Security is a main ingredient in the software development lifecycle nowadays. And even though you try to work with ‘security by design’ principles and ‘least privileges’ concepts in mind, sometimes you will get surprised. It is fair to say we encountered such a surprise recently while working on the Data Fitness ControlOne Agent.
Let’s say you run your regular checks to see if any of your systems or home built applications are vulnerable (to something what turned out to be Log4Shell [1]) for example.
Then a very easy, fast and reliable way to start acquiring the info you need to take action (hopefully not…) is scanning your file systems, repos, images and Docker containers with Syft and Grype.
The following sections describe installtion and operation. Note that currently Syft and Grype work on MacOS and Linux.
Syft
Syft is a CLI tool and library for generating a Software Bill of Materials from container images and filesystems.
https://github.com/anchore/syft
brew tap anchore/syftbrew install syftsyft packages /Users/emilzegers/BitBucket/DataFit/controloneagent -o json > syft_controloneagent.json
✔ Indexed /Users/emilzegers/BitBucket/DataFit/controloneagent
✔ Cataloged packages [241 packages]
Syft saves the results in a json file, providing a full list of dependencies with lots of useful information.
Grype
Grype is a vulnerability scanner for container images and filesystems, it can use Syft results as input. On first execution it will download the vulnerability database.
https://github.com/anchore/grype
brew tap anchore/grypebrew install grypegrype sbom:./syft_controloneagent.json -o json > grype_controloneagent.json
✔ Vulnerability DB [updated]
✔ Scanned image [26 vulnerabilities]
😱 Tika 2.1.0 [2] vulnerable for Log4Shell! (In this specific case not really harmful: using the app jar, not running as a service or server instance. In addition only vulnerable when log4j is configured to be used, and when interface actually passes messages to log4j. But good to take action anyway…).
🤔 Tika 1.2.6 not vulnerable for Log4Shell, although it is good to update to latest 1.x release, currently 1.27.
Ok, 26 vulnerabilities to check, so get your security team on it! 🙂 (To be fair, all vulnerabilities are reason for attention, but not all require action. However, to understand what is relevant tooling like Syft & Grype is indispensable.)
TIP: Use jsonpath [3], a nice online tool to quickly browse the resulting json. Here is an example of filtering out the CVE ids.
Feedback?
Do you have some tips or questions about using Syft & Grype or similar tools? Let me know at emil@basaltaura.nl
At the DataEther website [4] you will find more information about the Data Fitness solution.
Link
Overview of links related to the content in this blog:
[1] https://github.com/NCSC-NL/log4shell/tree/main/software
[4] https://www.dataether.nl/ and https://www.dataether.nl/work/tip-syft-grype/https://www.dataether.nl/work/tip-syft-grype/