Google Cloud Artifact Vulnerability Scans

[BoBeR182]

Google Artifact Security Scan
Google Cloud has a Artifact Registry that you can enable security scans https://cloud.google.com/artifact-registry/docs/analysis
Once a scan is completed, results can be pulled via API/gcloud https://cloud.google.com/artifact-analysis/docs/metadata-storage and exported to json
gcloud artifacts docker images describe northamerica-northeast1-docker.pkg.dev/test-cloud/testing/testing-image@sha256:decode00000000000000000000000000000000000000000000000deadbeef --show-package-vulnerability --format=json

Sample File
Please attach a sample file and the format of the file (xml, json, csv).
vulns.json.txt
Had to rename ending to .txt but its a json file.

Minor censorship was done on the file, format should be the same but repo/project/image names are faked.

[manuel-sommer]

This issue can be closed @mtesauro

[manuel-sommer]

see here @anthonwellsjo

[anthonwellsjo]

see here @anthonwellsjo

Thank you @manuel-sommer.

I noticed however that in the output the fixAvailable property is optional, and breaks the parser when missing (see here).

Let me know if this is a bug and something I can help you out with.

[manuel-sommer]

Ah, good to know. I can submit a PR. Do you have a sample file?

[anthonwellsjo]

I encountered the same issue now when cvssScore is missing in the output.

Ah, good to know. I can submit a PR. Do you have a sample file?

I'll soon provide a sample file so that you can test it.

[anthonwellsjo]

Here is a censored output sample that should catch both cases. Let me know if you need anything more.

artifact-analysis-occurrences-sample.json

[manuel-sommer]

I am already working on a fix. Could you give me your opinion about "effectiveSeverity": "MINIMAL" from your samplefile? What severity should I use in those examples?

[anthonwellsjo]

I am already working on a fix. Could you give me your opinion about "effectiveSeverity": "MINIMAL" from your samplefile? What severity should I use in those examples?

I would probably suggest mapping "effectiveSeverity": "MINIMAL" to Low and "effectiveSeverity": undefined to Info.