Docker containers are filled with vulnerabilities: Here's how the top 1,000 fared

guest · Jun 26, 2019

Docker containers are filled with vulnerabilities: Here's how the top 1,000 fared
An analysis of the 1,000 most popular Docker containers uncovered a variety of security vulnerabilities, some of which are critical
June 26, 2019
https://www.techrepublic.com/articl...vulnerabilities-heres-how-the-top-1000-fared/

Following the publication of CVE-2019-5021—an issue relating to the use of a blank (null) password for root accounts in Alpine Linux Docker images—security researchers have turned their attention toward Docker in earnest, uncovering similar issues of unprotected root accounts in other containers.

Jerry Gamblin, principal security engineer at Kenna Security, created VulnerableContainers.org to evaluate the security of the 1,000 most popular containers based on downloads, and scans them for vulnerabilities.

Gamblin notes in a blog post that "Over 60 percent of the top Docker files held a vulnerability that had a Kenna Risk Score above 330; and over 20 percent of the files contained at least one vulnerability that would be considered high risk under Kenna's scoring model," adding that the average (mean) number of CVEs per container is 176, with the median at 37.
Click to expand...

Kenna Security: One-fifth of the most-used Docker containers have at least one critical vulnerability

guest · Oct 25, 2020

Snyk to automatically check Docker Official Images for security problems
Synk and Docker are making sure those images are safe for use
October 22, 2020
https://www.zdnet.com/article/snyk-...docker-official-images-for-security-problems/

I love containers. You love containers. We all love containers. But our love for them blinds to us to the fact that we often don't really know what's running within them. In 2019, Snyk, an open-source security company, found that the "top 10 most popular Docker images each contain at least 30 vulnerabilities."

But far more common are insecure applications within containers.
Now, Snyk and Docker are partnering up to find and eliminate security problems in the Docker Official Images.
Click to expand...

Snyk adds security insight to Official Images. This makes vulnerability risk assessment part of the Official and Certified Images selection process. In short, you can now be reasonably sure that, when you download a containerized program from the Official Images collection, you're getting software that's free of any known security holes.
Snyk scanning is also integrated into the Docker Desktop and Docker Hub. With this, you can incorporate vulnerability assessment along each step of your own container development and deployment process.
Click to expand...

Log in or Sign up

Docker containers are filled with vulnerabilities: Here's how the top 1,000 fared

guest Guest

guest Guest

Log in or Sign up

Docker containers are filled with vulnerabilities: Here's how the top 1,000 fared

guest Guest

guest Guest

Useful Searches