p-rog
commented
1 year ago @davecore82 Thank you for opening this issue.
The cve-analyser project expects an input in a pre-defined format:
cve-id,red_hat_container_name
Where the red_hat_container_name use format that is also used in the Red Hat Container Catalog, i.e.:
container_repository/container_name:version
(side note: :version information is optional)
In your example this is a correct entry:
CVE-2022-2526,openshift-logging/cluster-logging-rhel8-operator
but this one is not correct:
CVE-2022-29154,openshift-release-dev/ocp-v4.0-art-dev
because openshift-release-dev/ocp-v4.0-art-dev is not an Red Hat repository from the Red Hat Container Catalog, but it's repository from quay.io.
How to convert the OpenShift release container names from quay.io image repository to Red Hat Container Catalog image name you can find for example in this Red Hat blog post:
https://www.redhat.com/en/blog/gathering-security-data-container-images-using-pyxis-api
I will use this issue to improve the output message, to help users understand what Not Found Any Information exactly mean. It will be added to the next cve-analyser release.
When using cve-analyser to analyze openshift-release-dev or openshift-logging container images, the result is often "Not Found Any Information". Some of them will return good information.
Are these images not supported by the tool? Or is there another way to enter those images for the tool to process them properly? Is the following CSV and its results what is expected?
ie.
This will return:
Thank you.