jfrog / jfrog/jfrog-cli-security

`jf docker scan` command exit code is always 0

Open
#341 6 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

When using jf docker scan command the exit code is always 0 even when the vulnerability was found or not. This is misleading since it was expected to throw a different exit code if the vulnerabilities are found.

Current behavior
❯ jf docker scan node  && echo "Exit code" $?
19:21:38 [πŸ”΅Info] Log path: /Users/jag/.jfrog/logs/jfrog-cli.2023-08-08.19-21-38.40675.log

πŸ’¬ The full scan results are available here: /var/folders/jl/bd9fsxtx56n261vylpl9nqtm0000gn/T/jfrog.cli.temp.-1691536948-3662802376

Vulnerabilities
β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
β”‚ SEVERITY β”‚ DIRECT             β”‚ DIRECT  β”‚ IMPACTED        β”‚ IMPACTED β”‚ FIXED      β”‚ TYPE   β”‚ CVE           β”‚
β”‚          β”‚ PACKAGE            β”‚ PACKAGE β”‚ PACKAGE         β”‚ PACKAGE  β”‚ VERSIONS   β”‚        β”‚               β”‚
β”‚          β”‚                    β”‚ VERSION β”‚ NAME            β”‚ VERSION  β”‚            β”‚        β”‚               β”‚
β”œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€
β”‚ πŸŽƒMedium β”‚ sha256__61f2871f54 β”‚         β”‚ 3.18:libcrypto3 β”‚ 3.1.1-r1 β”‚ [3.1.1-r2] β”‚ Alpine β”‚ CVE-2023-2975 β”‚
β”‚          β”‚ 5a9b23a9340f96b331 β”‚         β”‚                 β”‚          β”‚            β”‚        β”‚               β”‚
.
.
.
β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”΄β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”΄β”€β”€β”€β”€β”€β”€β”€β”€β”€β”΄β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”΄β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”΄β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”΄β”€β”€β”€β”€β”€β”€β”€β”€β”΄β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
19:22:28 [πŸ”΅Info] Scan completed successfully.
Exit code: 0
❯ jf docker scan alpine  && echo "Exit code: " $?
19:25:23 [πŸ”΅Info] Log path: /Users/jag/.jfrog/logs/jfrog-cli.2023-08-08.19-25-23.40914.log

πŸ’¬ The full scan results are available here: /var/folders/jl/bd9fsxtx56n261vylpl9nqtm0000gn/T/jfrog.cli.temp.-1691537134-468047909

β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
β”‚ ✨ No vulnerabilities were found ✨ β”‚
β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
19:25:34 [πŸ”΅Info] Scan completed successfully.
Exit code:  0
Reproduction steps

Runa jf docker scan command with a vulnerable and non-vulnerable image and check the exit code

Expected behavior

If the scan is failed due to the violations was found, the exit code should be 3

JFrog CLI version

jf version 2.45.0

Operating system type and version

MacOS 13.5

JFrog Artifactory version

saas

JFrog Xray version

saas

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up β€” it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by running the reported jf docker scan command with both a vulnerable and a non-vulnerable image, then trace the docker scan command entry point in this Go module. Compare the command's returned status with the expected exit code of 3 when vulnerabilities are found and 0 when none are found.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.