你的基础镜像有多安全？对热门开源容器进行实时安全测试.pdf

1、#SECTORCA BlackHatEventsHow Secure Is Your Base Image?A security test of popular OSS containersJohn Amaral CTO and Co-Founder,Root.IO#SECTORCA BlackHatEventsJohn AmaralFounder,CTO at root#SECTORCA BlackHatEventsWhy this matters now?Attacker TimelineHoursExploit timelines compressed to hours.Zero-day

2、 to weaponization is rapid.Faster than most organizations can detect or react.Defender TimelineWeeksProcess-driven timelines.Fixes need testing,staging,approval.Involves multi-org coordinationKEV Git(CVE-2025-48384)serves as our example of this timing mismatch,highlighting why it drives compliance d

3、eadlines for security teams.#SECTORCA BlackHatEventsPopular SecureConvenience over Security:Popular base images are chosen for ease of use,not security.Daily CVE Accumulation:Widespread trust creates blind spots as vulnerabilities emerge constantly.Insights:See whats inside and how to secure these c

4、ontainers today.Observed in Enterprise:Tools to find these images prevalent in production environments.#SECTORCA BlackHatEventsThe Three Subjectsgolang:1.24-bookwormPrimary Issue:CISA KEV Git vulnerability in runtimeSecondary Issues:Massive linux-libc-dev vulns(no fix)Dev toolchains shipped to produ

5、ctionArchitecture Flaw:Builder image used as runtime containerpython:3.10-bookwormPrimary Issue:linux-libc-dev/glibc critical findings(no fix)Secondary Issues:Dev headers&build tools in final imageArchitecture Flaw:Single-stage build:dev&runtime mixedmcp-gateway:v2Primary Issue:Go stdlib CVE(require

6、s 1.24.6+for fix)Secondary Issues:Root userDIND patternsAttack toolsUnpinned installationsArchitecture Flaw:Dangerous permissions+powerful toolingAll three images are real-world CI and application images teams are commonly running in production environments today.#SECTORCA BlackHatEventsScan:golang: