用Trivy扫描容器镜像_trivy --format template --template-CSDN博客

本文链接：https://blog.csdn.net/weixin_43902588/article/details/122028555

红帽 RHACS 支持自动对其管理的 OpenShift 或 Kubernetes 上的容器进行漏洞扫描、合规评估。在 RHACS 中使用了开源的 Clair 来扫描镜像，而红帽 Quay 使用的镜像扫描也是 Clair。因为 RHACS 和 Quay 都是企业平台，因此对运行环境的要求较高。而 Trivy 是一个轻量级漏洞扫描工具，支持基于 CVE 对常用的 Linux 、镜像和应用进行安全扫描。

以下是使用Trivy扫描镜像的过程：

$ curl -OL https://github.com/aquasecurity/trivy/releases/download/v0.21.2/trivy_0.21.2_Linux-64bit.tar.gz
$ tar -xvf trivy_0.21.2_Linux-64bit.tar.gz 
$ ./trivy image  --ignore-unfixed --severity "HIGH,CRITICAL" --vuln-type library elastic/logstash:7.13.0
 
Java (jar)
==========
Total: 5 (HIGH: 3, CRITICAL: 2)

+-------------------------------------+------------------+----------+-------------------+----------------+---------------------------------------+
|               LIBRARY               | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION  |                 TITLE                 |
+-------------------------------------+------------------+----------+-------------------+----------------+---------------------------------------+
| org.apache.logging.log4j:log4j-api  | CVE-2021-44228   | CRITICAL | 2.14.0            | 2.15.0         | log4j-core: Remote code execution     |
|                                     |                  |          |                   |                | in Log4j 2.x when logs contain        |
|                                     |                  |          |                   |                | an attacker-controlled...             |
|                                     |                  |          |                   |                | -->avd.aquasec.com/nvd/cve-2021-44228 |
+                                     +------------------+----------+                   +----------------+---------------------------------------+
|                                     | CVE-2021-45105   | HIGH     |                   | 2.17.0, 2.12.3 | Improper Input Validation             |
|                                     |                  |          |                   |                | and Uncontrolled                      |
|                                     |                  |          |                   |                | Recursion in Apache Log4j2            |
|                                     |                  |          |                   |                | -->avd.aquasec.com/nvd/cve-2021-45105 |
+-------------------------------------+------------------+----------+                   +----------------+---------------------------------------+
| org.apache.logging.log4j:log4j-core | CVE-2021-44228   | CRITICAL |                   | 2.15.0         | log4j-core: Remote code execution     |
|                                     |                  |          |                   |                | in Log4j 2.x when logs contain        |
|                                     |                  |          |                   |                | an attacker-controlled...             |
|                                     |                  |          |                   |                | -->avd.aquasec.com/nvd/cve-2021-44228 |
+                                     +------------------+----------+                   +----------------+---------------------------------------+
|                                     | CVE-2021-45105   | HIGH     |                   | 2.17.0, 2.12.3 | Improper Input Validation             |
|                                     |                  |          |                   |                | and Uncontrolled                      |
|                                     |                  |          |                   |                | Recursion in Apache Log4j2            |
|                                     |                  |          |                   |                | -->avd.aquasec.com/nvd/cve-2021-45105 |
+-------------------------------------+------------------+          +-------------------+----------------+---------------------------------------+
| org.bouncycastle:bcprov-jdk15on     | CVE-2020-28052   |          |              1.65 |           1.67 | bouncycastle: password bypass         |
|                                     |                  |          |                   |                | in OpenBSDBCrypt.checkPassword        |
|                                     |                  |          |                   |                | utility possible                      |
|                                     |                  |          |                   |                | -->avd.aquasec.com/nvd/cve-2020-28052 |
+-------------------------------------+------------------+----------+-------------------+----------------+---------------------------------------+

$ ./trivy image --ignore-unfixed --severity "HIGH,CRITICAL" --vuln-type library elastic/logstash:7.13.0

Java (jar)
==========
Total: 3 (HIGH: 1, CRITICAL: 2)

+-------------------------------------+------------------+----------+-------------------+---------------+
|               LIBRARY               | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |
+-------------------------------------+------------------+----------+-------------------+---------------+
| org.apache.logging.log4j:log4j-api  | CVE-2021-44228   | CRITICAL | 2.14.0            | 2.15.0        |
+-------------------------------------+                  +          +                   +               +
| org.apache.logging.log4j:log4j-core |                  |          |                   |               |
+-------------------------------------+------------------+----------+-------------------+---------------+
| org.bouncycastle:bcprov-jdk15on     | CVE-2020-28052   | HIGH     |              1.65 |          1.67 |
+-------------------------------------+------------------+----------+-------------------+---------------+

$ ./trivy image --ignore-unfixed --vuln-type library --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if  eq .Severity "CRITICAL" }}{{- $critical = add $critical 1 }}{{- end }}{{- if  eq .Severity "HIGH" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' elastic/logstash:7.13.0
 
Critical: 2, High: 3