diff --git a/pkg/sbombastic-image-vulnerability-scanner/components/CveDetails.vue b/pkg/sbombastic-image-vulnerability-scanner/components/CveDetails.vue new file mode 100644 index 0000000..001c027 --- /dev/null +++ b/pkg/sbombastic-image-vulnerability-scanner/components/CveDetails.vue @@ -0,0 +1,489 @@ + + + + \ No newline at end of file diff --git a/pkg/sbombastic-image-vulnerability-scanner/config/table-headers.ts b/pkg/sbombastic-image-vulnerability-scanner/config/table-headers.ts index 2441f1f..4df293e 100644 --- a/pkg/sbombastic-image-vulnerability-scanner/config/table-headers.ts +++ b/pkg/sbombastic-image-vulnerability-scanner/config/table-headers.ts @@ -234,6 +234,7 @@ export const VULNERABILITIES_TABLE = [ name: "cve", labelKey: "imageScanner.vulnerabilities.table.headers.cve", value: "metadata.name", + formatter: "CveNameLink", sort: "metadata.name", width: 140, }, @@ -335,3 +336,115 @@ export const VULNERABILITY_DETAILS_TABLE = [ width: 200, }, ]; + +export const VULNERABILITIES_DETAIL_IMAGE_LIST_TABLE = [ + { + name: "imageName", + labelKey: "imageScanner.vulnerabilities.details.table.headers.imageName", + value: "imageName", + formatter: "ImageNameCell", + sort: "imageName", + width: 200, + }, + { + name: "package", + labelKey: "imageScanner.vulnerabilities.details.table.headers.package", + value: "package", + sort: "package" + }, + { + name: "status", + labelKey: "imageScanner.vulnerabilities.details.table.headers.status", + value: "status", + sort: "status", + }, + { + name: "fixAvailable", + labelKey: "imageScanner.vulnerabilities.details.table.headers.fixVersion", + formatter: "FixAvailableCell", + value: "fixAvailable", + sort: "fixAvailable", + }, + { + name: "packageVersion", + labelKey: "imageScanner.vulnerabilities.details.table.headers.packageVersion", + value: "packageVersion", + sort: "packageVersion", + }, + { + name: "packagePath", + labelKey: "imageScanner.vulnerabilities.details.table.headers.packagePath", + value: "packagePath", + sort: "packagePath", + }, + { + name: "repository", + labelKey: "imageScanner.vulnerabilities.details.table.headers.repository", + value: "repository", + sort: "repository", + } +]; + +export const VULNERABILITIES_DETAIL_GROUP_BY_REPOSITORY_TABLE = [ + { + name: "repository", + labelKey: "imageScanner.vulnerabilities.details.table.headers.repository", + value: "repository", + sort: "repository", + width: 300, + }, + { + name: "registry", + labelKey: "imageScanner.vulnerabilities.details.table.headers.registry", + value: "registry", + sort: "registry", + } +] + +export const VULNERABILITIES_DETAIL_SUB_IMAGES_TABLE = [ + { + name: "", + value: "", + sort: "", + width: 60, + }, + { + name: "imageName", + labelKey: "imageScanner.vulnerabilities.details.table.headers.imageName", + value: "imageName", + formatter: "ImageNameCell", + sort: "imageName", + }, + { + name: "package", + labelKey: "imageScanner.vulnerabilities.details.table.headers.package", + value: "package", + sort: "package", + }, + { + name: "status", + labelKey: "imageScanner.vulnerabilities.details.table.headers.status", + value: "status", + sort: "status", + }, + { + name: "fixAvailable", + labelKey: "imageScanner.vulnerabilities.details.table.headers.fixVersion", + formatter: "FixAvailableCell", + value: "fixAvailable", + sort: "fixAvailable", + }, + { + name: "packageVersion", + labelKey: "imageScanner.vulnerabilities.details.table.headers.packageVersion", + value: "packageVersion", + sort: "packageVersion", + }, + { + name: "packagePath", + labelKey: "imageScanner.vulnerabilities.details.table.headers.packagePath", + value: "packagePath", + sort: "packagePath", + } + +] diff --git a/pkg/sbombastic-image-vulnerability-scanner/data/sbombastic.rancher.io.cveDetails.js b/pkg/sbombastic-image-vulnerability-scanner/data/sbombastic.rancher.io.cveDetails.js new file mode 100644 index 0000000..e632399 --- /dev/null +++ b/pkg/sbombastic-image-vulnerability-scanner/data/sbombastic.rancher.io.cveDetails.js @@ -0,0 +1,321 @@ +export const cveDetail = { + "id": "CVE-2017-5337", + "severity": "critical", + "description": "The ReadMATImageV4 function in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption.", + "score": "9.9", + "cvssVersion": "v3", + "advisoryVendors": [ + { + "name": "Microsoft", + "references": [ + { + "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-131", + "title": "Microsoft Security Bulletin MS15-131 - Critical | Microsoft Docs" + }, + { + "url": "http://www.securitytracker.com/id/1034324", + "title": "Microsoft Office File Processing Flaws Lets Remote Users Execute Arbitrary Code" + }, + { + "url": "https://www.exploit-db.com/exploits/40878/", + "title": "Microsoft Edge - CMarkup::EnsureDeleteCFState Use-After-Free (MS15-131)" + }, + { + "url": "https://imagemagick.org/script/security-policy.php", + "title": "ImageMagick Security Policy" + } + ] + }, + { + "name": "SUSE", + "references": [ + { + "url": "https://www.suse.com/security/cve/CVE-2017-5337/", + "title": "SUSE Security CVE-2017-5337" + } + ] + }, + { + "name": "Red Hat", + "references": [ + { + "url": "https://access.redhat.com/security/cve/CVE-2017-5337", + "title": "Red Hat CVE-2017-5337" + } + ] + }, + { + "name": "Alpine", + "references": [ + { + "url": "https://security.alpinelinux.org/vuln/CVE-2017-5337", + "title": "Alpine Linux CVE-2017-5337" + } + ] + }, + { + "name": "CISA", + "references": [ + { + "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog/CVE-2017-5337", + "title": "CISA Known Exploited Vulnerabilities - CVE-2017-5337" + } + ] + } + ], + "cvssScores": [ + { + "source": "NVD CVSSv3", + "score": 9.9, + "link": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2017-5337" + }, + { + "source": "NVD CVSSv2", + "score": 9.8, + "link": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2017-5337" + } + ], + "affectedImages": 150, + "totalImages": 900, + "imagesIdentifiedDate": "Sep 01, 2025 10:00 AM", + "publishedDate": "Oct 19, 2024 4:37 AM", + "lastModifiedDate": "Sep 01, 2025 9:00 AM", + "sources": [ + { + "name": "NVD", + "link": "https://nvd.nist.gov/vuln/detail/CVE-2017-5337" + }, + { + "name": "GHSA", + "link": "https://github.com/advisories/GHSA-1234-5678" + } + ], + }; + + export const images = [ + { + "id": "struts-attachment:1.0", + "metadata": { + name: 'struts-attachment:1.0', + }, + "package": "tomcat-embed-jasper:9.1", + "status": "Affected", + "fixAvailable": true, + "fixVersion": "7.28.1.3", + "packageVersion": "7.26.0.1+weezy20", + "packagePath": "/usr/local/bin/", + "repository": "coredns", + "registry": "Docker Hub", + "cve": "CVE-2017-5337" + }, + { + "id": "imagemagick:4.8.5613", + "metadata": { + name: 'imagemagick:4.8.5613', + }, + "package": "libxml2", + "status": "Not affected", + "fixAvailable": false, + "fixVersion": null, + "packageVersion": "2.8.0+dfsg17+weezy9", + "packagePath": "/usr/local/bin/", + "repository": "demo-cody-protected", + "registry": "demo.suse-security-ivs.io", + "cve": "CVE-2017-5337" + }, + { + "id": "centos:7.1908", + "metadata": { + name: 'centos:7.1908', + }, + "package": "python:2.7", + "status": "Affected", + "fixAvailable": false, + "fixVersion": null, + "packageVersion": "2.7.3.6+deb7u3", + "packagePath": "/", + "repository": "kube-controller-manager", + "registry": "Docker Hub", + "cve": "CVE-2017-5337" + }, + { + "id": "nginx:1.19.10", + "metadata": { + name: 'nginx:1.19.10', + }, + "package": "tomcat-api-el-9.0", + "status": "Affected", + "fixAvailable": true, + "fixVersion": "10.1.39+deb", + "packageVersion": "10.1.34.11.0.2.9.0.28", + "packagePath": "/", + "repository": "kube-apiserver", + "registry": "demo.suse-security-ivs.io", + "cve": "CVE-2017-5337" + }, + { + "id": "docker-compose:1.29.2", + "metadata": { + name: 'docker-compose:1.29.2', + }, + "package": "imagemagick", + "status": "Not affected", + "fixAvailable": false, + "fixVersion": null, + "packageVersion": "4.8.5613+deb7u9", + "packagePath": "/usr/bin/", + "repository": "coredns", + "registry": "Docker Hub", + "cve": "CVE-2017-5337" + }, + { + "id": "python:3.9.7", + "metadata": { + name: 'python:3.9.7', + }, + "package": "tomcat-embed-jasper:9.1", + "status": "Affected", + "fixAvailable": true, + "fixVersion": "8.21.6", + "packageVersion": "7.26.0.1+weezy20", + "packagePath": "/home/klipper-helm/lo...", + "repository": "flask-app", + "registry": "ecr.ap-southeast-emea.2", + "cve": "CVE-2017-5337" + }, + { + "id": "nodejs:14.17.3", + "metadata": { + name: 'nodejs:14.17.3', + }, + "package": "libxml2", + "status": "Affected", + "fixAvailable": false, + "fixVersion": null, + "packageVersion": "2.8.0+dfsg17+weezy9", + "packagePath": "/home/klipper-helm/lo...", + "repository": "data-store", + "registry": "ecr.ap-southeast-emea.2", + "cve": "CVE-2017-5337" + }, + { + "id": "redis:5.0.7", + "metadata": { + name: 'redis:5.0.7', + }, + "package": "python:2.7", + "status": "Not affected", + "fixAvailable": false, + "fixVersion": null, + "packageVersion": "2.7.3.6+deb7u3", + "packagePath": "/usr/local/bin/", + "repository": "cache-service", + "registry": "Docker Hub", + "cve": "CVE-2017-5337" + }, + { + "id": "mongodb:4.4.1", + "metadata": { + name: 'mongodb:4.4.1', + }, + "package": "tomcat-api-el-9.0", + "status": "Affected", + "fixAvailable": true, + "fixVersion": "7.28.1.3", + "packageVersion": "10.1.34.11.0.2.9.0.28", + "packagePath": "/usr/local/bin/", + "repository": "data-store", + "registry": "ecr.ap-southeast-emea.2", + "cve": "CVE-2017-5337" + }, + { + "id": "colangi:1.6.5", + "metadata": { + name: 'colangi:1.6.5', + }, + "package": "imagemagick", + "status": "Affected", + "fixAvailable": false, + "fixVersion": null, + "packageVersion": "4.8.5613+deb7u9", + "packagePath": "/usr/bin/", + "repository": "api-gateway", + "registry": "ecr.ap-southeast-emea.2", + "cve": "CVE-2017-5337" + }, + { + "id": "ruby:2.7.3", + "metadata": { + name: 'ruby:2.7.3', + }, + "package": "tomcat-embed-jasper:9.1", + "status": "Affected", + "fixAvailable": true, + "fixVersion": "10.1.39+deb", + "packageVersion": "7.26.0.1+weezy20", + "packagePath": "/usr/bin/", + "repository": "web-application", + "registry": "demo.suse-security-ivs.io", + "cve": "CVE-2017-5337" + }, + { + "id": "postgres:13.4", + "metadata": { + name: 'postgres:13.4', + }, + "package": "libxml2", + "status": "Not affected", + "fixAvailable": false, + "fixVersion": null, + "packageVersion": "2.9.1+deb11u1", + "packagePath": "/usr/lib/", + "repository": "etcd", + "registry": "demo.suse-security-ivs.io", + "cve": "CVE-2017-5337" + }, + { + "id": "elasticsearch:7.15.2", + "metadata": { + name: 'elasticsearch:7.15.2', + }, + "package": "python:3.8", + "status": "Affected", + "fixAvailable": true, + "fixVersion": "3.8.12", + "packageVersion": "3.8.10", + "packagePath": "/opt/elasticsearch/", + "repository": "search-service", + "registry": "demo.suse-security-ivs.io", + "cve": "CVE-2017-5337" + }, + { + "id": "kafka:2.8.0", + "metadata": { + name: 'kafka:2.8.0', + }, + "package": "tomcat-api-el-9.0", + "status": "Not affected", + "fixAvailable": false, + "fixVersion": null, + "packageVersion": "9.0.45", + "packagePath": "/usr/local/kafka/", + "repository": "message-broker", + "registry": "demo.suse-security-ivs.io", + "cve": "CVE-2017-5337" + }, + { + "id": "jenkins:2.319.1", + "metadata": { + name: 'jenkins:2.319.1', + }, + "package": "imagemagick", + "status": "Affected", + "fixAvailable": true, + "fixVersion": "7.1.0-20", + "packageVersion": "7.0.8-7", + "packagePath": "/var/jenkins_home/", + "repository": "ci-cd-pipeline", + "registry": "Docker Hub", + "cve": "CVE-2017-5337" + } + ]; \ No newline at end of file diff --git a/pkg/sbombastic-image-vulnerability-scanner/formatters/CveNameLink.vue b/pkg/sbombastic-image-vulnerability-scanner/formatters/CveNameLink.vue new file mode 100644 index 0000000..c682be2 --- /dev/null +++ b/pkg/sbombastic-image-vulnerability-scanner/formatters/CveNameLink.vue @@ -0,0 +1,29 @@ + + + \ No newline at end of file diff --git a/pkg/sbombastic-image-vulnerability-scanner/l10n/en-us.yaml b/pkg/sbombastic-image-vulnerability-scanner/l10n/en-us.yaml index e2ab236..e6c5673 100644 --- a/pkg/sbombastic-image-vulnerability-scanner/l10n/en-us.yaml +++ b/pkg/sbombastic-image-vulnerability-scanner/l10n/en-us.yaml @@ -196,6 +196,25 @@ imageScanner: affectedImages: Affected images severity: Severity identifiedImages: Images identified in + details: + score: Score + affectedImages: Affected images + imageIdentifiedIn: Image identified in + published: Published + lastModified: Last modified + source: Source + advisoryVendors: Advisory vendors + cvssScores: CVSS scores + table: + headers: + imageName: Image name + package: Package + status: Status + fixVersion: Fix available + packageVersion: Package version + packagePath: Package path + repository: Repository + registry: Registry vexManagement: title: VEX management description: Configure the security scanner to use up-to-date VEX reports. This will prioritize remediation efforts, focusing on vulnerabilities that are confirmed to be exploitable and reducing the noise coming from false positives. diff --git a/pkg/sbombastic-image-vulnerability-scanner/routes/sbombastic-image-vulnerability-scanner-routes.ts b/pkg/sbombastic-image-vulnerability-scanner/routes/sbombastic-image-vulnerability-scanner-routes.ts index 0098038..577b9ad 100644 --- a/pkg/sbombastic-image-vulnerability-scanner/routes/sbombastic-image-vulnerability-scanner-routes.ts +++ b/pkg/sbombastic-image-vulnerability-scanner/routes/sbombastic-image-vulnerability-scanner-routes.ts @@ -7,6 +7,7 @@ import CreateResource from "@pkg/pages/c/_cluster/sbombastic-image-vulnerability import ListResource from "@pkg/pages/c/_cluster/sbombastic-image-vulnerability-scanner/_resource/index.vue"; import Entry from "@pkg/pages/c/_cluster/sbombastic-image-vulnerability-scanner/index.vue"; import VexManagement from "@pkg/pages/c/_cluster/sbombastic-image-vulnerability-scanner/VexManagement.vue"; +import CveDetails from "@pkg/components/CveDetails.vue"; import { PRODUCT_NAME, PAGE, @@ -49,6 +50,11 @@ const routes = [ path: `/c/:cluster/${PRODUCT_NAME}/${PAGE.VEX_MANAGEMENT}`, component: VexManagement, }, + { + name: `c-cluster-${PRODUCT_NAME}-${PAGE.CVE_DETAIL}-id`, + path: `/c/:cluster/${PRODUCT_NAME}/${PAGE.CVE_DETAIL}/:id`, + component: CveDetails, + }, { name: `${ PRODUCT_NAME }-c-cluster-resource-create`, path: `/${ PRODUCT_NAME }/c/:cluster/:resource/create`,