Google開源漏洞掃描器OSV-Scanner部署及使用

一、OSV是什么？

OSV 是Google提供的一個開源項目的漏洞數(shù)據(jù)庫和分類基礎(chǔ)設(shè)施，旨在幫助開源項目的開發(fā)人員和用戶應(yīng)對開源項目漏洞。 對于開發(fā)人員，OSV 的自動化功能有助于減輕分類負擔，每個漏洞都會經(jīng)過自動分析，以確定受影響的提交和版本范圍。

二、OSV-Scanner是什么？

OSV-Scanner是Google基于其提供的開源漏洞（OSV）模式和 OSV.dev 漏洞數(shù)據(jù)庫服務(wù)，推出的一個免費的漏洞掃描器，可以在整個軟件供應(yīng)鏈中自動發(fā)現(xiàn)和修補漏洞。它聲稱這是最大的社區(qū)可編輯的開源漏洞數(shù)據(jù)庫。OSV-Scanner 使開發(fā)者能夠自動將代碼和依賴關(guān)系與已知的漏洞列表相匹配，并確定是否有補丁或更新。

三、OSV-Scanner部署

0.環(huán)境狀況

OS：AlmaLinux release 8.6 (Sky Tiger)

Go：go version go1.18.9 linux/amd64(要求1.18+)

HardWare：1C1G

1.Go install
# yum install curl
# yum install wget
# wget -c https://golang.google.cn/dl/go1.18.9.linux-amd64.tar.gz
選擇合適的Go版本，要求1.18+
https://golang.google.cn/dl/
# tar -C /usr/local -xzf go1.18.9.linux-amd64.tar.gz 
# cd  /usr/local 
# vi /etc/profile.d/goenv.sh
export GOROOT=/usr/local/go
export GOPATH=$HOME/go
export PATH=$PATH:$GOROOT/bin:$GOPATH/bin
# go version
go version go1.18.9 linux/amd64

國內(nèi)使用，調(diào)整Go環(huán)境
# go env -w GOSUMDB="sum.golang.org"
# go env -w GO111MODULE=on
# go env -w GOPROXY=https://goproxy.cn,direct
2.OSV-Scanner install
# go install github.com/google/osv-scanner/cmd/osv-scanner@v1
# ln /root/go/bin/osv-scanner /usr/bin/osv-scanner
# osv-scanner --version
osv-scanner version: dev
commit: n/a
built at: n/a

四、OSV-Scanner使用

1.OSV-Scanner掃描目錄
$ osv-scanner -r /path/to/your/dir
JSON格式輸出
$ osv-scanner --json -r /path/to/your/dir
配置 osv-scanner，參考文件./go/pkg/mod/github.com/google/osv-scanner@v1.0.1/fixtures/testdatainner/osv-scanner.toml修改
$ osv-scanner --json --config=./go/pkg/mod/github.com/google/osv-scanner@v1.0.1/fixtures/testdatainner/osv-scanner.toml -r /path/to/your/dir

[[IgnoredVulns]]
id = "GO-2022-0968"
# ignoreUntil = 2022-11-09 # Optional exception expiry date
reason = "No ssh servers are connected to or hosted in Go lang"
id = "GO-2022-1059"
# ignoreUntil = 2022-11-09 # Optional exception expiry date
reason = "No external http servers are written in Go lang."
$ osv-scanner --json --config=./go/pkg/mod/github.com/google/osv-scanner@v1.0.1/fixtures/testdatainner/osv-scanner.toml -r /path/to/your/dir


參考例子
# osv-scanner --json -r /root/go/pkg/mod/github.com/google/osv-scanner@v1.0.1/
Scanning dir /root/go/pkg/mod/github.com/google/osv-scanner@v1.0.1/
Scanned /root/go/pkg/mod/github.com/google/osv-scanner@v1.0.1/cmd/osv-scanner/fixtures/locks-many/Gemfile.lock file and found 1 packages
Scanned /root/go/pkg/mod/github.com/google/osv-scanner@v1.0.1/cmd/osv-scanner/fixtures/locks-many/composer.lock file and found 1 packages
Scanned /root/go/pkg/mod/github.com/google/osv-scanner@v1.0.1/cmd/osv-scanner/fixtures/locks-many/yarn.lock file and found 1 packages
Scanned /root/go/pkg/mod/github.com/google/osv-scanner@v1.0.1/cmd/osv-scanner/fixtures/locks-many-with-invalid/Gemfile.lock file and found 1 packages
Attempted to scan lockfile but failed: /root/go/pkg/mod/github.com/google/osv-scanner@v1.0.1/cmd/osv-scanner/fixtures/locks-many-with-invalid/composer.lock
Scanned /root/go/pkg/mod/github.com/google/osv-scanner@v1.0.1/cmd/osv-scanner/fixtures/locks-many-with-invalid/yarn.lock file and found 1 packages
Scanned /root/go/pkg/mod/github.com/google/osv-scanner@v1.0.1/cmd/osv-scanner/fixtures/locks-one-with-nested/nested/composer.lock file and found 1 packages
Scanned /root/go/pkg/mod/github.com/google/osv-scanner@v1.0.1/cmd/osv-scanner/fixtures/locks-one-with-nested/yarn.lock file and found 1 packages
Scanned /root/go/pkg/mod/github.com/google/osv-scanner@v1.0.1/go.mod file and found 18 packages
{
  "results": []
}
2.OSV-Scanner掃描docker的鏡像包

目前僅支持基于 Debian 的 docker 鏡像掃描。

快速導(dǎo)入docker并拉取debain鏡像
# yum install -y yum-utils device-mapper-persistent-data lvm2
# yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
# yum install docker-ce*
# docker search debain
# systemctl start docker
# systemctl enable docker
# cat /etc/docker/daemon.json
{
  "registry-mirrors": ["http://hub-mirror.c.163.com"]
}
# systemctl restart docker
# docker info
# docker search debain
# docker pull 717160040/debain
# docker image list

OSV-Scanner掃描docker的鏡像包
語法：osv-scanner --docker image_name:latest
# osv-scanner --docker 717160040/debain:latest --json >/root/717160040_debain.json
# cat /root/717160040_debain.json
"results": [
    {
      "source": {
        "path": "717160040/debain:latest",
        "type": "docker"
      },
      "packages": [
        {
          "package": {
            "name": "apt",
            "version": "1.4.8",
            "ecosystem": "Debian"
          },
          "vulnerabilities": [
            {
              "schema_version": "1.3.0",
              "id": "DLA-2487-1",
              "modified": "2022-08-05T05:18:58.818593Z",
              "published": "2020-12-10T00:00:00Z",
              "aliases": [
                "CVE-2020-27350"
              ],
              "summary": "apt - security update",
              "details": "\nIt was discovered that missing input validation in the ar/tar\nimplementations of APT, the high level package manager, could cause\nout-of-bounds reads or infinite loops, resulting in denial of service\nwhen processing malformed deb files.\n\n\nFor Debian 9 stretch, this problem has been fixed in version\n1.4.11.\n\n\nWe recommend that you upgrade your apt packages.\n\n\nFor the detailed security status of apt please refer to\nits security tracker page at:\n\u003chttps://security-tracker.debian.org/tracker/apt\u003e\n\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: \u003chttps://wiki.debian.org/LTS\u003e\n\n\n",
              "affected": [
                {
                  "package": {
                    "ecosystem": "Debian:9",
                    "name": "apt",
                    "purl": "pkg:deb/debian/apt?arch=source"
                  },
....
3.OSV-Scanner掃描鎖定文件

支持使用包 URL的SPDX和CycloneDX SBOM 。格式是根據(jù)輸入文件內(nèi)容自動檢測的。

# osv-scanner --lockfile=/path/to/your/package-lock.json -L /path/to/another/Cargo.lock

Cargo.lock
package-lock.json
yarn.lock
pnpm-lock.yaml
composer.lock
Gemfile.lock
go.mod
mix.lock
poetry.lock
pubspec.lock
pom.xml*
requirements.txt*
gradle.lockfile
buildscript-gradle.lockfile

參考URL

https://github.com/google/osv-scanner/releases
https://github.com/google/osv-scanner
https://osv.dev/
https://osv.dev/list

最后編輯于 ：
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請聯(lián)系作者
【社區(qū)內(nèi)容提示】社區(qū)部分內(nèi)容疑似由AI輔助生成，瀏覽時請結(jié)合常識與多方信息審慎甄別。
平臺聲明：文章內(nèi)容（如有圖片或視頻亦包括在內(nèi)）由作者上傳并發(fā)布，文章內(nèi)容僅代表作者本人觀點，簡書系信息發(fā)布平臺，僅提供信息存儲服務(wù)。

相關(guān)閱讀更多精彩內(nèi)容

友情鏈接更多精彩內(nèi)容