Closed YOU54F closed 1 year ago
Fix up node image, as it's been a while, still not released as part of this change but will be able to close the vulns pr's
If we provide CMD we get in the node repl, but using ENTRYPOINT seems to work fine.
CMD
ENTRYPOINT
Ran a trivy cli against it
π16:30:46 β― trivy image pact-cli 2023-04-26T16:31:36.235+0100 INFO Need to update DB 2023-04-26T16:31:36.235+0100 INFO DB Repository: ghcr.io/aquasecurity/trivy-db 2023-04-26T16:31:36.235+0100 INFO Downloading DB... 36.47 MiB / 36.47 MiB [--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 23.64 MiB p/s 1.7s 2023-04-26T16:31:39.566+0100 INFO Vulnerability scanning is enabled 2023-04-26T16:31:39.566+0100 INFO Secret scanning is enabled 2023-04-26T16:31:39.566+0100 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2023-04-26T16:31:39.566+0100 INFO Please see also https://aquasecurity.github.io/trivy/v0.40/docs/secret/scanning/#recommendation for faster secret detection 2023-04-26T16:32:07.121+0100 INFO Detected OS: alpine 2023-04-26T16:32:07.121+0100 INFO Detecting Alpine vulnerabilities... 2023-04-26T16:32:07.124+0100 INFO Number of language-specific files: 4 2023-04-26T16:32:07.124+0100 INFO Detecting cargo vulnerabilities... 2023-04-26T16:32:07.125+0100 INFO Detecting node-pkg vulnerabilities... 2023-04-26T16:32:07.131+0100 INFO Detecting gemspec vulnerabilities... pact-cli (alpine 3.17.3) Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 0, CRITICAL: 0) ββββββββββββββ¬ββββββββββββββββ¬βββββββββββ¬ββββββββββββββββββββ¬ββββββββββββββββ¬βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β Library β Vulnerability β Severity β Installed Version β Fixed Version β Title β ββββββββββββββΌββββββββββββββββΌβββββββββββΌββββββββββββββββββββΌββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€ β libcrypto3 β CVE-2023-1255 β MEDIUM β 3.0.8-r3 β 3.0.8-r4 β Input buffer over-read in AES-XTS implementation on 64 bit β β β β β β β ARM β β β β β β β https://avd.aquasec.com/nvd/cve-2023-1255 β ββββββββββββββ€ β β β β β β libssl3 β β β β β β β β β β β β β β β β β β β β ββββββββββββββ΄ββββββββββββββββ΄βββββββββββ΄ββββββββββββββββββββ΄ββββββββββββββββ΄βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ 2023-04-26T16:32:07.146+0100 INFO Table result includes only package filenames. Use '--format json' option to get the full path to the package file. Node.js (node-pkg) Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 3, CRITICAL: 0) βββββββββββββββββββββββββββββββββββββββ¬βββββββββββββββββ¬βββββββββββ¬ββββββββββββββββββββ¬βββββββββββββββββββββββββββββ¬ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β Library β Vulnerability β Severity β Installed Version β Fixed Version β Title β βββββββββββββββββββββββββββββββββββββββΌβββββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€ β ansi-regex (package.json) β CVE-2021-3807 β HIGH β 3.0.0 β 3.0.1, 4.1.1, 5.0.1, 6.0.1 β nodejs-ansi-regex: Regular expression denial of service β β β β β β β (ReDoS) matching ANSI escape codes β β β β β β β https://avd.aquasec.com/nvd/cve-2021-3807 β β β β βββββββββββββββββββββ€ β β β β β β 4.1.0 β β β β β β β β β β β β β β β β β βββββββββββββββββββββββββββββββββββββββΌβββββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€ β got (package.json) β CVE-2022-33987 β MEDIUM β 6.7.1 β 11.8.5, 12.1.0 β nodejs-got: missing verification of requested URLs allows β β β β β β β redirects to UNIX sockets β β β β β β β https://avd.aquasec.com/nvd/cve-2022-33987 β βββββββββββββββββββββββββββββββββββββββΌβββββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€ β http-cache-semantics (package.json) β CVE-2022-25881 β HIGH β 3.8.1 β 4.1.1 β Regular Expression Denial of Service (ReDoS) vulnerability β β β β β β β https://avd.aquasec.com/nvd/cve-2022-25881 β βββββββββββββββββββββββββββββββββββββββΌβββββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€ β request (package.json) β CVE-2023-28155 β MEDIUM β 2.88.2 β β ** UNSUPPORTED WHEN ASSIGNED ** The Request package through β β β β β β β 2.88.1 for ...... β β β β β β β https://avd.aquasec.com/nvd/cve-2023-28155 β βββββββββββββββββββββββββββββββββββββββ΄βββββββββββββββββ΄βββββββββββ΄ββββββββββββββββββββ΄βββββββββββββββββββββββββββββ΄ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
Fix up node image, as it's been a while, still not released as part of this change but will be able to close the vulns pr's
If we provide
CMD
we get in the node repl, but usingENTRYPOINT
seems to work fine.Ran a trivy cli against it