When scanning an image you probably want to scan for both operating system vulnerabilities and vulnerabilities in the application dependencies (like npm, pom.xml, package.json etc), in order to get a full picture of the security issues within your images.
Until now, when using the Snyk Container test/monitor commands to scan images you had to specify the --app-vulns
flag in order to scan for application vulnerabilities.
We are excited to share that now, when using the snyk container test/monitor
commands, we will scan for application vulnerabilities by default. This change will go live on Sep 13, 2022, so be sure to update your Snyk CLI to take advantage of the new capability.
In order to support this update, we now also include application vulnerabilities when using the --json
flag. We’ve added a new applications
key to the JSON output that includes an array of all application scan results. The new JSON format will look like the following:
{
"vulnerabilities": [],
"ok": true,
"dependencyCount": 13,
...
"packageManager": "apk",
"summary": "No known operating system vulnerabilities",
"uniqueCount": 0,
"projectName": "docker-image|snykgoof/os-app",
"platform": "linux/amd64",
"path": "snykgoof/os-app:node-snykin/os-app",
"applications": [
{
"vulnerabilities": [
{
A bunch of vulns
},
...
],
"ok": false,
"dependencyCount": 116,
"packageManager": "yarn",
"summary": "14 vulnerable dependency paths",
"uniqueCount": 9,
"targetFile": "/app2/package.json",
"projectName": "snykin",
"displayTargetFile": "/app2/package.json",
"path": "snykgoof/os-app:node-snykin"
}
]
The new JSON output is available in CLI version 1.962.0.
Using the Snyk CLI in your CI/CD pipeline
Adding security scanning to your continuous integration and continuous delivery pipeline is a common way to scan your images and secure your containers. And, since integrating with a CI/CD pipeline ultimately uses the Snyk CLI, it’s important to know about every change made in the results.
How will this change impact my build?
If you have integrated Snyk Container testing into your existing CI/CD workflow, you should know that this update may cause your scan to detect more vulnerabilities — since application vulnerabilities will now be included.
If you were already using the --app-vulns
flag, you won’t notice any changes in behavior or results of your scans. However, if you aren’t currently specifying the --app-vulns
flag in your snyk container test
command, your scan behavior may be different and you’ll potentially see more vulnerabilities. If you wish to maintain the previous behavior, you can “opt out” of the application vulnerability scanning by specifying the --exclude-app-vulns
flag — which will omit the application vulnerabilities section from the results, mimicking the previous behavior.
We suggest downloading the newest CLI version, and testing the updates with your current configuration as soon as possible.