github/kubescape
1
0
Fork 0
mirror of https://github.com/kubescape/kubescape.git synced 2026-04-15 06:58:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

update docs & minor changes

Browse Source 
Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>
This commit is contained in:
Anubhav Gupta
2023-09-04 13:02:18 +05:30
parent 7f889b8423
commit 78ec661452
7 changed files with 66 additions and 19089 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/patch/README.md
+59 -27
View File
@@ -41,16 +41,15 @@ The patch command can be run in 2 ways:
### Flags
| Flag | Description | Required | Default |
|------|-------------|----------|---------|
| -i, --image | Image name to be patched (should be in canonical form) | Yes | |
| -r, --report | Generate reports of the image scan before and after patching | No | false |
| -a, --addr | Address of the buildkitd service | No | unix:///run/buildkit/buildkitd.sock |
| -t, --tag | Tag of the resultant patched image | No | image_name-patched |
| --timeout | Timeout for the patching process | No | 5m |
| -u, --username | Username for the image registry login | No | |
| -p, --password | Password for the image registry login | No | |
| -h, --help | help for patch | No | |
| Flag | Description | Required | Default |
| -------------- | ------------------------------------------------------ | -------- | ----------------------------------- |
| -i, --image | Image name to be patched (should be in canonical form) | Yes | |
| -a, --addr | Address of the buildkitd service | No | unix:///run/buildkit/buildkitd.sock |
| -t, --tag | Tag of the resultant patched image | No | image_name-patched |
| --timeout | Timeout for the patching process | No | 5m |
| -u, --username | Username for the image registry login | No | |
| -p, --password | Password for the image registry login | No | |
| -h, --help | help for patch | No | |
## Example
@@ -76,27 +75,60 @@ We will demonstrate how to use the patch command with an example of [nginx](http
sudo kubescape patch --image docker.io/library/nginx:1.22
```
3. The output will be similar to:
3. You will get an output like below:
```bash
[info] Scanning image...
[success] Scanned image successfully
[info] Patching image...
...<logs>
[success] Patched image successfully
[info] Re-scanning image...
[success] Re-scanned image successfully
[info] Preparing results ...
✅ Successfully scanned image: docker.io/library/nginx:1.22
✅ Patched image successfully. Loaded image: nginx:1.22-patched
✅ Successfully re-scanned image: nginx:1.22-patched
| Severity | Vulnerability | Component | Version | Fixed In |
| -------- | -------------- | ------------- | ----------------------- | -------- |
| Critical | CVE-2023-23914 | curl | 7.74.0-1.3+deb11u7 | wont-fix |
| Critical | CVE-2019-8457 | libdb5.3 | 5.3.28+dfsg1-0.8 | wont-fix |
| High | CVE-2022-42916 | libcurl4 | 7.74.0-1.3+deb11u7 | wont-fix |
| High | CVE-2022-1304 | libext2fs2 | 1.46.2-2 | wont-fix |
| High | CVE-2022-42916 | curl | 7.74.0-1.3+deb11u7 | wont-fix |
| High | CVE-2022-1304 | e2fsprogs | 1.46.2-2 | wont-fix |
| High | CVE-2022-1304 | libcom-err2 | 1.46.2-2 | wont-fix |
| High | CVE-2023-27533 | curl | 7.74.0-1.3+deb11u7 | wont-fix |
| High | CVE-2023-27534 | libcurl4 | 7.74.0-1.3+deb11u7 | wont-fix |
| High | CVE-2023-27533 | libcurl4 | 7.74.0-1.3+deb11u7 | wont-fix |
| High | CVE-2022-43551 | libcurl4 | 7.74.0-1.3+deb11u7 | wont-fix |
| High | CVE-2022-3715 | bash | 5.1-2+deb11u1 | wont-fix |
| High | CVE-2023-27534 | curl | 7.74.0-1.3+deb11u7 | wont-fix |
| High | CVE-2022-43551 | curl | 7.74.0-1.3+deb11u7 | wont-fix |
| High | CVE-2021-33560 | libgcrypt20 | 1.8.7-6 | wont-fix |
| High | CVE-2023-2953 | libldap-2.4-2 | 2.4.57+dfsg-3+deb11u1 | wont-fix |
| High | CVE-2022-1304 | libss2 | 1.46.2-2 | wont-fix |
| High | CVE-2020-22218 | libssh2-1 | 1.9.0-2 | wont-fix |
| High | CVE-2023-29491 | libtinfo6 | 6.2+20201114-2+deb11u1 | wont-fix |
| High | CVE-2022-2309 | libxml2 | 2.9.10+dfsg-6.7+deb11u4 | wont-fix |
| High | CVE-2022-4899 | libzstd1 | 1.4.8+dfsg-2.1 | wont-fix |
| High | CVE-2022-1304 | logsave | 1.46.2-2 | wont-fix |
| High | CVE-2023-29491 | ncurses-base | 6.2+20201114-2+deb11u1 | wont-fix |
| High | CVE-2023-29491 | ncurses-bin | 6.2+20201114-2+deb11u1 | wont-fix |
| High | CVE-2023-31484 | perl-base | 5.32.1-4+deb11u2 | wont-fix |
| High | CVE-2020-16156 | perl-base | 5.32.1-4+deb11u2 | wont-fix |
Vulnerability summary:
Image: docker.io/library/nginx:1.22
* Total CVE's : 175
* Fixable CVE's: 23
Image: docker.io/library/nginx:1.22-patched
* Total CVE's : 152
* Fixable CVE's: 0
Vulnerability summary - 161 vulnerabilities found:
Image: nginx:1.22-patched
* 3 Critical
* 24 High
* 31 Medium
* 103 Other
Most vulnerable components:
* curl (7.74.0-1.3+deb11u7) - 1 Critical, 4 High, 5 Medium, 1 Low, 3 Negligible
* libcurl4 (7.74.0-1.3+deb11u7) - 1 Critical, 4 High, 5 Medium, 1 Low, 3 Negligible
* libtiff5 (4.2.0-1+deb11u4) - 7 Medium, 10 Negligible, 2 Unknown
* libxml2 (2.9.10+dfsg-6.7+deb11u4) - 1 High, 2 Medium
* perl-base (5.32.1-4+deb11u2) - 2 High, 2 Negligible
What now?
─────────
* Run with '--verbose'/'-v' flag for detailed vulnerabilities view
* Install Kubescape in your cluster for continuous monitoring and a full vulnerability report: https://github.com/kubescape/helm-charts/tree/main/charts/kubescape-cloud-operator
```
## Limitations
cmd/patch/patch.go
+1 -1
View File
@@ -64,7 +64,7 @@ func validateImagePatchInfo(patchInfo *metav1.PatchInfo) error {
}
// Convert image to canonical format (required by copacetic for patching images)
patchInfoImage, err := cautils.Normalize_image_name(patchInfo.Image)
patchInfoImage, err := cautils.NormalizeImageName(patchInfo.Image)
if err != nil {
return nil
}
core/cautils/normalize_image_name.go
+1 -1
View File
@@ -4,7 +4,7 @@ import (
"github.com/docker/distribution/reference"
)
func Normalize_image_name(img string) (string, error) {
func NormalizeImageName(img string) (string, error) {
name, err := reference.ParseNormalizedNamed(img)
if err != nil {
return "", err
core/cautils/normalize_image_name_test.go
+1 -1
View File
@@ -21,7 +21,7 @@ func Test_normalize_name(t *testing.T) {
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
name, _ := Normalize_image_name(tt.img)
name, _ := NormalizeImageName(tt.img)
assert.Equal(t, tt.want, name, tt.name)
})
}
core/core/patch.go
+3 -10
View File
@@ -9,7 +9,7 @@ import (
"github.com/anchore/grype/grype/presenter"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/go-logger/iconlogger"
"github.com/kubescape/kubescape/v2/core/cautils"
ksmetav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
@@ -22,7 +22,6 @@ import (
func (ks *Kubescape) Patch(ctx context.Context, patchInfo *ksmetav1.PatchInfo) error {
logger.InitLogger(iconlogger.LoggerName)
// ===================== Scan the image =====================
logger.L().Start(fmt.Sprintf("Scanning image: %s", patchInfo.Image))
@@ -63,9 +62,8 @@ func (ks *Kubescape) Patch(ctx context.Context, patchInfo *ksmetav1.PatchInfo) e
return err
}
if logger.L().GetLevel() != "debug" {
enableCopaLogger(sout, serr)
}
// Restore the output streams
os.Stdout, os.Stderr = sout, serr
patchedImageName := fmt.Sprintf("%s:%s", patchInfo.ImageName, patchInfo.PatchedImageTag)
logger.L().StopSuccess(fmt.Sprintf("Patched image successfully. Loaded image: %s", patchedImageName))
@@ -109,8 +107,3 @@ func disableCopaLogger() {
null, _ := os.Open(os.DevNull)
log.SetOutput(null)
}
func enableCopaLogger(sout, serr *os.File) {
os.Stdout, os.Stderr = sout, serr
log.SetOutput(os.Stdout)
}
core/pkg/opaprocessor/utils.go
+1 -1
View File
@@ -106,6 +106,6 @@ var imageNameNormalizeDefinition = func(bctx rego.BuiltinContext, a *ast.Term) (
if err != nil {
return nil, fmt.Errorf("invalid parameter type: %v", err)
}
normalizedName, err := cautils.Normalize_image_name(string(aStr))
normalizedName, err := cautils.NormalizeImageName(string(aStr))
return ast.StringTerm(normalizedName), err
}
nginx:latest.json
-19048
View File
File diff suppressed because one or more lines are too long