US 11,727,117 B2
Vulnerability analyzer for application dependencies in development pipelines
Aagam Shah, Bengaluru (IN); Samuzzal Choudhury, Bengaluru (IN); and Mitesh Patel, Bengaluru (IN)
Assigned to Red Hat, Inc., Raleigh, NC (US)
Filed by Red Hat, Inc., Raleigh, NC (US)
Filed on Dec. 19, 2018, as Appl. No. 16/226,126.
Prior Publication US 2020/0202006 A1, Jun. 25, 2020
Int. Cl. G06F 21/57 (2013.01); G06F 8/77 (2018.01); G06F 8/71 (2018.01); G06F 8/41 (2018.01)
CPC G06F 21/577 (2013.01) [G06F 8/433 (2013.01); G06F 8/71 (2013.01); G06F 8/77 (2013.01); G06F 2221/033 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A system comprising:
a non-transitory memory; and
one or more hardware processors coupled to the non-transitory memory to execute instructions from the non-transitory memory to perform operations comprising:
providing a repository to a development stage of a development pipeline;
building an image associated with the repository;
identifying a list of dependencies and versions of the dependencies used in the building of the image;
determining whether one or more portions of the image utilizes dependencies verified as free of a security vulnerability in a prior version of the image, wherein the security vulnerability corresponds to an aspect of the image which may be exploited;
responsive to identifying at least one portion of the image that utilizes a dependency verified as being free of the security vulnerability, skipping an analysis of the at least one portion of the image;
analyzing a remaining portion of the image for the security vulnerability based on the identified list of dependencies and the versions of the dependencies used in the building of the image;
determining whether one or more portions of the image utilizes dependencies unverified as free of the security vulnerability;
responsive to identifying at least one portion of the image that utilizes a dependency unverified as being free of the security vulnerability, retrieving a closest-match version of the dependency unverified as being free of the security vulnerability that has been verified as free of the security vulnerability; and
providing a report based on the analyzing.