Windows Image: OS-Level is not scanned
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 454
- Forks
- 134
- PR merge metrics
- No merged PRs in 30d
Description
Thank you that it is already possible to scan Windows images even if it is still very slow.
However, I miss the OS level in the scan.
If an image is scanned with an outdated base image, at least a warning should be displayed.
It might also be possible to display the CVE directly from sources such as https://msrc.microsoft.com/update-guide/vulnerability
Example:
docker scout cves mcr.microsoft.com/windows/nanoserver:1809-KB4464455
Only finds the outdated curl package in the image but that the Windows version is from November 13, 2018 (operating system build 17763.107) is not detected and displayed.
It is possible to read the Windows version from the image. Described e.g. in this article
https://jamiemagee.co.uk/blog/scanning-windows-container-images-is-surprisingly-easy/
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running the example command against the Windows Nano Server image and review the linked article on reading Windows container versions. Trace how the scan identifies the existing curl package and determine where Windows OS build information and Microsoft Security Response Center data would fit. Done means outdated Windows base-image versions are detected and surfaced with relevant vulnerability information.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100