clair、anchore、trivy开源数据库的数据来源分析

数据来源分析

trivy

• trivy 分了四个仓库进行维护，分别是

  • trivy 负责提供cli交互程序

  • trivy-db 负责将处理好的数据打包成blot格式

  • vlun-list 负责存放处理好的原始数据json格式

  • vlun-list-update 负责收集的数据并进行预处理，收集方式从各个厂商的公开漏洞库中下载收据，以及有一些开源语言包的漏洞数据

  • 具体的数据源信息如下

    Directory	OS	Source	URL
    alma/	AlmaLinux	AlmaLinux Errata	https://errata.almalinux.org/8/errata.json
    alpine/	Alpine Linux	Alpine secdb	https://secdb.alpinelinux.org/
    amazon/1	Amazon Linux	Amazon Linux Security Center	https://alas.aws.amazon.com/
    amazon/2	Amazon Linux 2	Amazon Linux Security Center	https://alas.aws.amazon.com/alas2.html
    arch-linux/	Arch Linux	Arch Linux Security Tracker	https://security.archlinux.org/json
    debian/	Debian GNU/Linux	Security Bug Tracker	https://security-tracker.debian.org/tracker/
    nvd/	-	National Vulnerability Database	https://nvd.nist.gov/
    oval/debian	Debian GNU/Linux	OVAL	https://www.debian.org/security/oval/
    oval/oracle	Oracle Linux	OVAL	https://linux.oracle.com/security/oval/
    oval/redhat	RHEL/CentOS	OVAL	https://www.redhat.com/security/data/oval/v2/
    redhat/	RHEL/CentOS	Security Data	https://www.redhat.com/security/data/metrics/
    rocky/	Rocky Linux	Rocky Linux UpdateInfo	https://download.rockylinux.org/pub/rocky
    ubuntu/	Ubuntu	Ubuntu CVE Tracker	https://people.canonical.com/~ubuntu-security/cve/
    cvrf/suse	OpenSUSE/SLES	SUSE Security CVRF	http://ftp.suse.com/pub/projects/security/cvrf/
    photon/	Photon	Photon Security Advisory	https://github.com/vmware/photon/wiki/Security-Advisories https://packages.vmware.com/photon/photon_cve_metadata/
    ghsa/	-	GitHub Advisory Database	https://github.com/advisories/
    glad/	-	GitLab Advisory Database	https://gitlab.com/gitlab-org/advisories-community/

anchore

• anchore 使用 grype 管理漏洞库， 具体的使用 sqlite 进行存储。
• grype 的数据来源
  • Alpine Linux SecDB: https://secdb.alpinelinux.org/
  • Amazon Linux ALAS: https://alas.aws.amazon.com/AL2/alas.rss
  • RedHat RHSAs: https://www.redhat.com/security/data/oval/
  • Debian Linux CVE Tracker: https://security-tracker.debian.org/tracker/data/json
  • Github GHSAs: https://github.com/advisories
  • National Vulnerability Database (NVD): https://nvd.nist.gov/vuln/data-feeds
  • Oracle Linux OVAL: https://linux.oracle.com/security/oval/
  • RedHat Linux Security Data: https://access.redhat.com/hydra/rest/securitydata/
  • Suse Linux OVAL: https://ftp.suse.com/pub/projects/security/oval/
  • Ubuntu Linux Security: https://people.canonical.com/~ubuntu-security/
• 数据库表结构为
  
  (https://hackmd.in.chaitin.net/uploads/46802a92-1a27-4c66-b4ac-39648625e014.png)]

clair

• clair 使用 claircore ,进行数据处理，基本上和上面一样，是先下载后解析的方式,最终存储到 postregs 数据库。
• clair 的数据来源
  • alpin
  • aws
  • crda
  • debain
  • dpkg
  • java
  • oracle
  • photon
  • python
  • pkg
  • rhel
  • suse
  • ubuntu
  • rpm
  • pyupio

总结

• 总体来说，trivy/anchore 所做的工作，可以用下面这张图表示
  

• 具体的数据做法是从各个厂商以及公开渠道获取相关的CVE信息文件，然后周期性自动下载，解析成自定义的标准格式，最后存到数据库中

• 其中，trivy 用到了 OSV 的部分数据， clair 用到了 snyk 的部分数据

• 我们应该在上述的漏洞来源中加入国产漏洞库