https://rancher.com/ logo
Join Slack
Powered by
This message was deleted.
# neuvector-security
a
This message was deleted.
q
It might be that vulns for a distro that old are no longer being reported by the feed(s).
m
If that's the case I would expect 
ubuntu:16.04
to also not return any vulerabilities
Copy code
docker run --rm neuvector/scanner -i ubuntu:16.04
2024-12-01T08:40:44|MON|Start scanner, pid=7
2024-12-01T08:40:44.394|INFO|SCN|container.Connect: - endpoint=unix:///var/run/docker.sock
2024-12-01T08:40:44.394|INFO|SCN|container.InitStubRtDriver:
2024-12-01T08:40:44.398|ERRO|SCN|orchestration.GetK8sVersion: Read File fail - tag=k8s, error=open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory
2024-12-01T08:40:44.401|ERRO|SCN|orchestration.GetK8sVersion: Read File fail - tag=oc, error=open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory
2024-12-01T08:40:44.401|INFO|SCN|main.main: Scan cacher maximum sizes - record=0
2024-12-01T08:40:44.401|INFO|SCN|common.LoadCveDb: Expand new DB - version=3.629
2024-12-01T08:41:05.092|INFO|SCN|main.scanOnDemand: registry - dockerRegistries.Contains(req.Registry) =false req.Registry= req.Repository=ubuntu
Image: <https://registry.hub.docker.com/library/ubuntu:16.04>
Base OS: ubuntu:16.04
Created at: 2021-08-31T01:21:30Z

Vulnerabilities: 246, HIGH: 83, MEDIUM: 126, LOW: 9, UNKNOWN: 28
q
What version of NeuVector are you running? I ask because this may be an issue with the buffer size in the Controller, and likely would have a fix in 5.3.1+
m
In the cluster we run 5.4.2 but I don't think it's related to the controller but rather the scanner. I was scanning using this command
Copy code
docker run --rm neuvector/scanner -i ubuntu:18.04
I've also tried deploying a pod in the cluster but it returns the same result. I've also tried with an older scanner since I first thought it was the vulndb. But even using a container from march returns 0 vulns.
q
Okay, yeah. Seeing same with Trivy, so 🤔 something else is going on. I know folks are looking into it.
m
I didn't check Trivy, I was using Grype to compare results. I assume this means that you're using Trivy to do the scanning?
q
No, it was just a sanity-check engineering did. 😉
While this is a lot of speculation on my part, the databases of CVEs keep growing and growing and growing, and at some point it wouldn’t be surprising to see data for old platforms fall out of the back end. For example, it wouldn’t be all that shocking to see certain tooling report back that scanning for CVEs on a platform that has been way out of Support for a certain amount of time is no longer supported in and of itself.
m
Makes sense I guess, what's annoying is that 16.04 does show vulnerabilities 🙂 May I come with a suggestion, and that is to have some sort of output explaining the results, just as trivy are doing.
Copy code
2024-12-05T06:54:25+01:00       WARN    This OS version is no longer supported by the distribution      family="ubuntu" version="16.04"
2024-12-05T06:54:25+01:00       WARN    The vulnerability detection may be insufficient because security updates are not provided

ubuntu:16.04 (ubuntu 16.04)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
q
A very good idea.
m
You wan't me to update the issue with the same statment?
q
Absolutely. Thank you. 🙂
m
No worries, thanks for taking the time to answer my questions! 🙂
q
and thank you for bringing feedback into the community
3 Views
Open in Slack
PreviousNext
Powered by