Anchore Enterprise Release Notes - Version 3.3.0
Anchore Enterprise 3.3.0
This release offers Rocky Linux support and various UI updates.
Version 3.3.0 also includes other improvements and fixes.
Rocky Linux support
Anchore Enterprise can now scan Rocky Linux images for vulnerabilities.
Configure maximum number of parallel workers
Asynchronous parts of the image deletion workflow in the backend can now be parallelized. You may now configure the maximum number of parallel workers in the catalog configuration.
Fixes
- Images that had Go content and hints enabled were failing analysis. This has been fixed.
- Images reported via runtime inventory that also had port numbers in the registry host URL were failing to parse properly, which caused scan failures. This issue has been fixed.
- NuGet packages were not matched to vulnerabilities correctly. This is now fixed.
- With the Grype provider, NVD and vendor CVSS scores were missing for records in non-NVD namespaces. This is now fixed.
- Migration code was added to clean-up the unused feed records, and fixed artifacts and vulnerabilities records for the github:os group.
Known Issue
NVD CVSS scores may not be present in the API responses for the request to get a detailed information query about a vulnerability feed record.
- There is a workaround to get this information. See the Workaround section below for more details on the workaround.
- This is only present for a subset of records NVD records.
- It does not impact the vulnerability reports or findings for images. It only impacts the next-gen vulnerability scanner, so users still on the legacy scanner are not impacted.
Details
The /query/vulnerabilities API response contains an nvd_data attribute for each vulnerability in the result. The value of the attribute represents the NVD assigned CVSS scores. This field is not correctly populating for a small subset of vulnerabilities in the system. Instead of a list of results, the value is a null reference as shown below.
Note: This known issue only affects vulnerabilities that exclusively belong in the nvd namespace with Grype as the vulnerabilities provider (next-gen v2 scanner). It does not affect the legacy vulnerability provider.
% curl -u user:password "http://localhost:8228/v1/query/vulnerabilities?id=CVE-2019-15780"
{
"page": "1",
"returned_count": 1,
"total_count": 1,
"vulnerabilities": [
{
"affected_packages": [
{
"name": "formidable_form_builder",
"type": "unknown",
"version": "< 4.02.01",
"will_not_fix": false
}
],
"description": "The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.",
"id": "CVE-2019-15780",
"link": "https://nvd.nist.gov/vuln/detail/CVE-2019-15780",
"namespace": "nvd",
"nvd_data": null,
"references": [
{
"source": "N/A",
"url": "https://wordpress.org/plugins/formidable/#developers"
},
{
"source": "N/A",
"url": "https://raw.githubusercontent.com/Strategy11/formidable-forms/master/changelog.txt"
},
{
"source": "N/A",
"url": "https://pentest.co.uk/labs/advisory/cve-2019-15780/"
},
{
"source": "N/A",
"url": "https://wpvulndb.com/vulnerabilities/9935"
}
],
"severity": "Critical",
"vendor_data": []
}
]
}
Workaround
The API supports a namespace query parameter to filter results based on the namespace. Supply the namespace with an nvd value to view the NVD CVSS scores, as shown in the following example.
% curl -u user:password "http://localhost:8228/v1/query/vulnerabilities?id=CVE-2019-15780&namespace=nvd"
{
"page": "1",
"returned_count": 1,
"total_count": 1,
"vulnerabilities": [
{
"affected_packages": [
{
"name": "formidable_form_builder",
"type": "unknown",
"version": "< 4.02.01",
"will_not_fix": false
}
],
"description": "The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.",
"id": "CVE-2019-15780",
"link": "https://nvd.nist.gov/vuln/detail/CVE-2019-15780",
"namespace": "nvd",
"nvd_data": [
{
"cvss_v2": {
"base_metrics": {
"base_score": 7.5,
"expolitability_score": 10,
"impact_score": 6.4
},
"severity": "High",
"vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": null,
"id": "CVE-2019-15780"
},
{
"cvss_v2": null,
"cvss_v3": {
"base_metrics": {
"base_score": 9.8,
"expolitability_score": 3.9,
"impact_score": 5.9
},
"severity": "Critical",
"vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"id": "CVE-2019-15780"
}
],
"references": [
{
"source": "N/A",
"url": "https://wordpress.org/plugins/formidable/#developers"
},
{
"source": "N/A",
"url": "https://raw.githubusercontent.com/Strategy11/formidable-forms/master/changelog.txt"
},
{
"source": "N/A",
"url": "https://pentest.co.uk/labs/advisory/cve-2019-15780/"
},
{
"source": "N/A",
"url": "https://wpvulndb.com/vulnerabilities/9935"
}
],
"severity": "Critical",
"vendor_data": []
}
]
}
Enterprise UI Changes
- Multi-image selection and deletion now possible for RepositoryView.
- The login page banner can now be edited. You can now edit the banner on the login page to provide customized information, such as how to log in, whether to use SSO or email addresses, and support contact information.
- Failed images can now be removed from a repository.
- The context of the policy bundle test results view is now preserved as a user changes to different tabs.
Fixes
- JSON and CSV downloads from the Policy Compliance tab now include the policy bundle name and data.
- Compliance tables now correctly filter based on column data.
Upgrading
Upgrading to Anchore Enterprise 3.3.0 involves a database upgrade that the system will handle itself. It may cause the upgrade to take several minutes.
AnchoreCTL
The latest version of AnchoreCTL is 0.1.3. AnchoreCTL is dependent on Syft v0.20.0 as a library.
The current features that are supported are as follows:
- Compliance Reports: View and operate on runtime compliance reports, such as STIGs, created by the
remtool. - Corrections Management: View and modify corrections information to help reduce false positives in your vulnerability results.
- Image Management: View, list, import local analysis, and request image analysis by the system.
- Runtime Inventory Management: Add, update, and view cluster configurations for Anchore to scan, as well as for the inventory reports themselves.
- System Operations: View and manage system information for your Enterprise deployment.