search

openshift / image-inspector

Apache License 2.0
34 stars 29 forks source link

CVE URL returning invalid #101

Closed bagnaram closed 6 years ago

bagnaram commented 6 years ago

When automatically retrieving the https://www.redhat.com/security/data/metrics/ds/com.redhat.rhsa-RHEL7.ds.xml.bz2 file to /tmp/ the contents are invalid and contain: Perhaps there are invalid headers being inserted in the HTTP get but I do not have a way to debug this because there are no verbose loggings.

<HTML><HEAD>
<TITLE>Access Denied</TITLE>
</HEAD><BODY>
<H1>Access Denied</H1>
You don't have permission to access "http&#58;&#47;&#47;www&#46;redhat&#46;com&#47;security&#47;data&#47;metrics&#47;ds&#47;com&#46;redhat&#46;rhsa&#45;RHEL7&#46;ds&#46;xm1&#46;b22" on this server.<P>
Reference&#32;&#35;18&#46;5e962317&#46;1 36093256&#46;1295892e
</BODY>
</HTML>
simon3z commented 6 years ago

@cben @nimrodshn is this something you recently fixed?

cben commented 6 years ago

I think @nimrodshn has mentioned 403 on one of the bugzillas related to #100, specifically in https://bugzilla.redhat.com/show_bug.cgi?id=1620068#c17 (private comment). I'm not sure if that's the same or a separate problem. cc @yaacov who might also know.

@bagnaram could you try openshift/image-inspector@sha256:9f9958ab51cb1aeb02d4609aa63d355238a7e5137cd4da90215378e4bcdae053 which should include #100 (that's current latest, build details) and tell us if it helps?

bagnaram commented 6 years ago

I see. I will re-do my test because I am running using the RPM based image-inspector within a Jenkins slave

bagnaram commented 6 years ago

@cben Thank you that worked. I suppose the RPM version was way behind and that was the issue.

bagnaram commented 6 years ago

Any idea when this update will make it to registry.access.redhat.com?