30.03.122 Scan Results

OpenSCAP and vulnerability scan report:

• Prisma Cloud Compute release: 30.03 (30.03.122)
• Base image: registry.access.redhat.com/ubi8/ubi-minimal:8.8
• Benchmark URL: scap-security-guide-0.1.68/ssg-rhel8-ds.xml
• Benchmark ID: xccdf_org.ssgproject.content_benchmark_RHEL-8
• Profile ID: xccdf_org.ssgproject.content_profile_stig
• Compared to IronBank’s UBI8-minimal, Version 8.8, Build Date: 2023-05-03T15:02:09

twistlock/private:console_30_03_122

Findings for Prisma Cloud Compute Console.

OpenSCAP report

You can find the OpenSCAP report here

Rule_ID	Compute finding	IronBank finding	Justification
xccdf_org.ssgproject.content_rule_accounts_authorized_local_users	Fail	Pass	Local accounts include: twistlock = non-root account for service, mongod = mongoDB database & saslauth = authentication libraries. Application is a non-interactive container. There is no interactive console session with the container.
xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_exists	Fail	Pass	Non-interactive / non-root user twistlock does not have a home directory (/home/twistlock).

Vulnerabilities full report

You can find the full vulnerabilities report here.

CVE	Package	Version	Fix Status	Justification
CVE-2022-1996	go-restful	2.9.5	Fixed in 3.8.0	The package is a transitive dependency that is being pulled with k8s.io/client-go and k8s.io/kube-openapi, and is not being used directly in the Compute Defender and Console.

twistlock/private:defender_30_03_122

Findings for Prisma Cloud Compute Defender.

OpenSCAP report

You can find the OpenSCAP report here.

Vulnerabilities full report

You can find the full vulnerabilities report here.

CVE	Package	Version	Fix Status	Justification
CVE-2022-1996	go-restful	2.9.5	Fixed in 3.8.0	The package is a transitive dependency that is being pulled with k8s.io/client-go and k8s.io/kube-openapi, and is not being used directly in the Compute Defender and Console.