[ アップデート ] Amazon ECR のベーシックスキャンで CVSS v3 が利用されるようになりました！

{
    "imageScanFindings": {
        "findings": [
            {
                "name": "CVE-2020-13844",
                "description": "Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka \"straight-line speculation.\"",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-13844",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "CVSS3_SCORE",
                        "value": "5.5"
                    },
                    {
                        "key": "package_version",
                        "value": "8.4.0-1ubuntu1~18.04"
                    },
                    {
                        "key": "package_name",
                        "value": "gcc-8"
                    },
                    {
                        "key": "CVSS3_VECTOR",
                        "value": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:L/AC:L/Au:N/C:P/I:N/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "2.1"
                    }
                ]
            }
        ],
        "imageScanCompletedAt": "2023-06-18T18:40:12+09:00",
        "vulnerabilitySourceUpdatedAt": "2023-06-18T04:33:19+09:00",
        "findingSeverityCounts": {
            "MEDIUM": 1,
            "LOW": 6,
            "INFORMATIONAL": 4
        }
    },
    "registryId": "123456789012",
    "repositoryName": "ubuntu",
    "imageId": {
        "imageDigest": "sha256:0891d22f55fab66664581bbfca80601dfc9d6e8fff8f65a493e9f96644e29417",
        "imageTag": "18.04"
    },
    "imageScanStatus": {
        "status": "COMPLETE",
        "description": "The scan was completed successfully."
    }
}

{
    "imageScanFindings": {
      "findings": [
          {
              "name": "CVE-2019-5188",
              "description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
              "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-5188",
              "severity": "MEDIUM",
              "attributes": [
                  {
                      "key": "package_version",
                      "value": "1.44.1-1ubuntu1.1"
                  },
                  {
                      "key": "package_name",
                      "value": "e2fsprogs"
                  },
                  {
                      "key": "CVSS2_VECTOR",
                      "value": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
                  },
                  {
                      "key": "CVSS2_SCORE",
                      "value": "4.6"
                  }
              ]
          }
      ],
      "imageScanCompletedAt": 1579839105.0,
      "vulnerabilitySourceUpdatedAt": 1579811117.0,
      "findingSeverityCounts": {
          "MEDIUM": 1
      }
  },
  "registryId": "123456789012",
  "repositoryName": "sample-repo",
  "imageId": {
      "imageDigest": "sha256:74b2c688c700ec95a93e478cdb959737c148df3fbf5ea706abe0318726e885e6"
  },
  "imageScanStatus": {
      "status": "COMPLETE",
      "description": "The scan was completed successfully."
  }
}