# Clair SCI output design

## aqua-output format
schema: aqua/output/v1
suite_type: clair
test_case_info:
- end_time: <Populated by the SCI>
external_ref: ""
name: <name of the testcase>
logging: ""
result: <SUCCESS or FAIL>
start_time: <Populated by the SCI>
test_target: ""
time: "0:00:40.208487"`

## Clair sample output:
LayerCount: 4
Vulnerabilities:
Low:
- Name: CVE-2019-13050
NamespaceName: ubuntu:18.04
Description: Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
Link: http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-13050
Severity: Low
Metadata:
NVD:
CVSSv2:
PublishedDateTime: 2019-06-29T17:15Z
Score: 5
Vectors: AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSSv3:
ExploitabilityScore: 3.9
ImpactScore: 3.6
Score: 7.5
Vectors: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
FeatureName: gnupg2
FeatureVersion: 2.2.4-1ubuntu1.3
Medium:
- Name: CVE-2018-20839
NamespaceName: ubuntu:18.04
Description: systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.
Link: http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20839
Severity: Medium
Metadata:
NVD:
CVSSv2:
PublishedDateTime: 2019-05-17T04:29Z
Score: 5
Vectors: AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
ExploitabilityScore: 3.9
ImpactScore: 5.9
Score: 9.8
Vectors: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
FeatureName: systemd
FeatureVersion: 237-3ubuntu10.44

## Questions:
1. Will any of the clair scan info be in kibana and do we need it?
`Not needed at this time. Running on cicddepot. Static scan and doesnt have anything to do with the site-type.`
2. Do we want severity on the name of successful testcases? If so, whats the list?
`NOTE: There might be two container images that has same name, but sha is different. So sha's are helpful in the testcase name
Example testcase name: clair.nc.aic-aqa-common.aqua-common-suite-parent@sha:<sha>.low or
clair.low.nc.aic-aqa-common.aqua-common-suite-parent@sha:<sha> ?
Add fully qualified url of the scan to logging`
3. Will there be one json file for scan? If so, do we want that in external ref?
`Dont add json file as external ref for now`
4. Do we want to use test_target as a fully qualified URL of the scan?
`Yes`

## Statements:
1. Image_name in the test_case_info name should be a known endpoint name.
2. Start and end time will be set by the SCI.

## Sample aqua-output yaml for a clair scan output run
Image that is scanned is docker-nc.zc1.cti.att.com/nc/aic-aqa-common/aqua-common-suite-parent@sha256:58516c78a1f7550eac6d7390436e2c14414994131a501dcf37d0034578b79884

schema: aqua/output/v1
suite_type: clair
test_case_info:
- end_time: None
external_ref: ""
name: clair.nc.aic-aqa-common.aqua-common-suite-parent.low
logging: |
- Name: CVE-2019-13050
NamespaceName: ubuntu:18.04
Description: Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
Link: http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-13050
Severity: Low
Metadata:
NVD:
CVSSv2:
PublishedDateTime: 2019-06-29T17:15Z
Score: 5
Vectors: AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSSv3:
ExploitabilityScore: 3.9
ImpactScore: 3.6
Score: 7.5
Vectors: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
FeatureName: gnupg2
FeatureVersion: 2.2.4-1ubuntu1.3
result: FAIL
start_time: None
test_target: "docker-nc.zc1.cti.att.com/nc/aic-aqa-common/aqua-common-suite-parent@sha256:58516c78a1f7550eac6d7390436e2c14414994131a501dcf37d0034578b79884"
time: "0:00:40.208487"
- end_time: None
external_ref: ""
name: clair.nc.aic-aqa-common.aqua-common-suite-parent.medium
logging: |
- Name: CVE-2018-20839
NamespaceName: ubuntu:18.04
Description: systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.
Link: http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20839
Severity: Medium
Metadata:
NVD:
CVSSv2:
PublishedDateTime: 2019-05-17T04:29Z
Score: 5
Vectors: AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
ExploitabilityScore: 3.9
ImpactScore: 5.9
Score: 9.8
Vectors: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
FeatureName: systemd
FeatureVersion: 237-3ubuntu10.44
result: FAIL
start_time: None
test_target: "docker-nc.zc1.cti.att.com/nc/aic-aqa-common/aqua-common-suite-parent@sha256:58516c78a1f7550eac6d7390436e2c14414994131a501dcf37d0034578b79884"
time: "0:00:40.208487"

airflow-crit: pass (direct categories that clair supports - the component has a crit severity) ---|
airflow-crit-with-fix-by: pass (direct categories that clair supports - the component has a crit severity) |
airflow-high: fail - the component has a high |
airflow-high-with-fix-by: fail - the component has a high with fix by |
airflow-med: fail - the component has a medium | bare minimum day 1
airflow-med-with-fix-by: fail - the component has a medium with fix by |
airflow-low: pass - the component has a low |
airflow-low-with-fix-by: pass - the component has a low with fix by |
airflow-info: fail - the component has a info |
airflow-info-with-fix-by: fail - the component has a info with fix by |
airflow-scan-was-completed pass (the component was scanned vs. fail= the component failed to scan) ---|

# Sample clair json output

The json output for `docker-nc.zc1.cti.att.com/nc/aic-aqa-common/aqua-common-suite-parent@sha256:58516c78a1f7550eac6d7390436e2c14414994131a501dcf37d0034578b79884` is:
:::spoiler

{
"LayerCount":4,
"Vulnerabilities":{
"High":[
{
"Name":"CVE-2021-3449",
"NamespaceName":"ubuntu:18.04",
"Description":"NULL pointer deref in signature_algorithms processing",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2021-3449",
"Severity":"High",
"FixedBy":"1.1.1-1ubuntu2.1~18.04.9",
"FeatureName":"openssl",
"FeatureVersion":"1.1.1-1ubuntu2.1~18.04.7"
}
],
"Low":[
{
"Name":"CVE-2018-16868",
"NamespaceName":"ubuntu:18.04",
"Description":"A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-16868",
"Severity":"Low",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2018-12-03T14:29Z",
"Score":3.3,
"Vectors":"AV:L/AC:M/Au:N/C:P/I:P/A:N"
},
"CVSSv3":{
"ExploitabilityScore":0.4,
"ImpactScore":4.7,
"Score":5.6,
"Vectors":"CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N"
}
}
},
"FeatureName":"gnutls28",
"FeatureVersion":"3.5.18-1ubuntu1.4"
},
{
"Name":"CVE-2019-20838",
"NamespaceName":"ubuntu:18.04",
"Description":"libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \\X or \\R has more than one fixed quantifier, a related issue to CVE-2019-20454.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-20838",
"Severity":"Low",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2020-06-15T17:15Z",
"Score":4.3,
"Vectors":"AV:N/AC:M/Au:N/C:N/I:N/A:P"
},
"CVSSv3":{
"ExploitabilityScore":3.9,
"ImpactScore":3.6,
"Score":7.5,
"Vectors":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
}
},
"FeatureName":"pcre3",
"FeatureVersion":"2:8.39-9"
},
{
"Name":"CVE-2019-18276",
"NamespaceName":"ubuntu:18.04",
"Description":"An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-18276",
"Severity":"Low",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2019-11-28T01:15Z",
"Score":7.2,
"Vectors":"AV:L/AC:L/Au:N/C:C/I:C/A:C"
},
"CVSSv3":{
"ExploitabilityScore":1.8,
"ImpactScore":5.9,
"Score":7.8,
"Vectors":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
}
},
"FeatureName":"bash",
"FeatureVersion":"4.4.18-2ubuntu1.2"
},
{
"Name":"CVE-2021-23840",
"NamespaceName":"ubuntu:18.04",
"Description":"Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2021-23840",
"Severity":"Low",
"FixedBy":"1.1.1-1ubuntu2.1~18.04.8",
"FeatureName":"openssl",
"FeatureVersion":"1.1.1-1ubuntu2.1~18.04.7"
},
{
"Name":"CVE-2019-12098",
"NamespaceName":"ubuntu:18.04",
"Description":"In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-12098",
"Severity":"Low",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2019-05-15T23:29Z",
"Score":5.8,
"Vectors":"AV:N/AC:M/Au:N/C:P/I:P/A:N"
},
"CVSSv3":{
"ExploitabilityScore":2.2,
"ImpactScore":5.2,
"Score":7.4,
"Vectors":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
}
},
"FeatureName":"heimdal",
"FeatureVersion":"7.5.0+dfsg-1"
},
{
"Name":"CVE-2018-16869",
"NamespaceName":"ubuntu:18.04",
"Description":"A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-16869",
"Severity":"Low",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2018-12-03T14:29Z",
"Score":3.3,
"Vectors":"AV:L/AC:M/Au:N/C:P/I:P/A:N"
},
"CVSSv3":{
"ExploitabilityScore":0.5,
"ImpactScore":4.7,
"Score":5.7,
"Vectors":"CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N"
}
}
},
"FeatureName":"nettle",
"FeatureVersion":"3.4-1"
},
{
"Name":"CVE-2020-6096",
"NamespaceName":"ubuntu:18.04",
"Description":"An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-6096",
"Severity":"Low",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2020-04-01T22:15Z",
"Score":6.8,
"Vectors":"AV:N/AC:M/Au:N/C:P/I:P/A:P"
},
"CVSSv3":{
"ExploitabilityScore":2.2,
"ImpactScore":5.9,
"Score":8.1,
"Vectors":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
}
},
"FeatureName":"glibc",
"FeatureVersion":"2.27-3ubuntu1.4"
},
{
"Name":"CVE-2016-10739",
"NamespaceName":"ubuntu:18.04",
"Description":"In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-10739",
"Severity":"Low",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2019-01-21T19:29Z",
"Score":4.6,
"Vectors":"AV:L/AC:L/Au:N/C:P/I:P/A:P"
},
"CVSSv3":{
"ExploitabilityScore":1.8,
"ImpactScore":3.4,
"Score":5.3,
"Vectors":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
}
},
"FeatureName":"glibc",
"FeatureVersion":"2.27-3ubuntu1.4"
},
{
"Name":"CVE-2019-25013",
"NamespaceName":"ubuntu:18.04",
"Description":"The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-25013",
"Severity":"Low",
"FeatureName":"glibc",
"FeatureVersion":"2.27-3ubuntu1.4"
},
{
"Name":"CVE-2020-27618",
"NamespaceName":"ubuntu:18.04",
"Description":"The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-27618",
"Severity":"Low",
"FeatureName":"glibc",
"FeatureVersion":"2.27-3ubuntu1.4"
},
{
"Name":"CVE-2019-17543",
"NamespaceName":"ubuntu:18.04",
"Description":"LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-17543",
"Severity":"Low",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2019-10-14T02:15Z",
"Score":6.8,
"Vectors":"AV:N/AC:M/Au:N/C:P/I:P/A:P"
},
"CVSSv3":{
"ExploitabilityScore":2.2,
"ImpactScore":5.9,
"Score":8.1,
"Vectors":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
}
},
"FeatureName":"lz4",
"FeatureVersion":"0.0~r131-2ubuntu3"
},
{
"Name":"CVE-2016-2781",
"NamespaceName":"ubuntu:18.04",
"Description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-2781",
"Severity":"Low",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2017-02-07T15:59Z",
"Score":2.1,
"Vectors":"AV:L/AC:L/Au:N/C:N/I:P/A:N"
},
"CVSSv3":{
"ExploitabilityScore":2,
"ImpactScore":4,
"Score":6.5,
"Vectors":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"
}
}
},
"FeatureName":"coreutils",
"FeatureVersion":"8.28-1ubuntu1"
},
{
"Name":"CVE-2020-9849",
"NamespaceName":"ubuntu:18.04",
"Description":"An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0. A remote attacker may be able to leak memory.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-9849",
"Severity":"Low",
"FeatureName":"sqlite3",
"FeatureVersion":"3.22.0-1ubuntu0.4"
},
{
"Name":"CVE-2020-9991",
"NamespaceName":"ubuntu:18.04",
"Description":"This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, iOS 14.0 and iPadOS 14.0, iCloud for Windows 7.21, tvOS 14.0. A remote attacker may be able to cause a denial of service.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-9991",
"Severity":"Low",
"FeatureName":"sqlite3",
"FeatureVersion":"3.22.0-1ubuntu0.4"
},
{
"Name":"CVE-2018-5710",
"NamespaceName":"ubuntu:18.04",
"Description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function \"strlen\" is getting a \"NULL\" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5710",
"Severity":"Low",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2018-01-16T09:29Z",
"Score":4,
"Vectors":"AV:N/AC:L/Au:S/C:N/I:N/A:P"
},
"CVSSv3":{
"ExploitabilityScore":2.8,
"ImpactScore":3.6,
"Score":6.5,
"Vectors":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
}
},
"FeatureName":"krb5",
"FeatureVersion":"1.16-2ubuntu0.2"
},
{
"Name":"CVE-2019-12904",
"NamespaceName":"ubuntu:18.04",
"Description":"** DISPUTED ** In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-12904",
"Severity":"Low",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2019-06-20T00:15Z",
"Score":4.3,
"Vectors":"AV:N/AC:M/Au:N/C:P/I:N/A:N"
},
"CVSSv3":{
"ExploitabilityScore":2.2,
"ImpactScore":3.6,
"Score":5.9,
"Vectors":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
}
},
"FeatureName":"libgcrypt20",
"FeatureVersion":"1.8.1-4ubuntu1.2"
},
{
"Name":"CVE-2019-13050",
"NamespaceName":"ubuntu:18.04",
"Description":"Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-13050",
"Severity":"Low",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2019-06-29T17:15Z",
"Score":5,
"Vectors":"AV:N/AC:L/Au:N/C:N/I:N/A:P"
},
"CVSSv3":{
"ExploitabilityScore":3.9,
"ImpactScore":3.6,
"Score":7.5,
"Vectors":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
}
},
"FeatureName":"gnupg2",
"FeatureVersion":"2.2.4-1ubuntu1.3"
},
{
"Name":"CVE-2013-4235",
"NamespaceName":"ubuntu:18.04",
"Description":"shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2013-4235",
"Severity":"Low",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2019-12-03T15:15Z",
"Score":3.3,
"Vectors":"AV:L/AC:M/Au:N/C:N/I:P/A:P"
},
"CVSSv3":{
"ExploitabilityScore":1,
"ImpactScore":3.6,
"Score":4.7,
"Vectors":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
}
},
"FeatureName":"shadow",
"FeatureVersion":"1:4.5-1ubuntu2"
},
{
"Name":"CVE-2018-7169",
"NamespaceName":"ubuntu:18.04",
"Description":"An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used \"group blacklisting\" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-7169",
"Severity":"Low",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2018-02-15T20:29Z",
"Score":5,
"Vectors":"AV:N/AC:L/Au:N/C:P/I:N/A:N"
},
"CVSSv3":{
"ExploitabilityScore":3.9,
"ImpactScore":1.4,
"Score":5.3,
"Vectors":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
}
},
"FeatureName":"shadow",
"FeatureVersion":"1:4.5-1ubuntu2"
}
],
"Medium":[
{
"Name":"CVE-2021-23841",
"NamespaceName":"ubuntu:18.04",
"Description":"The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2021-23841",
"Severity":"Medium",
"FixedBy":"1.1.1-1ubuntu2.1~18.04.8",
"FeatureName":"openssl",
"FeatureVersion":"1.1.1-1ubuntu2.1~18.04.7"
},
{
"Name":"CVE-2018-20839",
"NamespaceName":"ubuntu:18.04",
"Description":"systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20839",
"Severity":"Medium",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2019-05-17T04:29Z",
"Score":5,
"Vectors":"AV:N/AC:L/Au:N/C:P/I:N/A:N"
},
"CVSSv3":{
"ExploitabilityScore":3.9,
"ImpactScore":5.9,
"Score":9.8,
"Vectors":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
}
},
"FeatureName":"systemd",
"FeatureVersion":"237-3ubuntu10.44"
},
{
"Name":"CVE-2020-36227",
"NamespaceName":"ubuntu:18.04",
"Description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-36227",
"Severity":"Medium",
"FixedBy":"2.4.45+dfsg-1ubuntu1.9",
"FeatureName":"openldap",
"FeatureVersion":"2.4.45+dfsg-1ubuntu1.8"
},
{
"Name":"CVE-2020-36229",
"NamespaceName":"ubuntu:18.04",
"Description":"A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-36229",
"Severity":"Medium",
"FixedBy":"2.4.45+dfsg-1ubuntu1.9",
"FeatureName":"openldap",
"FeatureVersion":"2.4.45+dfsg-1ubuntu1.8"
},
{
"Name":"CVE-2020-36230",
"NamespaceName":"ubuntu:18.04",
"Description":"A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-36230",
"Severity":"Medium",
"FixedBy":"2.4.45+dfsg-1ubuntu1.9",
"FeatureName":"openldap",
"FeatureVersion":"2.4.45+dfsg-1ubuntu1.8"
},
{
"Name":"CVE-2020-36223",
"NamespaceName":"ubuntu:18.04",
"Description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read).",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-36223",
"Severity":"Medium",
"FixedBy":"2.4.45+dfsg-1ubuntu1.9",
"FeatureName":"openldap",
"FeatureVersion":"2.4.45+dfsg-1ubuntu1.8"
},
{
"Name":"CVE-2020-36221",
"NamespaceName":"ubuntu:18.04",
"Description":"An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-36221",
"Severity":"Medium",
"FixedBy":"2.4.45+dfsg-1ubuntu1.9",
"FeatureName":"openldap",
"FeatureVersion":"2.4.45+dfsg-1ubuntu1.8"
},
{
"Name":"CVE-2020-36222",
"NamespaceName":"ubuntu:18.04",
"Description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-36222",
"Severity":"Medium",
"FixedBy":"2.4.45+dfsg-1ubuntu1.9",
"FeatureName":"openldap",
"FeatureVersion":"2.4.45+dfsg-1ubuntu1.8"
},
{
"Name":"CVE-2020-36228",
"NamespaceName":"ubuntu:18.04",
"Description":"An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-36228",
"Severity":"Medium",
"FixedBy":"2.4.45+dfsg-1ubuntu1.9",
"FeatureName":"openldap",
"FeatureVersion":"2.4.45+dfsg-1ubuntu1.8"
},
{
"Name":"CVE-2020-36224",
"NamespaceName":"ubuntu:18.04",
"Description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-36224",
"Severity":"Medium",
"FixedBy":"2.4.45+dfsg-1ubuntu1.9",
"FeatureName":"openldap",
"FeatureVersion":"2.4.45+dfsg-1ubuntu1.8"
},
{
"Name":"CVE-2020-36226",
"NamespaceName":"ubuntu:18.04",
"Description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch-\u003ebv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-36226",
"Severity":"Medium",
"FixedBy":"2.4.45+dfsg-1ubuntu1.9",
"FeatureName":"openldap",
"FeatureVersion":"2.4.45+dfsg-1ubuntu1.8"
},
{
"Name":"CVE-2020-36225",
"NamespaceName":"ubuntu:18.04",
"Description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-36225",
"Severity":"Medium",
"FixedBy":"2.4.45+dfsg-1ubuntu1.9",
"FeatureName":"openldap",
"FeatureVersion":"2.4.45+dfsg-1ubuntu1.8"
},
{
"Name":"CVE-2021-27212",
"NamespaceName":"ubuntu:18.04",
"Description":"In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2021-27212",
"Severity":"Medium",
"FixedBy":"2.4.45+dfsg-1ubuntu1.10",
"FeatureName":"openldap",
"FeatureVersion":"2.4.45+dfsg-1ubuntu1.8"
},
{
"Name":"CVE-2019-9513",
"NamespaceName":"ubuntu:18.04",
"Description":"Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9513",
"Severity":"Medium",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2019-08-13T21:15Z",
"Score":7.8,
"Vectors":"AV:N/AC:L/Au:N/C:N/I:N/A:C"
},
"CVSSv3":{
"ExploitabilityScore":3.9,
"ImpactScore":3.6,
"Score":7.5,
"Vectors":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
}
},
"FeatureName":"nghttp2",
"FeatureVersion":"1.30.0-1ubuntu1"
},
{
"Name":"CVE-2019-9511",
"NamespaceName":"ubuntu:18.04",
"Description":"Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9511",
"Severity":"Medium",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2019-08-13T21:15Z",
"Score":7.8,
"Vectors":"AV:N/AC:L/Au:N/C:N/I:N/A:C"
},
"CVSSv3":{
"ExploitabilityScore":3.9,
"ImpactScore":3.6,
"Score":7.5,
"Vectors":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
}
},
"FeatureName":"nghttp2",
"FeatureVersion":"1.30.0-1ubuntu1"
},
{
"Name":"CVE-2020-9794",
"NamespaceName":"ubuntu:18.04",
"Description":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A malicious application may cause a denial of service or potentially disclose memory contents.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-9794",
"Severity":"Medium",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2020-06-09T17:15Z",
"Score":5.8,
"Vectors":"AV:N/AC:M/Au:N/C:P/I:N/A:P"
},
"CVSSv3":{
"ExploitabilityScore":2.8,
"ImpactScore":5.2,
"Score":8.1,
"Vectors":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"
}
}
},
"FeatureName":"sqlite3",
"FeatureVersion":"3.22.0-1ubuntu0.4"
},
{
"Name":"CVE-2020-13844",
"NamespaceName":"ubuntu:18.04",
"Description":"Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka \"straight-line speculation.\"",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-13844",
"Severity":"Medium",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2020-06-08T23:15Z",
"Score":2.1,
"Vectors":"AV:L/AC:L/Au:N/C:P/I:N/A:N"
},
"CVSSv3":{
"ExploitabilityScore":1.8,
"ImpactScore":3.6,
"Score":5.5,
"Vectors":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
}
},
"FeatureName":"gcc-8",
"FeatureVersion":"8.4.0-1ubuntu1~18.04"
},
{
"Name":"CVE-2018-20217",
"NamespaceName":"ubuntu:18.04",
"Description":"A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20217",
"Severity":"Medium",
"Metadata":{
"NVD":{
"CVSSv2":{
"PublishedDateTime":"2018-12-26T21:29Z",
"Score":3.5,
"Vectors":"AV:N/AC:M/Au:S/C:N/I:N/A:P"
},
"CVSSv3":{
"ExploitabilityScore":1.6,
"ImpactScore":3.6,
"Score":5.3,
"Vectors":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
}
},
"FeatureName":"krb5",
"FeatureVersion":"1.16-2ubuntu0.2"
},
{
"Name":"CVE-2021-22876",
"NamespaceName":"ubuntu:18.04",
"Description":"libcurl does not strip off user credentials from the URL when automatically populating the `Referer:` HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2021-22876",
"Severity":"Medium",
"FixedBy":"7.58.0-2ubuntu3.13",
"FeatureName":"curl",
"FeatureVersion":"7.58.0-2ubuntu3.12"
},
{
"Name":"CVE-2021-24032",
"NamespaceName":"ubuntu:18.04",
"Description":"Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2021-24032",
"Severity":"Medium",
"FixedBy":"1.3.3+dfsg-2ubuntu1.2",
"FeatureName":"libzstd",
"FeatureVersion":"1.3.3+dfsg-2ubuntu1.1"
},
{
"Name":"CVE-2021-24031",
"NamespaceName":"ubuntu:18.04",
"Description":"In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.",
"Link":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2021-24031",
"Severity":"Medium",
"FixedBy":"1.3.3+dfsg-2ubuntu1.2",
"FeatureName":"libzstd",
"FeatureVersion":"1.3.3+dfsg-2ubuntu1.1"
}
]
}
}
:::

=========================================================

Scorecard: https://jenkins-dev-nc.wnv2b.cci.att.com/job/aqua/job/on-demand/job/AQuA-Clair/122/AQuA_20Scorecard/

Jared's Discussion points:
1. I think it can be confusing that these are High/Critical not due to Clair/Vendor rating, but by the NVD CVSSv3 score
2. Do we know what a High/Critical from the Clair/Vendor rating looks like?
3. I like that we revolve around the container images, but others will be interested in the underlying CVEs. Is there a way to just export all the CVE data from the job in json?
4. Finally this is probably going to confuse the CPACE people who (while they understand the container images) end up looking at just package/CVEs

AQuA Team's Thoughts:
From Doug: doing a scan of base images not in versions.yaml

Meeting discussion points:
- Get a new scorecard category for CICD, and get the regex for what we think are related to cicd team
- List of container images with ownership https://tspace.web.att.com/files/app/file/97272681-f6e4-46d2-a99a-40662b8ca19e

Base images:
- generated by cicd
- from upstream