BUG: ProGet Vulnerablity Listing

scroak_6473

Hi Guys,

Pretty sure this is a bug, I'm running ProGet v5.3.7 as a docker container.

Clicking on "Vulnerabilities" in the top navigation bar lists all discovered vulnerabilities. However in the package column it displays the package digest, not the name. It would be great if we could have the name instead.

Thanks

Simon

rhessinger

Hi @scroak_6473,

This works as designed. Clair attaches a vulnerability at the Docker image layer, not at the image itself. This also means that that vulnerability can exist across multiple images because Docker will share layers between images.

Thanks,
Rich

scroak_6473

Thanks @rhessinger

If that is the case then perhaps this view could have an extra column detailing the package this layer (and vulnerability) exists in?

The use case I have:

I've just connected my docker registry feed to a Vulnerablity scanner source
I have no way of finding out a "summary" of which packages/images in my feed have Vulnerabilities in them without clicking each repo and then clicking the "Vulnerabilities" tab
Additionally if a developer uploads an image to the repo, that contains a new vulnerability how do I see this / get notified of this without checking each repo manually?

Thanks

Simon

atripp

Thanks, you have have a pretty good point here. Finding where the vulnerabilities live is kind of difficult, but let's make it easier

First, bc9ab73e5b14 is a layer that's in one or more container images that has zero or more tags in a repository (in a registry/feed).

What's actually useful information is registry (feed), then repository+tag (containername:version).

If all this added up to a single tag in a single registry + repository + tag combination, we could display that instead. But there are going to be a lot of container images using that layer...

Maybe clicking that page opens up a page that is like, "tags that use this layer" or something, and it displays Registry (Feed) and REpository+Tag in a simple list view?

The only way to get to this page would be clicking on a image hash like that, so perhaps it could be a modal-popup window instead?

Just brainstorming... what do you think?

scroak_6473

Hi @atripp

I like your "tags that use this layer" suggestion, I was also thinking you could do something like this mock-up within the repo view:

In addition you could also improve the "feed view" with some more information about the number of tags/images & vulnerablities per repo like this:

Or even:

atripp

@scroak_6473 great suggestions, thanks!! The mockups will really help me to present a case :)

I see that the priority is on finding the unassessed vulnerabilities, which make sense. I don't know about a "mouseover" (we don't have this UI construct in our products like this to make this easily doable), but I can envision a modal window (popup) or a regular page that allows for quickly asessing those vulnerabilities

This isn't trivial, but it's not terribly complicated either. I'm going to try to get this submitted internally next week (I'll share what I write up), and from there we might be able to get this in the following or near-term maintence release

scroak_6473

Amazing thanks @atripp

Let me know what version this appears in I would love to try it out.

Thanks

Simon

atripp

Great!! I've logged this as PG-1798, and it's planned for 5.3.10 (Aug 28), but may get delayed depending on other priories.

rhessinger

Hi @scroak_6473,

I just wanted to send over a few screenshots so you can see what is releasing tomorrow:

When you click on the layer digest on the Vulnerabilities, Repository Vulnerabilities, and Image Vulnerabilities pages, it now will show this modal dialog:

The List Repositories page now looks like this:

The All Tags for a Repository now looks like this:

The All Images for a Repository looks like this:

Thanks,
Rich

scroak_6473

That's amazing! Thanks so much @rhessinger

You guys rock!