Created
May 9, 2022 21:04
-
-
Save thomasdarimont/bcd0fecf2db9f98e82e599ea353eb1dd to your computer and use it in GitHub Desktop.
Custom Keycloak.X Image docker scan output
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ docker scan thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT | |
| Testing thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT... | |
| Package manager: apk | |
| Project name: docker-image|thomasdarimont/custom-keycloakx | |
| Docker image: thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT | |
| Platform: linux/amd64 | |
| Base image: alpine:3.15.4 | |
| ✔ Tested 51 dependencies for known vulnerabilities, no vulnerable paths found. | |
| According to our scan, you are currently using the most secure version of the selected base image | |
| For more free scans that keep your images secure, sign up to Snyk at https://dockr.ly/3ePqVcp | |
| ------------------------------------------------------- | |
| Testing thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT... | |
| Tested 20 dependencies for known vulnerabilities, found 1 vulnerability. | |
| Issues with no direct upgrade or patch: | |
| ✗ Information Exposure [Low Severity][https://snyk.io/vuln/SNYK-JAVA-COMMONSCODEC-561518] in commons-codec:commons-codec@1.11 | |
| introduced by org.keycloak:keycloak-admin-cli@18.0.0 > commons-codec:commons-codec@1.11 and 1 other path(s) | |
| This issue was fixed in versions: 1.13 | |
| Package manager: maven | |
| Target file: /opt/keycloak/bin/client | |
| Project name: thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT:/opt/keycloak/bin/client | |
| Docker image: thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT | |
| For more free scans that keep your images secure, sign up to Snyk at https://dockr.ly/3ePqVcp | |
| ------------------------------------------------------- | |
| Testing thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT... | |
| Package manager: maven | |
| Target file: /opt/keycloak/lib/app | |
| Project name: thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT:/opt/keycloak/lib/app | |
| Docker image: thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT | |
| ✔ Tested thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT for known vulnerabilities, no vulnerable paths found. | |
| For more free scans that keep your images secure, sign up to Snyk at https://dockr.ly/3ePqVcp | |
| ------------------------------------------------------- | |
| Testing thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT... | |
| Tested 8 dependencies for known vulnerabilities, found 6 vulnerabilities. | |
| Issues to fix by upgrading: | |
| Upgrade org.graalvm.sdk:graal-sdk@21.3.1 to org.graalvm.sdk:graal-sdk@21.3.2 to fix | |
| ✗ Denial of Service (DoS) (new) [Low Severity][https://snyk.io/vuln/SNYK-JAVA-ORGGRAALVMSDK-2769616] in org.graalvm.sdk:graal-sdk@21.3.1 | |
| introduced by org.graalvm.sdk:graal-sdk@21.3.1 | |
| ✗ Unsafe Reflection (new) [Medium Severity][https://snyk.io/vuln/SNYK-JAVA-ORGGRAALVMSDK-2769612] in org.graalvm.sdk:graal-sdk@21.3.1 | |
| introduced by org.graalvm.sdk:graal-sdk@21.3.1 | |
| ✗ Denial of Service (DoS) (new) [Medium Severity][https://snyk.io/vuln/SNYK-JAVA-ORGGRAALVMSDK-2769614] in org.graalvm.sdk:graal-sdk@21.3.1 | |
| introduced by org.graalvm.sdk:graal-sdk@21.3.1 | |
| ✗ Improper Input Validation (new) [Medium Severity][https://snyk.io/vuln/SNYK-JAVA-ORGGRAALVMSDK-2769620] in org.graalvm.sdk:graal-sdk@21.3.1 | |
| introduced by org.graalvm.sdk:graal-sdk@21.3.1 | |
| ✗ Access Restriction Bypass (new) [High Severity][https://snyk.io/vuln/SNYK-JAVA-ORGGRAALVMSDK-2767964] in org.graalvm.sdk:graal-sdk@21.3.1 | |
| introduced by org.graalvm.sdk:graal-sdk@21.3.1 | |
| ✗ Information Exposure (new) [High Severity][https://snyk.io/vuln/SNYK-JAVA-ORGGRAALVMSDK-2769618] in org.graalvm.sdk:graal-sdk@21.3.1 | |
| introduced by org.graalvm.sdk:graal-sdk@21.3.1 | |
| Package manager: maven | |
| Target file: /opt/keycloak/lib/lib/boot | |
| Project name: thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT:/opt/keycloak/lib/lib/boot | |
| Docker image: thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT | |
| For more free scans that keep your images secure, sign up to Snyk at https://dockr.ly/3ePqVcp | |
| ------------------------------------------------------- | |
| Testing thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT... | |
| Package manager: maven | |
| Target file: /opt/keycloak/lib/lib/deployment | |
| Project name: thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT:/opt/keycloak/lib/lib/deployment | |
| Docker image: thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT | |
| ✔ Tested 150 dependencies for known vulnerabilities, no vulnerable paths found. | |
| For more free scans that keep your images secure, sign up to Snyk at https://dockr.ly/3ePqVcp | |
| ------------------------------------------------------- | |
| Testing thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT... | |
| Tested 252 dependencies for known vulnerabilities, found 5 vulnerabilities. | |
| Issues to fix by upgrading: | |
| Upgrade commons-io:commons-io@2.1 to commons-io:commons-io@2.7 to fix | |
| ✗ Directory Traversal [Medium Severity][https://snyk.io/vuln/SNYK-JAVA-COMMONSIO-1277109] in commons-io:commons-io@2.1 | |
| introduced by commons-io:commons-io@2.1 | |
| Upgrade io.netty:netty-common@4.1.73.Final to io.netty:netty-common@4.1.77.Final to fix | |
| ✗ Information Exposure (new) [Medium Severity][https://snyk.io/vuln/SNYK-JAVA-IONETTY-2812456] in io.netty:netty-common@4.1.73.Final | |
| introduced by io.netty:netty-common@4.1.73.Final | |
| Issues with no direct upgrade or patch: | |
| ✗ Information Exposure [Low Severity][https://snyk.io/vuln/SNYK-JAVA-COMMONSCODEC-561518] in commons-codec:commons-codec@1.11 | |
| introduced by org.keycloak:keycloak-admin-cli@18.0.0 > commons-codec:commons-codec@1.11 and 1 other path(s) | |
| This issue was fixed in versions: 1.13 | |
| ✗ Improper Certificate Validation [Medium Severity][https://snyk.io/vuln/SNYK-JAVA-IONETTY-1042268] in io.netty:netty-handler@4.1.74.Final | |
| introduced by io.netty:netty-handler@4.1.74.Final | |
| No upgrade or patch available | |
| ✗ Authorization Bypass [Medium Severity][https://snyk.io/vuln/SNYK-JAVA-ORGKEYCLOAK-1085642] in org.keycloak:keycloak-core@18.0.0 | |
| introduced by org.keycloak:keycloak-core@18.0.0 | |
| No upgrade or patch available | |
| Package manager: maven | |
| Target file: /opt/keycloak/lib/lib/main | |
| Project name: thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT:/opt/keycloak/lib/lib/main | |
| Docker image: thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT | |
| For more free scans that keep your images secure, sign up to Snyk at https://dockr.ly/3ePqVcp | |
| ------------------------------------------------------- | |
| Testing thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT... | |
| Package manager: maven | |
| Target file: /opt/keycloak/lib/quarkus | |
| Project name: thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT:/opt/keycloak/lib/quarkus | |
| Docker image: thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT | |
| ✔ Tested thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT for known vulnerabilities, no vulnerable paths found. | |
| For more free scans that keep your images secure, sign up to Snyk at https://dockr.ly/3ePqVcp | |
| ------------------------------------------------------- | |
| Testing thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT... | |
| Package manager: maven | |
| Target file: /opt/keycloak/lib | |
| Project name: thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT:/opt/keycloak/lib | |
| Docker image: thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT | |
| ✔ Tested thomasdarimont/custom-keycloakx:1.0.0-SNAPSHOT for known vulnerabilities, no vulnerable paths found. | |
| For more free scans that keep your images secure, sign up to Snyk at https://dockr.ly/3ePqVcp | |
| Tested 8 projects, 3 contained vulnerable paths. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment