arminc / clair-scanner

Docker containers vulnerability scan
Apache License 2.0
848 stars 154 forks source link

Feature: Whitelist multiple CVEs of a given PACKAGE NAME #111

Open ghost opened 3 years ago

ghost commented 3 years ago

He, I think there is a problem with whitelists. In my case I am building my images via a gitlab-ci pipeline that is executed on a machine by a gitlab-runner. After that I scan the created image on that machine which often throws CVEs regarding the underlying linux kernel. While the image is build on this system it will never run there but is deployed on another machine with a newer linux kernel without the vulnerabilty. Because of this I would say we need something like a wildcard for linux-CVEs like this

---
generalwhitelist:
  CVE-2020*: linux

or maybe a switch to toggle this function, like:

---
generalwhitelist:
  CVE-2020-7788:  node-ini
  CVE-2020-26159: libonig
  CVE-2020-7774:  node-y18n
  CVE-2020-25696: postgresql-11
scan_linux_kernel: false