Skip to content

Commit cbbd1ce

Browse files
knqyf263DmitriyLewenchen-keinan
authored
feat(k8s): add support for vulnerability detection (#5268)
Signed-off-by: knqyf263 <[email protected]> Signed-off-by: chenk <[email protected]> Co-authored-by: DmitriyLewen <[email protected]> Co-authored-by: chenk <[email protected]>
1 parent 24a0d92 commit cbbd1ce

File tree

21 files changed

+1451
-117
lines changed

21 files changed

+1451
-117
lines changed

‎docs/docs/scanner/vulnerability.md

+5-4
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ The following packages are supported.
55

66
- [OS packages](#os-packages)
77
- [Language-specific packages](#language-specific-packages)
8+
- [Kubernetes components (control plane, node and addons)](#kubernetes-components-control-plane-node-and-addons)
89

910
Trivy also detects known vulnerabilities in Kubernetes components using KBOM (Kubernetes bill of Material) scanning. To learn more, see the [documentation for Kubernetes scanning](../target/kubernetes.md#KBOM).
1011

@@ -106,9 +107,9 @@ Trivy can detect vulnerabilities in Kubernetes clusters and components.
106107

107108
### Data Sources
108109

109-
| Vendor | Source |
110-
| ------------- | ------------------------------------------------------------ |
111-
| Kubernetes | [Kubernetes Official CVE feed][^1] |
110+
| Vendor | Source |
111+
| ------------- |---------------------------------------------|
112+
| Kubernetes | [Kubernetes Official CVE feed][k8s-cve][^1] |
112113

113114
[^1]: Some manual triage and correction has been made.
114115

@@ -195,4 +196,4 @@ Currently, specifying a username and password is not supported.
195196

196197
[nvd]: https://nvd.nist.gov/vuln
197198

198-
[Kubernetes Official CVE feed]: https://kubernetes.io/docs/reference/issues-security/official-cve-feed/
199+
[k8s-cve]: https://kubernetes.io/docs/reference/issues-security/official-cve-feed/

‎go.mod

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,9 @@ require (
2323
github.com/aquasecurity/table v1.8.0
2424
github.com/aquasecurity/testdocker v0.0.0-20230111101738-e741bda259da
2525
github.com/aquasecurity/tml v0.6.1
26-
github.com/aquasecurity/trivy-db v0.0.0-20230831170347-f732860d4917
26+
github.com/aquasecurity/trivy-db v0.0.0-20231005141211-4fc651f7ac8d
2727
github.com/aquasecurity/trivy-java-db v0.0.0-20230209231723-7cddb1406728
28-
github.com/aquasecurity/trivy-kubernetes v0.5.7
28+
github.com/aquasecurity/trivy-kubernetes v0.5.8-0.20230928134646-b414e546fe6d
2929
github.com/aws/aws-sdk-go v1.45.19
3030
github.com/aws/aws-sdk-go-v2 v1.21.0
3131
github.com/aws/aws-sdk-go-v2/config v1.18.38

‎go.sum

+4-4
Original file line numberDiff line numberDiff line change
@@ -343,12 +343,12 @@ github.com/aquasecurity/testdocker v0.0.0-20230111101738-e741bda259da h1:pj/adfN
343343
github.com/aquasecurity/testdocker v0.0.0-20230111101738-e741bda259da/go.mod h1:852lbQLpK2nCwlR4ZLYIccxYCfoQao6q9Nl6tjz54v8=
344344
github.com/aquasecurity/tml v0.6.1 h1:y2ZlGSfrhnn7t4ZJ/0rotuH+v5Jgv6BDDO5jB6A9gwo=
345345
github.com/aquasecurity/tml v0.6.1/go.mod h1:OnYMWY5lvI9ejU7yH9LCberWaaTBW7hBFsITiIMY2yY=
346-
github.com/aquasecurity/trivy-db v0.0.0-20230831170347-f732860d4917 h1:MQd7h7yUyA8UlUzhjNMzpUX0NpD7jfxmRfSKwp/Ji3E=
347-
github.com/aquasecurity/trivy-db v0.0.0-20230831170347-f732860d4917/go.mod h1:WJ5Qnk5ZNGWvks07GOZe2IOsuXrPfSC5c8hYGOGfrsU=
346+
github.com/aquasecurity/trivy-db v0.0.0-20231005141211-4fc651f7ac8d h1:fjI9mkoTUAkbGqpzt9nJsO24RAdfG+ZSiLFj0G2jO8c=
347+
github.com/aquasecurity/trivy-db v0.0.0-20231005141211-4fc651f7ac8d/go.mod h1:cj9/QmD9N3OZnKQMp+/DvdV+ym3HyIkd4e+F0ZM3ZGs=
348348
github.com/aquasecurity/trivy-java-db v0.0.0-20230209231723-7cddb1406728 h1:0eS+V7SXHgqoT99tV1mtMW6HL4HdoB9qGLMCb1fZp8A=
349349
github.com/aquasecurity/trivy-java-db v0.0.0-20230209231723-7cddb1406728/go.mod h1:Ldya37FLi0e/5Cjq2T5Bty7cFkzUDwTcPeQua+2M8i8=
350-
github.com/aquasecurity/trivy-kubernetes v0.5.7 h1:+tIrSnIkvweL+cuK0SSiYxF8EvKT3Xk1iuE9EWduV+c=
351-
github.com/aquasecurity/trivy-kubernetes v0.5.7/go.mod h1:e1RaMcs2R/C+eP1Pi7JyhDB7Qn1PNRg5rTVwuJL7AiE=
350+
github.com/aquasecurity/trivy-kubernetes v0.5.8-0.20230928134646-b414e546fe6d h1:5urHj0NMGflp/M9Ll5QlKfo0Kf6nJ01RED1HRgl0CeE=
351+
github.com/aquasecurity/trivy-kubernetes v0.5.8-0.20230928134646-b414e546fe6d/go.mod h1:e1RaMcs2R/C+eP1Pi7JyhDB7Qn1PNRg5rTVwuJL7AiE=
352352
github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
353353
github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
354354
github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=

‎integration/sbom_test.go

+9
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,15 @@ func TestSBOM(t *testing.T) {
5858
},
5959
golden: "testdata/fluentd-multiple-lockfiles.json.golden",
6060
},
61+
{
62+
name: "minikube KBOM",
63+
args: args{
64+
input: "testdata/fixtures/sbom/minikube-kbom.json",
65+
format: "json",
66+
artifactType: "cyclonedx",
67+
},
68+
golden: "testdata/minikube-kbom.json.golden",
69+
},
6170
{
6271
name: "centos7 in in-toto attestation",
6372
args: args{

‎integration/testdata/fixtures/db/data-source.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -144,3 +144,8 @@
144144
ID: "cbl-mariner"
145145
Name: "CBL-Mariner Vulnerability Data"
146146
URL: "https://github.com/microsoft/CBL-MarinerVulnerabilityData"
147+
- key: k8s::Official Kubernetes CVE Feed
148+
value:
149+
ID: "k8s"
150+
Name: "Official Kubernetes CVE Feed"
151+
URL: "https://kubernetes.io/docs/reference/issues-security/official-cve-feed/index.json"

‎integration/testdata/fixtures/db/k8s.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
- bucket: "k8s::Official Kubernetes CVE Feed"
2+
pairs:
3+
- bucket: k8s.io/kubelet
4+
pairs:
5+
- key: CVE-2023-2431
6+
value:
7+
PatchedVersions:
8+
- 1.24.14
9+
- 1.25.9
10+
- 1.26.4
11+
- 1.27.1
12+
VulnerableVersions:
13+
- "< 1.24.14"
14+
- ">= 1.25.0, < 1.25.9"
15+
- ">= 1.26.0, < 1.26.4"
16+
- ">= 1.27.0, < 1.27.1"

‎integration/testdata/fixtures/db/vulnerability.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -1037,6 +1037,20 @@
10371037
ghsa: 3.0
10381038
nvd: 3.0
10391039
redhat: 3.0
1040+
- key: CVE-2023-2431
1041+
value:
1042+
Title: "Bypass of seccomp profile enforcement "
1043+
Description: "A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement..."
1044+
Severity: LOW
1045+
VendorSeverity:
1046+
k8s: 1
1047+
CVSS:
1048+
k8s:
1049+
V3Vector: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
1050+
V3Score: 3.4
1051+
References:
1052+
- https://github.com/kubernetes/kubernetes/issues/118690
1053+
- https://www.cve.org/cverecord?id=CVE-2023-2431
10401054
- key: CVE-2021-3712
10411055
value:
10421056
CVSS:

0 commit comments

Comments
 (0)