DefectDojo - Scanning with Trivy

[Noonster77]

I have scanned the 4 running containers, and they have hundreds of vulnerability findings. How can I get these containers so they scan clean? I am not trying to fix every single one of these. Thanks!!

[manuel-sommer]

I guess there is a lot of information missing:

• Which 4 running containers with which version did you exactly scan?
• Which Trivy scan config did you use to scan the 4 running containers?
• Did you change any config or did you follow best practices to run in production before you scanned the targeted 4 containers?
• If your expected answer is to ask about how to deploy DefectDojo securely in production, did you check the documentation? Furthermore, I would suggest you ask in the OWASP slack channel or contact the official support.

[valentijnscholten]

Every monthly release the container base images and python libraries are updated which should solve the largest part of vulnerabilities. That's about as much as we can do. As described in https://docs.defectdojo.com/en/open_source/installation/running-in-production/ the containers provided are a good starting point, but some work is needed to run them in production. If you have strict security compliance requirements you may to have to build your own images. In my experience a very large percentage of the vulnerabilities found are not exploitable. We do act on vulnerabilities reported by Dependabot: https://github.com/DefectDojo/django-DefectDojo/security/dependabot (not sure if this is visible to the public)

[kiblik]

All images are released with debian and alpine versions. Alpines have usually less vulnerabilities. debian is default. It might make sense to use alpine. E.g. 2.44.2-alpine

[Noonster77]

I tried scanning with dockle and only got a few minor findings. I scanned the django:latest (debian) with Trivy and got tons of findings. But Alot are all duplicates or at least for the same. Should I try to fix these or are they not a major concern?

trivy_report.json Thanks!!
Do I need to turn on deduplicate findings? Thanks for the help.

[valentijnscholten]

As stated before every month our base image and libraries are updated. If you want to update faster than that you need to build your own images. In my experience base images always contain some vulnerabilities, some of them are unfixable.