0

I would like to check the common vulnerabilities in some of FIWARE components that we are using in our platform, components list is given below.

  1. Cepheus
  2. Cygnus
  3. Orion
  4. STH-Comet
  5. QuantumLeap
  6. IoT Agent for JSON
  7. IoT Agent Node Lib

If any source is available over some FIWARE website or some other source, where we can verify the vulnerabilities in FIWARE component. Please provide the information if such information is available.

fgalan
  • 11,732
  • 9
  • 46
  • 89
Ajay yadav
  • 4,141
  • 4
  • 31
  • 40

1 Answers1

2

For a given Docker baseline we are using Anchore and Clair checks. For a given usual running Docker Container based on a Docker Compose file a Docker Benchmark Security recommendation is executed. Additionally, we are running SAST code analysis over the corresponding repositories. Plus npm audit for the node.js ones plus.

We are defining corresponding GitHub Actions to use inside the repositories.

There is a working project to provide security analysis of the components, the first version is not released yet. You can take a look on it in this repository FIWARE Security Scan

flopez
  • 620
  • 1
  • 4
  • 9