diff --git a/index.html b/index.html index 0796d77..1526ea6 100644 --- a/index.html +++ b/index.html @@ -51,7 +51,7 @@ } a.toggle-more-links { cursor: pointer; } - docker.io/rockylinux/rockylinux:8 (rocky 8.7) - Trivy Report - 2023-02-01 13:06:16.593126051 +0000 UTC m=+1.398537792 + docker.io/rockylinux/rockylinux:8 (rocky 8.7) - Trivy Report - 2023-02-02 13:06:21.484997751 +0000 UTC m=+1.104527583 -

docker.io/rockylinux/rockylinux:8 (rocky 8.7) - Trivy Report - 2023-02-01 13:06:16.593153451 +0000 UTC m=+1.398565192

+

docker.io/rockylinux/rockylinux:8 (rocky 8.7) - Trivy Report - 2023-02-02 13:06:21.485022451 +0000 UTC m=+1.104552283

- - - - - - - - - - - - - - - - - -
rocky
No Vulnerabilities found
No Misconfigurations found
python-pkg
PackageVulnerability IDSeverityInstalled VersionFixed VersionLinks
setuptoolsCVE-2022-40897HIGH39.2.065.5.1 - https://access.redhat.com/security/cve/CVE-2022-40897 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40897 - https://github.com/advisories/GHSA-r9hx-vwmv-q579 - https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200 - https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be - https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1 - https://github.com/pypa/setuptools/issues/3659 - https://nvd.nist.gov/vuln/detail/CVE-2022-40897 - https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/ - https://pyup.io/vulnerabilities/CVE-2022-40897/52495/ - https://setuptools.pypa.io/en/latest/ - https://ubuntu.com/security/notices/USN-5817-1 -
No Misconfigurations found
diff --git a/trivy-results.sarif b/trivy-results.sarif index 77db716..4068682 100644 --- a/trivy-results.sarif +++ b/trivy-results.sarif @@ -8,67 +8,11 @@ "fullName": "Trivy Vulnerability Scanner", "informationUri": "https://github.com/aquasecurity/trivy", "name": "Trivy", - "rules": [ - { - "id": "CVE-2022-40897", - "name": "LanguageSpecificPackageVulnerability", - "shortDescription": { - "text": "pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py" - }, - "fullDescription": { - "text": "Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py." - }, - "defaultConfiguration": { - "level": "error" - }, - "helpUri": "https://avd.aquasec.com/nvd/cve-2022-40897", - "help": { - "text": "Vulnerability CVE-2022-40897\nSeverity: HIGH\nPackage: setuptools\nFixed Version: 65.5.1\nLink: [CVE-2022-40897](https://avd.aquasec.com/nvd/cve-2022-40897)\nPython Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.", - "markdown": "**Vulnerability CVE-2022-40897**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|setuptools|65.5.1|[CVE-2022-40897](https://avd.aquasec.com/nvd/cve-2022-40897)|\n\nPython Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py." - }, - "properties": { - "precision": "very-high", - "security-severity": "7.5", - "tags": [ - "vulnerability", - "security", - "HIGH" - ] - } - } - ], - "version": "0.34.0" + "rules": [], + "version": "0.37.1" } }, - "results": [ - { - "ruleId": "CVE-2022-40897", - "ruleIndex": 0, - "level": "error", - "message": { - "text": "Package: setuptools\nInstalled Version: 39.2.0\nVulnerability CVE-2022-40897\nSeverity: HIGH\nFixed Version: 65.5.1\nLink: [CVE-2022-40897](https://avd.aquasec.com/nvd/cve-2022-40897)" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "usr/lib/python3.6/site-packages/setuptools-39.2.0.dist-info/METADATA", - "uriBaseId": "ROOTPATH" - }, - "region": { - "startLine": 1, - "startColumn": 1, - "endLine": 1, - "endColumn": 1 - } - }, - "message": { - "text": "usr/lib/python3.6/site-packages/setuptools-39.2.0.dist-info/METADATA: setuptools@39.2.0" - } - } - ] - } - ], + "results": [], "columnKind": "utf16CodeUnits", "originalUriBaseIds": { "ROOTPATH": {