Durch die Nutzung von AWS re:Post stimmt du den AWS re:Post Nutzungsbedingungen
AWS re:Postre:Post

False positive in ECR container image detected by AWS Inspector v2 related with com.fasterxml.jackson.core:jackson-databind?

2

We started a 15-day trial of new Amazon Inspector and it scanned all our existing repos. Latest version of them showed up with up to 19 critical vulnerabilities.... Looking into more detailed they were all related with com.fasterxml.jackson.core:jackson-databind specifically the version that is said to be detected is 0:2.9.6 We started investigating to fix the issue, but we don't have that version inside the offending .jar (we expanded it to look for it). Instead we found version 2.11.2 which has no vulnerability associated. WE did Found a jackson-core-asl-1.9.1.jar and jackson-mapper-asl-1.9.3.jar we thought might be causing it... Still when scanning the new image now without those *-asl.jar the same vulnerabilities are shown. Is it possible AWS Inspector is detecting this as fault possitive? Is there any more in-depth info on why the images are marked as having it, because we can't understand why is been flagged or how to solve it with the provided info.

Can AWS be reached for specific support on correcting false positives and how?

  • JaccoPK
    vor 3 Jahren

    I had an experience with a 'false positive' too. But in the end we appeared to have a yarn.lock file which a developer of a package accidently included in the package. After removing this yarn.lock the vulnerability was no longer reported by Inspector v2. I guess inspector does not work with hashes of file but scans these kind of package references in lock files (there is also package.lock.json). Under the hood AWS is using Snyk (or similar) to detect vulnerabilities.

  • jeanpierrelevesque
    vor 2 Jahren

    Look if you are using ehcache. Upgrading to the newest version fixed all of ours issues. ehcache package itself jackson-databind ...

Themen
Sicherheit, Identität & Konformität
Tags
Amazon Inspektor
Sprache
English
AWS-User-7745669
gefragt vor 3 Jahren464 Aufrufe
1 Antwort
0

Simple answer is yes, you can go to Support section in the AWS Console and inquire about anything related to any AWS Services as long as you have the appropriate level of Support. You can find more about what support levels contains here - https://aws.amazon.com/premiumsupport/plans/

For your vulnerability, AWS Inspector uses the file that contains what packages are used to build the container. These files are in each package as well. So it may have picked up the package in another package that you have installed.

That is what we found, when we were getting 'false positives', we found that the package was in another package we installed.

Hope this helps!.

profile picture
Carlos del Castillo
beantwortet vor 2 Jahren

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen

Relevanter Inhalt