ImageVulnAnalyzer

This tool can parse the raw vulnerabilities report of container image generated by trivy and generate a human-readable HTML page.

Installation

pip install iv-sherlock

Use the tool

This tool comes with a default config.toml, it's designed for running in linux OS.

[report]
# directory to put raw report generated by trivy
source_path = "/tmp/iv_sherlock/data"
# directory which hosts the generated html report
out_path = "/tmp/iv_sherlock/data/tmp"
# report encoding
default_encoding = "utf-8"
# enable pdf generation or not
export_pdf = false

[cvss]
# default vector score metric. You should change the score based on your security requirements, you can obtain your
# own cvss_score and cve severity
score_mapping = '{"AV": {"N": 0.85, "A": 0.62, "L": 0.55, "P": 0.2}, "AC": {"L": 0.77, "H": 0.44}, "PR": {"N": 0.85, "L": 0.62, "H": 0.27}, "UI": {"N": 0.85, "R": 0.62}, "S": {"U": 1.0, "C": 1.08}, "C": {"H": 0.56, "L": 0.22, "N": 0.0}, "I": {"H": 0.56, "L": 0.22, "N": 0.0}, "A": {"H": 0.56, "L": 0.22, "N": 0.0}}'

You can overload the default configuration file by using the -c or --conf option.

# run the application with default conf, only works in Linux OS
iv_sherlock

# run the application with custom conf
iv_sherlock -c path/to/custom_conf.toml

For windows user, you must provide a custom_conf.toml. You can use the above example and modify the source_path and out_path

To generate some raw report for image in trivy, you can use the below command

$ trivy image -f json -o redis.json redis

You can have more details of trivy from here

The image vulnerabilities

The image vulnerabilities can be divided into two categories:

• The vulnerabilities from base OS
• The vulnerabilities from the applications (or dependencies of the application)

Rendering

The application will generate one report per image and one general report (summary) It is possible to get such a report in PDF too because it prints badly in browsers from HTML

To do that, install playwright and use :

playwright install

Otherwise, you can deactivate this functionality in the config.toml by setting export_pdf to false.

The app will run without playwright then