"""Application configuration.""" import logging import os from dotenv import load_dotenv # Load env file if it exists load_dotenv(verbose=True) # Service information SERVICE_NAME = os.environ.get("SERVICE_NAME", "docker-image-ecr-scan") SERVICE_VERSION = "1.0.0" PROD_ACCOUNT_ID = "437795906767" AWS_REGION = os.environ.get("AWS_REGION", "us-east-1") # Logger Name LOGGER_NAME = os.environ.get("LOGGER_NAME", "docker-image-scanner") LOGGER_LEVEL = logging.INFO LOGGER_DSN = os.environ.get("LOGGER_DSN") or None # ANSI escape codes for colors RED = "\033[31m" YELLOW = "\033[33m" RESET = "\033[0m" ENVIRONMENT = os.environ.get("Environment", "dev") ENVIRONMENTS = ["dev", "qa", "prod"] if ENVIRONMENT not in ENVIRONMENTS: raise Exception("The environment used is not properly named.") # Optionally provide ECR metadata to get links to findings in Inspector console. ECR_REPOSITORY_NAME = os.environ.get("ECR_REPOSITORY_NAME") IMAGE_TAG = os.environ.get("IMAGE_TAG") # The path to the Docker image tarball to scan IMAGE_PATH = os.environ.get("IMAGE_PATH", "image.tar") # Optional path to write the findings table to. If not set, the findings table is only logged. FINDINGS_OUTPUT_FILE = os.environ.get("FINDINGS_OUTPUT_FILE") VULNERABILITY_SEVERITIES_TO_FAIL = [ "CRITICAL", "HIGH", ] # Allow override of failing severities if os.environ.get("VULNERABILITY_SEVERITIES_TO_FAIL"): VULNERABILITY_SEVERITIES_TO_FAIL = os.environ.get( "VULNERABILITY_SEVERITIES_TO_FAIL" ).split(",") FILE_PATHS_TO_IGNORE = [ # Ignore false positives produced from ECR scanning Gemfile.lock files in # the Ruby installation, which are not indicative of what gems are actually # installed. r"^/usr/local/lib/ruby/gems/.*/Gemfile.lock$", r"^/var/lang/lib/ruby/gems/.*/Gemfile.lock$", # Ignore false positives produced from scanning package-lock.json files # nested within node_modules. These belong to (dev) dependencies of indirect # dependencies (e.g. @apollo/protobufjs) and list packages that are not # actually installed in the image. The top-level package-lock.json, which is # indicative of what is actually installed, lives outside node_modules and is # still scanned. r"^.*/node_modules/.+/package-lock\.json$", ] # Allow individual vulnerabilities to be ignored. # This should be a list of vulnerability IDs VULNERABILITIES_TO_IGNORE = [ v for v in os.getenv("VULNERABILITIES_TO_IGNORE", "").split(",") if v != "" ] # Global exceptions based on the image's operating system EXCEPTIONS_BY_OS = { "Debian GNU/Linux": { "11": [], "12": [], "13": [ "CVE-2026-3805", # pkg:deb/debian/curl@8.14.1-2+deb13u3?arch=amd64&distro=trixie&epoch=0 "CVE-2025-13151", # pkg:deb/debian/libtasn1-6 ], }, "Amazon Linux": { "2": [], }, } # Global exceptions based on which parent image(s) the image is based on EXCEPTIONS_BY_PARENT_IMAGE = { "debian-php82": [ "CVE-2026-33164", # pkg:deb/debian/libde265 "CVE-2026-34980", # pkg:deb/debian/cups@2.4.2-3 ], "debian12-php84": [ "CVE-2026-33164", # pkg:deb/debian/libde265 "CVE-2026-34980", # pkg:deb/debian/cups@2.4.2-3 ], "debian12-rust1.94": [ "CVE-2026-33164", # pkg:deb/debian/libde265 ], "debian13-php82": [ "CVE-2026-33164", # pkg:deb/debian/libde265 "CVE-2026-34980", # pkg:deb/debian/cups@2.4.2-3 "CVE-2026-20884", # pkg:deb/debian/libraw@0.21.4-2 - no fix available "CVE-2026-20889", # pkg:deb/debian/libraw@0.21.4-2 - no fix available "CVE-2026-21413", # pkg:deb/debian/libraw@0.21.4-2 - no fix available "CVE-2026-24450", # pkg:deb/debian/libraw@0.21.4-2 - no fix available "CVE-2026-24660", # pkg:deb/debian/libraw@0.21.4-2 - no fix available ], "debian13-php84": [ "CVE-2026-33164", # pkg:deb/debian/libde265 "CVE-2026-34980", # pkg:deb/debian/cups@2.4.2-3 "CVE-2026-20884", # pkg:deb/debian/libraw@0.21.4-2 - no fix available "CVE-2026-20889", # pkg:deb/debian/libraw@0.21.4-2 - no fix available "CVE-2026-21413", # pkg:deb/debian/libraw@0.21.4-2 - no fix available "CVE-2026-24450", # pkg:deb/debian/libraw@0.21.4-2 - no fix available "CVE-2026-24660", # pkg:deb/debian/libraw@0.21.4-2 - no fix available ], "kafka-connect77": [ "CVE-2014-0114", "CVE-2019-10086", "CVE-2019-17571", "CVE-2020-11979", "CVE-2021-4104", "CVE-2022-23302", "CVE-2022-23305", "CVE-2022-23307", "CVE-2022-45868", "CVE-2023-26464", "CVE-2023-6378", "CVE-2024-12798", # requires upstream fix "CVE-2024-29857", "CVE-2025-48734", "CVE-2025-12183", "CVE-2024-12801", "CVE-2025-66566", "CVE-2025-66418", "CVE-2025-66471", "CVE-2024-29371", # pkg:maven/org.bitbucket.b_c/jose4j@0.9.5 "CVE-2026-21441", # pkg:pypi/urllib3@1.26.20 "CVE-2026-24400", # pkg:maven/org.assertj/assertj-core - no fix available "CVE-2026-24281", # pkg:maven/org.apache.zookeeper/zookeeper - vulnerability in upstream "CVE-2026-24308", # pkg:maven/org.apache.zookeeper/zookeeper - vulnerability in upstream "CVE-2024-34447", # pkg:maven/org.bouncycastle/bcprov-jdk15on@1.70 - vulnerability in upstream "CVE-2026-34478", # pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3? - vulnerability in upstream "CVE-2026-34480", # pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1 - vulnerability in upstream "CVE-2026-34479", # pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.24.3? - vulnerability in upstream "CVE-2026-44431", # pkg:pypi/urllib3@2.5.0 - vulnerability in upstream "CVE-2025-11226", # pkg:maven/ch.qos.logback/logback-core@1.3.14?scope=test - vulnerability in upstream "CVE-2026-54512", # pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0 - base bump insufficient "CVE-2026-54513", # pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0 - base bump insufficient "CVE-2026-8643", # pkg:pypi/pip@26.0.1 - no pip release >=26.1 supports the bundled Python 3.9.20 # fix published for aarch64 but not x86_64 yet; dnf upgrade already runs, revisit once repo catches up "CVE-2025-13151", # pkg:rpm/libtasn1@4.13-5.el8_10, fix 4.13-6.el8_10 not in x86_64 UBI8 repo yet "CVE-2026-48864", # pkg:rpm/libsolv@0.7.20-6.el8, fix 0.7.20-7.el8_10 not in x86_64 UBI8 repo yet ], "kafka-connect79": [ "CVE-2019-17571", # pkg:maven/log4j/log4j@1.2.17 "CVE-2022-23305", # pkg:maven/log4j/log4j@1.2.17 "CVE-2022-23307", # pkg:maven/log4j/log4j@1.2.17 "CVE-2025-12183", # pkg:maven/org.lz4/lz4-java@1.8.0 "CVE-2014-0114", # pkg:maven/commons-beanutils/commons-beanutils@1.8.3 "CVE-2019-10086", # pkg:maven/commons-beanutils/commons-beanutils@1.8.3 "CVE-2020-11979", # pkg:maven/org.apache.ant/ant@1.8.4 "CVE-2021-4104", # pkg:maven/log4j/log4j@1.2.17 "CVE-2022-23302", # pkg:maven/log4j/log4j@1.2.17 "CVE-2022-45868", # pkg:maven/com.h2database/h2@2.1.214 "CVE-2023-26464", # pkg:maven/log4j/log4j@1.2.17 "CVE-2023-6378", # pkg:maven/ch.qos.logback/logback-classic@1.2.11 "CVE-2024-12798", # pkg:maven/ch.qos.logback/logback-core@1.3.14 "CVE-2024-12801", # pkg:maven/ch.qos.logback/logback-core@1.3.14 "CVE-2024-29371", # pkg:maven/org.bitbucket.b_c/jose4j@0.9.5 "CVE-2024-29857", # pkg:maven/org.bouncycastle/bcprov-jdk15on@1.70 "CVE-2025-48734", # pkg:maven/commons-beanutils/commons-beanutils@1.8.3 "CVE-2026-24400", # pkg:maven/org.assertj/assertj-core@2.2.0 "CVE-2025-66566", # pkg:maven/org.lz4/lz4-java@1.8.0 "CVE-2026-24281", # pkg:maven/org.apache.zookeeper/zookeeper - vulnerability in upstream "CVE-2026-24308", # pkg:maven/org.apache.zookeeper/zookeeper - vulnerability in upstream "CVE-2024-34447", # pkg:maven/org.bouncycastle/bcprov-jdk15on@1.70 - vulnerability in upstream "CVE-2026-34478", # pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3? - vulnerability in upstream "CVE-2026-34480", # pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1 - vulnerability in upstream "CVE-2026-34479", # pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.24.3? - vulnerability in upstream "CVE-2026-44431", # kg:pypi/urllib3@2.6.3 - vulnerability in upstream "CVE-2026-44432", # kg:pypi/urllib3@2.6.3 - vulnerability in upstream "CVE-2025-11226", # pkg:maven/ch.qos.logback/logback-core@1.3.14?scope=test - vulnerability in upstream "CVE-2026-54512", # pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0 - base bump insufficient "CVE-2026-54513", # pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0 - base bump insufficient "CVE-2026-8643", # pkg:pypi/pip@26.0.1 - no pip release >=26.1 supports the bundled Python 3.9.20 # fix published for aarch64 but not x86_64 yet; dnf upgrade already runs, revisit once repo catches up "CVE-2025-13151", # pkg:rpm/libtasn1@4.13-5.el8_10, fix 4.13-6.el8_10 not in x86_64 UBI8 repo yet "CVE-2026-48864", # pkg:rpm/libsolv@0.7.20-6.el8, fix 0.7.20-7.el8_10 not in x86_64 UBI8 repo yet ], "kafka-connect81": [ "CVE-2025-12383", # pkg:maven/org.glassfish.jersey.core/jersey-client "CVE-2025-61729", # golang/stdlib "CVE-2023-6481", # pkg:maven/org.bitbucket.b_c/jose4j "CVE-2023-26119", # pkg:maven/net.sourceforge.htmlunit "CVE-2023-2798", # pkg:maven/net.sourceforge.htmlunit "CVE-2014-0114", # pkg:maven/commons-beanutils/commons-beanutils "CVE-2024-12801", # pkg:maven/ch.qos.logback/logback-core "CVE-2019-10086", # pkg:maven/commons-beanutils/commons-beanutils "CVE-2025-48734", # pkg:maven/commons-beanutils/commons-beanutils "CVE-2025-12183", # pkg:maven/org.lz4/lz4-java "CVE-2022-45868", # pkg:maven/com.h2database/h2 "CVE-2020-5529", # pkg:maven/net.sourceforge.htmlunit "CVE-2024-12798", # pkg:maven/ch.qos.logback/logback-classic "CVE-2024-29857", # pkg:maven/org.bouncycastle/bcprov-jdk15on "CVE-2020-11979", # pkg:maven/org.apache.ant/ant "CVE-2023-6378", # pkg:maven/ch.qos.logback/logback-classic "CVE-2025-66566", # pkg:maven/org.lz4/lz4-java ], "kafka-connect82": [ "CVE-2026-24400", # pkg:maven/org.assertj/assertj-core@2.2.0?scope=test "CVE-2014-0114", # pkg:maven/commons-beanutils/commons-beanutils@1.8.3 "CVE-2019-10086", # pkg:maven/commons-beanutils/commons-beanutils@1.8.3 "CVE-2020-11979", # pkg:maven/org.apache.ant/ant@1.8.4?scope=test "CVE-2022-45868", # pkg:maven/com.h2database/h2@2.1.214?scope=test "CVE-2023-6378", # pkg:maven/ch.qos.logback/logback-classic@1.2.11?scope=test "CVE-2024-29857", # pkg:maven/org.bouncycastle/bcprov-jdk15on@1.70?scope=test "CVE-2024-34447", # pkg:maven/org.bouncycastle/bcprov-jdk15on@1.70? "CVE-2025-48734", # pkg:maven/commons-beanutils/commons-beanutils@1.8.3 "CVE-2026-42504", # pkg:generic/package_dedupe?go_toolchain=1.26.3 "CVE-2026-27145", # pkg:generic/package_dedupe@1.26.3 - vulnerability in upstream ], "lambda-node22": [ "CVE-2026-33671", # pkg:npm/picomatch@4.0.3 requires update in node upstream "CVE-2026-33750", # pkg:npm/brace-expansion@5.0.3 requires update in node upstream "CVE-2026-12143", # pkg:npm/form-data@4.0.5 ], "lambda-node24": [ "CVE-2026-12143", # pkg:npm/form-data@4.0.5 "CVE-2026-12151", # pkg:npm/undici@6.26.0 ], "lambda-python311": [ "IN-DISCONTINUED-001", # AL2 is EOL, but Amazon will provide security updates until the end of June 2027 ], "node22": [ "CVE-2026-33671", # pkg:npm/picomatch@4.0.3 requires update in node upstream "CVE-2026-33750", # pkg:npm/brace-expansion@5.0.3 requires update in node upstream ], "node24": [ "CVE-2026-5773", # pkg:deb/debian/curl@7.88.1-10%2Bdeb12u14?arch=amd64&distro=bookworm&epoch=0 "CVE-2026-12151", # pkg:npm/undici@6.26.0 ], "ruby34": [], "ruby40": [ "CVE-2026-42257", # pkg:gem/net-imap@0.3.9 requires update in ruby upstream "CVE-2026-42245", # pkg:gem/net-imap@0.3.9 requires update in ruby upstream "CVE-2026-42246", # pkg:gem/net-imap@0.3.9 requires update in ruby upstream ], } # The maximum number of components supported by the ScanSbom API MAXIMUM_NUMBER_OF_SBOM_COMPONENTS = 2000 DAYS_FOR_ERROR = {} DAYS_FOR_ERROR["CRITICAL"] = int(os.environ.get("CRITICAL_ERROR_DAYS", 7)) DAYS_FOR_ERROR["HIGH"] = int(os.environ.get("HIGH_ERROR_DAYS", 14)) DAYS_FOR_ERROR["NON_BLOCKING"] = int(os.environ.get("NON_BLOCKING_ERROR_DAYS", 90)) # The scanners to skip when generating the SBOM. # Skip the javascript-yarnlock scanner by default because it produces false positives by scanning yarn.lock files # within the node_modules folder, which are not indicative of what packages are actually installed. # This also ensures consistency with the findings shown in the Inspector console. INSPECTOR_SBOMGEN_SKIP_SCANNERS = os.getenv( "INSPECTOR_SBOMGEN_SKIP_SCANNERS", "javascript-yarnlock" )