[アップデート] Amazon Inspector SBOM Generator が Dockerfile の設定不備を検出するようになりました #AWSreInforce

Amazon Inspector SBOM Generator が Dockerfile の設定不備を検出するようになりました。 Inspector Scan API を利用して詳細を確認できます。
特集

たかくに

2024.06.13

こんにちは！ AWS 事業本部コンサルティング部のたかくに（@takakuni_）です。普段は趣味で Amazon Inspector の追っかけをしています。

フィラデルフィアで開催されている AWS re:Inforce 2024 に参加しています。

Keynote や What's new の裏側で Amazon Inspector SBOM Generator が Dockerfile の設定不備を検出するようになりました。

Updated functionality The Amazon Inspector SBOM Generator now scans Dockerfiles and Docker container images for misconfigurations that can introduce security vulnerabilities. For more information, see Amazon Inspector Dockerfile checks. June 10, 2024

Document history for the Amazon Inspector User Guide - Amazon Inspector

Amazon Inspector SBOM Generator については以下をご覧ください。

Inspector のコンテナイメージスキャンを CodeBuild で実行してみた #AWSreInvent | DevelopersIO

何が変わったのか

端的に言いますと先ほどの通りで、Amazon Inspector SBOM Generator が Dockerfile の設定不備を検出するようになりました。

もう少し深掘りすると、以下の 2 つの場面において Dockerfile の設定不備をスキャンし SBOM に登録するようになりました。

  • コンテナイメージ内の Dockerfile
  • Docckerfile を含むディレクトリ or Dockerfile 本体をターゲットにした場合

検出項目

リリース時点での検出項目は以下のとおりです。

  • sudo のバイナリが含まれる
  • 複数行の apt-get を実行している
  • 認証情報がハードコードされている
  • 特権モードで実行している
  • 各ランタイムでの脆弱な環境変数の設定
  • 各ランタイムでの脆弱なコマンドフラグの設定

詳しくは以下をご覧ください。

Amazon Inspector Dockerfile checks - Amazon Inspector

やってみる

簡単にですが Amazon Inspector SBOM Generator で Dockerfile のスキャンをして見ます。

Amazon Linux 2023 を用意して以下のコマンドを使ってインストールしていきます。

sudo su -

# ARM と AMD でパスが違う
curl -O "https://amazon-inspector-sbomgen.s3.amazonaws.com/latest/linux/arm64/inspector-sbomgen.zip"

unzip inspector-sbomgen.zip
mv inspector-sbomgen-* inspector-sbomgen-latest

chmod +x inspector-sbomgen-latest/linux/arm64/inspector-sbomgen
./inspector-sbomgen-latest/linux/arm64/inspector-sbomgen --version

dnf install -y docker
service docker start

Dockerfile の準備

Dockefile は以下を使います。明示的に root ユーザーを使っているよう指定します。

app/Dockerfile

FROM public.ecr.aws/docker/library/python:3.10-slim
USER root
COPY requirements.txt /root/
RUN pip3 install --no-cache-dir -r /root/requirements.txt

requirements.txt は簡単に以下を用意しました。

app/requirements.txt

boto3==1.34.125

コマンドを実行してみる

それでは Dockerfile のスキャンを行なって見ます。

./inspector-sbomgen-latest/linux/arm64/inspector-sbomgen directory --path app/ --outfile /tmp/sbom.json --quiet

中身をのぞいてみると SBOM ファイルの中に Dockerfile の情報が含まれてますね。 type が file のものが該当しそうです。

/tmp/sbom.json

{
	"bomFormat": "CycloneDX",
	"specVersion": "1.5",
	"serialNumber": "urn:uuid:43d83b26-2707-4ecb-b493-cce8514cc451",
	"version": 1,
	"metadata": {
		"timestamp": "2024-06-13T07:28:16Z",
		"tools": {
			"components": [
				{
					"type": "application",
					"author": "Amazon Web Services, Inc. (AWS)",
					"name": "inspector-sbomgen",
					"version": "1.2.0",
					"hashes": [
						{
							"alg": "SHA-256",
							"content": "eaaa273cb3796e764ac8bae485e62160052d5fee5f0e4d21fde8f21dbfbcd513"
						}
					]
				}
			]
		},
		"component": {
			"bom-ref": "comp-1",
			"type": "file",
			"name": "/root/app"
		}
	},
	"components": [
		{
			"bom-ref": "comp-2",
			"type": "library",
			"name": "boto3",
			"version": "1.34.125",
			"purl": "pkg:pypi/boto3@1.34.125",
			"properties": [
				{
					"name": "amazon:inspector:sbom_generator:source_path",
					"value": "app/requirements.txt"
				}
			]
		},
		{
			"bom-ref": "comp-3",
			"type": "file",
			"name": "dockerfile:app/Dockerfile",
			"properties": [
				{
					"name": "amazon:inspector:sbom_generator:dockerfile_finding:IN-DOCKER-003",
					"value": "affected_lines:2-2"
				}
			]
		}
	]
}

Inspector Scan API を利用して SBOM ファイルから脆弱性を確認して見ます。

aws inspector-scan scan-sbom --sbom file:///tmp/sbom.json --output-format INSPECTOR --no-cli-pager

実行結果を確認すると IN-DOCKER-003 の ID で脆弱性が検出されていますね。

[root@ip-172-31-2-25 ~]# aws inspector-scan scan-sbom --sbom file:///tmp/sbom.json --output-format INSPECTOR --no-cli-pager
{
    "sbom": {
        "messages": [
            {
                "purl": "pkg:pypi/boto3@1.34.125",
                "info_message": "Component skipped: no rules found."
            }
        ],
        "vulnerabilities": [
            {
                "severity": "info",
                "references": [
                    "https://docs.docker.com/develop/develop-images/instructions/"
                ],
                "created": "2024-03-27T14:36:39Z",
                "description": "Last USER is root: If a service can run without privileges, use USER to change to a non-root user.",
                "affects": [
                    {
                        "file": "dockerfile:app/Dockerfile",
                        "lines": "2-2"
                    }
                ],
                "id": "IN-DOCKER-003",
                "source": "https://aws.amazon.com/inspector/",
                "updated": "2024-03-27T14:36:39Z",
                "properties": {}
            }
        ],
        "vulnerability_count": {
            "high": 0,
            "other": 1,
            "critical": 0,
            "low": 0,
            "medium": 0
        }
    }
}

コンテナイメージ

コンテナイメージのビルドを行なって、コンテナイメージからも Dockerfile のチェックを確認してみます。

docker image build -t sbom-target app/
./inspector-sbomgen-latest/linux/arm64/inspector-sbomgen container --image sbom-target:latest --outfile /tmp/sbom_from_image.json --quiet
aws inspector-scan scan-sbom --sbom file:///tmp/sbom_from_image.json --output-format INSPECTOR --no-cli-pager

コンテナイメージで使っている OS のスキャナーも働くため、先ほどより検出項目が多いですね。見たかったのは IN-DOCKER-003 ですが、コンテナイメージでもしっかり機能していることがわかります。

[root@ip-172-31-2-25 ~]# aws inspector-scan scan-sbom --sbom file:///tmp/sbom_from_image.json --output-format INSPECTOR --no-cli-pager
{
    "sbom": {
        "messages": [
            {
                "purl": "pkg:deb/debian/mawk@1.3.4.20200120-3.1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/grep@3.8-5?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libhogweed6@3.8.1-2?arch=arm64&distro=bookworm&epoch=0&source=nettle",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libaudit1@3.0.9-1?arch=all&distro=bookworm&epoch=1&source=audit",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:pypi/python-dateutil@2.9.0.post0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libxxhash0@0.8.1-1?arch=arm64&distro=bookworm&epoch=0&source=xxhash",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/gzip@1.12-1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libpam-modules@1.5.2-6%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0&source=pam",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u7?arch=arm64&distro=bookworm&epoch=0&source=glibc",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libtinfo6@6.4-4?arch=arm64&distro=bookworm&epoch=0&source=ncurses",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:pypi/setuptools@65.5.1",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libgcc-s1@12.2.0-14?arch=arm64&distro=bookworm&epoch=0&source=gcc-12",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/netbase@6.4?arch=all&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libsepol@3.4-2.1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/lz4@1.9.4-1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libstdc%2B%2B6@12.2.0-14?arch=arm64&distro=bookworm&epoch=0&source=gcc-12",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0&source=util-linux",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:pypi/urllib3@2.2.1",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libidn2@2.3.3-1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u2?arch=arm64&distro=bookworm&epoch=0&source=gnutls28",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libffi@3.4.4-1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/coreutils@9.1-1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libacl1@2.3.1-3?arch=arm64&distro=bookworm&epoch=0&source=acl",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libsemanage@3.4-1?arch=all&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/bsdutils@2.38.1-5%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0&source=util-linux",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u7?arch=arm64&distro=bookworm&epoch=0&source=glibc",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libsemanage2@3.4-1?arch=all&distro=bookworm&epoch=0&source=libsemanage",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libmd0@1.0.4-2?arch=arm64&distro=bookworm&epoch=0&source=libmd",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:pypi/wheel@0.43.0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/tzdata@2024a-0%2Bdeb12u1?arch=all&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/db5.3@5.3.28%2Bdfsg2-1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/glibc@2.36-9%2Bdeb12u7?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libselinux@3.4-1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/dpkg@1.21.22?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libnettle8@3.8.1-2?arch=arm64&distro=bookworm&epoch=0&source=nettle",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libbz2-1.0@1.0.8-5?arch=arm64&distro=bookworm&epoch=0&source=bzip2",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libunistring@1.0-2?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libidn2-0@2.3.3-1?arch=arm64&distro=bookworm&epoch=0&source=libidn2",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libssl3@3.0.11-1%7Edeb12u2?arch=arm64&distro=bookworm&epoch=0&source=openssl",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0&source=util-linux",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/sysvinit@3.06-4?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/hostname@3.23%2Bnmu1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libgmp10@6.2.1%2Bdfsg1-1.1?arch=arm64&distro=bookworm&epoch=2&source=gmp",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/xxhash@0.8.1-1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:pypi/boto3@1.34.125",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libseccomp@2.5.4-1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0&source=perl",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0&source=util-linux",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libpam-runtime@1.5.2-6%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0&source=pam",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/debconf@1.5.82?arch=all&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/cdebconf@0.270?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/ncurses-bin@6.4-4?arch=arm64&distro=bookworm&epoch=0&source=ncurses",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/gmp@6.2.1%2Bdfsg1-1.1?arch=arm64&distro=bookworm&epoch=2",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libsepol2@3.4-2.1?arch=arm64&distro=bookworm&epoch=0&source=libsepol",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/gnupg2@2.2.40-1.1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libattr1@2.5.1-4?arch=arm64&distro=bookworm&epoch=1&source=attr",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0&source=util-linux",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libgpg-error@1.46-1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libapt-pkg6.0@2.6.1?arch=arm64&distro=bookworm&epoch=0&source=apt",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/ncurses@6.4-4?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:pypi/six@1.16.0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libtasn1-6@4.19.0-2?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/sysvinit-utils@3.06-4?arch=arm64&distro=bookworm&epoch=0&source=sysvinit",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/gnutls28@3.7.9-2%2Bdeb12u2?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libffi8@3.4.4-1?arch=arm64&distro=bookworm&epoch=0&source=libffi",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libdb5.3@5.3.28%2Bdfsg2-1?arch=arm64&distro=bookworm&epoch=0&source=db5.3",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libpam0g@1.5.2-6%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0&source=pam",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/usrmerge@37%7Edeb12u1?arch=all&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/pam@1.5.2-6%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/nettle@3.8.1-2?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libxcrypt@4.4.33-2?arch=arm64&distro=bookworm&epoch=1",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/bash@5.2.15-2?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/logsave@1.47.0-2?arch=arm64&distro=bookworm&epoch=0&source=e2fsprogs",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/p11-kit@0.24.1-2?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libdebconfclient0@0.270?arch=arm64&distro=bookworm&epoch=0&source=cdebconf",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/dash@0.5.12-2?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libaudit-common@3.0.9-1?arch=all&distro=bookworm&epoch=1&source=audit",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libzstd1@1.5.4%2Bdfsg2-5?arch=arm64&distro=bookworm&epoch=0&source=libzstd",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/passwd@4.13%2Bdfsg1-1?arch=arm64&distro=bookworm&epoch=1&source=shadow",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0&source=util-linux",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libp11-kit0@0.24.1-2?arch=arm64&distro=bookworm&epoch=0&source=p11-kit",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libgcrypt20@1.10.1-3?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libpcre2-8-0@10.42-1?arch=arm64&distro=bookworm&epoch=0&source=pcre2",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/attr@2.5.1-4?arch=arm64&distro=bookworm&epoch=1",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/zlib@1.2.13.dfsg-1?arch=arm64&distro=bookworm&epoch=1",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/base-files@12.4%2Bdeb12u5?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libzstd@1.5.4%2Bdfsg2-5?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:pypi/botocore@1.34.125",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/login@4.13%2Bdfsg1-1?arch=arm64&distro=bookworm&epoch=1&source=shadow",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/audit@3.0.9-1?arch=all&distro=bookworm&epoch=1",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libsemanage-common@3.4-1?arch=all&distro=bookworm&epoch=0&source=libsemanage",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libss2@1.47.0-2?arch=arm64&distro=bookworm&epoch=0&source=e2fsprogs",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/shadow@4.13%2Bdfsg1-1?arch=arm64&distro=bookworm&epoch=1",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/base-passwd@3.6.1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/pcre2@10.42-1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libcom-err2@1.47.0-2?arch=arm64&distro=bookworm&epoch=0&source=e2fsprogs",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libsystemd0@252.22-1%7Edeb12u1?arch=arm64&distro=bookworm&epoch=0&source=systemd",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libcap-ng@0.8.3-1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/zlib1g@1.2.13.dfsg-1?arch=arm64&distro=bookworm&epoch=1&source=zlib",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/usr-is-merged@37%7Edeb12u1?arch=all&distro=bookworm&epoch=0&source=usrmerge",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libcap2@2.66-4?arch=arm64&distro=bookworm&epoch=1",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libmd@1.0.4-2?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libcrypt1@4.4.33-2?arch=arm64&distro=bookworm&epoch=1&source=libxcrypt",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/diffutils@3.8-4?arch=arm64&distro=bookworm&epoch=1",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libcap-ng0@0.8.3-1?arch=arm64&distro=bookworm&epoch=0&source=libcap-ng",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/debian-archive-keyring@2023.3%2Bdeb12u1?arch=all&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/e2fsprogs@1.47.0-2?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libgpg-error0@1.46-1?arch=arm64&distro=bookworm&epoch=0&source=libgpg-error",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/xz-utils@5.4.1-0.2?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/debianutils@5.7-0.5%7Edeb12u1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:pypi/s3transfer@0.10.1",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libext2fs2@1.47.0-2?arch=arm64&distro=bookworm&epoch=0&source=e2fsprogs",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/adduser@3.134?arch=all&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libselinux1@3.4-1?arch=arm64&distro=bookworm&epoch=0&source=libselinux",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libseccomp2@2.5.4-1?arch=arm64&distro=bookworm&epoch=0&source=libseccomp",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/findutils@4.9.0-4?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/bzip2@1.0.8-5?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/init-system-helpers@1.65.2?arch=all&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/ncurses-base@6.4-4?arch=arm64&distro=bookworm&epoch=0&source=ncurses",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:pypi/jmespath@1.0.1",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/gpgv@2.2.40-1.1?arch=arm64&distro=bookworm&epoch=0&source=gnupg2",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/liblzma5@5.4.1-0.2?arch=arm64&distro=bookworm&epoch=0&source=xz-utils",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/ca-certificates@20230311?arch=all&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0&source=util-linux",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/gcc-12-base@12.2.0-14?arch=arm64&distro=bookworm&epoch=0&source=gcc-12",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libudev1@252.22-1%7Edeb12u1?arch=arm64&distro=bookworm&epoch=0&source=systemd",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/sed@4.9-1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/apt@2.6.1?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/libunistring2@1.0-2?arch=arm64&distro=bookworm&epoch=0&source=libunistring",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/libpam-modules-bin@1.5.2-6%2Bdeb12u1?arch=arm64&distro=bookworm&epoch=0&source=pam",
                "info_message": "Component skipped: no rules found."
            },
            {
                "purl": "pkg:deb/debian/acl@2.3.1-3?arch=arm64&distro=bookworm&epoch=0",
                "info_message": "Component scanned: no vulnerabilities found."
            },
            {
                "purl": "pkg:deb/debian/liblz4-1@1.9.4-1?arch=arm64&distro=bookworm&epoch=0&source=lz4",
                "info_message": "Component skipped: no rules found."
            }
        ],
        "vulnerabilities": [
            {
                "severity": "low",
                "related": [
                    "GHSA-mq26-g339-26xf"
                ],
                "references": [
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/622OZXWG72ISQPLM5Y57YCVIMWHD4C3U/",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65UKKF5LBHEFDCUSPBHUN4IHYX7SRMHH/",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YBSB3SUPQ3VIFYUMHPO3MEQI4BJAXKCZ/",
                    "https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E/",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXUVMJM25PUAZRQZBF54OFVKTY3MINPW/",
                    "https://alas.aws.amazon.com/AL2023/ALAS-2023-442.html",
                    "https://access.redhat.com/errata/RHSA-2024:3781",
                    "https://alas.aws.amazon.com/AL2/ALAS-2023-2349.html",
                    "https://www.cve.org/CVERecord?id=CVE-2023-5752"
                ],
                "created": "2023-10-25T18:17:44Z",
                "description": "When installing a package from a Mercurial VCS URL  (ie \"pip install \nhg+...\") with pip prior to v23.3, the specified Mercurial revision could\n be used to inject arbitrary configuration options to the \"hg clone\" \ncall (ie \"--config\"). Controlling the Mercurial configuration can modify\n how and which repository is installed. This vulnerability does not \naffect users who aren't installing from Mercurial.\n",
                "affects": [
                    {
                        "path": "/usr/local/lib/python3.10/site-packages/pip-23.0.1.dist-info/METADATA",
                        "fixed_version": "23.3",
                        "installed_version": "pkg:pypi/pip@23.0.1"
                    }
                ],
                "id": "CVE-2023-5752",
                "source": "https://nvd.nist.gov/vuln/detail/CVE-2023-5752",
                "updated": "2024-06-10T18:15:24Z",
                "properties": {
                    "epss": 0.00045,
                    "cwes": [
                        77
                    ],
                    "cvss": [
                        {
                            "severity": "low",
                            "cvss_3_base_score": 3.2999999523,
                            "cvss_3_base_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
                            "source": "NVD"
                        }
                    ]
                }
            },
            {
                "severity": "info",
                "references": [
                    "https://docs.docker.com/develop/develop-images/instructions/"
                ],
                "created": "2024-03-27T14:36:39Z",
                "description": "Last USER is root: If a service can run without privileges, use USER to change to a non-root user.",
                "affects": [
                    {
                        "file": "dockerfile:comp-1.Dockerfile",
                        "lines": "3-3"
                    }
                ],
                "id": "IN-DOCKER-003",
                "source": "https://aws.amazon.com/inspector/",
                "updated": "2024-03-27T14:36:39Z",
                "properties": {}
            },
            {
                "severity": "medium",
                "references": [
                    "https://www.openssl.org/news/secadv/20240109.txt",
                    "https://ubuntu.com/security/notices/USN-6622-1",
                    "https://www.cve.org/CVERecord?id=CVE-2023-6129",
                    "https://access.redhat.com/errata/RHSA-2024:2447",
                    "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1060347"
                ],
                "created": "2024-01-09T17:15:12Z",
                "description": "Issue summary: The POLY1305 MAC (message authentication code) implementation\ncontains a bug that might corrupt the internalstate of applications running\non PowerPC CPU based platforms if the CPU provides vector instructions.\n\nImpact summary: If an attacker can influence whether the POLY1305 MAC\nalgorithm is used, the application state might be corrupted with various\napplication dependent consequences.\n\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL for\nPowerPC CPUs restores the contents of vector registers in a different order\nthan they are saved. Thusthe contents of some of these vector registers\nare corrupted when returning to the caller. The vulnerable code is used only\non newer PowerPC processors supporting the PowerISA 2.07 instructions.\n\nThe consequences of this kind of internal application state corruption can\nbe various - from no consequences, ifthe calling application does not\ndepend on the contents of non-volatile XMM registers at all, to the worst\nconsequences, where the attacker could get complete control of the application\nprocess. However unless the compiler uses the vector registers for storing\npointers, the most likely consequence, if any, would be an incorrect result\nof some application dependent calculations or a crash leading to a denial of\nservice.\n\nThe POLY1305 MAC algorithm is most frequently used as part of the\nCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)\nalgorithm. The most common usage of this AEAD cipher is with TLS protocol\nversions 1.2 and 1.3. If this cipher is enabled on the server a malicious\nclient can influence whether this AEAD cipher is used. This implies that\nTLS server applications using OpenSSL can be potentially impacted. However\nwe are currently not aware of any concrete application that would be affected\nby this issue therefore we consider this a Low severity security issue.",
                "affects": [
                    {
                        "installed_version": "pkg:deb/debian/openssl@3.0.11-1%7Edeb12u2?arch=arm64&distro=bookworm&epoch=0"
                    }
                ],
                "id": "CVE-2023-6129",
                "source": "https://nvd.nist.gov/vuln/detail/CVE-2023-6129",
                "updated": "2024-05-03T13:15:21Z",
                "properties": {
                    "epss": 0.0014900001,
                    "cwes": [
                        787
                    ],
                    "cvss": [
                        {
                            "severity": "medium",
                            "cvss_3_base_score": 6.5,
                            "cvss_3_base_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
                            "source": "NVD"
                        }
                    ]
                }
            },
            {
                "severity": "medium",
                "references": [
                    "https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539",
                    "https://www.openssl.org/news/secadv/20240125.txt",
                    "https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8",
                    "https://www.cve.org/CVERecord?id=CVE-2024-0727",
                    "https://alas.aws.amazon.com/AL2/ALASOPENSSL-SNAPSAFE-2024-005.html",
                    "https://alas.aws.amazon.com/AL2/ALAS-2024-2478.html",
                    "https://ubuntu.com/security/notices/USN-6632-1",
                    "https://alas.aws.amazon.com/AL2/ALAS-2024-2483.html",
                    "https://alas.aws.amazon.com/AL2/ALAS-2024-2479.html",
                    "https://ubuntu.com/security/notices/USN-6709-1",
                    "https://ubuntu.com/security/notices/USN-6622-1",
                    "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061582",
                    "https://alas.aws.amazon.com/AL2/ALAS-2024-2502.html",
                    "https://alas.aws.amazon.com/AL2023/ALAS-2024-520.html",
                    "https://access.redhat.com/errata/RHSA-2024:2447"
                ],
                "created": "2024-01-26T09:15:07Z",
                "description": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from anuntrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.",
                "affects": [
                    {
                        "installed_version": "pkg:deb/debian/openssl@3.0.11-1%7Edeb12u2?arch=arm64&distro=bookworm&epoch=0"
                    }
                ],
                "id": "CVE-2024-0727",
                "source": "https://nvd.nist.gov/vuln/detail/CVE-2024-0727",
                "updated": "2024-05-01T18:15:13Z",
                "properties": {
                    "epss": 0.0022799999,
                    "cvss": [
                        {
                            "severity": "medium",
                            "cvss_3_base_score": 5.5,
                            "cvss_3_base_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                            "source": "NVD"
                        }
                    ]
                }
            },
            {
                "severity": "unknown",
                "references": [
                    "https://www.openssl.org/news/secadv/20240115.txt",
                    "https://ubuntu.com/security/notices/USN-6622-1",
                    "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1060858",
                    "https://alas.aws.amazon.com/AL2023/ALAS-2024-520.html",
                    "https://access.redhat.com/errata/RHSA-2024:2447",
                    "https://www.cve.org/CVERecord?id=CVE-2023-6237"
                ],
                "created": "2024-04-25T07:15:45Z",
                "description": "Issue summary: Checking excessively long invalid RSA public keys may take\na long time.\n\nImpact summary: Applications thatuse the function EVP_PKEY_public_check()\nto check RSA public keys may experience long delays. Where the key that\nis being checked has been obtained from an untrusted source this may lead\nto a Denial of Service.\n\nWhen function EVP_PKEY_public_check() is called on RSA public keys,\na computation is done to confirm that the RSA modulus, n, is composite.\nFor valid RSA keys, n is a product of two or more large primes and this\ncomputation completes quickly. However, if n is an overly large prime,\nthen this computation would take a long time.\n\nAn application that calls EVP_PKEY_public_check() and supplies an RSA key\nobtained from an untrusted source could be vulnerable to a Denial of Service\nattack.\n\nThe function EVP_PKEY_public_check() is not called from other OpenSSL\nfunctions however it is called from the OpenSSL pkey command line\napplication. For that reason that application is also vulnerable if used\nwith the '-pubin' and '-check' options on untrusted data.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.",
                "affects": [
                    {
                        "installed_version": "pkg:deb/debian/openssl@3.0.11-1%7Edeb12u2?arch=arm64&distro=bookworm&epoch=0"
                    }
                ],
                "id": "CVE-2023-6237",
                "source": "https://nvd.nist.gov/vuln/detail/CVE-2023-6237",
                "updated": "2024-06-10T17:16:16Z",
                "properties": {
                    "epss": 0.00044
                }
            },
            {
                "severity": "unknown",
                "references": [
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/",
                    "https://kb.isc.org/docs/cve-2023-50868",
                    "https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html",
                    "https://datatracker.ietf.org/doc/html/rfc5155",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/",
                    "https://www.isc.org/blogs/2024-bind-security-release/",
                    "https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html",
                    "https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/",
                    "https://access.redhat.com/security/cve/CVE-2023-50868",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/",
                    "https://bugzilla.suse.com/show_bug.cgi?id=1219826",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/",
                    "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5039294",
                    "https://www.cve.org/CVERecord?id=CVE-2023-50868",
                    "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5039330",
                    "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5039214",
                    "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1063845",
                    "https://ubuntu.com/security/notices/USN-6657-1",
                    "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5039217",
                    "https://ubuntu.com/security/notices/USN-6657-2",
                    "https://access.redhat.com/errata/RHSA-2024:0977",
                    "https://access.redhat.com/errata/RHSA-2024:1782",
                    "https://access.redhat.com/errata/RHSA-2024:1543",
                    "https://access.redhat.com/errata/RHSA-2024:1545",
                    "https://access.redhat.com/errata/RHSA-2024:1544",
                    "https://access.redhat.com/errata/RHSA-2024:1789",
                    "https://access.redhat.com/errata/RHSA-2024:2551",
                    "https://access.redhat.com/errata/RHSA-2024:1781",
                    "https://alas.aws.amazon.com/AL2/ALAS-2024-2530.html",
                    "https://blog.powerdns.com/2024/02/13/powerdns-recursor-4-8-6-4-9-3-5-0-2-released",
                    "https://access.redhat.com/errata/RHSA-2024:0965",
                    "https://access.redhat.com/errata/RHSA-2024:1334",
                    "https://ubuntu.com/security/notices/USN-6723-1",
                    "https://access.redhat.com/errata/RHSA-2024:2587",
                    "https://access.redhat.com/errata/RHSA-2024:2821",
                    "https://access.redhat.com/errata/RHSA-2024:1335",
                    "https://access.redhat.com/errata/RHSA-2024:3271",
                    "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5039236",
                    "https://access.redhat.com/errata/RHSA-2024:1648",
                    "https://alas.aws.amazon.com/AL2/ALASDNSMASQ-2024-002.html",
                    "https://alas.aws.amazon.com/AL2023/ALAS-2024-552.html",
                    "https://access.redhat.com/errata/RHSA-2024:1801",
                    "https://access.redhat.com/errata/RHSA-2024:1647",
                    "https://ubuntu.com/security/notices/USN-6642-1",
                    "https://ubuntu.com/security/notices/USN-6665-1",
                    "https://access.redhat.com/errata/RHSA-2024:1804",
                    "https://access.redhat.com/errata/RHSA-2024:1803",
                    "https://access.redhat.com/errata/RHSA-2024:2696",
                    "https://access.redhat.com/errata/RHSA-2024:3741",
                    "https://access.redhat.com/errata/RHSA-2024:1522",
                    "https://access.redhat.com/errata/RHSA-2024:1800",
                    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50868",
                    "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5039260",
                    "https://access.redhat.com/errata/RHSA-2024:2890",
                    "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5039227",
                    "https://alas.aws.amazon.com/AL2023/ALAS-2024-553.html",
                    "https://alas.aws.amazon.com/AL2/ALAS-2024-2481.html",
                    "https://alas.aws.amazon.com/AL2023/ALAS-2024-550.html",
                    "https://ubuntu.com/security/notices/USN-6633-1",
                    "https://access.redhat.com/errata/RHSA-2024:2720",
                    "https://access.redhat.com/errata/RHSA-2024:0981",
                    "https://access.redhat.com/errata/RHSA-2024:0982",
                    "https://access.redhat.com/errata/RHSA-2024:2721",
                    "https://support.microsoft.com/help/5039227"
                ],
                "created": "2024-02-14T16:15:45Z",
                "description": "The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the \"NSEC3\" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.",
                "affects": [
                    {
                        "installed_version": "pkg:deb/debian/systemd@252.22-1%7Edeb12u1?arch=arm64&distro=bookworm&epoch=0"
                    }
                ],
                "id": "CVE-2023-50868",
                "source": "https://nvd.nist.gov/vuln/detail/CVE-2023-50868",
                "updated": "2024-06-10T17:16:16Z",
                "properties": {
                    "exploit_available": true,
                    "epss": 0.00046,
                    "exploit_last_seen_in_public": "2024-06-11T01:56:13Z"
                }
            },
            {
                "severity": "medium",
                "references": [
                    "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055",
                    "https://www.openssl.org/news/secadv/20231106.txt",
                    "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017",
                    "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c",
                    "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6",
                    "https://access.redhat.com/errata/RHSA-2023:7877",
                    "https://alas.aws.amazon.com/AL2/ALASOPENSSL-SNAPSAFE-2023-004.html",
                    "https://www.cve.org/CVERecord?id=CVE-2023-5678",
                    "https://ubuntu.com/security/notices/USN-6632-1",
                    "https://alas.aws.amazon.com/AL2/ALAS-2023-2351.html",
                    "https://access.redhat.com/errata/RHSA-2024:1318",
                    "https://access.redhat.com/errata/RHSA-2024:1317",
                    "https://ubuntu.com/security/notices/USN-6709-1",
                    "https://access.redhat.com/errata/RHSA-2024:0208",
                    "https://ubuntu.com/security/notices/USN-6622-1",
                    "https://alas.aws.amazon.com/ALAS-2023-1891.html",
                    "https://access.redhat.com/errata/RHSA-2024:1319",
                    "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1055473",
                    "https://alas.aws.amazon.com/AL2/ALAS-2024-2502.html",
                    "https://access.redhat.com/errata/RHSA-2024:0154",
                    "https://access.redhat.com/errata/RHSA-2024:2447",
                    "https://access.redhat.com/errata/RHSA-2024:1325",
                    "https://alas.aws.amazon.com/AL2023/ALAS-2023-443.html",
                    "https://alas.aws.amazon.com/AL2/ALAS-2023-2350.html",
                    "https://access.redhat.com/errata/RHSA-2024:1316"
                ],
                "created": "2023-11-06T16:15:42Z",
                "description": "Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays.  Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_check_pub_key() doesn't make any of these checks, and is therefore\nvulnerable for excessively large P and Q parameters.\n\nLikewise, while DH_generate_key() performs a check for an excessively large\nP, it doesn't check for an excessively large Q.\n\nAn application that calls DH_generate_key() or DH_check_pub_key() and\nsupplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nDH_generate_key() and DH_check_pub_key() are also called by a number of\nother OpenSSL functions.  An application calling any of those other\nfunctions may similarly be affected.  The other functions affected by this\nare DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().\n\nAlso vulnerable are the OpenSSL pkey command line application when using the\n\"-pubcheck\" option, as well as the OpenSSL genpkey command line application.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n\n",
                "affects": [
                    {
                        "installed_version": "pkg:deb/debian/openssl@3.0.11-1%7Edeb12u2?arch=arm64&distro=bookworm&epoch=0"
                    }
                ],
                "id": "CVE-2023-5678",
                "source": "https://nvd.nist.gov/vuln/detail/CVE-2023-5678",
                "updated": "2024-05-01T18:15:12Z",
                "properties": {
                    "epss": 0.00111,
                    "cwes": [
                        754
                    ],
                    "cvss": [
                        {
                            "severity": "medium",
                            "cvss_3_base_score": 5.3000001907,
                            "cvss_3_base_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                            "source": "NVD"
                        }
                    ]
                }
            },
            {
                "severity": "medium",
                "references": [
                    "https://developer.arm.com/Arm Security Center/GCC Stack Protector Vulnerability AArch64",
                    "https://alas.aws.amazon.com/AL2/ALAS-2023-2245.html",
                    "https://alas.aws.amazon.com/AL2023/ALAS-2023-342.html",
                    "https://alas.aws.amazon.com/AL2/ALAS-2023-2244.html"
                ],
                "created": "2023-09-13T09:15:15Z",
                "description": "\n\n**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failureonly applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled lossof availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.\n\n\n\n\n\n",
                "affects": [
                    {
                        "installed_version": "pkg:deb/debian/gcc-12@12.2.0-14?arch=arm64&distro=bookworm&epoch=0"
                    }
                ],
                "id": "CVE-2023-4039",
                "source": "https://nvd.nist.gov/vuln/detail/CVE-2023-4039",
                "updated": "2024-02-19T23:15:07Z",
                "properties": {
                    "exploit_available": true,
                    "epss": 0.00046,
                    "cwes": [
                        693
                    ],
                    "exploit_last_seen_in_public": "2024-06-05T07:04:29Z",
                    "cvss": [
                        {
                            "severity": "medium",
                            "cvss_3_base_score": 4.8000001907,
                            "cvss_3_base_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
                            "source": "NVD"
                        }
                    ]
                }
            },
            {
                "severity": "high",
                "references": [
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/",
                    "https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html",
                    "https://bugzilla.suse.com/show_bug.cgi?id=1219823",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/",
                    "https://access.redhat.com/security/cve/CVE-2023-50387",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/",
                    "https://www.isc.org/blogs/2024-bind-security-release/",
                    "https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html",
                    "https://kb.isc.org/docs/cve-2023-50387",
                    "https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/",
                    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50387",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/",
                    "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/",
                    "https://ubuntu.com/security/notices/USN-6657-1",
                    "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1063845",
                    "https://ubuntu.com/security/notices/USN-6657-2",
                    "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5034767",
                    "https://access.redhat.com/errata/RHSA-2024:0977",
                    "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5034768",
                    "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5034769",
                    "https://access.redhat.com/errata/RHSA-2024:1782",
                    "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5034809",
                    "https://access.redhat.com/errata/RHSA-2024:1543",
                    "https://access.redhat.com/errata/RHSA-2024:1545",
                    "https://access.redhat.com/errata/RHSA-2024:1544",
                    "https://access.redhat.com/errata/RHSA-2024:1789",
                    "https://access.redhat.com/errata/RHSA-2024:2551",
                    "https://access.redhat.com/errata/RHSA-2024:1781",
                    "https://alas.aws.amazon.com/AL2/ALAS-2024-2530.html",
                    "https://blog.powerdns.com/2024/02/13/powerdns-recursor-4-8-6-4-9-3-5-0-2-released",
                    "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5034830",
                    "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5034831",
                    "https://access.redhat.com/errata/RHSA-2024:0965",
                    "https://access.redhat.com/errata/RHSA-2024:1334",
                    "https://access.redhat.com/errata/RHSA-2024:2587",
                    "https://ubuntu.com/security/notices/USN-6723-1",
                    "https://access.redhat.com/errata/RHSA-2024:2821",
                    "https://access.redhat.com/errata/RHSA-2024:1335",
                    "https://www.cve.org/CVERecord?id=CVE-2023-50387",
                    "https://access.redhat.com/errata/RHSA-2024:3271",
                    "https://access.redhat.com/errata/RHSA-2024:1648",
                    "https://access.redhat.com/errata/RHSA-2024:1801",
                    "https://access.redhat.com/errata/RHSA-2024:1647",
                    "https://alas.aws.amazon.com/AL2/ALASDNSMASQ-2024-002.html",
                    "https://alas.aws.amazon.com/AL2023/ALAS-2024-552.html",
                    "https://access.redhat.com/errata/RHSA-2024:1804",
                    "https://ubuntu.com/security/notices/USN-6642-1",
                    "https://ubuntu.com/security/notices/USN-6665-1",
                    "https://access.redhat.com/errata/RHSA-2024:1803",
                    "https://access.redhat.com/errata/RHSA-2024:2696",
                    "https://access.redhat.com/errata/RHSA-2024:3741",
                    "https://access.redhat.com/errata/RHSA-2024:1522",
                    "https://access.redhat.com/errata/RHSA-2024:1800",
                    "https://access.redhat.com/errata/RHSA-2024:2890",
                    "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5034770",
                    "https://alas.aws.amazon.com/AL2023/ALAS-2024-553.html",
                    "https://alas.aws.amazon.com/AL2/ALAS-2024-2481.html",
                    "https://alas.aws.amazon.com/AL2023/ALAS-2024-550.html",
                    "https://ubuntu.com/security/notices/USN-6633-1",
                    "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5034819",
                    "https://access.redhat.com/errata/RHSA-2024:2720",
                    "https://access.redhat.com/errata/RHSA-2024:0981",
                    "https://support.microsoft.com/help/5034770",
                    "https://access.redhat.com/errata/RHSA-2024:0982",
                    "https://access.redhat.com/errata/RHSA-2024:2721"
                ],
                "created": "2024-02-14T16:15:45Z",
                "description": "Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to causea denial of service (CPU consumption) via one or more DNSSEC responses, aka the \"KeyTrap\" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.",
                "affects": [
                    {
                        "installed_version": "pkg:deb/debian/systemd@252.22-1%7Edeb12u1?arch=arm64&distro=bookworm&epoch=0"
                    }
                ],
                "id": "CVE-2023-50387",
                "source": "https://nvd.nist.gov/vuln/detail/CVE-2023-50387",
                "updated": "2024-06-10T17:16:15Z",
                "properties": {
                    "exploit_available": true,
                    "epss": 0.0500300005,
                    "cwes": [
                        770
                    ],
                    "exploit_last_seen_in_public": "2024-06-11T02:06:01Z",
                    "cvss": [
                        {
                            "severity": "high",
                            "cvss_3_base_score": 7.5,
                            "cvss_3_base_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                            "source": "NVD"
                        }
                    ]
                }
            }
        ],
        "vulnerability_count": {
            "high": 1,
            "other": 3,
            "critical": 0,
            "low": 1,
            "medium": 4
        }
    }
}

まとめ

以上、「Amazon Inspector SBOM Generator が Dockerfile の設定不備を検出するようになりました」

従来、 Dockerfile のスキャンといえば Trivy や Dockle のイメージでしたが、ついに Amazon Inspector も参戦してきて面白くなってきました。このブログがどなたかの参考になれば幸いです。

AWS 事業本部コンサルティング部のたかくに（@takakuni_）でした！

AWS

関連記事

SSM Automation Runbook “AWSSupport-TroubleshootManagedInstance” をやってみた

片方 裕人

2024.06.26

AWS CLI を用いて S3 サーバーアクセスログを有効化してみた

m.hayakawa

2024.06.26

Amazon Linux 2023에서 SSH 접속이 되지 않을 때 해결 방법

Kim Jaewook

2024.06.26

[プレビュー] AWS 上のコストと使用量のデータを FOCUS 1.0 スキーマでエクスポート出来るようなったようなので Amazon Athena から参照してみた

いわさ

2024.06.26