Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Catalog perl binary #1587

Closed
witchcraze opened this issue Feb 18, 2023 · 0 comments · Fixed by #1592
Closed

Catalog perl binary #1587

witchcraze opened this issue Feb 18, 2023 · 0 comments · Fixed by #1592
Labels
enhancement New feature or request

Comments

@witchcraze
Copy link
Contributor

What would you like to be added:

An additional file classifier which finds perl binary.

Why is this needed:

perl is widely used.

pullCount : 100M+
starCount : 435
from https://hub.docker.com/_/perl

perl will be installed without a package manger in container env with official image.
We want to be able to catalog this.

$ syft -q perl | grep perl
libdpkg-perl                  1.20.12                         deb
liberror-perl                 0.17029-1                       deb
libperl5.32                   5.32.1-4+deb11u2                deb
perl                          5.32.1-4+deb11u2                deb
perl-base                     5.32.1-4+deb11u2                deb
perl-modules-5.32             5.32.1-4+deb11u2                deb

$ docker run -it --rm perl perl -v

This is perl 5, version 36, subversion 0 (v5.36.0) built for x86_64-linux-gnu

Copyright 1987-2022, Larry Wall

Perl may be copied only under the terms of either the Artistic License or the
GNU General Public License, which may be found in the Perl 5 source kit.

Complete documentation for Perl, including FAQ lists, should be found on
this system using "man perl" or "perldoc perl".  If you have access to the
Internet, point your browser at https://www.perl.org/, the Perl Home Page.

$ docker run -it --rm perl perl -e "print $]"
5.036000

Additional context:

cpe:2.3:a:perl:perl is used in NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10543

DOCKER OFFICIAL IMAGE : perl:5.36

# which perl
/usr/local/bin/perl

# /usr/local/bin/perl -v | grep version
This is perl 5, version 36, subversion 0 (v5.36.0) built for x86_64-linux-gnu

# strings /usr/local/bin/perl | grep '5\.36'
/usr/local/lib/perl5/5.36.0/x86_64-linux-gnu/CORE

DOCKER OFFICIAL IMAGE : perl:5.20.0 (oldest tag)

# which perl
/usr/local/bin/perl

# /usr/local/bin/perl -v | grep version
This is perl 5, version 20, subversion 0 (v5.20.0) built for x86_64-linux

# strings /usr/local/bin/perl | grep '5\.20'
/usr/local/lib/perl5/site_perl/5.20.0/x86_64-linux
/usr/local/lib/perl5/site_perl/5.20.0
/usr/local/lib/perl5/5.20.0/x86_64-linux
/5.20.0/x86_64-linux
v5.20.0
/usr/local/lib/perl5/5.20.0
use feature ':5.20';

Ubuntu 22.04 + OS Package (This will be shown as package)

# which perl
/usr/bin/perl

# /usr/bin/perl -v | grep version
This is perl 5, version 34, subversion 0 (v5.34.0) built for x86_64-linux-gnu-thread-multi

# strings /usr/bin/perl | grep '5\.34'
DEBPKG:debian/patchlevel - https://bugs.debian.org/567489 List packaged patches for 5.34.0-3ubuntu1.1 in patchlevel.h
v5.34.0
/usr/local/share/perl/5.34.0
/usr/share/perl/5.34
/5.34.0/x86_64-linux-gnu-thread-multi
/usr/local/lib/x86_64-linux-gnu/perl/5.34.0
/usr/lib/x86_64-linux-gnu/perl5/5.34
/usr/lib/x86_64-linux-gnu/perl/5.34
use feature ':5.34';

Rocky Linux8 + OS Package (This will be shown as package)

# which perl
/usr/bin/perl

# /usr/bin/perl -v | grep version
This is perl 5, version 26, subversion 3 (v5.26.3) built for x86_64-linux-thread-multi

# strings /usr/bin/perl | grep '5\.26'
libperl.so.5.26
perl-5.26.3-421.el8.x86_64.debug
@witchcraze witchcraze added the enhancement New feature or request label Feb 18, 2023
This was referenced Feb 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant