grype v0.13 releases: vulnerability scanner for container images and filesystems
A vulnerability scanner for container images and filesystems. Easily install the binary to try it out.
- Scan the contents of a container image or filesystem to find known vulnerabilities.
- Find vulnerabilities for major operating system packages
- CentOS / Red Hat
- Find vulnerabilities for language-specific packages
- Ruby (Bundler)
- Java (JARs, etc)
- Python (Egg/Wheel)
- Python pip/requirements.txt/setup.py listings
- Supports Docker and OCI image formats
- Exclusion option for files and folders #183
- Add NVD CVSS scores to grype json output for matches on the vendor record #314
- Add Vendor metadata for vulnerability fixes #276
- Replace links to Slack channels with public signup link #325 (luhring)
- There should always be links associated with a vulnerability #189
- Add vendor-provided CVSS scores to vulnerability match records where available #287
To scan for vulnerabilities in an image:
The above command scans for vulnerabilities that are visible in the container (i.e., the squashed representation of the image). To include software from all image layers in the vulnerability scan, regardless of its presence in the final image, provide –scope all-layers:
grype <image> --scope all-layers
Grype can scan a variety of sources beyond those found in Docker.
The output format for Grype is configurable as well:
grype <image> -o <format>
Where the formats available are:
- json: Use this to get as much information out of Grype as possible!
- cyclonedx: An XML report conforming to the CycloneDX 1.2 specification.
- table: A columnar summary (default).
Grype pulls a database of vulnerabilities derived from the publicly available Anchore Feed Service. This database is updated at the beginning of each scan, but an update can also be triggered manually.
grype db update
Copyright (C) 2020 anchore