Finding vulnerabilities in python pip packages

docker / scout-cli

Docker Scout CLI

https://docker.com/products/docker-scout

Other

250 stars 60 forks source link

Finding vulnerabilities in python pip packages #85

Closed gergelyfabian closed 4 months ago

gergelyfabian commented 5 months ago

It seems docker scout sbom finds pip packages (type pypi). However security vulnerabilities are not reported for them (for docker scout cves). Is this intentional?

cdupuis commented 5 months ago

@gergelyfabian, thanks for raising this. No, this isn't intentional. Do you have an example for us to investigate?

gergelyfabian commented 5 months ago

I have debugged this further. One reason was that I was only looking at critical cves. These are for other levels. Then, I believe I could not see them because those are transitive CVEs.

E.g. oci==2.68.0 has cryptography as its dependency, and that package has a CVE (that is properly detected by docker scout).

cdupuis commented 4 months ago

Please re-open if you are still seeing issues with CVE reports on pip packages.