关联漏洞
描述
ClusterImagePolicy demo for cve-2022-42889 text4shell
介绍
# Text4Shell Demo
This demo shows how you can use Sigstore to validate your signed SBOMs against text4shell policies in Kubernetes or on the command line
## Option 1: Check if your remote OCI image is affected using cue with cosign 2.0
```
cosign verify-attestation --policy policy/text4shell.cue --type https://cyclonedx.org/bom --certificate-identity-regexp=.* --certificate-oidc-issuer-regexp=.* ghcr.io/chainguard-dev/text4shell-policy:main
```
## Option 2: Check using Enforce for Kubernetes with image built from this repo
```
chainctl policies create --group $DEMO_GROUP -f policy/text4shell-policy.yaml
kubectl label ns default policy.sigstore.dev/include=true --overwrite
kubectl run text4shell --image=ghcr.io/chainguard-dev/text4shell-policy:main
```
### Clean Up
```
kubectl delete pod text4shell --grace-period=0
chainctl policy delete -y $(chainctl policy list -o json | jq -r '[.items[] | select(.name == "vuln-cve-2022-42889-text4shell")][0].id')
kubectl label ns default policy.sigstore.dev/include-
```
文件快照
[4.0K] /data/pocs/2cad68456c86436001c1f3bcbffd225b86bac3ab
├── [ 230] Dockerfile
├── [ 11K] LICENSE
├── [4.0K] policy
│ ├── [ 473] text4shell.cue
│ └── [1.0K] text4shell-policy.yaml
├── [4.5K] pom.xml
├── [1.1K] README.md
├── [ 730] slsa.csv
├── [4.0K] src
│ └── [4.0K] main
│ └── [4.0K] java
│ └── [1.2K] Text4Shell.java
└── [4.0K] target
├── [ 24K] bom.json
├── [ 20K] bom.xml
├── [4.0K] classes
│ └── [2.0K] Text4Shell.class
├── [4.0K] lib
│ ├── [241K] commons-beanutils-1.9.4.jar
│ ├── [575K] commons-collections-3.2.2.jar
│ ├── [734K] commons-collections4-4.4.jar
│ ├── [319K] commons-io-2.11.0.jar
│ ├── [574K] commons-lang3-3.12.0.jar
│ ├── [ 60K] commons-logging-1.2.jar
│ ├── [211K] commons-text-1.9.jar
│ └── [233K] opencsv-5.7.0.jar
├── [4.0K] maven-archiver
│ └── [ 68] pom.properties
├── [4.0K] maven-status
│ └── [4.0K] maven-compiler-plugin
│ └── [4.0K] compile
│ └── [4.0K] default-compile
│ ├── [ 17] createdFiles.lst
│ └── [ 94] inputFiles.lst
└── [3.4K] text4shell-1.0.0-SNAPSHOT.jar
12 directories, 23 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。