container-grype

預期結果:

• Grype found 12 vulnerabilities in myapp:latest:
• • 2 Critical (CVSS 9.0+) - CVE-2024-1234, CVE-2024-5678
• • 3 High (CVSS 7.0-8.9) - Vulnerabilities in base image packages
• • 5 Medium (CVSS 4.0-6.9) - Dependency vulnerabilities
• • 2 Low (CVSS <4.0) - Informational findings
• RECOMMENDED ACTION: Focus on Critical vulnerabilities first. CVE-2024-1234 appears in CISA KEV (actively exploited in the wild). Update alpine:3.14 base image to 3.19 or apply available security patches.

預期結果:

• Here is a GitHub Actions workflow for Grype container scanning:
• name: Container Security Scan
• on: [push, pull_request]
• jobs:
• grype-scan:
• runs-on: ubuntu-latest
• steps:
• - uses: actions/checkout@v4
• - name: Build Docker image
• run: docker build -t ${{ github.repository }}:${{ github.sha }} .
• - name: Run Grype scan
• uses: anchore/scan-action@v3
• with:
• image: ${{ github.repository }}:${{ github.sha }}
• fail-build: true
• severity-cutoff: critical

預期結果:

• Recommended remediation priority order:
• 1. CISA KEV vulnerabilities (actively exploited in the wild) - fix immediately
• 2. High EPSS scores (>10%) - high probability of exploitation
• 3. CVSS Critical (9.0-10.0) - severe impact vulnerabilities
• 4. CVSS High (7.0-8.9) - significant security impact
• 5. CVSS Medium (4.0-6.9) - moderate impact, schedule remediation
• 6. CVSS Low (<4.0) - informational, address when time permits