Dependency on Vulnerable Third-Party Component (CWE-1395)

Dependency on Vulnerable Third-Party Component

The product uses a third-party component that contains one or more known vulnerabilities.

Using vulnerable dependencies exposes the application to known exploits. Container images and application dependencies should be regularly scanned and updated.

Prevalência

Alta

Frequentemente explorada

Impacto

Médio

Revisão recomendada

Prevenção

Documentada

3 exemplos de correção

2 Prevenção

Como corrigir esta vulnerabilidade

Estratégias de prevenção para Dependency on Vulnerable Third-Party baseadas em 3 regras de detecção do Shoulder.

🐳 Docker Ver tudo Docker detalhes →

Docker apt-get Missing Cache Cleanup LOW

Clean apt cache in the same RUN layer to reduce image size

+3 -1 dockerfile

  FROM ubuntu:22.04
- RUN apt-get update && apt-get install -y --no-install-recommends curl
+ RUN apt-get update && \
+     apt-get install -y --no-install-recommends curl && \
+     rm -rf /var/lib/apt/lists/*

Docker apt-get Missing --no-install-recommends LOW

Add --no-install-recommends to apt-get install to minimize image size

+1 -1 dockerfile

  FROM ubuntu:22.04
- RUN apt-get update && apt-get install -y curl
+ RUN apt-get update && apt-get install -y --no-install-recommends curl

Docker apt-get Missing -y Flag LOW

Add -y flag to apt-get install for non-interactive Docker builds

+1 -1 dockerfile

  FROM ubuntu:22.04
- RUN apt-get update && apt-get install curl
+ RUN apt-get update && apt-get install -y curl

3 Detecção

Encontre vulnerabilidades no seu código

Use o Shoulder para escanear seu código em busca de padrões Dependency on Vulnerable Third-Party Component. 3 regras.

terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=1395

# Or scan entire project
npx @shoulderdev/cli trust .

Regras de Detecção (3)

🐳 Dockerfile 3 rules

Docker apt-get Missing Cache Cleanup LOW

Detects apt-get commands without cache cleanup in the same RUN layer.

Docker apt-get Missing --no-install-recommends LOW

Detects apt-get install commands without --no-install-recommends flag.

Docker apt-get Missing -y Flag LOW

Detects apt-get install commands without the -y flag for non-interactive builds.

4 Sinais de Alerta

O que observar nas revisões de código

Estes padrões indicam vulnerabilidades potenciais de Dependency on Vulnerable Third-Party Component. Procure-os durante revisões de código e auditorias de segurança.

🔵

apt-get without cache cleanup increases image size docker-apt-missing-cache-cleanup

🔵

apt-get commands without cache cleanup in the same RUN layer docker-apt-missing-cache-cleanup

🔵

apt-get without --no-install-recommends increases image size docker-apt-missing-no-install-recommends

🔵

apt-get install commands without --no-install-recommends flag docker-apt-missing-no-install-recommends

🔵

apt-get install without -y flag may hang waiting for input docker-apt-missing-y-flag

🔍

Escaneie seu código para Dependency on Vulnerable Third-Party Component

O Shoulder CLI encontra padrões vulneráveis em todo o seu código.

npx shoulder trust Ver todas as regras