CVE is only detected when package is installed, not when it's built from source
Open
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 454
- Forks
- 134
- PR merge metrics
- No merged PRs in 30d
Description
Example CVE:
Compare:
- Installing package
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y libpmix2
CVE is detected.
- Building from source
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y \
wget \
tar \
libevent-dev \
libhwloc-dev \
build-essential \
python3
ARG DOCKER_PMIX_VERSION=4.1.2
RUN wget https://github.com/openpmix/openpmix/releases/download/v${DOCKER_PMIX_VERSION}/pmix-${DOCKER_PMIX_VERSION}.tar.gz && \
tar -xzvf pmix-${DOCKER_PMIX_VERSION}.tar.gz && \
cd pmix-${DOCKER_PMIX_VERSION} && \
./configure --prefix=/usr/local && \
make && \
make install
RUN apt purge -y build-essential linux-libc-dev && apt autoremove -y
CVE is not detected
Is this expected?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the two Dockerfile cases from the issue and compare the Scout CLI vulnerability results for the installed package and source-built PMIx image. Trace the CLI's image vulnerability detection entry point to determine whether the missing CVE is expected or a defect; done means the behavior is explained and, if defective, covered by a regression test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, shell, ubuntu
- Domain
- cli, devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100