供应链安全-镜像 Trivy kubesec_the first run cannot skip downloading db(2)

m0_60607971

已于 2024-04-09 04:37:05 修改

阅读量729

点赞数 8

分类专栏： 2024年程序员学习文章标签：安全数据库

于 2024-04-09 04:37:04 首次发布

本文链接：https://blog.csdn.net/m0_60607971/article/details/137532230

版权

2024年程序员学习专栏收录该内容

257 篇文章 0 订阅

订阅专栏

│ └── fanal.db
└── java-db
├── metadata.json
└── trivy-java.db

db等文件详细解析：镜像安全扫描工具Trivy深入实践 - 知乎

漏洞检测

[root@master trivy]# trivy image nginx:1.17.1 --skip-db-update --skip-java-db-update
2023-11-15T02:10:00.448-0500 INFO Vulnerability scanning is enabled
2023-11-15T02:10:00.448-0500 INFO Secret scanning is enabled
2023-11-15T02:10:00.448-0500 INFO If your scanning is slow, please try ‘–scanners vuln’ to disable secret scanning
2023-11-15T02:10:00.448-0500 INFO Please see also https://aquasecurity.github.io/trivy/v0.46/docs/scanner/secret/#recommendation for faster secret detection
2023-11-15T02:10:26.595-0500 INFO Detected OS: debian
2023-11-15T02:10:26.595-0500 INFO Detecting Debian vulnerabilities…
2023-11-15T02:10:26.625-0500 INFO Number of language-specific files: 0
2023-11-15T02:10:26.685-0500 WARN This OS version is no longer supported by the distribution: debian 9.9
2023-11-15T02:10:26.685-0500 WARN The vulnerability detection may be insufficient because security updates are not provided

nginx:1.17.1 (debian 9.9)

Total: 204 (UNKNOWN: 7, LOW: 40, MEDIUM: 52, HIGH: 74, CRITICAL: 31)

┌────────────────────────┬──────────────────┬──────────┬──────────────┬────────────────────────┬────────────────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├────────────────────────┼──────────────────┼──────────┼──────────────┼────────────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤
│ apt │ CVE-2020-27350 │ MEDIUM │ fixed │ 1.4.9 │ 1.4.11 │ apt: integer overflows and underflows while parsing .deb │
│ │ │ │ │ │ │ packages │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-27350 │
│ ├──────────────────┤ │ │ ├────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2020-3810 │ │ │ │ 1.4.10 │ Missing input validation in the ar/tar implementations of │
│ │ │ │ │ │ │ APT before v … │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-3810 │

漏洞解析

CVE-2016-2779 漏洞编号（可以进行通过编号去修复漏洞）

HIGH 级别

1:2.29.2-1+deb9u1 目前的版本

Title 其中网址打开就是漏洞介绍和修复方式

常用命令

跳过拉取漏洞数据库

–skip-update=true

查看命令帮助

trivy -h

容器镜像扫描

trivy image nginx
trivy image -i nginx.tar

打印指定 (高危，严重)

trivy image -s HIGH,nginx
trivy image -s HIGH,CRITICAL nginx

JSON 格式输出并保存到文件

trivy image nginx -f json -o ./output.json

trivy image nginx:1.18.0
trivy image --severity CRITICAL nginx:1.18.0
trivy image --severity CRITICAL, HIGH nginx:1.18.0
trivy image --ignore-unfixed nginx:1.18.0

Scanning image tarball

docker save nginx:1.18.0 > nginx.tar
trivy image --input archive.tar

Scan and output results to file

trivy image --output python_alpine.txt python:3.10.0a4-alpine
trivy image --severity HIGH --output /root/python.txt python:3.10.0a4-alpine

Scan image tarball

trivy image --input alpine.tar --format json --output /root/alpine.json

kubesec 检测yaml文件安全配置

kubesec：是一个针对K8s资源清单文件进行安全配置评估的工具，根据安全配置

https://kubesec.io/
https://github.com/controlplaneio/kubesec

注：因为网络问题，所以手动下载检测文件

通过容器更方便，避免网络问题

命令示例

kubesec scan -h

–schema-location 是本地json检测文件

主要是因为网络问题，所以建议自行下载后通过这个参数指定

[root@master kubesec]# kubesec scan deploy.yaml --schema-location deployment-apps-v1.json
[
{
“object”: “Deployment/web.default”,
“valid”: true,
“fileName”: “deploy.yaml”,
“message”: “Passed with a score of 0 points”,
“score”: 0,
“scoring”: {
“advise”: [
{
“id”: “ApparmorAny”,
“selector”: “.metadata .annotations .“container.apparmor.security.beta.kubernetes.io/nginx””,
“reason”: “Well defined AppArmor policies may provide greater protection from unknown threats. WARNING: NOT PRODUCTION READY”,
“points”: 3
},
{