t.behrendt
77fa83fb31
CD / Release (push) Successful in 6s
Adding a action to merge multiple SARIF files into one. Also contains a test and example files. Reviewed-on: t.behrendt/trivy-actions#37 Reviewed-by: branch-buddy <branch-buddy@t00n.de> Co-authored-by: Timo Behrendt <t.behrendt@t00n.de> Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
71 lines
3.4 KiB
JSON
71 lines
3.4 KiB
JSON
{
|
|
"version": "2.1.0",
|
|
"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
|
|
"runs": [
|
|
{
|
|
"tool": {
|
|
"driver": {
|
|
"fullName": "Trivy Vulnerability Scanner",
|
|
"informationUri": "https://github.com/aquasecurity/trivy",
|
|
"name": "Trivy",
|
|
"rules": [
|
|
{
|
|
"id": "KSV-0014",
|
|
"name": "Misconfiguration",
|
|
"shortDescription": {
|
|
"text": "Root file system is not read-only"
|
|
},
|
|
"fullDescription": {
|
|
"text": "An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk."
|
|
},
|
|
"defaultConfiguration": {
|
|
"level": "error"
|
|
},
|
|
"helpUri": "https://avd.aquasec.com/misconfig/ksv-0014",
|
|
"help": {
|
|
"text": "Misconfiguration KSV-0014\nType: Kubernetes Security Check\nSeverity: HIGH\nCheck: Root file system is not read-only\nMessage: Container 'renovate' of CronJob 'renovate' should set 'securityContext.readOnlyRootFilesystem' to true\nLink: [KSV-0014](https://avd.aquasec.com/misconfig/ksv-0014)\nAn immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.",
|
|
"markdown": "**Misconfiguration KSV-0014**\n| Type | Severity | Check | Message | Link |\n| --- | --- | --- | --- | --- |\n|Kubernetes Security Check|HIGH|Root file system is not read-only|Container 'renovate' of CronJob 'renovate' should set 'securityContext.readOnlyRootFilesystem' to true|[KSV-0014](https://avd.aquasec.com/misconfig/ksv-0014)|\n\nAn immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk."
|
|
},
|
|
"properties": {
|
|
"precision": "very-high",
|
|
"security-severity": "8.0",
|
|
"tags": ["misconfiguration", "security", "HIGH"]
|
|
}
|
|
}
|
|
],
|
|
"version": "0.69.1"
|
|
}
|
|
},
|
|
"results": [
|
|
{
|
|
"ruleId": "KSV-0014",
|
|
"ruleIndex": 0,
|
|
"level": "error",
|
|
"message": {
|
|
"text": "Artifact: k8s/31_deployment_redis.yaml\nType: kubernetes\nVulnerability KSV-0014\nSeverity: HIGH\nMessage: Container 'redis' of Deployment 'redis' should set 'securityContext.readOnlyRootFilesystem' to true\nLink: [KSV-0014](https://avd.aquasec.com/misconfig/ksv-0014)"
|
|
},
|
|
"locations": [
|
|
{
|
|
"physicalLocation": {
|
|
"artifactLocation": {
|
|
"uri": "k8s/31_deployment_redis.yaml",
|
|
"uriBaseId": "ROOTPATH"
|
|
},
|
|
"region": {
|
|
"startLine": 34,
|
|
"startColumn": 1,
|
|
"endLine": 51,
|
|
"endColumn": 1
|
|
}
|
|
},
|
|
"message": {
|
|
"text": "k8s/31_deployment_redis.yaml"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|