Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

audit: newline to seperate vulnerable dependency #74

Merged
merged 1 commit into from
Jan 23, 2020
Merged

audit: newline to seperate vulnerable dependency #74

merged 1 commit into from
Jan 23, 2020

Conversation

adamdecaf
Copy link
Contributor

Add a newline when a vulnerable change is printed. Look for the following lines smushed together.

05be37d02b682020/01/21 14:43:31 [135/203] pkg:golang/github.com/opentracing/opentracing-go@1.0.2
Before
2020/01/21 14:43:31 [133/203] pkg:golang/github.com/opencontainers/image-spec@1.0.1    No known vulnerabilities against package/version
------------------------------------------------------------
[134/203] pkg:golang/github.com/opencontainers/runc@1.0.0-rc9  [Vulnerable]    1 known vulnerabilities affecting installed version

[CVE-2019-5736]  Containment Errors (Container Errors)
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

ID:d089f726-f419-4e72-ab60-05be37d02b68
Details:https://ossindex.sonatype.org/vuln/d089f726-f419-4e72-ab60-05be37d02b682020/01/21 14:43:31 [135/203] pkg:golang/github.com/opentracing/opentracing-go@1.0.2    No known vulnerabilities against package/version
2020/01/21 14:43:31 [136/203] pkg:golang/github.com/openzipkin/zipkin-go@0.1.6    No known vulnerabilities against package/version

After
2020/01/21 14:48:08 [133/203] pkg:golang/github.com/opencontainers/image-spec@1.0.1    No known vulnerabilities against package/version
------------------------------------------------------------
[134/203] pkg:golang/github.com/opencontainers/runc@1.0.0-rc9  [Vulnerable]    1 known vulnerabilities affecting installed version

[CVE-2019-5736]  Containment Errors (Container Errors)
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

ID:d089f726-f419-4e72-ab60-05be37d02b68
Details:https://ossindex.sonatype.org/vuln/d089f726-f419-4e72-ab60-05be37d02b68
2020/01/21 14:48:08 [135/203] pkg:golang/github.com/opentracing/opentracing-go@1.0.2    No known vulnerabilities against package/version
2020/01/21 14:48:08 [136/203] pkg:golang/github.com/openzipkin/zipkin-go@0.1.6    No known vulnerabilities against package/version

cc @bhamail / @DarthHater

Copy link
Contributor

@zendern zendern left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@DarthHater DarthHater merged commit 92bcd7e into sonatype-nexus-community:master Jan 23, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants