From f9c3403c07395d442cd81227cea3d343426c0d7e Mon Sep 17 00:00:00 2001 From: Chris Chinchilla Date: Fri, 28 Apr 2023 12:53:10 +0200 Subject: [PATCH 1/2] Move package ecosystem section Signed-off-by: Chris Chinchilla --- scout/advanced-image-analysis.md | 15 --------------- scout/advisory-db-sources.md | 16 +++++++++++++++- 2 files changed, 15 insertions(+), 16 deletions(-) diff --git a/scout/advanced-image-analysis.md b/scout/advanced-image-analysis.md index 2aa5031dcf..fd2b5e2b3a 100644 --- a/scout/advanced-image-analysis.md +++ b/scout/advanced-image-analysis.md @@ -19,21 +19,6 @@ exposures (CVEs) for the image in the **Tags** section. The **Tags** tab shows a The **Images** section of Docker Desktop shows an overview of CVEs for an image and the details view shows all vulnerabilities. -Advanced image analysis supports the following package ecosystems: - -- .NET -- GitHub packages -- Go -- Java -- JavaScript -- PHP -- Python -- RPM -- Ruby -- `alpm` (Arch Linux) -- `apk` (Alpine Linux) -- `deb` (Debian Linux and derivatives) - ## Activate Advanced image analysis Advanced image analysis is an early access feature and activated on a diff --git a/scout/advisory-db-sources.md b/scout/advisory-db-sources.md index fd1f3c2eec..c461aff5b1 100644 --- a/scout/advisory-db-sources.md +++ b/scout/advisory-db-sources.md @@ -46,6 +46,21 @@ trackers, such as: - [Ubuntu CVE Tracker](https://people.canonical.com/~ubuntu-security/cve/) - [Wolfi Security Feed](https://packages.wolfi.dev/os/security.json) +And the following package ecosystems: + +- .NET +- GitHub packages +- Go +- Java +- JavaScript +- PHP +- Python +- RPM +- Ruby +- `alpm` (Arch Linux) +- `apk` (Alpine Linux) +- `deb` (Debian Linux and derivatives) + Docker Scout correlates this data by making a full inventory of a container image and storing that inventory in a [software bill of materials (SBOM)](https://ntia.gov/sites/default/files/publications/sbom_at_a_glance_apr2021_0.pdf). @@ -73,7 +88,6 @@ Many other tools use fuzzy [Common Product Enumeration wild cards to known vulnerabilities with the versions of software packages they affect. This can return a lot of false positives which you need to triage. - The typical structure of a CPE match looks like this: ``` From 3cbe3f2139e4a953e33ee135ac13c05246fced2f Mon Sep 17 00:00:00 2001 From: Chris Chinchilla Date: Tue, 2 May 2023 17:51:57 +0200 Subject: [PATCH 2/2] Move package ecosystem section Signed-off-by: Chris Chinchilla --- scout/advisory-db-sources.md | 36 +++++++++++++++++++----------------- 1 file changed, 19 insertions(+), 17 deletions(-) diff --git a/scout/advisory-db-sources.md b/scout/advisory-db-sources.md index c461aff5b1..e1108b231c 100644 --- a/scout/advisory-db-sources.md +++ b/scout/advisory-db-sources.md @@ -1,6 +1,6 @@ --- description: More details on the Docker Scout Advisory Database and CVE-to-package matching service. -keywords: scanning, vulnerabilities, Hub, supply chain, security +keywords: scanning, analysis, vulnerabilities, Hub, supply chain, security title: Advisory Database sources and matching service --- @@ -46,21 +46,6 @@ trackers, such as: - [Ubuntu CVE Tracker](https://people.canonical.com/~ubuntu-security/cve/) - [Wolfi Security Feed](https://packages.wolfi.dev/os/security.json) -And the following package ecosystems: - -- .NET -- GitHub packages -- Go -- Java -- JavaScript -- PHP -- Python -- RPM -- Ruby -- `alpm` (Arch Linux) -- `apk` (Alpine Linux) -- `deb` (Debian Linux and derivatives) - Docker Scout correlates this data by making a full inventory of a container image and storing that inventory in a [software bill of materials (SBOM)](https://ntia.gov/sites/default/files/publications/sbom_at_a_glance_apr2021_0.pdf). @@ -76,7 +61,7 @@ images that Docker Scout can then match to CVEs. Find more details on how this works in the [Advanced image analysis document](http://./advanced-image-analysis.md). -Docker Scout is ideal for scanning images in Docker Desktop and Docker Hub, but +Docker Scout is ideal for analyzing images in Docker Desktop and Docker Hub, but the flexibility of the approach also means it can integrate with other image sources, for example, [JFrog Artifactory](https://docs.docker.com/scout/artifactory/). @@ -117,3 +102,20 @@ system versions to make more precise matches. In summary, Docker Scout’s technique improves matching accuracy and reduces the number of results that turn out to be false-positives. + +## Package ecosystems supported by the Docker Scout Advisory Database + +By sourcing vulnerability data from the providers above, Docker Scout is able to support analyzing the following package ecosystems: + +- .NET +- GitHub packages +- Go +- Java +- JavaScript +- PHP +- Python +- RPM +- Ruby +- `alpm` (Arch Linux) +- `apk` (Alpine Linux) +- `deb` (Debian Linux and derivatives)