<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:562956631;
mso-list-template-ids:-164619750;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1
{mso-list-id:1504278232;
mso-list-template-ids:396020372;}
@list l1:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style>
</head>
<body lang="EN-CA" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:black">All,<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">The security team has been collaborating with the build team to evaluate tools for CVE Scanning in Starling X. This collaboration has clarified the requirements for a tool which has been documented here:<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"><a href="https://storyboard.openstack.org/#!/story/2005088"><span style="color:#954F72">https://storyboard.openstack.org/#!/story/2005088</span></a><o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">To fulfil these requirements, we started with evaluating tools for the host OS. These included:<o:p></o:p></span></p>
<ol style="margin-top:0cm;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px" start="1" type="1">
<li class="MsoNormal" style="color:black;mso-list:l0 level1 lfo1">cveman<o:p></o:p>
<ol style="margin-top:0cm" start="1" type="a">
<li class="MsoNormal" style="color:black;mso-list:l0 level2 lfo1">this tool is hardcoded to work for CLR Linux. This does not meet the requirement to understand CVEs for CentOS and Ubuntu.<o:p></o:p></li></ol>
</li><li class="MsoNormal" style="color:black;mso-list:l0 level1 lfo1"><a href="https://github.com/clearlinux/cve-check-tool"><span style="color:#954F72">cve-check-tool</span></a><span class="apple-converted-space"> </span>/<span class="apple-converted-space"> </span><a href="https://github.com/intel/cve-bin-tool"><span style="color:#954F72">cve-bin-tool</span></a><o:p></o:p></li></ol>
<ol style="margin-top:0cm" start="2" type="1">
<ol style="margin-top:0cm" start="1" type="a">
<li class="MsoNormal" style="color:black;mso-list:l0 level2 lfo2">OS agnostic.<o:p></o:p></li><li class="MsoNormal" style="color:black;mso-list:l0 level2 lfo2">Both of these tools are up-to-date with NVD<o:p></o:p></li><li class="MsoNormal" style="color:black;mso-list:l0 level2 lfo2">Identified 10% of known CVEs<o:p></o:p></li><li class="MsoNormal" style="color:black;mso-list:l0 level2 lfo2">Required a significant amount of manual work to extract a useful report.<o:p></o:p></li></ol>
<li class="MsoNormal" style="color:black;mso-list:l0 level1 lfo2"><a href="https://github.com/future-architect/vuls"><span style="color:#954F72">vuls</span></a><o:p></o:p></li></ol>
<ol style="margin-top:0cm" start="3" type="1">
<ol style="margin-top:0cm" start="1" type="a">
<li class="MsoNormal" style="color:black;mso-list:l0 level2 lfo3">Understands specific OSs including CentOS and Ubuntu<o:p></o:p></li><li class="MsoNormal" style="color:black;mso-list:l0 level2 lfo3">All data required to make decisions is provided in the report; easy to extract<o:p></o:p></li><li class="MsoNormal" style="color:black;mso-list:l0 level2 lfo3">Identified 90% of known CVEs<o:p></o:p></li></ol>
</ol>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">Based on this, we are planning to proceed with vuls for the initial host OS reports.<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">We have explored a couple of open source scanners on the container scan side:<o:p></o:p></span></p>
<ol style="margin-top:0cm;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px" start="1" type="1">
<li class="MsoNormal" style="color:black;mso-list:l1 level1 lfo4"><a href="https://anchore.com/opensource"><span style="color:#954F72">Anchore Engine</span></a><o:p></o:p>
<ol style="margin-top:0cm" start="1" type="a">
<li class="MsoNormal" style="color:black;mso-list:l1 level2 lfo4">Understands specific OSs including CentOS and Ubuntu<o:p></o:p></li><li class="MsoNormal" style="color:black;mso-list:l1 level2 lfo4">A stand-alone tool<o:p></o:p></li><li class="MsoNormal" style="color:black;mso-list:l1 level2 lfo4">CLI only with open source; GUI with commercial version<o:p></o:p></li></ol>
</li><li class="MsoNormal" style="color:black;mso-list:l1 level1 lfo4"><a href="https://coreos.com/clair/docs/latest/"><span style="color:#954F72">CoreOS Clair</span></a><o:p></o:p></li></ol>
<ol style="margin-top:0cm" start="2" type="1">
<ol style="margin-top:0cm" start="1" type="a">
<li class="MsoNormal" style="color:black;mso-list:l1 level2 lfo5">Understands specific OSs including CentOS and Ubuntu<o:p></o:p></li><li class="MsoNormal" style="color:black;mso-list:l1 level2 lfo5">Stand-alone or integrated with a repository like Harbor<o:p></o:p></li><li class="MsoNormal" style="color:black;mso-list:l1 level2 lfo5">May have issues integrating into a dashboard<o:p></o:p></li></ol>
</ol>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">Both scanners yielded similar results identifying an CVE which needs to be corrected. Both scanners have some limitations with CentOS which we are exploring further. It seems they only identify CVEs which have already been fixed
in CentOS. This is due to the nature of the CentOS community CVE database. Currently we are learning towards Clair since It does have integration with repositories and correlates quite well to the results we are seeing from vuls.<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">A big thanks to Victor Rodriguez Bahena and Irene Chen for helping with this effort.<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">Regards,<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">Ken Y<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
</body>
</html>