reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Image security scanning process created

Browse Source
This commit is contained in:
Raj Chaudhuri committed 2023-03-27 22:59:38 +05:30
1 parent ee3b7ce368
commit 273c611d43
12 files changed
+330
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

reweave/BUILDING-OLD.md
+1
View File
@@ -50,6 +50,7 @@ The Makefile includes rules to push these images, which involve pushing all arch
The Makefile also includes rules to build a Docker plugin, and to run tests. The Makefile also includes rules to build a Docker plugin, and to run tests.
## Important Makefile parameters ## Important Makefile parameters
|Name|Description|Default| |Name|Description|Default|
|---|---|---| |---|---|---|
|ARCH|The build target architecture. Can be one of: `amd64` `arm` `arm64` `ppc64le` `s390x`|`amd64`| |ARCH|The build target architecture. Can be one of: `amd64` `arm` `arm64` `ppc64le` `s390x`|`amd64`|
reweave/CHANGELOG.md
+13
View File
@@ -0,0 +1,13 @@
# Changelog
All changes made to the weave net codebase during the reweave effort will be documented in this file.
## 2.8.1
This was the last released version of the weave net images before the reweave effort began.
### Added
* Documentation and tools under the `reweave` directory
* Image security scanning tools
* Security scan reports for `weave-kube` and `weave-npc` images.
reweave/Makefile
+15
View File
@@ -0,0 +1,15 @@
IMAGE_VERSION ?= 2.8.1
REGISTRY_USER ?= weaveworks
# Targets
.PHONY: scan
scan:
REGISTRY_USER=${REGISTRY_USER} IMAGE_VERSION=${IMAGE_VERSION} \
tools/scan-images.sh
.PHONY: clean-scan
clean-scan:
tools/clean-scans.sh
.PHONY: clean
clean: clean-scan
reweave/README.md
+1
View File
@@ -13,6 +13,7 @@ The current focus of this effort is running weave net as a CNI plugin on Kuberne
## Tasks ## Tasks
* ~~Document the old build process~~Old build process documented in [BUILDING-OLD.md](BUILDING-OLD.md) * ~~Document the old build process~~Old build process documented in [BUILDING-OLD.md](BUILDING-OLD.md)
* ~~Create a image scanning process and scan current image~~Image scanning process created, scan reports generated for 2.8.1
* Create a new build process * Create a new build process
* Build, generate and test current images * Build, generate and test current images
* Upgrade Go compiler version * Upgrade Go compiler version
reweave/scans/images-version.txt
+1
View File
@@ -0,0 +1 @@
Image version: 2.8.1
reweave/scans/scanner-version.txt
+10
View File
@@ -0,0 +1,10 @@
Application: grype
Version: 0.59.0
Syft Version: v0.74.0
BuildDate: 2023-03-03T21:34:44Z
GitCommit: 5754360376ace11befb1bd9fa4b0f97d79ea2344
GitDescription: v0.59.0
Platform: linux/amd64
GoVersion: go1.19.6
Compiler: gc
Supported DB Schema: 5
reweave/scans/weave-kube-count-vulns.txt
+1
View File
@@ -0,0 +1 @@
weave-kube CVE Count: 163
reweave/scans/weave-kube-list-vulns.txt
+165
View File
@@ -0,0 +1,165 @@
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
apk-tools 2.10.4-r2 2.10.6-r0 apk CVE-2021-30139 High
apk-tools 2.10.4-r2 2.10.7-r0 apk CVE-2021-36159 Critical
bind-libs 9.14.12-r0 9.16.11-r2 apk CVE-2020-8625 High
bind-libs 9.14.12-r0 9.16.15-r0 apk CVE-2021-25214 Medium
bind-libs 9.14.12-r0 9.16.15-r0 apk CVE-2021-25215 High
bind-libs 9.14.12-r0 9.16.15-r0 apk CVE-2021-25216 Critical
bind-libs 9.14.12-r0 9.16.4-r0 apk CVE-2020-8618 Medium
bind-libs 9.14.12-r0 9.16.4-r0 apk CVE-2020-8619 Medium
bind-libs 9.14.12-r0 9.16.6-r0 apk CVE-2020-8620 High
bind-libs 9.14.12-r0 9.16.6-r0 apk CVE-2020-8621 High
bind-libs 9.14.12-r0 9.16.6-r0 apk CVE-2020-8622 Medium
bind-libs 9.14.12-r0 9.16.6-r0 apk CVE-2020-8623 High
bind-libs 9.14.12-r0 9.16.6-r0 apk CVE-2020-8624 Medium
bind-tools 9.14.12-r0 9.16.11-r2 apk CVE-2020-8625 High
bind-tools 9.14.12-r0 9.16.15-r0 apk CVE-2021-25214 Medium
bind-tools 9.14.12-r0 9.16.15-r0 apk CVE-2021-25215 High
bind-tools 9.14.12-r0 9.16.15-r0 apk CVE-2021-25216 Critical
bind-tools 9.14.12-r0 9.16.4-r0 apk CVE-2020-8618 Medium
bind-tools 9.14.12-r0 9.16.4-r0 apk CVE-2020-8619 Medium
bind-tools 9.14.12-r0 9.16.6-r0 apk CVE-2020-8620 High
bind-tools 9.14.12-r0 9.16.6-r0 apk CVE-2020-8621 High
bind-tools 9.14.12-r0 9.16.6-r0 apk CVE-2020-8622 Medium
bind-tools 9.14.12-r0 9.16.6-r0 apk CVE-2020-8623 High
bind-tools 9.14.12-r0 9.16.6-r0 apk CVE-2020-8624 Medium
busybox 1.30.1-r3 apk CVE-2021-42374 Medium
busybox 1.30.1-r3 apk CVE-2021-42376 Medium
busybox 1.30.1-r3 apk CVE-2021-42378 High
busybox 1.30.1-r3 apk CVE-2021-42379 High
busybox 1.30.1-r3 apk CVE-2021-42380 High
busybox 1.30.1-r3 apk CVE-2021-42381 High
busybox 1.30.1-r3 apk CVE-2021-42382 High
busybox 1.30.1-r3 apk CVE-2021-42384 High
busybox 1.30.1-r3 apk CVE-2021-42385 High
busybox 1.30.1-r3 apk CVE-2021-42386 High
busybox 1.30.1-r3 apk CVE-2022-28391 High
busybox 1.30.1-r3 1.30.1-r5 apk CVE-2021-28831 High
curl 7.66.0-r0 apk CVE-2020-8284 Low
curl 7.66.0-r0 apk CVE-2021-22897 Medium
curl 7.66.0-r0 apk CVE-2021-22922 Medium
curl 7.66.0-r0 apk CVE-2021-22923 Medium
curl 7.66.0-r0 apk CVE-2021-22925 Medium
curl 7.66.0-r0 apk CVE-2021-22926 High
curl 7.66.0-r0 apk CVE-2021-22946 High
curl 7.66.0-r0 apk CVE-2021-22947 Medium
curl 7.66.0-r0 apk CVE-2022-22576 High
curl 7.66.0-r0 apk CVE-2022-27774 Medium
curl 7.66.0-r0 apk CVE-2022-27775 High
curl 7.66.0-r0 apk CVE-2022-27776 Medium
curl 7.66.0-r0 apk CVE-2022-27781 High
curl 7.66.0-r0 apk CVE-2022-27782 High
curl 7.66.0-r0 apk CVE-2022-32206 Medium
curl 7.66.0-r0 apk CVE-2022-32207 Critical
curl 7.66.0-r0 apk CVE-2022-32208 Medium
curl 7.66.0-r0 apk CVE-2022-32221 Critical
curl 7.66.0-r0 apk CVE-2022-35252 Low
curl 7.66.0-r0 apk CVE-2022-43552 Medium
curl 7.66.0-r0 apk CVE-2023-23916 High
curl 7.66.0-r0 7.66.0-r1 apk CVE-2020-8169 High
curl 7.66.0-r0 7.66.0-r1 apk CVE-2020-8177 High
curl 7.66.0-r0 7.66.0-r2 apk CVE-2020-8231 High
curl 7.66.0-r0 7.66.0-r3 apk CVE-2020-8285 High
curl 7.66.0-r0 7.66.0-r3 apk CVE-2020-8286 High
curl 7.66.0-r0 7.66.0-r4 apk CVE-2021-22898 Low
github.com/aws/aws-sdk-go v1.13.22 1.34.0 go-module GHSA-76wf-9vgp-pj7w Medium
github.com/aws/aws-sdk-go v1.13.22 1.34.0 go-module GHSA-7f33-f4f5-xwgw Low
github.com/aws/aws-sdk-go v1.13.22 1.34.0 go-module GHSA-f5pg-7wfw-84q9 Medium
github.com/containernetworking/cni v0.5.2 0.8.1 go-module GHSA-xjqr-g762-pxwp High
github.com/docker/distribution v2.6.0-rc.1.0.20180327202408-83389a148052+incompatible 2.7.0-rc.0 go-module GHSA-h62f-wm92-2cmw High
github.com/docker/distribution v2.6.0-rc.1.0.20180327202408-83389a148052+incompatible 2.8.0 go-module GHSA-qq97-vm5h-rrhg Low
github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2018-10892 Medium
github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2019-13139 High
github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2019-13509 High
github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2019-16884 High
github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2019-5736 High
github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2020-27534 Medium
github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2021-21284 Medium
github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible go-module CVE-2021-21285 Medium
github.com/gogo/protobuf v1.3.1 1.3.2 go-module GHSA-c3h9-896r-86jm High
github.com/miekg/dns v1.0.4 1.0.10 go-module GHSA-9jcx-pr2f-qvq5 High
github.com/miekg/dns v1.0.4 1.1.25 go-module GHSA-44r7-7p62-q3fr Medium
github.com/opencontainers/image-spec v1.0.1 1.0.2 go-module GHSA-77vh-xpmg-72qh Low
github.com/opencontainers/runc v0.1.1 go-module GHSA-vpvm-3wq2-2wvm High
github.com/opencontainers/runc v0.1.1 1.0.0-rc3 go-module GHSA-gp4j-w3vj-7299 Medium
github.com/opencontainers/runc v0.1.1 1.0.0-rc8.0.20190930145003-cad42f6e0932 go-module GHSA-fgv8-vj5c-2ppq High
github.com/opencontainers/runc v0.1.1 1.0.0-rc9.0.20200122160610-2fc03cc11c77 go-module GHSA-fh74-hm69-rqjw Medium
github.com/opencontainers/runc v0.1.1 1.0.0-rc91 go-module GHSA-g54h-m393-cpwq Low
github.com/opencontainers/runc v0.1.1 1.0.0-rc95 go-module GHSA-c3xm-pvg7-gh7r High
github.com/opencontainers/runc v0.1.1 1.0.3 go-module GHSA-v95c-p5hm-xq8f Medium
github.com/opencontainers/runc v0.1.1 1.1.2 go-module GHSA-f3fp-gc8g-vw66 Medium
github.com/prometheus/client_golang v1.7.1 go-module CVE-2022-21698 High
github.com/prometheus/client_golang v1.7.1 1.11.1 go-module GHSA-cg3q-j54f-5p7p High
golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 0.0.0-20201216223049-8b5274cf687f go-module GHSA-3vm4-22fp-5rfm High
golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 0.0.0-20211202192323-5770296d904e go-module GHSA-gwc9-m7rh-j2ww High
golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 0.0.0-20220314234659-1baeb1ce4c0b go-module GHSA-8c26-wmh5-6g9v High
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.0.0-20210428140749-89ef3d95e781 go-module GHSA-h86h-8ppg-mxmh Medium
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.0.0-20210520170846-37e1c6afe023 go-module GHSA-83g2-8m93-v3w7 High
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.0.0-20220906165146-f3363e06e74c go-module GHSA-69cg-p879-7622 High
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.7.0 go-module GHSA-vvpx-j8f3-3w6h High
golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1 0.0.0-20220412211240-33da011f77ad go-module GHSA-p782-xgp4-8hr8 Medium
golang.org/x/text v0.3.2 0.3.7 go-module GHSA-ppp9-7jff-5vj2 High
golang.org/x/text v0.3.2 0.3.8 go-module GHSA-69ch-w2m2-3vjp High
k8s.io/client-go v0.18.6 0.20.0-alpha.2 go-module GHSA-8cfg-vx93-jvxw Medium
krb5-libs 1.17-r0 1.17.2-r0 apk CVE-2020-28196 High
libcrypto1.1 1.1.1g-r0 apk CVE-2021-3711 Critical
libcrypto1.1 1.1.1g-r0 apk CVE-2021-3712 High
libcrypto1.1 1.1.1g-r0 apk CVE-2021-4160 Medium
libcrypto1.1 1.1.1g-r0 apk CVE-2022-0778 High
libcrypto1.1 1.1.1g-r0 apk CVE-2022-1292 Critical
libcrypto1.1 1.1.1g-r0 apk CVE-2022-2068 Critical
libcrypto1.1 1.1.1g-r0 apk CVE-2022-2097 Medium
libcrypto1.1 1.1.1g-r0 apk CVE-2022-4304 Medium
libcrypto1.1 1.1.1g-r0 apk CVE-2022-4450 High
libcrypto1.1 1.1.1g-r0 apk CVE-2023-0215 High
libcrypto1.1 1.1.1g-r0 apk CVE-2023-0286 High
libcrypto1.1 1.1.1g-r0 1.1.1i-r0 apk CVE-2020-1971 Medium
libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23839 Low
libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23840 High
libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23841 Medium
libcrypto1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3449 Medium
libcrypto1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3450 High
libcurl 7.66.0-r0 7.66.0-r1 apk CVE-2020-8169 High
libcurl 7.66.0-r0 7.66.0-r1 apk CVE-2020-8177 High
libcurl 7.66.0-r0 7.66.0-r2 apk CVE-2020-8231 High
libcurl 7.66.0-r0 7.66.0-r3 apk CVE-2020-8285 High
libcurl 7.66.0-r0 7.66.0-r3 apk CVE-2020-8286 High
libcurl 7.66.0-r0 7.66.0-r4 apk CVE-2021-22898 Low
libssl1.1 1.1.1g-r0 apk CVE-2021-3711 Critical
libssl1.1 1.1.1g-r0 apk CVE-2021-3712 High
libssl1.1 1.1.1g-r0 apk CVE-2021-4160 Medium
libssl1.1 1.1.1g-r0 apk CVE-2022-0778 High
libssl1.1 1.1.1g-r0 apk CVE-2022-1292 Critical
libssl1.1 1.1.1g-r0 apk CVE-2022-2068 Critical
libssl1.1 1.1.1g-r0 apk CVE-2022-2097 Medium
libssl1.1 1.1.1g-r0 apk CVE-2022-4304 Medium
libssl1.1 1.1.1g-r0 apk CVE-2022-4450 High
libssl1.1 1.1.1g-r0 apk CVE-2023-0215 High
libssl1.1 1.1.1g-r0 apk CVE-2023-0286 High
libssl1.1 1.1.1g-r0 1.1.1i-r0 apk CVE-2020-1971 Medium
libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23839 Low
libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23840 High
libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23841 Medium
libssl1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3449 Medium
libssl1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3450 High
libxml2 2.9.9-r3 2.9.9-r4 apk CVE-2020-24977 Medium
libxml2 2.9.9-r3 2.9.9-r5 apk CVE-2021-3517 High
libxml2 2.9.9-r3 2.9.9-r5 apk CVE-2021-3518 High
libxml2 2.9.9-r3 2.9.9-r5 apk CVE-2021-3537 Medium
musl 1.1.22-r3 1.1.22-r4 apk CVE-2020-28928 Medium
musl-utils 1.1.22-r3 1.1.22-r4 apk CVE-2020-28928 Medium
protobuf 3.6.1-r1 apk CVE-2021-22570 Medium
ssl_client 1.30.1-r3 apk CVE-2021-42374 Medium
ssl_client 1.30.1-r3 apk CVE-2021-42376 Medium
ssl_client 1.30.1-r3 apk CVE-2021-42378 High
ssl_client 1.30.1-r3 apk CVE-2021-42379 High
ssl_client 1.30.1-r3 apk CVE-2021-42380 High
ssl_client 1.30.1-r3 apk CVE-2021-42381 High
ssl_client 1.30.1-r3 apk CVE-2021-42382 High
ssl_client 1.30.1-r3 apk CVE-2021-42384 High
ssl_client 1.30.1-r3 apk CVE-2021-42385 High
ssl_client 1.30.1-r3 apk CVE-2021-42386 High
ssl_client 1.30.1-r3 apk CVE-2022-28391 High
ssl_client 1.30.1-r3 1.30.1-r5 apk CVE-2021-28831 High
zlib 1.2.11-r1 apk CVE-2018-25032 High
zlib 1.2.11-r1 apk CVE-2022-37434 Critical
reweave/scans/weave-npc-count-vulns.txt
+1
View File
@@ -0,0 +1 @@
weave-npc CVE Count: 77
reweave/scans/weave-npc-list-vulns.txt
+79
View File
@@ -0,0 +1,79 @@
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
apk-tools 2.10.4-r2 2.10.6-r0 apk CVE-2021-30139 High
apk-tools 2.10.4-r2 2.10.7-r0 apk CVE-2021-36159 Critical
busybox 1.30.1-r3 apk CVE-2021-42374 Medium
busybox 1.30.1-r3 apk CVE-2021-42376 Medium
busybox 1.30.1-r3 apk CVE-2021-42378 High
busybox 1.30.1-r3 apk CVE-2021-42379 High
busybox 1.30.1-r3 apk CVE-2021-42380 High
busybox 1.30.1-r3 apk CVE-2021-42381 High
busybox 1.30.1-r3 apk CVE-2021-42382 High
busybox 1.30.1-r3 apk CVE-2021-42384 High
busybox 1.30.1-r3 apk CVE-2021-42385 High
busybox 1.30.1-r3 apk CVE-2021-42386 High
busybox 1.30.1-r3 apk CVE-2022-28391 High
busybox 1.30.1-r3 1.30.1-r5 apk CVE-2021-28831 High
github.com/gogo/protobuf v1.3.1 1.3.2 go-module GHSA-c3h9-896r-86jm High
github.com/prometheus/client_golang v1.7.1 go-module CVE-2022-21698 High
github.com/prometheus/client_golang v1.7.1 1.11.1 go-module GHSA-cg3q-j54f-5p7p High
golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 0.0.0-20201216223049-8b5274cf687f go-module GHSA-3vm4-22fp-5rfm High
golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 0.0.0-20211202192323-5770296d904e go-module GHSA-gwc9-m7rh-j2ww High
golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 0.0.0-20220314234659-1baeb1ce4c0b go-module GHSA-8c26-wmh5-6g9v High
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.0.0-20210428140749-89ef3d95e781 go-module GHSA-h86h-8ppg-mxmh Medium
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.0.0-20210520170846-37e1c6afe023 go-module GHSA-83g2-8m93-v3w7 High
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.0.0-20220906165146-f3363e06e74c go-module GHSA-69cg-p879-7622 High
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 0.7.0 go-module GHSA-vvpx-j8f3-3w6h High
golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1 0.0.0-20220412211240-33da011f77ad go-module GHSA-p782-xgp4-8hr8 Medium
golang.org/x/text v0.3.2 0.3.7 go-module GHSA-ppp9-7jff-5vj2 High
golang.org/x/text v0.3.2 0.3.8 go-module GHSA-69ch-w2m2-3vjp High
k8s.io/client-go v0.18.6 0.20.0-alpha.2 go-module GHSA-8cfg-vx93-jvxw Medium
libcrypto1.1 1.1.1g-r0 apk CVE-2021-3711 Critical
libcrypto1.1 1.1.1g-r0 apk CVE-2021-3712 High
libcrypto1.1 1.1.1g-r0 apk CVE-2021-4160 Medium
libcrypto1.1 1.1.1g-r0 apk CVE-2022-0778 High
libcrypto1.1 1.1.1g-r0 apk CVE-2022-1292 Critical
libcrypto1.1 1.1.1g-r0 apk CVE-2022-2068 Critical
libcrypto1.1 1.1.1g-r0 apk CVE-2022-2097 Medium
libcrypto1.1 1.1.1g-r0 apk CVE-2022-4304 Medium
libcrypto1.1 1.1.1g-r0 apk CVE-2022-4450 High
libcrypto1.1 1.1.1g-r0 apk CVE-2023-0215 High
libcrypto1.1 1.1.1g-r0 apk CVE-2023-0286 High
libcrypto1.1 1.1.1g-r0 1.1.1i-r0 apk CVE-2020-1971 Medium
libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23839 Low
libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23840 High
libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23841 Medium
libcrypto1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3449 Medium
libcrypto1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3450 High
libssl1.1 1.1.1g-r0 apk CVE-2021-3711 Critical
libssl1.1 1.1.1g-r0 apk CVE-2021-3712 High
libssl1.1 1.1.1g-r0 apk CVE-2021-4160 Medium
libssl1.1 1.1.1g-r0 apk CVE-2022-0778 High
libssl1.1 1.1.1g-r0 apk CVE-2022-1292 Critical
libssl1.1 1.1.1g-r0 apk CVE-2022-2068 Critical
libssl1.1 1.1.1g-r0 apk CVE-2022-2097 Medium
libssl1.1 1.1.1g-r0 apk CVE-2022-4304 Medium
libssl1.1 1.1.1g-r0 apk CVE-2022-4450 High
libssl1.1 1.1.1g-r0 apk CVE-2023-0215 High
libssl1.1 1.1.1g-r0 apk CVE-2023-0286 High
libssl1.1 1.1.1g-r0 1.1.1i-r0 apk CVE-2020-1971 Medium
libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23839 Low
libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23840 High
libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23841 Medium
libssl1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3449 Medium
libssl1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3450 High
musl 1.1.22-r3 1.1.22-r4 apk CVE-2020-28928 Medium
musl-utils 1.1.22-r3 1.1.22-r4 apk CVE-2020-28928 Medium
ssl_client 1.30.1-r3 apk CVE-2021-42374 Medium
ssl_client 1.30.1-r3 apk CVE-2021-42376 Medium
ssl_client 1.30.1-r3 apk CVE-2021-42378 High
ssl_client 1.30.1-r3 apk CVE-2021-42379 High
ssl_client 1.30.1-r3 apk CVE-2021-42380 High
ssl_client 1.30.1-r3 apk CVE-2021-42381 High
ssl_client 1.30.1-r3 apk CVE-2021-42382 High
ssl_client 1.30.1-r3 apk CVE-2021-42384 High
ssl_client 1.30.1-r3 apk CVE-2021-42385 High
ssl_client 1.30.1-r3 apk CVE-2021-42386 High
ssl_client 1.30.1-r3 apk CVE-2022-28391 High
ssl_client 1.30.1-r3 1.30.1-r5 apk CVE-2021-28831 High
zlib 1.2.11-r1 apk CVE-2018-25032 High
zlib 1.2.11-r1 apk CVE-2022-37434 Critical
reweave/tools/clean-scans.sh
Executable
+7
View File
@@ -0,0 +1,7 @@
#!/bin/sh
set -e
# Get directory of script file
a="/$0"; a="${a%/*}"; a="${a:-.}"; a="${a##/}/"; BINDIR=$(cd "$a"; pwd)
rm "${BINDIR}/../scans/"*
reweave/tools/scan-images.sh
Executable
+36
View File
@@ -0,0 +1,36 @@
#!/bin/sh
set -e
# These variables are used to choose the images to scan. Change as
# required.
: "${IMAGE_VERSION:=}"
: "${REGISTRY_USER:=}"
if [ -z "${IMAGE_VERSION}" ] || [ -z "${REGISTRY_USER}" ] ; then
>&2 echo "Please provide valid values for IMAGE_VERSION and REGISTRY_USER."
exit 1
fi
echo "Scanning images and collecting data..."
# Currently, we are interested only in the weave-kube and weave-npc
# images.
WEAVE_KUBE_IMAGE="${REGISTRY_USER}/weave-kube:${IMAGE_VERSION}"
WEAVE_NPC_IMAGE="${REGISTRY_USER}/weave-npc:${IMAGE_VERSION}"
# Get directory of script file
a="/$0"; a="${a%/*}"; a="${a:-.}"; a="${a##/}/"; BINDIR=$(cd "$a"; pwd)
mkdir -p "${BINDIR}/../scans"
echo "Image version: ${IMAGE_VERSION}" >"${BINDIR}/../scans/images-version.txt"
grype version >"${BINDIR}/../scans/scanner-version.txt"
grype "${WEAVE_KUBE_IMAGE}" --add-cpes-if-none >"${BINDIR}/../scans/weave-kube-list-vulns.txt"
grype "${WEAVE_NPC_IMAGE}" --add-cpes-if-none >"${BINDIR}/../scans/weave-npc-list-vulns.txt"
echo "weave-kube CVE Count: $(tail +3 "${BINDIR}/../scans/weave-kube-list-vulns.txt" | wc -l)" \
>"${BINDIR}/../scans/weave-kube-count-vulns.txt"
echo "weave-npc CVE Count: $(tail +3 "${BINDIR}/../scans/weave-npc-list-vulns.txt" | wc -l)" \
>"${BINDIR}/../scans/weave-npc-count-vulns.txt"