Dependency on Vulnerable Third-Party Component (CWE-1395)

Dependency on Vulnerable Third-Party Component

The product uses a third-party component that contains one or more known vulnerabilities.

Using vulnerable dependencies exposes the application to known exploits. Container images and application dependencies should be regularly scanned and updated.

Prevalencia

Alta

Frecuentemente explotada

Impacto

Medio

Se recomienda revisión

Prevención

Documentada

3 ejemplos de corrección

2 Prevención

Cómo corregir esta vulnerabilidad

Estrategias de prevención para Dependency on Vulnerable Third-Party basadas en 3 reglas de detección de Shoulder.

🐳 Docker Ver todo Docker detalles →

Docker apt-get Missing Cache Cleanup LOW

Clean apt cache in the same RUN layer to reduce image size

+3 -1 dockerfile

  FROM ubuntu:22.04
- RUN apt-get update && apt-get install -y --no-install-recommends curl
+ RUN apt-get update && \
+     apt-get install -y --no-install-recommends curl && \
+     rm -rf /var/lib/apt/lists/*

Docker apt-get Missing --no-install-recommends LOW

Add --no-install-recommends to apt-get install to minimize image size

+1 -1 dockerfile

  FROM ubuntu:22.04
- RUN apt-get update && apt-get install -y curl
+ RUN apt-get update && apt-get install -y --no-install-recommends curl

Docker apt-get Missing -y Flag LOW

Add -y flag to apt-get install for non-interactive Docker builds

+1 -1 dockerfile

  FROM ubuntu:22.04
- RUN apt-get update && apt-get install curl
+ RUN apt-get update && apt-get install -y curl

3 Detección

Encuentra vulnerabilidades en tu código

Usa Shoulder para escanear tu código en busca de patrones Dependency on Vulnerable Third-Party Component. 3 reglas.

terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=1395

# Or scan entire project
npx @shoulderdev/cli trust .

Reglas de Detección (3)

🐳 Dockerfile 3 rules

Docker apt-get Missing Cache Cleanup LOW

Detects apt-get commands without cache cleanup in the same RUN layer.

Docker apt-get Missing --no-install-recommends LOW

Detects apt-get install commands without --no-install-recommends flag.

Docker apt-get Missing -y Flag LOW

Detects apt-get install commands without the -y flag for non-interactive builds.

4 Señales de Alerta

Qué buscar en las revisiones de código

Estos patrones indican vulnerabilidades potenciales de Dependency on Vulnerable Third-Party Component. Búscalos durante las revisiones de código y auditorías de seguridad.

🔵

apt-get without cache cleanup increases image size docker-apt-missing-cache-cleanup

🔵

apt-get commands without cache cleanup in the same RUN layer docker-apt-missing-cache-cleanup

🔵

apt-get without --no-install-recommends increases image size docker-apt-missing-no-install-recommends

🔵

apt-get install commands without --no-install-recommends flag docker-apt-missing-no-install-recommends

🔵

apt-get install without -y flag may hang waiting for input docker-apt-missing-y-flag

🔍

Escanea tu base de código para Dependency on Vulnerable Third-Party Component

Shoulder CLI encuentra patrones vulnerables en toda tu base de código.

npx shoulder trust Ver todas las reglas