.0-r0 7.66.0-r1 apk CVE-2020-8177 High +curl 7.66.0-r0 7.66.0-r2 apk CVE-2020-8231 High +curl 7.66.0-r0 7.66.0-r3 apk CVE-2020-8285 High +curl 7.66.0-r0 7.66.0-r3 apk CVE-2020-8286 High +curl 7.66.0-r0 7.66.0-r4 apk CVE-2021-22898 Low +github.com/aws/aws-sdk-go v1.13.22 1.34.0 go-module GHSA-76wf-9vgp-pj7w Medium +github.com/aws/aws-sdk-go v1.13.22 1.34.0 go-module GHSA-7f33-f4f5-xwgw Low +github.com/aws/aws-sdk-go v1.13.22 1.34.0 go-module GHSA-f5pg-7wfw-84q9 Medium +github.com/containernetworking/cni v0.5.2 0.8.1 go-module GHSA-xjqr-g762-pxwp High +github.com/docker/distribution v2.6.0-rc.1.0.20180327202408-83389a148052+incompatible 2.7.0-rc.0 go-module GHSA-h62f-wm92-2cmw High +github.com/docker/distribution v2.6.0-rc.1.0.20180327202408-83389a148052+incompatible 2.8.0 go-module GHSA-qq97-vm5h-rrhg Low +github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2018-10892 Medium +github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2019-13139 High +github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2019-13509 High +github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2019-16884 High +github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2019-5736 High +github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2020-27534 Medium +github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2021-21284 Medium +github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2021-21285 Medium +github.com/gogo/protobuf v1.3.1 1.3.2 go-module GHSA-c3h9-896r-86jm High +github.com/miekg/dns v1.0.4 1.0.10 go-module GHSA-9jcx-pr2f-qvq5 High +github.com/miekg/dns v1.0.4 1.1.25 go-module GHSA-44r7-7p62-q3fr Medium +github.com/opencontainers/image-spec v1.0.1 1.0.2 go-module GHSA-77vh-xpmg-72qh Low +github.com/opencontainers/runc v0.1.1 go-module GHSA-vpvm-3wq2-2wvm High +github.com/opencontainers/runc v0.1.1 1.0.0-rc3 go-module GHSA-gp4j-w3vj-7299 Medium +github.com/opencontainers/runc v0.1.1 1.0.0-rc8.0.20190930145003-cad42f6e0932 go-module GHSA-fgv8-vj5c-2ppq High +github.com/opencontainers/runc v0.1.1 1.0.0-rc9.0.20200122160610-2fc03cc11c77 go-module GHSA-fh74-hm69-rqjw Medium +github.com/opencontainers/runc v0.1.1 1.0.0-rc91 go-module GHSA-g54h-m393-cpwq Low +github.com/opencontainers/runc v0.1.1 1.0.0-rc95 go-module GHSA-c3xm-pvg7-gh7r High +github.com/opencontainers/runc v0.1.1 1.0.3 go-module GHSA-v95c-p5hm-xq8f Medium +github.com/opencontainers/runc v0.1.1 1.1.2 go-module GHSA-f3fp-gc8g-vw66 Medium +github.com/prometheus/client_golang v1.7.1 go-module CVE-2022-21698 High +github.com/prometheus/client_golang v1.7.1 1.11.1 go-module GHSA-cg3q-j54f-5p7p High +golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 0.0.0-20201216223049-8b5274cf687f go-module GHSA-3vm4-22fp-5rfm High +golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 0.0.0-20211202192323-5770296d904e go-module GHSA-gwc9-m7rh-j2ww High +golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 0.0.0-20220314234659-1baeb1ce4c0b go-module GHSA-8c26-wmh5-6g9v High +golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.0.0-20210428140749-89ef3d95e781 go-module GHSA-h86h-8ppg-mxmh Medium +golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.0.0-20210520170846-37e1c6afe023 go-module GHSA-83g2-8m93-v3w7 High +golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.0.0-20220906165146-f3363e06e74c go-module GHSA-69cg-p879-7622 High +golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.7.0 go-module GHSA-vvpx-j8f3-3w6h High +golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1 0.0.0-20220412211240-33da011f77ad go-module GHSA-p782-xgp4-8hr8 Medium +golang.org/x/text v0.3.2 0.3.7 go-module GHSA-ppp9-7jff-5vj2 High +golang.org/x/text v0.3.2 0.3.8 go-module GHSA-69ch-w2m2-3vjp High +k8s.io/client-go v0.18.6 0.20.0-alpha.2 go-module GHSA-8cfg-vx93-jvxw Medium +krb5-libs 1.17-r0 1.17.2-r0 apk CVE-2020-28196 High +libcrypto1.1 1.1.1g-r0 apk CVE-2021-3711 Critical +libcrypto1.1 1.1.1g-r0 apk CVE-2021-3712 High +libcrypto1.1 1.1.1g-r0 apk CVE-2021-4160 Medium +libcrypto1.1 1.1.1g-r0 apk CVE-2022-0778 High +libcrypto1.1 1.1.1g-r0 apk CVE-2022-1292 Critical +libcrypto1.1 1.1.1g-r0 apk CVE-2022-2068 Critical +libcrypto1.1 1.1.1g-r0 apk CVE-2022-2097 Medium +libcrypto1.1 1.1.1g-r0 apk CVE-2022-4304 Medium +libcrypto1.1 1.1.1g-r0 apk CVE-2022-4450 High +libcrypto1.1 1.1.1g-r0 apk CVE-2023-0215 High +libcrypto1.1 1.1.1g-r0 apk CVE-2023-0286 High +libcrypto1.1 1.1.1g-r0 1.1.1i-r0 apk CVE-2020-1971 Medium +libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23839 Low +libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23840 High +libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23841 Medium +libcrypto1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3449 Medium +libcrypto1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3450 High +libcurl 7.66.0-r0 7.66.0-r1 apk CVE-2020-8169 High +libcurl 7.66.0-r0 7.66.0-r1 apk CVE-2020-8177 High +libcurl 7.66.0-r0 7.66.0-r2 apk CVE-2020-8231 High +libcurl 7.66.0-r0 7.66.0-r3 apk CVE-2020-8285 High +libcurl 7.66.0-r0 7.66.0-r3 apk CVE-2020-8286 High +libcurl 7.66.0-r0 7.66.0-r4 apk CVE-2021-22898 Low +libssl1.1 1.1.1g-r0 apk CVE-2021-3711 Critical +libssl1.1 1.1.1g-r0 apk CVE-2021-3712 High +libssl1.1 1.1.1g-r0 apk CVE-2021-4160 Medium +libssl1.1 1.1.1g-r0 apk CVE-2022-0778 High +libssl1.1 1.1.1g-r0 apk CVE-2022-1292 Critical +libssl1.1 1.1.1g-r0 apk CVE-2022-2068 Critical +libssl1.1 1.1.1g-r0 apk CVE-2022-2097 Medium +libssl1.1 1.1.1g-r0 apk CVE-2022-4304 Medium +libssl1.1 1.1.1g-r0 apk CVE-2022-4450 High +libssl1.1 1.1.1g-r0 apk CVE-2023-0215 High +libssl1.1 1.1.1g-r0 apk CVE-2023-0286 High +libssl1.1 1.1.1g-r0 1.1.1i-r0 apk CVE-2020-1971 Medium +libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23839 Low +libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23840 High +libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23841 Medium +libssl1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3449 Medium +libssl1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3450 High +libxml2 2.9.9-r3 2.9.9-r4 apk CVE-2020-24977 Medium +libxml2 2.9.9-r3 2.9.9-r5 apk CVE-2021-3517 High +libxml2 2.9.9-r3 2.9.9-r5 apk CVE-2021-3518 High +libxml2 2.9.9-r3 2.9.9-r5 apk CVE-2021-3537 Medium +musl 1.1.22-r3 1.1.22-r4 apk CVE-2020-28928 Medium +musl-utils 1.1.22-r3 1.1.22-r4 apk CVE-2020-28928 Medium +protobuf 3.6.1-r1 apk CVE-2021-22570 Medium +ssl_client 1.30.1-r3 apk CVE-2021-42374 Medium +ssl_client 1.30.1-r3 apk CVE-2021-42376 Medium +ssl_client 1.30.1-r3 apk CVE-2021-42378 High +ssl_client 1.30.1-r3 apk CVE-2021-42379 High +ssl_client 1.30.1-r3 apk CVE-2021-42380 High +ssl_client 1.30.1-r3 apk CVE-2021-42381 High +ssl_client 1.30.1-r3 apk CVE-2021-42382 High +ssl_client 1.30.1-r3 apk CVE-2021-42384 High +ssl_client 1.30.1-r3 apk CVE-2021-42385 High +ssl_client 1.30.1-r3 apk CVE-2021-42386 High +ssl_client 1.30.1-r3 apk CVE-2022-28391 High +ssl_client 1.30.1-r3 1.30.1-r5 apk CVE-2021-28831 High +zlib 1.2.11-r1 apk CVE-2018-25032 High +zlib 1.2.11-r1 apk CVE-2022-37434 Critical diff --git a/reweave/scans/weave-npc-count-vulns.txt b/reweave/scans/weave-npc-count-vulns.txt new file mode 100644 index 00000000..7c5cce2f --- /dev/null +++ b/reweave/scans/weave-npc-count-vulns.txt @@ -0,0 +1 @@ +weave-npc CVE Count: 77 diff --git a/reweave/scans/weave-npc-list-vulns.txt b/reweave/scans/weave-npc-list-vulns.txt new file mode 100644 index 00000000..042b44e0 --- /dev/null +++ b/reweave/scans/weave-npc-list-vulns.txt @@ -0,0 +1,79 @@ +NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY +apk-tools 2.10.4-r2 2.10.6-r0 apk CVE-2021-30139 High +apk-tools 2.10.4-r2 2.10.7-r0 apk CVE-2021-36159 Critical +busybox 1.30.1-r3 apk CVE-2021-42374 Medium +busybox 1.30.1-r3 apk CVE-2021-42376 Medium +busybox 1.30.1-r3 apk CVE-2021-42378 High +busybox 1.30.1-r3 apk CVE-2021-42379 High +busybox 1.30.1-r3 apk CVE-2021-42380 High +busybox 1.30.1-r3 apk CVE-2021-42381 High +busybox 1.30.1-r3 apk CVE-2021-42382 High +busybox 1.30.1-r3 apk CVE-2021-42384 High +busybox 1.30.1-r3 apk CVE-2021-42385 High +busybox 1.30.1-r3 apk CVE-2021-42386 High +busybox 1.30.1-r3 apk CVE-2022-28391 High +busybox 1.30.1-r3 1.30.1-r5 apk CVE-2021-28831 High +github.com/gogo/protobuf v1.3.1 1.3.2 go-module GHSA-c3h9-896r-86jm High +github.com/prometheus/client_golang v1.7.1 go-module CVE-2022-21698 High +github.com/prometheus/client_golang v1.7.1 1.11.1 go-module GHSA-cg3q-j54f-5p7p High +golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 0.0.0-20201216223049-8b5274cf687f go-module GHSA-3vm4-22fp-5rfm High +golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 0.0.0-20211202192323-5770296d904e go-module GHSA-gwc9-m7rh-j2ww High +golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 0.0.0-20220314234659-1baeb1ce4c0b go-module GHSA-8c26-wmh5-6g9v High +golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.0.0-20210428140749-89ef3d95e781 go-module GHSA-h86h-8ppg-mxmh Medium +golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.0.0-20210520170846-37e1c6afe023 go-module GHSA-83g2-8m93-v3w7 High +golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.0.0-20220906165146-f3363e06e74c go-module GHSA-69cg-p879-7622 High +golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.7.0 go-module GHSA-vvpx-j8f3-3w6h High +golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1 0.0.0-20220412211240-33da011f77ad go-module GHSA-p782-xgp4-8hr8 Medium +golang.org/x/text v0.3.2 0.3.7 go-module GHSA-ppp9-7jff-5vj2 High +golang.org/x/text v0.3.2 0.3.8 go-module GHSA-69ch-w2m2-3vjp High +k8s.io/client-go v0.18.6 0.20.0-alpha.2 go-module GHSA-8cfg-vx93-jvxw Medium +libcrypto1.1 1.1.1g-r0 apk CVE-2021-3711 Critical +libcrypto1.1 1.1.1g-r0 apk CVE-2021-3712 High +libcrypto1.1 1.1.1g-r0 apk CVE-2021-4160 Medium +libcrypto1.1 1.1.1g-r0 apk CVE-2022-0778 High +libcrypto1.1 1.1.1g-r0 apk CVE-2022-1292 Critical +libcrypto1.1 1.1.1g-r0 apk CVE-2022-2068 Critical +libcrypto1.1 1.1.1g-r0 apk CVE-2022-2097 Medium +libcrypto1.1 1.1.1g-r0 apk CVE-2022-4304 Medium +libcrypto1.1 1.1.1g-r0 apk CVE-2022-4450 High +libcrypto1.1 1.1.1g-r0 apk CVE-2023-0215 High +libcrypto1.1 1.1.1g-r0 apk CVE-2023-0286 High +libcrypto1.1 1.1.1g-r0 1.1.1i-r0 apk CVE-2020-1971 Medium +libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23839 Low +libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23840 High +libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23841 Medium +libcrypto1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3449 Medium +libcrypto1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3450 High +libssl1.1 1.1.1g-r0 apk CVE-2021-3711 Critical +libssl1.1 1.1.1g-r0 apk CVE-2021-3712 High +libssl1.1 1.1.1g-r0 apk CVE-2021-4160 Medium +libssl1.1 1.1.1g-r0 apk CVE-2022-0778 High +libssl1.1 1.1.1g-r0 apk CVE-2022-1292 Critical +libssl1.1 1.1.1g-r0 apk CVE-2022-2068 Critical +libssl1.1 1.1.1g-r0 apk CVE-2022-2097 Medium +libssl1.1 1.1.1g-r0 apk CVE-2022-4304 Medium +libssl1.1 1.1.1g-r0 apk CVE-2022-4450 High +libssl1.1 1.1.1g-r0 apk CVE-2023-0215 High +libssl1.1 1.1.1g-r0 apk CVE-2023-0286 High +libssl1.1 1.1.1g-r0 1.1.1i-r0 apk CVE-2020-1971 Medium +libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23839 Low +libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23840 High +libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23841 Medium +libssl1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3449 Medium +libssl1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3450 High +musl 1.1.22-r3 1.1.22-r4 apk CVE-2020-28928 Medium +musl-utils 1.1.22-r3 1.1.22-r4 apk CVE-2020-28928 Medium +ssl_client 1.30.1-r3 apk CVE-2021-42374 Medium +ssl_client 1.30.1-r3 apk CVE-2021-42376 Medium +ssl_client 1.30.1-r3 apk CVE-2021-42378 High +ssl_client 1.30.1-r3 apk CVE-2021-42379 High +ssl_client 1.30.1-r3 apk CVE-2021-42380 High +ssl_client 1.30.1-r3 apk CVE-2021-42381 High +ssl_client 1.30.1-r3 apk CVE-2021-42382 High +ssl_client 1.30.1-r3 apk CVE-2021-42384 High +ssl_client 1.30.1-r3 apk CVE-2021-42385 High +ssl_client 1.30.1-r3 apk CVE-2021-42386 High +ssl_client 1.30.1-r3 apk CVE-2022-28391 High +ssl_client 1.30.1-r3 1.30.1-r5 apk CVE-2021-28831 High +zlib 1.2.11-r1 apk CVE-2018-25032 High +zlib 1.2.11-r1 apk CVE-2022-37434 Critical diff --git a/reweave/tools/clean-scans.sh b/reweave/tools/clean-scans.sh new file mode 100755 index 00000000..cb5d13c7 --- /dev/null +++ b/reweave/tools/clean-scans.sh @@ -0,0 +1,7 @@ +#!/bin/sh +set -e + +# Get directory of script file +a="/$0"; a="${a%/*}"; a="${a:-.}"; a="${a##/}/"; BINDIR=$(cd "$a"; pwd) + +rm "${BINDIR}/../scans/"* \ No newline at end of file diff --git a/reweave/tools/scan-images.sh b/reweave/tools/scan-images.sh new file mode 100755 index 00000000..ac130bbc --- /dev/null +++ b/reweave/tools/scan-images.sh @@ -0,0 +1,36 @@ +#!/bin/sh +set -e + +# These variables are used to choose the images to scan. Change as +# required. +: "${IMAGE_VERSION:=}" +: "${REGISTRY_USER:=}" + +if [ -z "${IMAGE_VERSION}" ] || [ -z "${REGISTRY_USER}" ] ; then + >&2 echo "Please provide valid values for IMAGE_VERSION and REGISTRY_USER." + exit 1 +fi + +echo "Scanning images and collecting data..." + +# Currently, we are interested only in the weave-kube and weave-npc +# images. +WEAVE_KUBE_IMAGE="${REGISTRY_USER}/weave-kube:${IMAGE_VERSION}" +WEAVE_NPC_IMAGE="${REGISTRY_USER}/weave-npc:${IMAGE_VERSION}" + +# Get directory of script file +a="/$0"; a="${a%/*}"; a="${a:-.}"; a="${a##/}/"; BINDIR=$(cd "$a"; pwd) +mkdir -p "${BINDIR}/../scans" + +echo "Image version: ${IMAGE_VERSION}" >"${BINDIR}/../scans/images-version.txt" + +grype version >"${BINDIR}/../scans/scanner-version.txt" + +grype "${WEAVE_KUBE_IMAGE}" --add-cpes-if-none >"${BINDIR}/../scans/weave-kube-list-vulns.txt" +grype "${WEAVE_NPC_IMAGE}" --add-cpes-if-none >"${BINDIR}/../scans/weave-npc-list-vulns.txt" + +echo "weave-kube CVE Count: $(tail +3 "${BINDIR}/../scans/weave-kube-list-vulns.txt" | wc -l)" \ + >"${BINDIR}/../scans/weave-kube-count-vulns.txt" + +echo "weave-npc CVE Count: $(tail +3 "${BINDIR}/../scans/weave-npc-list-vulns.txt" | wc -l)" \ + >"${BINDIR}/../scans/weave-npc-count-vulns.txt"