Google vulnerability scanner written in Go which uses the data provided by https://osv.dev
1.4K
Image maintained by: Andrew Malkov
Where to file issues for this image: https://github.com/anmalkov/osv-scanner/issues
Supported architectures: amd64
OSV-Scanner maintained by: Google
Official OSV-Scanner repository: https://github.com/google/osv-scanner
Where to file issues for OSV-Scanner: https://github.com/google/osv-scanner/issues
Use OSV-Scanner to find existing vulnerabilities affecting your project's dependencies.
OSV-Scanner provides an officially supported frontend to the OSV database that connects a project’s list of dependencies with the vulnerabilities that affect them. Since the OSV.dev database is open source and distributed, it has several benefits in comparison with closed source advisory databases and scanners:
The above all results in fewer, more actionable vulnerability notifications, which reduces the time needed to resolve them.
https://github.com/google/osv-scanner
Walks through a list of directories to find:
which is used to build the list of dependencies to be matched against OSV vulnerabilities.
Can be configured to recursively walk through subdirectories with the --recursive / -r flag.
Searching for git commit hash is intended to work with projects that use git submodules or a similar mechanism where dependencies are checked out as real git repositories.
$ docker run -v /path/to/your/dir:/data anmalkov/osv-scanner -r /data
SPDX and CycloneDX SBOMs using Package URLs are supported. The format is auto-detected based on the input file contents.
$ docker run -v /path/to/your/dir-with-sbom-file:/data anmalkov/osv-scanner --sbom=/data/sbom.json
A wide range of lockfiles are supported by utilizing this lockfile package. This is the current list of supported lockfiles:
Cargo.lockpackage-lock.jsonyarn.lockpnpm-lock.yamlcomposer.lockGemfile.lockgo.modmix.lockpoetry.lockpubspec.lockpom.xml*requirements.txt*gradle.lockfilebuildscript-gradle.lockfile$ docker run -v /path/to/your/dir-with-your-lock-files:/data anmalkov/osv-scanner --lockfile=/data/first-directory/package-lock.json --lockfile=/data/another-directory/Cargo.lock
By default osv-scanner outputs a human readable table. To have osv-scanner output JSON instead, pass the --json flag when calling osv-scanner.
When using the --json flag, only the JSON output will be printed to stdout, with all other outputs being directed to stderr. So to save only the json output to file, you can redirect the output with osv-scanner --json ... > /path/to/file.json
$ docker run -v /path/to/your/dir-with-your-lock-file:/data anmalkov/osv-scanner --lockfile=/data/yarn.lock --json > /folder/to/store/scanning/results/results.json
{
"results": [
{
"packageSource": {
"path": "/absolute/path/to/go.mod",
// One of: lockfile, sbom, git, docker
"type": "lockfile"
},
"packages": [
{
"Package": {
"name": "github.com/gogo/protobuf",
"version": "1.3.1",
"ecosystem": "Go"
},
"vulnerabilities": [
{
"id": "GHSA-c3h9-896r-86jm",
"aliases": [
"CVE-2021-3121"
],
// ... Full OSV
},
{
"id": "GO-2021-0053",
"aliases": [
"CVE-2021-3121",
"GHSA-c3h9-896r-86jm"
],
// ... Full OSV
}
],
// Grouping based on aliases, if two vulnerability share the same alias, or alias each other,
// they are considered the same vulnerability, and is grouped here under the id field.
"groups": [
{
"ids": [
"GHSA-c3h9-896r-86jm",
"GO-2021-0053"
]
}
]
}
]
},
{
"packageSource": {
"path": "/absolute/path/to/Cargo.lock",
"type": "lockfile"
},
"packages": [
{
"Package": {
"name": "regex",
"version": "1.5.1",
"ecosystem": "crates.io"
},
"vulnerabilities": [
{
"id": "GHSA-m5pq-gvj9-9vr8",
"aliases": [
"CVE-2022-24713"
],
// ... Full OSV
},
{
"id": "RUSTSEC-2022-0013",
"aliases": [
"CVE-2022-24713"
],
// ... Full OSV
}
],
"groups": [
{
"ids": [
"GHSA-m5pq-gvj9-9vr8",
"RUSTSEC-2022-0013"
]
}
]
}
]
}
]
}
Content type
Image
Digest
sha256:64d4ebe38…
Size
22.9 MB
Last updated
over 2 years ago
docker pull anmalkov/osv-scanner