Container Vulnerability Management For Developers

Aner Mazur's avatar Aner Mazur

Container Vulnerability Management

Today Snyk released a container vulnerability management solution which empowers developers to fully own the security of their Dockerized application!

Containers are becoming the standard form in which applications are packaged and executed, so the need to protect not only the application itself but the entire container against open source vulnerabilities is growing. Snyk, being committed to helping developers secure their applications from open source vulnerabilities, is extending its support to Docker containers, with its unique developer first approach. The solution will seamlessly integrate with the various dev and runtime platforms throughout the SDLC - providing deep application analysis, automated vulnerability remediation, and our leading vulnerability database.

Easily scan for open source vulnerabilities

Container images are created and managed by developers, so Snyk created a simple CLI that will enable developers to both test images locally as well as integrate image validation into their CI/CD processes. It’s part of Snyk’s regular CLI, and released to all Enterprise customers. All you need to do is upgrade to the latest CLI version:

npm install -g snyk
snyk auth

Snyk will scan all Operating System libraries installed by DEB, APK or RPM package managers, extract their exact versions, and test them against the most up to date version of our vulnerability database. To test a local Docker image, use the docker flag and point to the image name:

docker pull ubuntu:artful-20170601
snyk test ubuntu:artful-20170601 --docker --org=my-team

This will result in displaying all detected operating system vulnerabilities.

✗ High severity vulnerability found on glibc/libc-bin@2.24-9ubuntu2
- desc: Privilege Escalation
- info:
- from: ubuntu@artful-20170601 > glibc/libc-bin@2.24-9ubuntu2
- fixed in: glibc/libc-bin@2.26-0ubuntu2.1

✗ Medium severity vulnerability found on libgcrypt20@1.7.6-1
- desc: CVE-2018-0495
- info:
- from: ubuntu@artful-20170601 > util-linux/bsdutils@1:2.29-1ubuntu3 > systemd/libsystemd0@233-6ubuntu3 > libgcrypt20@1.7.6-1
- fixed in: libgcrypt20@1.7.8-2ubuntu1.1

✗ High severity vulnerability found on perl/perl-base@5.24.1-2ubuntu1
- desc: Buffer Overflow
- info:
- from: ubuntu@artful-20170601 > meta-common-packages@meta > perl/perl-base@5.24.1-2ubuntu1
- fixed in: perl/perl-base@5.26.0-8ubuntu1.1

To track a project for newly disclosed vulnerabilities through the Snyk UI, use the monitor command. You can use both snyk test and snyk monitor in your CI environments to bake security into your deployment pipeline.

Remediate vulnerabilities

One of Snyk’s key differentiators is empowering developers to not just find vulnerabilities, but actually fix them. For every vulnerability which has an upgradeable version for its library, which will fix the vulnerability, we will suggest the minimal version the user should upgrade to.

Looking at the first result of the snyk test run above, we see a privilege escalation vulnerability was found in libc-bin . Clicking the link to the vulnerability page in Snyk, we can see that with this vulnerability a local attacker could exploit it to execute arbitrary code in setuid programs and gain root privileges. On top of that, multiple exploits exist for this vulnerability and are publicly available (in metasploit, exploit db and the likes), so this one will be of critical priority to fix.

Vulnerability screenshot

Understand library context

Snyk considers containers to be a different way to package an application, and are approaches it with the same dev first angle we had before. This is evident in the great developer experience our CLI offers, but also in the application perspective. Instead of just saying we found a vulnerable component and leaving it to the developer to figure out “how did THAT library get there?”, we track the inclusion path of every vulnerable library (as seen in the ‘from’ line in the CLI results), making it far easier to understand the vulnerability in the context of the application - which is key for assessing exploitability but even more so for remediation.

Over time, you’ll see more capabilities around our container security that will help developers easily find and fix vulnerabilities, aligned with Snyk’s commitment to developer friendliness and remediation. So stay tuned :)

Zip Slip Vulnerability Cheat Sheet

June 28, 2018

Zip Slip is a form of a Directory Traversal that can be exploited by extracting files from an archive. This cheat sheet informs you of vulnerable libraries and code snippets that are exploitable to a Zip Slip attack. Additionally it provides you with the information you need to upgrade to fixed library versions and offers tips on how to find and fix your own vulnerable code.

The Most Common Vulnerabilities in Maven Central and npm

June 27, 2018

In this post we’ll look at the most common types of vulnerabilities for two of the main ecosystems we track in our vulnerability database, namely Maven Central and npm. The Snyk Vulnerability database consists of vulnerabilities from over 1,000,000 open source packages we track that use Composer, Go, Maven Central, npm, NuGet, pip and Rubygems.

Subscribe to The Secure Developer Podcast

A podcast about security for developers, covering tools and best practices.

Find out more

Interested in web security?

Subscribe to our newsletter:

Get realtime updates and fixes for JavaScript, Ruby and Java vulnerabilities that affect your applications