News for hackers. Stuff that matters.

A comment on Docker Image Vulnerability Research. Parent comment

Re:Docker Image Vulnerability Research by jsulinski on Tuesday March 14, 2017 @08:29PM (#13872866)
That's correct, vuls queries the package manager for installed packages, versions, and changelogs. It then compares the CVEs found in the changelogs to NVD.

There are certainly flaws in this approach; it's one of the reasons we intend to support multiple scanners. We started with vuls because clair wasn't released yet and we wanted to support more than containers.

[ Parent | on HN ]
Re:Docker Image Vulnerability Research by wyldfire on Wednesday March 15, 2017 @06:22PM (#13880416)
Are there any dynamic scanners that are designed like Vuls or Clair (I'm assuming they're both static)?
[ Parent | on HN ]
Re:Docker Image Vulnerability Research by jsulinski on Thursday March 16, 2017 @11:36PM (#13891246)
I don't fully understand the question.

clair does static analysis

vuls uses a package manager and changelogs

[ Parent | on HN ]
Re:Docker Image Vulnerability Research by wyldfire on Friday March 17, 2017 @12:41PM (#13895404)
Are there (any) dynamic analysis options available that would give a report similar in scope to clair or vuls?
[ Parent | on HN ]