Securing Containers Against Known Go Vulnerabilities
summary
Analysis of the top ~1,000 public Google Cloud images and a recent-year subset inspects ~4.5K unique Go binaries and finds 80% of Go binaries are vulnerable by matching symbol-level results from the go vulnerability detector; rebuilding with the latest Go or pretending std lib fixes drops flagged binaries from ~80% to ~20%. A custom scalibur plugin extracts build Go versions (via readexA and go list) and reports specific binaries (example: three outdated CLIs) with a rebuild recommendation.
AI-written summary · about
chapters (9)
- 0:00Go container security intro
- 1:05Cloud containers analysis
- 5:56Go vulnerability detection
- 8:04Vulnerabilities in Go binaries
- 9:28Rebuilding with latest Go
- 10:31Custom Scalibur plugin
- 18:34Scalibur plugin demo
- 20:38Live container scan results
- 21:18Summary & Q&A
related talks
29mDay in the Life of a Base Image: The Evolution of Vulnerabilities in the Most Popular C...
20mHow Secure is Your Base Image? ...
35mSecuring Containers by Breaking In
32mWhat Data Tells Us About Software Supply Chain Security & What To Do About It
16mUnpacking Open Source Security in Public Repos
52mThe Life of an Image: Evolution of Vulnerabilities in Popular Containers
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?
34mUnpacking Open Source Security in Public Repos & Registries