vimp

Compare data from multiple vulnerability scanners to get a more complete picture of potential exposures.

vimp CLI currently supports output from common open source vulnerability scanners like grype, snyk, and trivy. The CLI also comes with an embedded data store (sqlite) and support for other databases, like BigQuery. Alternatively, vimp can also output to local file (JSON or CVS) or stdout.

Usage

Start by using a container image, tor example, the official Redis image in Docker Hub:

export image="docker.io/redis"

Note, image can have a tag or or digest or both (yes, it looks weird but it's a valid URI). Either way, the image URI will be resolved to its digest during import.

vimp currently recognizes the output from the following OSS scanners/formats:

• grype --add-cpes-if-none -s AllLayers -o json --file report.json $image
• snyk container test --app-vulns --json-file-output=report.json $image
• trivy image --format json --output report.json $image

You can either import the resulting reports from any of the above commands into the local data store:

vimp import --source $image --file report.json

Or, omit the --file flag all together and vimp will automatically scan and import the provided image with any of the installed scanners:

vimp import --source $image

By default, vimp will store the imported data in Sqlite DB (.vimp.db) in your home directory. You can use the --target flag to save it to another location (e.g. sqlite://data/vimp.db) or another data store (e.g. postgres://localhost:5432/vulns). Find all the scanner and target data store options using vimp import -h.

The output for the above command should look something like this:

vimp import --source docker.io/redis@sha256:7b83a0167532d4320a87246a815a134e19e31504d85e8e55f0bb5bb9edf70448
INF v0.6.0
INF scanning image docker.io/redis@sha256:7b83a0167532d4320a87246a815a134e19e31504d85e8e55f0bb5bb9edf70448
INF grype scan completed: grype-110213000.json
INF found 83 unique vulnerabilities
INF snyk scan completed: snyk-255733000.json
INF found 78 unique vulnerabilities
INF trivy scan completed: trivy-658830000.json
INF found 79 unique vulnerabilities
INF importing: digest=sha256:7b83a0167532d4320a87246a815a134e19e31504d85e8e55f0bb5bb9edf70448 image=docker.io/redis target=sqlite://.vimp.db

Once you data is imported, you can then run queries against that data. The default query against the same data will provide summary of all the data in your store:

vimp query

Note, by default, vimp will query (.vimp.db) in your home directory. You can target different database using the --target flag (e.g. sqlite://data/vimp.db).

After importing data for one image from three sources the response will look something like this:

INF found 1 records
{
  "docker.io/redis": {
    "versions": {
      "sha256:7b83a0167532d4320a87246a815a134e19e31504d85e8e55f0bb5bb9edf70448": {
        "exposures": 240,
        "sources": 3,
        "packages": 73,
        "high_score": 10,
        "first_discovered": "2023-04-05T19:29:16Z",
        "last_discovered": "2023-04-05T19:41:11Z"
      }
    }
  }
}

To dig deeper into the data for that image, you can list all the vulnerabilities found that image across all of the sources:

vimp query --image docker.io/redis \
           --digest sha256:7b83a0167532d4320a87246a815a134e19e31504d85e8e55f0bb5bb9edf70448

The results for that query should look something like this:

Notice the differences in severity and score reported by the different scanners:

{
  "image": "docker.io/redis",
  "digest": "sha256:7b83a0167532d4320a87246a815a134e19e31504d85e8e55f0bb5bb9edf70448",
  "exposures": {
    "CVE-2013-4392": [
      {
        "source": "grype",
        "severity": "low",
        "score": 3.3,
        "last_discovered": "2023-04-08T12:30:45Z"
      },
      {
        "source": "snyk",
        "severity": "medium",
        "score": 4.4,
        "last_discovered": "2023-04-08T12:30:45Z"
      },
      {
        "source": "trivy",
        "severity": "low",
        "last_discovered": "2023-04-08T12:30:45Z"
      }
    ],
    ...
  }
}

There will be a lot of commonalities in the data returned by each one of the scanners. You can append the --diff flag to return only the data where the severity and scores are not the same across all of the sources.

Additionally, to drill into the packages impacted by each vulnerability, you can use the additional --exposure flag:

vimp query --image docker.io/redis \
           --digest sha256:7b83a0167532d4320a87246a815a134e19e31504d85e8e55f0bb5bb9edf70448 \
           --exposure CVE-2013-4392

The results should look something like this:

{
  "image": "docker.io/redis",
  "digest": "sha256:7b83a0167532d4320a87246a815a134e19e31504d85e8e55f0bb5bb9edf70448",
  "exposure": "CVE-2013-4392",
  "packages": [
    {
      "source": "grype",
      "package": "libsystemd0",
      "version": "247.3-7+deb11u1",
      "severity": "low",
      "score": 3.3,
      "last_discovered": "2023-04-08T12:30:45Z"
    },
    {
      "source": "grype",
      "package": "libudev1",
      "version": "247.3-7+deb11u1",
      "severity": "low",
      "score": 3.3,
      "last_discovered": "2023-04-08T12:30:45Z"
    },
    {
      "source": "snyk",
      "package": "systemd/libsystemd0",
      "version": "247.3-7+deb11u1",
      "severity": "medium",
      "score": 4.4,
      "last_discovered": "2023-04-08T12:30:45Z"
    },
    ...
  ]
}

Data Store

The schema created by vimp in the target DB will look something like this (adjusted for DB-specific data types):

image       TEXT      NOT NULL
digest      TEXT      NOT NULL
source      TEXT      NOT NULL
processed   TIMESTAMP NOT NULL
cve         TEXT      NOT NULL
package     TEXT      NOT NULL
version     TEXT      NOT NULL
severity    TEXT      NOT NULL
score       FLOAT     NOT NULL
fixed       BOOL      NOT NULL

See examples/query.sql for examples of queries against the imported data.

See https://github.com/mchmarny/artifact-events for how to set up vimp as an import for all new images in GCR or AR on GCP.

Installation

You can install vimp CLI using one of the following ways:

• Go
• Homebrew
• RHEL/CentOS
• Debian/Ubuntu
• Binary

See the release section for vimp checksums and SBOMs.

Go

If you have Go 1.17 or newer, you can install latest vimp using:

go install github.com/mchmarny/vimp@latest

Homebrew

On Mac or Linux, you can install vimp with Homebrew:

brew tap mchmarny/vimp
brew install vimp

New release will be automatically picked up when you run brew upgrade

RHEL/CentOS

rpm -ivh https://github.com/mchmarny/vimp/releases/download/v$VERSION/vimp-$VERSION_Linux-amd64.rpm

Debian/Ubuntu

wget https://github.com/aquasecurity/vimp/releases/download/v$VERSION/vimp-$VERSION_Linux-amd64.deb
sudo dpkg -i vimp-$VERSION_Linux-64bit.deb

Binary

You can also download the latest release version of vimp for your operating system/architecture from here. Put the binary somewhere in your $PATH, and make sure it has that executable bit.

The official vimp releases include SBOMs

Disclaimer

This is my personal project and it does not represent my employer. While I do my best to ensure that everything works, I take no responsibility for issues caused by this code.