Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ability to filter vulnerability results by CVSS score and fixability #126

Open
ekelson-bcove opened this issue Jun 2, 2020 · 3 comments
Open

Ability to filter vulnerability results by CVSS score and fixability #126

ekelson-bcove opened this issue Jun 2, 2020 · 3 comments
Labels
cli Something related to the Lacework CLI feat New feature or request

Comments

@ekelson-bcove
Copy link

for Usage: lacework vulnerability scan run <registry> <repository> <tag|digest> [flags]

It would be great to add two more flags:

  • The ability to filter by CVSS score (e.g. --cvss 7 returns 7+)
  • The ability to only return fixable vulns (e.g. --fixable)

Lastly as a possible stretch, it would be great to return a list of packages only that should be upgraded that can be via code
@afiune afiune added the feat New feature or request label Jun 2, 2020
@afiune afiune self-assigned this Jun 9, 2020
@afiune
Copy link
Contributor

afiune commented Jun 9, 2020 •
edited
Loading

@ekelson-bcove Thank you so much for your feedback! 💯

We are about to start working on this feature, the two flags you mentioned resonate
very well with us, though we are curious if you could elaborate a little more about the
"possible stretch" feature:

it would be great to return a list of packages only that should be upgraded that can be via code

-- 🤔 Is this extra feature related to listing the packages that could be upgraded since they have a fixed version available?

afiune added a commit that referenced this issue Jun 11, 2020
@afiune
feat(cli): add --fixable flag to vulnerability cmd
a4f723a 
Adding the ability to display only fixable vulnerabilities by providing
the new flag `--fixable`.

Example: From a total of 15 vulnerabilities, display only the 5 that are
fixable.
```
lacework vul report sha256:62dce44a0d2df7e3e3146817cc35681579c15a4ccd2c5d1f0bddb619fdd6dab8 --fixable
                                  CONTAINER IMAGE DETAILS                                 |        VULNERABILITIES
------------------------------------------------------------------------------------------+---------------------------------
    ID          sha256:1f40f2c68a11e338b7eda2264e71546ab1b5d6bc4c458bbd3785fd5efb3fc632   |   SEVERITY   COUNT   FIXABLE
    Digest      sha256:62dce44a0d2df7e3e3146817cc35681579c15a4ccd2c5d1f0bddb619fdd6dab8   | -----------+-------+----------
    Registry    index.docker.io                                                           |   Critical       0         0
    Repository  techallylw/lacework-cli                                                   |   High           0         0
    Size        58.2 MB                                                                   |   Medium         4         1
    Created At  2020-05-04T17:00:00+0000                                                  |   Low            9         4
    Tags        ubuntu-1804                                                               |   Info           2         0
                                                                                          |
-----------------+----------+----------+--------------------------+--------------------------+--------------------------
       CVE       | SEVERITY | PACKAGE  |     CURRENT VERSION      |       FIX VERSION        |   INTRODUCED IN LAYER
-----------------+----------+----------+--------------------------+--------------------------+--------------------------
  CVE-2020-12243 | Medium   | openldap | 2.4.45+dfsg-1ubuntu1.4   | 2.4.45+dfsg-1ubuntu1.5   | apt-get install curl -y
-----------------+----------+----------+--------------------------+--------------------------+--------------------------
  CVE-2019-1563  | Low      | openssl  | 1.1.1-1ubuntu2.1~18.04.5 | 1.1.1-1ubuntu2.1~18.04.6 | apt-get install curl -y
-----------------+----------+----------+--------------------------+--------------------------+--------------------------
  CVE-2019-1547  | Low      | openssl  | 1.1.1-1ubuntu2.1~18.04.5 | 1.1.1-1ubuntu2.1~18.04.6 | apt-get install curl -y
-----------------+----------+----------+--------------------------+--------------------------+--------------------------
  CVE-2019-1551  | Low      | openssl  | 1.1.1-1ubuntu2.1~18.04.5 | 1.1.1-1ubuntu2.1~18.04.6 | apt-get install curl -y
-----------------+----------+----------+--------------------------+--------------------------+--------------------------
  CVE-2019-1549  | Low      | openssl  | 1.1.1-1ubuntu2.1~18.04.5 | 1.1.1-1ubuntu2.1~18.04.6 | apt-get install curl -y
-----------------+----------+----------+--------------------------+--------------------------+--------------------------
```

GH: #126

Signed-off-by: Salim Afiune Maya <afiune@lacework.net>
@afiune afiune mentioned this issue Jun 11, 2020
Merged
afiune added a commit that referenced this issue Jun 11, 2020
@afiune
feat(cli): add --fixable flag to vulnerability cmd (#148)
d649e2a 
Adding the ability to display only fixable vulnerabilities by providing
the new flag `--fixable`.

Example: From a total of 15 vulnerabilities, display only the 5 that are
fixable.
```
lacework vul report sha256:62dce44a0d2df7e3e3146817cc35681579c15a4ccd2c5d1f0bddb619fdd6dab8 --fixable
                                  CONTAINER IMAGE DETAILS                                 |        VULNERABILITIES
------------------------------------------------------------------------------------------+---------------------------------
    ID          sha256:1f40f2c68a11e338b7eda2264e71546ab1b5d6bc4c458bbd3785fd5efb3fc632   |   SEVERITY   COUNT   FIXABLE
    Digest      sha256:62dce44a0d2df7e3e3146817cc35681579c15a4ccd2c5d1f0bddb619fdd6dab8   | -----------+-------+----------
    Registry    index.docker.io                                                           |   Critical       0         0
    Repository  techallylw/lacework-cli                                                   |   High           0         0
    Size        58.2 MB                                                                   |   Medium         4         1
    Created At  2020-05-04T17:00:00+0000                                                  |   Low            9         4
    Tags        ubuntu-1804                                                               |   Info           2         0
                                                                                          |
-----------------+----------+----------+--------------------------+--------------------------+--------------------------
       CVE       | SEVERITY | PACKAGE  |     CURRENT VERSION      |       FIX VERSION        |   INTRODUCED IN LAYER
-----------------+----------+----------+--------------------------+--------------------------+--------------------------
  CVE-2020-12243 | Medium   | openldap | 2.4.45+dfsg-1ubuntu1.4   | 2.4.45+dfsg-1ubuntu1.5   | apt-get install curl -y
-----------------+----------+----------+--------------------------+--------------------------+--------------------------
  CVE-2019-1563  | Low      | openssl  | 1.1.1-1ubuntu2.1~18.04.5 | 1.1.1-1ubuntu2.1~18.04.6 | apt-get install curl -y
-----------------+----------+----------+--------------------------+--------------------------+--------------------------
  CVE-2019-1547  | Low      | openssl  | 1.1.1-1ubuntu2.1~18.04.5 | 1.1.1-1ubuntu2.1~18.04.6 | apt-get install curl -y
-----------------+----------+----------+--------------------------+--------------------------+--------------------------
  CVE-2019-1551  | Low      | openssl  | 1.1.1-1ubuntu2.1~18.04.5 | 1.1.1-1ubuntu2.1~18.04.6 | apt-get install curl -y
-----------------+----------+----------+--------------------------+--------------------------+--------------------------
  CVE-2019-1549  | Low      | openssl  | 1.1.1-1ubuntu2.1~18.04.5 | 1.1.1-1ubuntu2.1~18.04.6 | apt-get install curl -y
-----------------+----------+----------+--------------------------+--------------------------+--------------------------
```

GH: #126

Signed-off-by: Salim Afiune Maya <afiune@lacework.net>
@afiune
Copy link
Contributor

afiune commented Jul 7, 2020

@ekelson-bcove Hi there! We are still working on some of your feedback.

We recently released a new feature #149 that adds a --packages flag to vulnerability commands, maybe this is something that you can use internally that can help with the stretch feature you mentioned in this issue. As usual, we welcome any feedback! Thank you and we will keep you posted with more updates.

@afiune afiune added the cli Something related to the Lacework CLI label Jul 7, 2020
@ekelson-bcove
Copy link
Author

ekelson-bcove commented Jul 7, 2020 via email

@afiune afiune removed their assignment May 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
cli Something related to the Lacework CLI feat New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@afiune @ekelson-bcove