diff --git a/MANIFEST.in b/MANIFEST.in index 9d4baf9..f24ff03 100644 --- a/MANIFEST.in +++ b/MANIFEST.in @@ -1,5 +1,6 @@ include LICENSE include README.md +include *.html include requirements.txt include .env.example recursive-include testfiles * diff --git a/config.py b/config.py index b17bf95..e1ac81f 100644 --- a/config.py +++ b/config.py @@ -38,7 +38,9 @@ BASE_DIR = os.path.abspath(os.path.dirname(__file__)) -RESULTS_DIR = os.path.join(BASE_DIR, "results") +# RESULTS_DIR = os.path.join(BASE_DIR, "results") +print("CURRENT WORKING DIRECTORY IS: ", os.getcwd()) +RESULTS_DIR = os.path.join(os.getcwd(), "results") os.makedirs(os.path.dirname(RESULTS_DIR), exist_ok=True) @@ -101,4 +103,460 @@ docker_score_prompt = PromptTemplate( input_variables=["results"], template=docker_score_template -) \ No newline at end of file +) + +# report_template.py + +html_template = """ + + + + + + Docker Security Report + + + +
+
+

Docker Security Report

+

{{SCAN_MODE_TITLE}}

+
+ +
+ +
+

Scan Information

+
+
+
Image Name
+
{{IMAGE_NAME}}
+
+
+
Scan Mode
+
{{SCAN_MODE}}
+
+
+
Dockerfile Path
+
{{DOCKERFILE_PATH}}
+
+
+
Scan Date
+
{{SCAN_DATE}}
+
+
+
Analysis Score
+
{{ANALYSIS_SCORE}}
+
+
+
+ + + {{SECURITY_SCORE_SECTION}} + + + {{IMAGE_INFO_SECTION}} + + + {{CONFIG_ANALYSIS_SECTION}} + + + {{DOCKERFILE_SECTION}} + + +
+

Vulnerability Summary

+ {{VULNERABILITY_SUMMARY}} +
+ + + {{DETAILED_VULNERABILITIES_SECTION}} +
+ +
+

Generated by docksec on {{SCAN_DATE}}

+
+
+ + + +""" diff --git a/docker_scanner.py b/docker_scanner.py index 6e042a9..1885c86 100644 --- a/docker_scanner.py +++ b/docker_scanner.py @@ -363,7 +363,8 @@ def save_results_to_json(self, results: Dict) -> str: "scan_info": { "image": self.image_name, "dockerfile": self.dockerfile_path, - "scan_time": results.get('timestamp', datetime.now().strftime("%Y-%m-%d %H:%M:%S")) + "scan_time": results.get('timestamp', datetime.now().strftime("%Y-%m-%d %H:%M:%S")), + "analysis score": self.analysis_score }, "vulnerabilities": json_results } @@ -470,6 +471,7 @@ def add_section_header(self, title): pdf.multi_cell_with_title('Scan Mode:', scan_mode.replace('_', ' ').title()) pdf.multi_cell_with_title('Dockerfile:', results.get('dockerfile_path', 'N/A')) pdf.multi_cell_with_title('Scan Date:', results.get('timestamp', '')) + pdf.multi_cell_with_title('Analysis Score:', str(self.analysis_score)) pdf.ln(5) # Add image information if available (for extended scans) @@ -616,7 +618,7 @@ def add_section_header(self, title): def generate_all_reports(self, results: Dict) -> Dict: """ - Generate all report formats (JSON, CSV, PDF) from scan results. + Generate all report formats (JSON, CSV, PDF, HTML) from scan results. Args: results: The scan results to save @@ -624,12 +626,16 @@ def generate_all_reports(self, results: Dict) -> Dict: Returns: Dictionary with paths to the generated reports """ + self.analysis_score = self.get_security_score(results) + report_paths = { 'json': '', 'csv': '', - 'pdf': '' + 'pdf': '', + 'html': '' } - + print("IMAGE SCANNING RESULTS BEFORE SAVING: ", results) + # Save to JSON json_path = self.save_results_to_json(results) if json_path: @@ -645,6 +651,11 @@ def generate_all_reports(self, results: Dict) -> Dict: if pdf_path: report_paths['pdf'] = pdf_path + # Save to html + html_path = self.save_results_to_html(results) + if html_path: + report_paths['html'] = html_path + return report_paths def get_security_score(self, results: Dict) -> float: @@ -661,8 +672,285 @@ def get_security_score(self, results: Dict) -> float: score = self.score_chain.invoke({"results": results}) print(f"Security Score: {score.score}") return score.score - + def save_results_to_html(self, results: Dict) -> str: + """ + Save scan results to an HTML file using a template. + + Args: + results: The scan results to save + + Returns: + Path to the saved HTML file + """ + output_file = os.path.join(self.RESULTS_DIR, f"{re.sub(r'[:/.\-]', '_', self.image_name)}_security_report.html") + # template_path = os.path.join(os.path.dirname(__file__), 'templates', 'report_template.html') + template_path = os.path.join(os.path.dirname(__file__), 'report_template.html') + + try: + # # Read the HTML template + # if not os.path.exists(template_path): + # raise FileNotFoundError(f"HTML template not found at {template_path}") + # + # with open(template_path, 'r', encoding='utf-8') as f: + # html_template = f.read() + from config import html_template + + # Prepare template variables + template_vars = self._prepare_html_template_vars(results) + + # Replace placeholders in template + html_content = html_template + for key, value in template_vars.items(): + html_content = html_content.replace(f'{{{{{key}}}}}', str(value)) + + # Save the HTML file + with open(output_file, 'w', encoding='utf-8') as f: + f.write(html_content) + + print(f"HTML report saved to {output_file}") + return output_file + + except Exception as e: + print(f"Error saving results to HTML file: {e}") + return "" + + def _prepare_html_template_vars(self, results: Dict) -> Dict[str, str]: + """ + Prepare variables for HTML template replacement. + + Args: + results: The scan results + + Returns: + Dictionary of template variables + """ + vulnerabilities = results.get('json_data', []) + scan_mode = results.get('scan_mode', 'full') + + # Base template variables + template_vars = { + 'IMAGE_NAME': self.image_name, + 'SCAN_MODE': scan_mode.replace('_', ' ').title(), + 'SCAN_MODE_TITLE': f"{scan_mode.replace('_', ' ').title()} Scan", + 'DOCKERFILE_PATH': results.get('dockerfile_path', 'N/A'), + 'SCAN_DATE': results.get('timestamp', ''), + 'ANALYSIS_SCORE': self.analysis_score + } + + # Security Score Section + if 'security_score' in results: + template_vars['SECURITY_SCORE_SECTION'] = f""" +
+

Security Score

+
+
Overall Security Score
+
{results['security_score']}/100
+
+
+ """ + else: + template_vars['SECURITY_SCORE_SECTION'] = "" + + # Image Information Section + if 'image_info' in results: + image_info = results['image_info'] + size_mb = round(image_info.get('size', 0) / (1024*1024), 2) if image_info.get('size') else 'N/A' + + template_vars['IMAGE_INFO_SECTION'] = f""" +
+

Image Information

+
+
+
Size
+
{size_mb} MB
+
+
+
Created
+
{image_info.get('created', 'N/A')[:19]}
+
+
+
Architecture
+
{image_info.get('architecture', 'N/A')}
+
+
+
OS
+
{image_info.get('os', 'N/A')}
+
+
+
+ """ + else: + template_vars['IMAGE_INFO_SECTION'] = "" + + # Configuration Analysis Section + if 'config_analysis' in results: + config_analysis = results['config_analysis'] + config_html = '

Configuration Analysis

' + + # High risk issues + if config_analysis.get('high_risk'): + config_html += '

High-Risk Issues

    ' + for issue in config_analysis['high_risk']: + config_html += f'
  • {self._escape_html(issue)}
    • ' + config_html += '
' + + # Medium risk issues + if config_analysis.get('medium_risk'): + config_html += '

Medium-Risk Issues

    ' + for issue in config_analysis['medium_risk']: + config_html += f'
  • {self._escape_html(issue)}
    • ' + config_html += '
' + + # Low risk issues + if config_analysis.get('low_risk'): + config_html += '

Low-Risk Issues

    ' + for issue in config_analysis['low_risk']: + config_html += f'
  • {self._escape_html(issue)}
    • ' + config_html += '
' + + config_html += '
' + template_vars['CONFIG_ANALYSIS_SECTION'] = config_html + else: + template_vars['CONFIG_ANALYSIS_SECTION'] = "" + + # Dockerfile Section + if not results['dockerfile_scan'].get('skipped', False): + if results['dockerfile_scan']['success']: + dockerfile_content = '
No Dockerfile linting issues found
' + else: + dockerfile_output = results['dockerfile_scan'].get('output', '') + dockerfile_content = f'
{self._escape_html(dockerfile_output[:2000])}
' + if len(dockerfile_output) > 2000: + dockerfile_content += '

Output truncated for display...

' + + template_vars['DOCKERFILE_SECTION'] = f""" +
+

Dockerfile Scan Results

+ {dockerfile_content} +
+ """ + else: + template_vars['DOCKERFILE_SECTION'] = "" + + # Vulnerability Summary + if not vulnerabilities: + template_vars['VULNERABILITY_SUMMARY'] = '
No vulnerabilities found
' + template_vars['DETAILED_VULNERABILITIES_SECTION'] = "" + else: + # Count vulnerabilities by severity + severity_counts = {'CRITICAL': 0, 'HIGH': 0, 'MEDIUM': 0, 'LOW': 0} + for vuln in vulnerabilities: + severity = vuln.get('Severity', 'UNKNOWN') + if severity in severity_counts: + severity_counts[severity] += 1 + + # Create severity statistics HTML + severity_html = f""" +
+
+
{severity_counts['CRITICAL']}
+
Critical
+
+
+
{severity_counts['HIGH']}
+
High
+
+
+
{severity_counts['MEDIUM']}
+
Medium
+
+
+
{severity_counts['LOW']}
+
Low
+
+
+

Total vulnerabilities: {len(vulnerabilities)}

+ """ + + template_vars['VULNERABILITY_SUMMARY'] = severity_html + + # Detailed vulnerabilities table + if vulnerabilities: + table_html = """ +
+

Detailed Vulnerabilities

+ + + + + + + + + + + + + + """ + + # Show top 50 vulnerabilities to avoid overly large HTML files + for vuln in vulnerabilities[:50]: + severity = vuln.get('Severity', 'UNKNOWN').lower() + severity_class = f'badge-{severity}' if severity in ['critical', 'high', 'medium', 'low'] else 'badge-low' + + status = vuln.get('Status', 'affected') + status_class = 'status-fixed' if status == 'fixed' else 'status-affected' + + cvss_score = vuln.get('CVSS', 'N/A') + if cvss_score and cvss_score != 'N/A': + cvss_score = f"{cvss_score:.1f}" if isinstance(cvss_score, (int, float)) else str(cvss_score) + + table_html += f""" + + + + + + + + + + """ + + table_html += """ + +
IDSeverityPackageVersionTitleCVSSStatus
{self._escape_html(vuln.get('VulnerabilityID', 'N/A'))}{vuln.get('Severity', 'N/A')}{self._escape_html(vuln.get('PkgName', 'N/A'))}{self._escape_html(vuln.get('InstalledVersion', 'N/A'))}{self._escape_html((vuln.get('Title', '')[:80] + '...') if len(vuln.get('Title', '')) > 80 else vuln.get('Title', 'N/A'))}{cvss_score}{status}
+ """ + + if len(vulnerabilities) > 50: + table_html += f'

Showing 50 of {len(vulnerabilities)} vulnerabilities. See CSV/JSON for complete list.

' + + table_html += '
' + template_vars['DETAILED_VULNERABILITIES_SECTION'] = table_html + else: + template_vars['DETAILED_VULNERABILITIES_SECTION'] = "" + + return template_vars + + def _escape_html(self, text: str) -> str: + """ + Escape HTML special characters in text. + + Args: + text: Text to escape + + Returns: + HTML-escaped text + """ + if not text: + return "" + + html_escape_table = { + "&": "&", + '"': """, + "'": "'", + ">": ">", + "<": "<", + } + + return "".join(html_escape_table.get(c, c) for c in str(text)) def main(): """Main function to run the security scanner.""" @@ -685,7 +973,6 @@ def main(): # Calculate security score score = scanner.get_security_score(results) - print_section("Security Score", [f"Score: {score}"], "yellow") # Save results to file diff --git a/report_template.html b/report_template.html new file mode 100644 index 0000000..766ba1b --- /dev/null +++ b/report_template.html @@ -0,0 +1,446 @@ + + + + + + Docker Security Report + + + +
+
+

Docker Security Report

+

{{SCAN_MODE_TITLE}}

+
+ +
+ +
+

Scan Information

+
+
+
Image Name
+
{{IMAGE_NAME}}
+
+
+
Scan Mode
+
{{SCAN_MODE}}
+
+
+
Dockerfile Path
+
{{DOCKERFILE_PATH}}
+
+
+
Scan Date
+
{{SCAN_DATE}}
+
+
+
+ + + {{SECURITY_SCORE_SECTION}} + + + {{IMAGE_INFO_SECTION}} + + + {{CONFIG_ANALYSIS_SECTION}} + + + {{DOCKERFILE_SECTION}} + + +
+

Vulnerability Summary

+ {{VULNERABILITY_SUMMARY}} +
+ + + {{DETAILED_VULNERABILITIES_SECTION}} +
+ +
+

Generated by docksec on {{SCAN_DATE}}

+
+
+ + diff --git a/report_template.html:Zone.Identifier b/report_template.html:Zone.Identifier new file mode 100644 index 0000000..e69de29 diff --git a/results/python_3_9_slim_scan_results.json b/results/python_3_9_slim_scan_results.json deleted file mode 100644 index fc05b00..0000000 --- a/results/python_3_9_slim_scan_results.json +++ /dev/null @@ -1,897 +0,0 @@ -{ - "scan_info": { - "image": "python:3.9-slim", - "dockerfile": ".\\testfiles\\1\\Dockerfile", - "scan_time": "2025-03-01 22:42:09" - }, - "vulnerabilities": [ - { - "VulnerabilityID": "CVE-2011-3374", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "apt", - "InstalledVersion": "2.6.1", - "Severity": "LOW", - "Title": "It was found that apt-key in apt, all versions, do not correctly valid ...", - "Description": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle a...", - "Status": "affected", - "CVSS": 3.7, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-3374" - }, - { - "VulnerabilityID": "TEMP-0841856-B18BAF", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "bash", - "InstalledVersion": "5.2.15-2+b7", - "Severity": "LOW", - "Title": "[Privilege escalation possible to other user than root]", - "Description": "", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://security-tracker.debian.org/tracker/TEMP-0841856-B18BAF" - }, - { - "VulnerabilityID": "CVE-2022-0563", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "bsdutils", - "InstalledVersion": "1:2.38.1-5+deb12u3", - "Severity": "LOW", - "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", - "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment var...", - "Status": "affected", - "CVSS": 5.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563" - }, - { - "VulnerabilityID": "CVE-2016-2781", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "coreutils", - "InstalledVersion": "9.1-1", - "Severity": "LOW", - "Title": "coreutils: Non-privileged session can escape to the parent session in chroot", - "Description": "chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes ...", - "Status": "will_not_fix", - "CVSS": 6.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-2781" - }, - { - "VulnerabilityID": "CVE-2017-18018", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "coreutils", - "InstalledVersion": "9.1-1", - "Severity": "LOW", - "Title": "coreutils: race condition vulnerability in chown and chgrp", - "Description": "In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R...", - "Status": "affected", - "CVSS": 4.7, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-18018" - }, - { - "VulnerabilityID": "CVE-2022-27943", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "gcc-12-base", - "InstalledVersion": "12.2.0-14", - "Severity": "LOW", - "Title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", - "Description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.", - "Status": "affected", - "CVSS": 5.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-27943" - }, - { - "VulnerabilityID": "CVE-2023-4039", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "gcc-12-base", - "InstalledVersion": "12.2.0-14", - "Severity": "LOW", - "Title": "gcc: -fstack-protector fails to guard dynamic stack allocations on ARM64", - "Description": "**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \n...", - "Status": "affected", - "CVSS": 4.8, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-4039" - }, - { - "VulnerabilityID": "CVE-2022-3219", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "gpgv", - "InstalledVersion": "2.2.40-1.1", - "Severity": "LOW", - "Title": "gnupg: denial of service issue (resource consumption) using compressed packets", - "Description": "GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to...", - "Status": "affected", - "CVSS": 3.3, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-3219" - }, - { - "VulnerabilityID": "CVE-2011-3374", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libapt-pkg6.0", - "InstalledVersion": "2.6.1", - "Severity": "LOW", - "Title": "It was found that apt-key in apt, all versions, do not correctly valid ...", - "Description": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle a...", - "Status": "affected", - "CVSS": 3.7, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-3374" - }, - { - "VulnerabilityID": "CVE-2022-0563", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libblkid1", - "InstalledVersion": "2.38.1-5+deb12u3", - "Severity": "LOW", - "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", - "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment var...", - "Status": "affected", - "CVSS": 5.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563" - }, - { - "VulnerabilityID": "CVE-2010-4756", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libc-bin", - "InstalledVersion": "2.36-9+deb12u9", - "Severity": "LOW", - "Title": "glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions", - "Description": "The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consu...", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2010-4756" - }, - { - "VulnerabilityID": "CVE-2018-20796", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libc-bin", - "InstalledVersion": "2.36-9+deb12u9", - "Severity": "LOW", - "Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c", - "Description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by ...", - "Status": "affected", - "CVSS": 7.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-20796" - }, - { - "VulnerabilityID": "CVE-2019-1010022", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libc-bin", - "InstalledVersion": "2.36-9+deb12u9", - "Severity": "LOW", - "Title": "glibc: stack guard protection bypass", - "Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vect...", - "Status": "affected", - "CVSS": 9.8, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010022" - }, - { - "VulnerabilityID": "CVE-2019-1010023", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libc-bin", - "InstalledVersion": "2.36-9+deb12u9", - "Severity": "LOW", - "Title": "glibc: running ldd on malicious ELF leads to code execution because of wrong size computation", - "Description": "GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privile...", - "Status": "affected", - "CVSS": 8.8, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010023" - }, - { - "VulnerabilityID": "CVE-2019-1010024", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libc-bin", - "InstalledVersion": "2.36-9+deb12u9", - "Severity": "LOW", - "Title": "glibc: ASLR bypass using cache of thread stack and heap", - "Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: gl...", - "Status": "affected", - "CVSS": 5.3, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010024" - }, - { - "VulnerabilityID": "CVE-2019-1010025", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libc-bin", - "InstalledVersion": "2.36-9+deb12u9", - "Severity": "LOW", - "Title": "glibc: information disclosure of heap addresses of pthread_created thread", - "Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: ...", - "Status": "affected", - "CVSS": 5.3, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010025" - }, - { - "VulnerabilityID": "CVE-2019-9192", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libc-bin", - "InstalledVersion": "2.36-9+deb12u9", - "Severity": "LOW", - "Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c", - "Description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by ...", - "Status": "affected", - "CVSS": 7.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9192" - }, - { - "VulnerabilityID": "CVE-2010-4756", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libc6", - "InstalledVersion": "2.36-9+deb12u9", - "Severity": "LOW", - "Title": "glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions", - "Description": "The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consu...", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2010-4756" - }, - { - "VulnerabilityID": "CVE-2018-20796", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libc6", - "InstalledVersion": "2.36-9+deb12u9", - "Severity": "LOW", - "Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c", - "Description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by ...", - "Status": "affected", - "CVSS": 7.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-20796" - }, - { - "VulnerabilityID": "CVE-2019-1010022", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libc6", - "InstalledVersion": "2.36-9+deb12u9", - "Severity": "LOW", - "Title": "glibc: stack guard protection bypass", - "Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vect...", - "Status": "affected", - "CVSS": 9.8, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010022" - }, - { - "VulnerabilityID": "CVE-2019-1010023", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libc6", - "InstalledVersion": "2.36-9+deb12u9", - "Severity": "LOW", - "Title": "glibc: running ldd on malicious ELF leads to code execution because of wrong size computation", - "Description": "GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privile...", - "Status": "affected", - "CVSS": 8.8, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010023" - }, - { - "VulnerabilityID": "CVE-2019-1010024", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libc6", - "InstalledVersion": "2.36-9+deb12u9", - "Severity": "LOW", - "Title": "glibc: ASLR bypass using cache of thread stack and heap", - "Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: gl...", - "Status": "affected", - "CVSS": 5.3, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010024" - }, - { - "VulnerabilityID": "CVE-2019-1010025", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libc6", - "InstalledVersion": "2.36-9+deb12u9", - "Severity": "LOW", - "Title": "glibc: information disclosure of heap addresses of pthread_created thread", - "Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: ...", - "Status": "affected", - "CVSS": 5.3, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010025" - }, - { - "VulnerabilityID": "CVE-2019-9192", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libc6", - "InstalledVersion": "2.36-9+deb12u9", - "Severity": "LOW", - "Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c", - "Description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by ...", - "Status": "affected", - "CVSS": 7.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9192" - }, - { - "VulnerabilityID": "CVE-2022-27943", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libgcc-s1", - "InstalledVersion": "12.2.0-14", - "Severity": "LOW", - "Title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", - "Description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.", - "Status": "affected", - "CVSS": 5.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-27943" - }, - { - "VulnerabilityID": "CVE-2023-4039", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libgcc-s1", - "InstalledVersion": "12.2.0-14", - "Severity": "LOW", - "Title": "gcc: -fstack-protector fails to guard dynamic stack allocations on ARM64", - "Description": "**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \n...", - "Status": "affected", - "CVSS": 4.8, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-4039" - }, - { - "VulnerabilityID": "CVE-2018-6829", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libgcrypt20", - "InstalledVersion": "1.10.1-3", - "Severity": "LOW", - "Title": "libgcrypt: ElGamal implementation doesn't have semantic security due to incorrectly encoded plaintexts possibly allowing to obtain sensitive information", - "Description": "cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain s...", - "Status": "affected", - "CVSS": 7.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-6829" - }, - { - "VulnerabilityID": "CVE-2011-3389", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libgnutls30", - "InstalledVersion": "3.7.9-2+deb12u3", - "Severity": "LOW", - "Title": "HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)", - "Description": "The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and o...", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-3389" - }, - { - "VulnerabilityID": "CVE-2018-5709", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libgssapi-krb5-2", - "InstalledVersion": "1.20.1-2+deb12u2", - "Severity": "LOW", - "Title": "krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.c", - "Description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16...", - "Status": "affected", - "CVSS": 7.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-5709" - }, - { - "VulnerabilityID": "CVE-2024-26458", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libgssapi-krb5-2", - "InstalledVersion": "1.20.1-2+deb12u2", - "Severity": "LOW", - "Title": "krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c", - "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26458" - }, - { - "VulnerabilityID": "CVE-2024-26461", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libgssapi-krb5-2", - "InstalledVersion": "1.20.1-2+deb12u2", - "Severity": "LOW", - "Title": "krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c", - "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26461" - }, - { - "VulnerabilityID": "CVE-2018-5709", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libk5crypto3", - "InstalledVersion": "1.20.1-2+deb12u2", - "Severity": "LOW", - "Title": "krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.c", - "Description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16...", - "Status": "affected", - "CVSS": 7.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-5709" - }, - { - "VulnerabilityID": "CVE-2024-26458", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libk5crypto3", - "InstalledVersion": "1.20.1-2+deb12u2", - "Severity": "LOW", - "Title": "krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c", - "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26458" - }, - { - "VulnerabilityID": "CVE-2024-26461", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libk5crypto3", - "InstalledVersion": "1.20.1-2+deb12u2", - "Severity": "LOW", - "Title": "krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c", - "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26461" - }, - { - "VulnerabilityID": "CVE-2018-5709", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libkrb5-3", - "InstalledVersion": "1.20.1-2+deb12u2", - "Severity": "LOW", - "Title": "krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.c", - "Description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16...", - "Status": "affected", - "CVSS": 7.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-5709" - }, - { - "VulnerabilityID": "CVE-2024-26458", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libkrb5-3", - "InstalledVersion": "1.20.1-2+deb12u2", - "Severity": "LOW", - "Title": "krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c", - "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26458" - }, - { - "VulnerabilityID": "CVE-2024-26461", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libkrb5-3", - "InstalledVersion": "1.20.1-2+deb12u2", - "Severity": "LOW", - "Title": "krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c", - "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26461" - }, - { - "VulnerabilityID": "CVE-2018-5709", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libkrb5support0", - "InstalledVersion": "1.20.1-2+deb12u2", - "Severity": "LOW", - "Title": "krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.c", - "Description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16...", - "Status": "affected", - "CVSS": 7.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-5709" - }, - { - "VulnerabilityID": "CVE-2024-26458", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libkrb5support0", - "InstalledVersion": "1.20.1-2+deb12u2", - "Severity": "LOW", - "Title": "krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c", - "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26458" - }, - { - "VulnerabilityID": "CVE-2024-26461", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libkrb5support0", - "InstalledVersion": "1.20.1-2+deb12u2", - "Severity": "LOW", - "Title": "krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c", - "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26461" - }, - { - "VulnerabilityID": "CVE-2022-0563", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libmount1", - "InstalledVersion": "2.38.1-5+deb12u3", - "Severity": "LOW", - "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", - "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment var...", - "Status": "affected", - "CVSS": 5.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563" - }, - { - "VulnerabilityID": "CVE-2022-0563", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libsmartcols1", - "InstalledVersion": "2.38.1-5+deb12u3", - "Severity": "LOW", - "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", - "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment var...", - "Status": "affected", - "CVSS": 5.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563" - }, - { - "VulnerabilityID": "CVE-2021-45346", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libsqlite3-0", - "InstalledVersion": "3.40.1-2+deb12u1", - "Severity": "LOW", - "Title": "sqlite: crafted SQL query allows a malicious user to obtain sensitive information", - "Description": "A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File...", - "Status": "affected", - "CVSS": 4.3, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-45346" - }, - { - "VulnerabilityID": "CVE-2022-27943", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libstdc++6", - "InstalledVersion": "12.2.0-14", - "Severity": "LOW", - "Title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", - "Description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.", - "Status": "affected", - "CVSS": 5.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-27943" - }, - { - "VulnerabilityID": "CVE-2023-4039", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libstdc++6", - "InstalledVersion": "12.2.0-14", - "Severity": "LOW", - "Title": "gcc: -fstack-protector fails to guard dynamic stack allocations on ARM64", - "Description": "**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \n...", - "Status": "affected", - "CVSS": 4.8, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-4039" - }, - { - "VulnerabilityID": "CVE-2013-4392", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libsystemd0", - "InstalledVersion": "252.33-1~deb12u1", - "Severity": "LOW", - "Title": "systemd: TOCTOU race condition when updating file permissions and SELinux security contexts", - "Description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink ...", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2013-4392" - }, - { - "VulnerabilityID": "CVE-2023-31437", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libsystemd0", - "InstalledVersion": "252.33-1~deb12u1", - "Severity": "LOW", - "Title": "An issue was discovered in systemd 253. An attacker can modify a seale ...", - "Description": "An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages ar...", - "Status": "affected", - "CVSS": 5.3, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31437" - }, - { - "VulnerabilityID": "CVE-2023-31438", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libsystemd0", - "InstalledVersion": "252.33-1~deb12u1", - "Severity": "LOW", - "Title": "An issue was discovered in systemd 253. An attacker can truncate a sea ...", - "Description": "An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows ...", - "Status": "affected", - "CVSS": 5.3, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31438" - }, - { - "VulnerabilityID": "CVE-2023-31439", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libsystemd0", - "InstalledVersion": "252.33-1~deb12u1", - "Severity": "LOW", - "Title": "An issue was discovered in systemd 253. An attacker can modify the con ...", - "Description": "An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that che...", - "Status": "affected", - "CVSS": 5.3, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31439" - }, - { - "VulnerabilityID": "CVE-2013-4392", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libudev1", - "InstalledVersion": "252.33-1~deb12u1", - "Severity": "LOW", - "Title": "systemd: TOCTOU race condition when updating file permissions and SELinux security contexts", - "Description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink ...", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2013-4392" - }, - { - "VulnerabilityID": "CVE-2023-31437", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libudev1", - "InstalledVersion": "252.33-1~deb12u1", - "Severity": "LOW", - "Title": "An issue was discovered in systemd 253. An attacker can modify a seale ...", - "Description": "An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages ar...", - "Status": "affected", - "CVSS": 5.3, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31437" - }, - { - "VulnerabilityID": "CVE-2023-31438", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libudev1", - "InstalledVersion": "252.33-1~deb12u1", - "Severity": "LOW", - "Title": "An issue was discovered in systemd 253. An attacker can truncate a sea ...", - "Description": "An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows ...", - "Status": "affected", - "CVSS": 5.3, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31438" - }, - { - "VulnerabilityID": "CVE-2023-31439", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libudev1", - "InstalledVersion": "252.33-1~deb12u1", - "Severity": "LOW", - "Title": "An issue was discovered in systemd 253. An attacker can modify the con ...", - "Description": "An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that che...", - "Status": "affected", - "CVSS": 5.3, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31439" - }, - { - "VulnerabilityID": "CVE-2022-0563", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "libuuid1", - "InstalledVersion": "2.38.1-5+deb12u3", - "Severity": "LOW", - "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", - "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment var...", - "Status": "affected", - "CVSS": 5.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563" - }, - { - "VulnerabilityID": "CVE-2007-5686", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "login", - "InstalledVersion": "1:4.13+dfsg1-1+b1", - "Severity": "LOW", - "Title": "initscripts in rPath Linux 1 sets insecure permissions for the /var/lo ...", - "Description": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding ...", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2007-5686" - }, - { - "VulnerabilityID": "CVE-2023-29383", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "login", - "InstalledVersion": "1:4.13+dfsg1-1+b1", - "Severity": "LOW", - "Title": "shadow: Improper input validation in shadow-utils package utility chfn", - "Description": "In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible...", - "Status": "affected", - "CVSS": 3.3, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-29383" - }, - { - "VulnerabilityID": "CVE-2024-56433", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "login", - "InstalledVersion": "1:4.13+dfsg1-1+b1", - "Severity": "LOW", - "Title": "shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise", - "Description": "shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) t...", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-56433" - }, - { - "VulnerabilityID": "TEMP-0628843-DBAD28", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "login", - "InstalledVersion": "1:4.13+dfsg1-1+b1", - "Severity": "LOW", - "Title": "[more related to CVE-2005-4890]", - "Description": "", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://security-tracker.debian.org/tracker/TEMP-0628843-DBAD28" - }, - { - "VulnerabilityID": "CVE-2022-0563", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "mount", - "InstalledVersion": "2.38.1-5+deb12u3", - "Severity": "LOW", - "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", - "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment var...", - "Status": "affected", - "CVSS": 5.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563" - }, - { - "VulnerabilityID": "CVE-2007-5686", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "passwd", - "InstalledVersion": "1:4.13+dfsg1-1+b1", - "Severity": "LOW", - "Title": "initscripts in rPath Linux 1 sets insecure permissions for the /var/lo ...", - "Description": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding ...", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2007-5686" - }, - { - "VulnerabilityID": "CVE-2023-29383", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "passwd", - "InstalledVersion": "1:4.13+dfsg1-1+b1", - "Severity": "LOW", - "Title": "shadow: Improper input validation in shadow-utils package utility chfn", - "Description": "In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible...", - "Status": "affected", - "CVSS": 3.3, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-29383" - }, - { - "VulnerabilityID": "CVE-2024-56433", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "passwd", - "InstalledVersion": "1:4.13+dfsg1-1+b1", - "Severity": "LOW", - "Title": "shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise", - "Description": "shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) t...", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-56433" - }, - { - "VulnerabilityID": "TEMP-0628843-DBAD28", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "passwd", - "InstalledVersion": "1:4.13+dfsg1-1+b1", - "Severity": "LOW", - "Title": "[more related to CVE-2005-4890]", - "Description": "", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://security-tracker.debian.org/tracker/TEMP-0628843-DBAD28" - }, - { - "VulnerabilityID": "CVE-2023-31484", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "perl-base", - "InstalledVersion": "5.36.0-7+deb12u1", - "Severity": "HIGH", - "Title": "perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS", - "Description": "CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.", - "Status": "affected", - "CVSS": 8.1, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31484" - }, - { - "VulnerabilityID": "CVE-2011-4116", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "perl-base", - "InstalledVersion": "5.36.0-7+deb12u1", - "Severity": "LOW", - "Title": "perl: File:: Temp insecure temporary file handling", - "Description": "_is_safe in the File::Temp module for Perl does not properly handle symlinks.", - "Status": "affected", - "CVSS": 7.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-4116" - }, - { - "VulnerabilityID": "CVE-2023-31486", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "perl-base", - "InstalledVersion": "5.36.0-7+deb12u1", - "Severity": "LOW", - "Title": "http-tiny: insecure TLS cert default", - "Description": "HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must ...", - "Status": "affected", - "CVSS": 8.1, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31486" - }, - { - "VulnerabilityID": "TEMP-0517018-A83CE6", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "sysvinit-utils", - "InstalledVersion": "3.06-4", - "Severity": "LOW", - "Title": "[sysvinit: no-root option in expert installer exposes locally exploitable security flaw]", - "Description": "", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://security-tracker.debian.org/tracker/TEMP-0517018-A83CE6" - }, - { - "VulnerabilityID": "CVE-2005-2541", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "tar", - "InstalledVersion": "1.34+dfsg-1.2+deb12u1", - "Severity": "LOW", - "Title": "tar: does not properly warn the user when extracting setuid or setgid files", - "Description": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2005-2541" - }, - { - "VulnerabilityID": "TEMP-0290435-0B57B5", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "tar", - "InstalledVersion": "1.34+dfsg-1.2+deb12u1", - "Severity": "LOW", - "Title": "[tar's rmt command may have undesired side effects]", - "Description": "", - "Status": "affected", - "CVSS": null, - "PrimaryURL": "https://security-tracker.debian.org/tracker/TEMP-0290435-0B57B5" - }, - { - "VulnerabilityID": "CVE-2022-0563", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "util-linux", - "InstalledVersion": "2.38.1-5+deb12u3", - "Severity": "LOW", - "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", - "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment var...", - "Status": "affected", - "CVSS": 5.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563" - }, - { - "VulnerabilityID": "CVE-2022-0563", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "util-linux-extra", - "InstalledVersion": "2.38.1-5+deb12u3", - "Severity": "LOW", - "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", - "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment var...", - "Status": "affected", - "CVSS": 5.5, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563" - }, - { - "VulnerabilityID": "CVE-2023-45853", - "Target": "python:3.9-slim (debian 12.9)", - "PkgName": "zlib1g", - "InstalledVersion": "1:1.2.13.dfsg-1", - "Severity": "CRITICAL", - "Title": "zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6", - "Description": "MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, ...", - "Status": "will_not_fix", - "CVSS": 9.8, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45853" - }, - { - "VulnerabilityID": "CVE-2022-40897", - "Target": "Python", - "PkgName": "setuptools", - "InstalledVersion": "58.1.0", - "Severity": "HIGH", - "Title": "pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py", - "Description": "Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custo...", - "Status": "fixed", - "CVSS": 5.9, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-40897" - }, - { - "VulnerabilityID": "CVE-2024-6345", - "Target": "Python", - "PkgName": "setuptools", - "InstalledVersion": "58.1.0", - "Severity": "HIGH", - "Title": "pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools", - "Description": "A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. Thes...", - "Status": "fixed", - "CVSS": null, - "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-6345" - } - ] -} \ No newline at end of file diff --git a/results/python_3_9_slim_security_report.pdf b/results/python_3_9_slim_security_report.pdf deleted file mode 100644 index acfbed2..0000000 Binary files a/results/python_3_9_slim_security_report.pdf and /dev/null differ diff --git a/results/python_3_9_slim_vulnerabilities.csv b/results/python_3_9_slim_vulnerabilities.csv deleted file mode 100644 index 93ec4f0..0000000 --- a/results/python_3_9_slim_vulnerabilities.csv +++ /dev/null @@ -1,81 +0,0 @@ -VulnerabilityID,Severity,PkgName,InstalledVersion,Title,Description,CVSS,Status,Target,PrimaryURL -CVE-2011-3374,LOW,apt,2.6.1,"It was found that apt-key in apt, all versions, do not correctly valid ...","It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle a...",3.7,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2011-3374 -TEMP-0841856-B18BAF,LOW,bash,5.2.15-2+b7,[Privilege escalation possible to other user than root],,,affected,python:3.9-slim (debian 12.9),https://security-tracker.debian.org/tracker/TEMP-0841856-B18BAF -CVE-2022-0563,LOW,bsdutils,1:2.38.1-5+deb12u3,util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline,"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an ""INPUTRC"" environment var...",5.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2022-0563 -CVE-2016-2781,LOW,coreutils,9.1-1,coreutils: Non-privileged session can escape to the parent session in chroot,"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes ...",6.5,will_not_fix,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2016-2781 -CVE-2017-18018,LOW,coreutils,9.1-1,coreutils: race condition vulnerability in chown and chgrp,"In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX ""-R...",4.7,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2017-18018 -CVE-2022-27943,LOW,gcc-12-base,12.2.0-14,binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const,"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.",5.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2022-27943 -CVE-2023-4039,LOW,gcc-12-base,12.2.0-14,gcc: -fstack-protector fails to guard dynamic stack allocations on ARM64,"**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains -that target AArch64 allows an attacker to exploit an existing buffer -...",4.8,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2023-4039 -CVE-2022-3219,LOW,gpgv,2.2.40-1.1,gnupg: denial of service issue (resource consumption) using compressed packets,"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to...",3.3,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2022-3219 -CVE-2011-3374,LOW,libapt-pkg6.0,2.6.1,"It was found that apt-key in apt, all versions, do not correctly valid ...","It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle a...",3.7,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2011-3374 -CVE-2022-0563,LOW,libblkid1,2.38.1-5+deb12u3,util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline,"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an ""INPUTRC"" environment var...",5.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2022-0563 -CVE-2010-4756,LOW,libc-bin,2.36-9+deb12u9,glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions,The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consu...,,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2010-4756 -CVE-2018-20796,LOW,libc-bin,2.36-9+deb12u9,glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c,"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by ...",7.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2018-20796 -CVE-2019-1010022,LOW,libc-bin,2.36-9+deb12u9,glibc: stack guard protection bypass,GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vect...,9.8,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2019-1010022 -CVE-2019-1010023,LOW,libc-bin,2.36-9+deb12u9,glibc: running ldd on malicious ELF leads to code execution because of wrong size computation,GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privile...,8.8,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2019-1010023 -CVE-2019-1010024,LOW,libc-bin,2.36-9+deb12u9,glibc: ASLR bypass using cache of thread stack and heap,GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: gl...,5.3,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2019-1010024 -CVE-2019-1010025,LOW,libc-bin,2.36-9+deb12u9,glibc: information disclosure of heap addresses of pthread_created thread,GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: ...,5.3,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2019-1010025 -CVE-2019-9192,LOW,libc-bin,2.36-9+deb12u9,glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c,"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by ...",7.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2019-9192 -CVE-2010-4756,LOW,libc6,2.36-9+deb12u9,glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions,The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consu...,,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2010-4756 -CVE-2018-20796,LOW,libc6,2.36-9+deb12u9,glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c,"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by ...",7.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2018-20796 -CVE-2019-1010022,LOW,libc6,2.36-9+deb12u9,glibc: stack guard protection bypass,GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vect...,9.8,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2019-1010022 -CVE-2019-1010023,LOW,libc6,2.36-9+deb12u9,glibc: running ldd on malicious ELF leads to code execution because of wrong size computation,GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privile...,8.8,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2019-1010023 -CVE-2019-1010024,LOW,libc6,2.36-9+deb12u9,glibc: ASLR bypass using cache of thread stack and heap,GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: gl...,5.3,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2019-1010024 -CVE-2019-1010025,LOW,libc6,2.36-9+deb12u9,glibc: information disclosure of heap addresses of pthread_created thread,GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: ...,5.3,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2019-1010025 -CVE-2019-9192,LOW,libc6,2.36-9+deb12u9,glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c,"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by ...",7.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2019-9192 -CVE-2022-27943,LOW,libgcc-s1,12.2.0-14,binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const,"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.",5.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2022-27943 -CVE-2023-4039,LOW,libgcc-s1,12.2.0-14,gcc: -fstack-protector fails to guard dynamic stack allocations on ARM64,"**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains -that target AArch64 allows an attacker to exploit an existing buffer -...",4.8,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2023-4039 -CVE-2018-6829,LOW,libgcrypt20,1.10.1-3,libgcrypt: ElGamal implementation doesn't have semantic security due to incorrectly encoded plaintexts possibly allowing to obtain sensitive information,"cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain s...",7.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2018-6829 -CVE-2011-3389,LOW,libgnutls30,3.7.9-2+deb12u3,HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST),"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and o...",,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2011-3389 -CVE-2018-5709,LOW,libgssapi-krb5-2,1.20.1-2+deb12u2,krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.c,"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable ""dbentry->n_key_data"" in kadmin/dbutil/dump.c that can store 16...",7.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2018-5709 -CVE-2024-26458,LOW,libgssapi-krb5-2,1.20.1-2+deb12u2,krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c,Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.,,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2024-26458 -CVE-2024-26461,LOW,libgssapi-krb5-2,1.20.1-2+deb12u2,krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c,Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.,,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2024-26461 -CVE-2018-5709,LOW,libk5crypto3,1.20.1-2+deb12u2,krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.c,"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable ""dbentry->n_key_data"" in kadmin/dbutil/dump.c that can store 16...",7.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2018-5709 -CVE-2024-26458,LOW,libk5crypto3,1.20.1-2+deb12u2,krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c,Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.,,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2024-26458 -CVE-2024-26461,LOW,libk5crypto3,1.20.1-2+deb12u2,krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c,Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.,,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2024-26461 -CVE-2018-5709,LOW,libkrb5-3,1.20.1-2+deb12u2,krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.c,"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable ""dbentry->n_key_data"" in kadmin/dbutil/dump.c that can store 16...",7.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2018-5709 -CVE-2024-26458,LOW,libkrb5-3,1.20.1-2+deb12u2,krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c,Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.,,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2024-26458 -CVE-2024-26461,LOW,libkrb5-3,1.20.1-2+deb12u2,krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c,Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.,,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2024-26461 -CVE-2018-5709,LOW,libkrb5support0,1.20.1-2+deb12u2,krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.c,"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable ""dbentry->n_key_data"" in kadmin/dbutil/dump.c that can store 16...",7.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2018-5709 -CVE-2024-26458,LOW,libkrb5support0,1.20.1-2+deb12u2,krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c,Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.,,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2024-26458 -CVE-2024-26461,LOW,libkrb5support0,1.20.1-2+deb12u2,krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c,Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.,,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2024-26461 -CVE-2022-0563,LOW,libmount1,2.38.1-5+deb12u3,util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline,"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an ""INPUTRC"" environment var...",5.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2022-0563 -CVE-2022-0563,LOW,libsmartcols1,2.38.1-5+deb12u3,util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline,"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an ""INPUTRC"" environment var...",5.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2022-0563 -CVE-2021-45346,LOW,libsqlite3-0,3.40.1-2+deb12u1,sqlite: crafted SQL query allows a malicious user to obtain sensitive information,A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File...,4.3,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2021-45346 -CVE-2022-27943,LOW,libstdc++6,12.2.0-14,binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const,"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.",5.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2022-27943 -CVE-2023-4039,LOW,libstdc++6,12.2.0-14,gcc: -fstack-protector fails to guard dynamic stack allocations on ARM64,"**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains -that target AArch64 allows an attacker to exploit an existing buffer -...",4.8,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2023-4039 -CVE-2013-4392,LOW,libsystemd0,252.33-1~deb12u1,systemd: TOCTOU race condition when updating file permissions and SELinux security contexts,"systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink ...",,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2013-4392 -CVE-2023-31437,LOW,libsystemd0,252.33-1~deb12u1,An issue was discovered in systemd 253. An attacker can modify a seale ...,"An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages ar...",5.3,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2023-31437 -CVE-2023-31438,LOW,libsystemd0,252.33-1~deb12u1,An issue was discovered in systemd 253. An attacker can truncate a sea ...,An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows ...,5.3,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2023-31438 -CVE-2023-31439,LOW,libsystemd0,252.33-1~deb12u1,An issue was discovered in systemd 253. An attacker can modify the con ...,An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that che...,5.3,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2023-31439 -CVE-2013-4392,LOW,libudev1,252.33-1~deb12u1,systemd: TOCTOU race condition when updating file permissions and SELinux security contexts,"systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink ...",,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2013-4392 -CVE-2023-31437,LOW,libudev1,252.33-1~deb12u1,An issue was discovered in systemd 253. An attacker can modify a seale ...,"An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages ar...",5.3,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2023-31437 -CVE-2023-31438,LOW,libudev1,252.33-1~deb12u1,An issue was discovered in systemd 253. An attacker can truncate a sea ...,An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows ...,5.3,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2023-31438 -CVE-2023-31439,LOW,libudev1,252.33-1~deb12u1,An issue was discovered in systemd 253. An attacker can modify the con ...,An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that che...,5.3,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2023-31439 -CVE-2022-0563,LOW,libuuid1,2.38.1-5+deb12u3,util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline,"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an ""INPUTRC"" environment var...",5.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2022-0563 -CVE-2007-5686,LOW,login,1:4.13+dfsg1-1+b1,initscripts in rPath Linux 1 sets insecure permissions for the /var/lo ...,"initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding ...",,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2007-5686 -CVE-2023-29383,LOW,login,1:4.13+dfsg1-1+b1,shadow: Improper input validation in shadow-utils package utility chfn,"In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible...",3.3,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2023-29383 -CVE-2024-56433,LOW,login,1:4.13+dfsg1-1+b1,shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise,"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) t...",,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2024-56433 -TEMP-0628843-DBAD28,LOW,login,1:4.13+dfsg1-1+b1,[more related to CVE-2005-4890],,,affected,python:3.9-slim (debian 12.9),https://security-tracker.debian.org/tracker/TEMP-0628843-DBAD28 -CVE-2022-0563,LOW,mount,2.38.1-5+deb12u3,util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline,"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an ""INPUTRC"" environment var...",5.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2022-0563 -CVE-2007-5686,LOW,passwd,1:4.13+dfsg1-1+b1,initscripts in rPath Linux 1 sets insecure permissions for the /var/lo ...,"initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding ...",,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2007-5686 -CVE-2023-29383,LOW,passwd,1:4.13+dfsg1-1+b1,shadow: Improper input validation in shadow-utils package utility chfn,"In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible...",3.3,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2023-29383 -CVE-2024-56433,LOW,passwd,1:4.13+dfsg1-1+b1,shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise,"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) t...",,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2024-56433 -TEMP-0628843-DBAD28,LOW,passwd,1:4.13+dfsg1-1+b1,[more related to CVE-2005-4890],,,affected,python:3.9-slim (debian 12.9),https://security-tracker.debian.org/tracker/TEMP-0628843-DBAD28 -CVE-2023-31484,HIGH,perl-base,5.36.0-7+deb12u1,perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS,CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.,8.1,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2023-31484 -CVE-2011-4116,LOW,perl-base,5.36.0-7+deb12u1,perl: File:: Temp insecure temporary file handling,_is_safe in the File::Temp module for Perl does not properly handle symlinks.,7.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2011-4116 -CVE-2023-31486,LOW,perl-base,5.36.0-7+deb12u1,http-tiny: insecure TLS cert default,"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must ...",8.1,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2023-31486 -TEMP-0517018-A83CE6,LOW,sysvinit-utils,3.06-4,[sysvinit: no-root option in expert installer exposes locally exploitable security flaw],,,affected,python:3.9-slim (debian 12.9),https://security-tracker.debian.org/tracker/TEMP-0517018-A83CE6 -CVE-2005-2541,LOW,tar,1.34+dfsg-1.2+deb12u1,tar: does not properly warn the user when extracting setuid or setgid files,"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.",,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2005-2541 -TEMP-0290435-0B57B5,LOW,tar,1.34+dfsg-1.2+deb12u1,[tar's rmt command may have undesired side effects],,,affected,python:3.9-slim (debian 12.9),https://security-tracker.debian.org/tracker/TEMP-0290435-0B57B5 -CVE-2022-0563,LOW,util-linux,2.38.1-5+deb12u3,util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline,"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an ""INPUTRC"" environment var...",5.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2022-0563 -CVE-2022-0563,LOW,util-linux-extra,2.38.1-5+deb12u3,util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline,"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an ""INPUTRC"" environment var...",5.5,affected,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2022-0563 -CVE-2023-45853,CRITICAL,zlib1g,1:1.2.13.dfsg-1,zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6,"MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, ...",9.8,will_not_fix,python:3.9-slim (debian 12.9),https://avd.aquasec.com/nvd/cve-2023-45853 -CVE-2022-40897,HIGH,setuptools,58.1.0,pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py,Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custo...,5.9,fixed,Python,https://avd.aquasec.com/nvd/cve-2022-40897 -CVE-2024-6345,HIGH,setuptools,58.1.0,pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools,A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. Thes...,,fixed,Python,https://avd.aquasec.com/nvd/cve-2024-6345 diff --git a/setup.py b/setup.py index 6360b42..680d7d7 100644 --- a/setup.py +++ b/setup.py @@ -1,8 +1,9 @@ from setuptools import setup - +import os +import glob setup( name="docksec", - version="0.0.5", + version="0.0.18", description="AI-Powered Docker Security Analyzer", long_description=open("README.md").read(), long_description_content_type="text/markdown", @@ -25,6 +26,7 @@ "langchain-openai", "python-dotenv", "pandas", + "tqdm", "colorama", "rich", @@ -37,4 +39,8 @@ "Operating System :: OS Independent", ], include_package_data=True, + # Ensure all Python files and templates are included in the distribution + package_data={ + '': ['*.py', 'templates/*.html', 'templates/**/*.html'], + }, ) \ No newline at end of file diff --git a/templates/report_template.html b/templates/report_template.html new file mode 100644 index 0000000..766ba1b --- /dev/null +++ b/templates/report_template.html @@ -0,0 +1,446 @@ + + + + + + Docker Security Report + + + +
+
+

Docker Security Report

+

{{SCAN_MODE_TITLE}}

+
+ +
+ +
+

Scan Information

+
+
+
Image Name
+
{{IMAGE_NAME}}
+
+
+
Scan Mode
+
{{SCAN_MODE}}
+
+
+
Dockerfile Path
+
{{DOCKERFILE_PATH}}
+
+
+
Scan Date
+
{{SCAN_DATE}}
+
+
+
+ + + {{SECURITY_SCORE_SECTION}} + + + {{IMAGE_INFO_SECTION}} + + + {{CONFIG_ANALYSIS_SECTION}} + + + {{DOCKERFILE_SECTION}} + + +
+

Vulnerability Summary

+ {{VULNERABILITY_SUMMARY}} +
+ + + {{DETAILED_VULNERABILITIES_SECTION}} +
+ +
+

Generated by docksec on {{SCAN_DATE}}

+
+
+ +