From 430ebd8c62ad0cbd58007ef5ab4f08c096f6c77d Mon Sep 17 00:00:00 2001 From: Calin Marina Date: Tue, 10 Oct 2023 22:21:36 +0100 Subject: [PATCH 1/2] add option to update docker-host via cli parameter --- action.yaml | 4 ++++ entrypoint.sh | 8 +++++++- test/test.bats | 8 ++++++++ 3 files changed, 19 insertions(+), 1 deletion(-) diff --git a/action.yaml b/action.yaml index 3e37c9b..45f0050 100644 --- a/action.yaml +++ b/action.yaml @@ -91,6 +91,9 @@ inputs: limit-severities-for-sarif: description: 'limit severities for SARIF format' required: false + docker-host: + description: 'unix domain socket path to use for docker scanning' + required: false runs: using: 'docker' @@ -119,3 +122,4 @@ runs: - '-u ${{ inputs.github-pat }}' - '-v ${{ inputs.trivy-config }}' - '-z ${{ inputs.limit-severities-for-sarif }}' + - '-y ${{ inputs.docker-host }}' \ No newline at end of file diff --git a/entrypoint.sh b/entrypoint.sh index 26a9dae..ce342fc 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,6 +1,6 @@ #!/bin/bash set -e -while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:z:" o; do +while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:z:y:" o; do case "${o}" in a) export scanType=${OPTARG} @@ -71,6 +71,9 @@ while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:z:" o; do z) export limitSeveritiesForSARIF=${OPTARG} ;; + y) + export dockerHost=${OPTARG} + ;; esac done @@ -157,6 +160,9 @@ fi if [ "$hideProgress" == "true" ];then ARGS="$ARGS --no-progress" fi +if [ "$dockerHost" == "true" ];then + ARGS="$ARGS --docker-host $dockerHost" +fi listAllPkgs=$(echo $listAllPkgs | tr -d '\r') if [ "$listAllPkgs" == "true" ];then diff --git a/test/test.bats b/test/test.bats index 13a69ce..e0ad3ac 100644 --- a/test/test.bats +++ b/test/test.bats @@ -81,3 +81,11 @@ bats_load_library bats-file echo "$output" assert_files_equal yamlconfig.test ./test/data/yamlconfig.test } + +@test "trivy image with custom docker-host" { + # trivy image --docker-host unix:///var/run/docker.sock --severity CRITICAL --output image.test knqyf263/vuln-image:1.2.3 + run ./entrypoint.sh '-y unix:///var/run/docker.sock' '-a image' '-i knqyf263/vuln-image:1.2.3' '-h image.test' '-g CRITICAL' + run diff image.test ./test/data/image.test + echo "$output" + assert_files_equal image.test ./test/data/image.test +} From 129ed552e9095cf31f73bb0f64f22f7d33d6f2ed Mon Sep 17 00:00:00 2001 From: Calin Marina Date: Tue, 10 Oct 2023 22:21:46 +0100 Subject: [PATCH 2/2] chore: update test results --- test/data/image-trivyignores.test | 20 +++++++++++++++---- test/data/image.test | 32 +++++++++++++++++++++++++++---- 2 files changed, 44 insertions(+), 8 deletions(-) diff --git a/test/data/image-trivyignores.test b/test/data/image-trivyignores.test index f2a567c..aa3d4ae 100644 --- a/test/data/image-trivyignores.test +++ b/test/data/image-trivyignores.test @@ -27,10 +27,10 @@ Total: 19 (CRITICAL: 19) │ │ CVE-2019-5481 │ │ │ │ 7.61.1-r3 │ curl: double free due to subsequent call of realloc() │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5481 │ │ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤ -│ │ CVE-2019-5482 │ │ │ │ │ curl: heap buffer overflow in function tftp_receive_packet() │ +│ │ CVE-2019-5482 │ │ │ │ │ heap buffer overflow in function tftp_receive_packet() │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5482 │ ├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤ -│ git │ CVE-2018-17456 │ │ │ 2.15.2-r0 │ 2.15.3-r0 │ git: arbitrary code execution via .gitmodules │ +│ git │ CVE-2018-17456 │ │ │ 2.15.2-r0 │ 2.15.3-r0 │ arbitrary code execution via .gitmodules │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-17456 │ │ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ │ CVE-2019-1353 │ │ │ │ 2.15.4-r0 │ git: NTFS protections inactive when running Git in the │ @@ -58,7 +58,7 @@ Total: 19 (CRITICAL: 19) │ │ CVE-2019-5481 │ │ │ │ 7.61.1-r3 │ curl: double free due to subsequent call of realloc() │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5481 │ │ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤ -│ │ CVE-2019-5482 │ │ │ │ │ curl: heap buffer overflow in function tftp_receive_packet() │ +│ │ CVE-2019-5482 │ │ │ │ │ heap buffer overflow in function tftp_receive_packet() │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5482 │ ├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤ │ musl │ CVE-2019-14697 │ │ │ 1.1.18-r3 │ 1.1.18-r4 │ musl libc through 1.1.23 has an x87 floating-point stack │ @@ -69,6 +69,18 @@ Total: 19 (CRITICAL: 19) │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ ├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤ -│ sqlite-libs │ CVE-2019-8457 │ │ │ 3.21.0-r1 │ 3.25.3-r1 │ sqlite: heap out-of-bound read in function rtreenode() │ +│ sqlite-libs │ CVE-2019-8457 │ │ │ 3.21.0-r1 │ 3.25.3-r1 │ heap out-of-bound read in function rtreenode() │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-8457 │ └─────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘ + +rust-app/Cargo.lock (cargo) +=========================== +Total: 1 (CRITICAL: 1) + +┌──────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐ +│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ +├──────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤ +│ smallvec │ CVE-2021-25900 │ CRITICAL │ fixed │ 0.6.9 │ 0.6.14, 1.6.1 │ An issue was discovered in the smallvec crate before 0.6.14 │ +│ │ │ │ │ │ │ and 1.x... │ +│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-25900 │ +└──────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘ diff --git a/test/data/image.test b/test/data/image.test index f2a567c..d954ed1 100644 --- a/test/data/image.test +++ b/test/data/image.test @@ -27,10 +27,10 @@ Total: 19 (CRITICAL: 19) │ │ CVE-2019-5481 │ │ │ │ 7.61.1-r3 │ curl: double free due to subsequent call of realloc() │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5481 │ │ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤ -│ │ CVE-2019-5482 │ │ │ │ │ curl: heap buffer overflow in function tftp_receive_packet() │ +│ │ CVE-2019-5482 │ │ │ │ │ heap buffer overflow in function tftp_receive_packet() │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5482 │ ├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤ -│ git │ CVE-2018-17456 │ │ │ 2.15.2-r0 │ 2.15.3-r0 │ git: arbitrary code execution via .gitmodules │ +│ git │ CVE-2018-17456 │ │ │ 2.15.2-r0 │ 2.15.3-r0 │ arbitrary code execution via .gitmodules │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-17456 │ │ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ │ CVE-2019-1353 │ │ │ │ 2.15.4-r0 │ git: NTFS protections inactive when running Git in the │ @@ -58,7 +58,7 @@ Total: 19 (CRITICAL: 19) │ │ CVE-2019-5481 │ │ │ │ 7.61.1-r3 │ curl: double free due to subsequent call of realloc() │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5481 │ │ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤ -│ │ CVE-2019-5482 │ │ │ │ │ curl: heap buffer overflow in function tftp_receive_packet() │ +│ │ CVE-2019-5482 │ │ │ │ │ heap buffer overflow in function tftp_receive_packet() │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-5482 │ ├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤ │ musl │ CVE-2019-14697 │ │ │ 1.1.18-r3 │ 1.1.18-r4 │ musl libc through 1.1.23 has an x87 floating-point stack │ @@ -69,6 +69,30 @@ Total: 19 (CRITICAL: 19) │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ ├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤ -│ sqlite-libs │ CVE-2019-8457 │ │ │ 3.21.0-r1 │ 3.25.3-r1 │ sqlite: heap out-of-bound read in function rtreenode() │ +│ sqlite-libs │ CVE-2019-8457 │ │ │ 3.21.0-r1 │ 3.25.3-r1 │ heap out-of-bound read in function rtreenode() │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-8457 │ └─────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘ + +rust-app/Cargo.lock (cargo) +=========================== +Total: 4 (CRITICAL: 4) + +┌───────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐ +│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ +├───────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤ +│ rand_core │ CVE-2020-25576 │ CRITICAL │ fixed │ 0.4.0 │ 0.4.2, 0.3.1 │ An issue was discovered in the rand_core crate before 0.4.2 │ +│ │ │ │ │ │ │ for Rust.... │ +│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-25576 │ +├───────────┼────────────────┤ │ ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤ +│ smallvec │ CVE-2019-15551 │ │ │ 0.6.9 │ 0.6.10 │ An issue was discovered in the smallvec crate before 0.6.10 │ +│ │ │ │ │ │ │ for Rust.... │ +│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-15551 │ +│ ├────────────────┤ │ │ │ ├─────────────────────────────────────────────────────────────┤ +│ │ CVE-2019-15554 │ │ │ │ │ An issue was discovered in the smallvec crate before 0.6.10 │ +│ │ │ │ │ │ │ for Rust.... │ +│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-15554 │ +│ ├────────────────┤ │ │ ├───────────────┼─────────────────────────────────────────────────────────────┤ +│ │ CVE-2021-25900 │ │ │ │ 0.6.14, 1.6.1 │ An issue was discovered in the smallvec crate before 0.6.14 │ +│ │ │ │ │ │ │ and 1.x... │ +│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-25900 │ +└───────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘