Vulnerability Scanner

Vulnerability Scanner

CVE research, system package auditing, and container image vulnerability scanning. Uses web search for CVE lookups and local tools for package/image analysis.

Quick Start

Quick CVE Check for a Specific Software

1. Identify the software and version
2. Web search: "[software name] [version] CVE site:nvd.nist.gov OR site:github.com/advisories"
3. Assess: Is the target version affected?
4. Report: Severity, affected versions, fix version, remediation steps

CVE Web Search Workflow

Step 1: Identify Software Versions

Gather current versions of monitored software:

# Docker
docker --version
docker compose version

# System packages (Arch Linux)
pacman -Q <package-name>

# Pi-hole (via SSH or API)
# Check ../workspace-devops/MEMORY.md for known version

# Gitea (via web UI or API)
curl -s http://<gitea-host>:3000/api/v1/version

Step 2: Search for CVEs

Use web search with targeted queries:

Useful sources:

• NVD: site:nvd.nist.gov
• GitHub Advisories: site:github.com/advisories
• MITRE: site:cve.mitre.org
• Vendor security pages (e.g., blog.gitea.com/security)

Step 3: Assess Impact

For each CVE found:

Step 4: Report

Update MEMORY.md:

• Add to Known Vulnerabilities table if affected
• Update CVE Watch List with last check date
• Log in Audit History

System Package Audit (Arch Linux)

Using arch-audit

# Install if not present
sudo pacman -S arch-audit

# Check for vulnerable packages
arch-audit

# Show only critical/high
arch-audit --upgradable

# JSON output for parsing
arch-audit --format json

Manual Package Check

# List all installed packages with versions
pacman -Q

# Check for orphaned packages (potential attack surface)
pacman -Qdt

# Check for packages not in official repos
pacman -Qm

# Check for outdated packages
checkupdates

Evaluate Findings

Docker Image Scanning

Using Trivy (Recommended)

# Install trivy
sudo pacman -S trivy  # Arch
# or
docker run --rm aquasec/trivy image <image-name>

# Scan a specific image
trivy image <image-name>:<tag>

# Scan with severity filter
trivy image --severity CRITICAL,HIGH <image-name>:<tag>

# Scan all running container images
docker ps --format '{{.Image}}' | sort -u | while read img; do
    echo "=== Scanning: $img ==="
    trivy image --severity CRITICAL,HIGH "$img"
done

# JSON output
trivy image --format json --output scan-results.json <image-name>

Using Grype (Alternative)

# Install grype
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

# Scan an image
grype <image-name>:<tag>

# Only critical and high
grype <image-name>:<tag> --only-fixed --fail-on critical

Evaluate Image Findings

For each vulnerable image:

1. Check if the vulnerability is in a dependency we actually use
2. Check if a fixed version of the base image exists
3. If fixable: update the image and redeploy
4. If not fixable: assess risk and document as accepted risk

Scan Report Format

When delivering vulnerability scan results:

# Vulnerability Scan Report

**Date:** YYYY-MM-DD
**Scope:** [What was scanned]
**Scanner:** [web search / arch-audit / trivy / grype]

## Summary

| Severity | Count |
|---|---|
| Critical | X |
| High | X |
| Medium | X |
| Low | X |

## Critical Findings

### CVE-YYYY-XXXXX: [Brief Description]

- **Severity:** Critical (CVSS 9.8)
- **Affected:** [software] [version]
- **Our version:** [version]
- **Status:** Vulnerable / Not affected / Patched
- **Fix:** Upgrade to [version]
- **Reference:** [NVD link]

## Recommendations

1. [Prioritized list of actions]

## Next Scan

Scheduled: [date or trigger condition]

CVE Watch List Management

Maintain the watch list in MEMORY.md:

1. Add new software when it's deployed to the infrastructure
2. Update versions when software is upgraded
3. Record check dates after each CVE lookup
4. Remove software when it's decommissioned

Recommended Check Frequency

Zero skill — Vulnerability scanning and CVE monitoring