Kicking the Tires of Docker Scout

I never moved away from Docker Desktop.

For some time, after you use it to build an image, it prints a message:

What's Next?
  View a summary of image vulnerabilities and recommendations → docker scout quickview

I decided to give it a try. I'll use the root commit of my OpenTelemetry tracing demo. Let's execute the proposed command:

docker scout quickview otel-catalog:1.0

Here's the result:

    ✓ Image stored for indexing
    ✓ Indexed 272 packages
  Target               │  otel-catalog:1.0        │    0C     2H    15M    23L
    digest             │  7adfce68062e            │
  Base image           │  eclipse-temurin:21-jre  │    0C     0H    15M    23L
  Refreshed base image │  eclipse-temurin:21-jre  │    0C     0H    15M    23L
                       │                          │
What's Next?
  View vulnerabilities → docker scout cves otel-catalog:1.0
  View base image update recommendations → docker scout recommendations otel-catalog:1.0
  Include policy results in your quickview by supplying an organization → docker scout quickview otel-catalog:1.0 --org <organization>

Docker gives out exciting bits of information:

• The base image contains 15 middle-severity vulnerabilities and 23 low-severity ones
• The final image has an additional two high-level severity
• Ergo, our code introduced them!

Following Scout's suggestion, we can drill down the CVEs:

docker scout cves otel-catalog:1.0

This is the result:

    ✓ SBOM of image already cached, 272 packages indexed
    ✗ Detected 18 vulnerable packages with a total of 39 vulnerabilities
## Overview
                    │       Analyzed Image
────────────────────┼──────────────────────────────
  Target            │  otel-catalog:1.0
    digest          │  7adfce68062e
    platform        │ linux/arm64
    vulnerabilities │    0C     2H    15M    23L
    size            │ 160 MB
    packages        │ 272
## Packages and Vulnerabilities
   0C     1H     0M     0L  org.yaml/snakeyaml 1.33
pkg:maven/org.yaml/[email protected]
    ✗ HIGH CVE-2022-1471 [Improper Input Validation]
      https://scout.docker.com/v/CVE-2022-1471
      Affected range : <=1.33
      Fixed version  : 2.0
      CVSS Score     : 8.3
      CVSS Vector    : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
   0C     1H     0M     0L  io.netty/netty-handler 4.1.100.Final
pkg:maven/io.netty/[email protected]
    ✗ HIGH CVE-2023-4586 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities]
      https://scout.docker.com/v/CVE-2023-4586
      Affected range : >=4.1.0
                     : <5.0.0
      Fixed version  : not fixed
      CVSS Score     : 7.4
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

The original output is much longer, but I stopped at the exciting bit: the two high-severity CVEs, First, we see the one coming from Netty still needs to be fixed - tough luck. However, Snake YAML fixed its CVE from version 2.0 onward.

I'm not using Snake YAML directly; it's a Spring dependency brought by Spring. Because of this, no guarantee exists that a major version upgrade will be compatible. But we can surely try. Let's bump the dependency to the latest version:

<dependency>
    <groupId>org.yaml</groupId>
    <artifactId>snakeyaml</artifactId>
    <version>2.2</version>
</dependency>

We can build the image again and check that it still works. Fortunately, it does. We can execute the process again:

docker scout quickview otel-catalog:1.0

Lo and behold, the high-severity CVE is no more!

  ✓ Image stored for indexing
  ✓ Indexed 273 packages
Target     │  local://otel-catalog:1.0-1  │    0C     1H    15M    23L
  digest   │  9ddc31cdd304                │
Base image │  eclipse-temurin:21-jre      │    0C     0H    15M    23L

Conclusion

In this short post, we tried Docker Scout, the Docker image vulnerability detection tool. Thanks to it, we removed one high-level CVE we introduced in the code.

To go further:

• Docker Scout
• 4 Free, Easy-To-Use Tools For Docker Vulnerability Scanning

Originally published at A Java Geek on January 14^th, 2024

Sponsored Content

Revenue Intelligence for Dev-Focused Companies

Reo.Dev analyzes developer activity across 20+ sources to identify high-intent accounts and key contacts ready to buy.

See How Reo.Dev Works!

• DevOps

Nicolas Frankel

Author

Technologist focusing on cloud-native technologies, DevOps, CI/CD pipelines, and system observability. His focus revolves around creating technical content, delivering talks, and engaging with developer communities to promote the adoption of modern software practices. With a strong background in software, he has worked extensively with the JVM, applying his expertise across various industries. In addition to his technical work, he is the author of several books and regularly shares insights through his blog and open-source contributions.