Bitnami Vulnerability Database integrated with Trivy

A journey towards comprehensive vulnerability assessment

Authored by Juan Ariza, Senior member of technical staff

Bitnami images and the CVE Security Feed for Bitnami Components

Bitnami-packaged container images are well-known and trusted for being secure, hardened, and ready to use. They are built with best practices, put through extensive automated tests and verifications to run in their target platforms with the expected behavior and performance, and delivered as ready-to-use packages. Furthermore, they are kept up to date with the latest official upstream application versions and this has enabled Bitnami to offer updates including security fixes even before CVEs were announced or detected by the scanners on numerous occasions. In addition, they are continuously scanned to detect security vulnerabilities in the sources and components used by the application. The results of all these tests and validations are available for the enterprise version of these packages through the VMware Tanzu Application Catalog UI. 

Open Source Software (OSS) scanners have consistently identified most of the CVEs that impact our images. Nevertheless, because of Bitnami components’ custom build and packaging, some vulnerability scanners have struggled to detect vulnerabilities in them.

To better enable vulnerability scanners to detect vulnerabilities in our components, we have launched the Bitnami Vulnerability Database, a public CVE security feed available on GitHub with extensive information about the vulnerabilities on Bitnami components. 

Behind the scenes of Bitnami Vulnerability Database

In July 2023, Bitnami published its first CVE security feed — Bitnami Vulnerability Database — which is available on its public GitHub repository.

As part of getting this vulnerability database set up and ready to go, our team had to analyze how some popular scanners work, identify gaps in them, research how to make those scanners locate Bitnami Software Bill of Materials (SBoM), explore available vulnerabilities sources; and took inspiration from other public CVE security feeds available on GitHub such as the Golang Vulnerability database. After collecting the needed information, we created a cron job that uses the data from the National Vulnerability Database (NVD). This cronjob would extract all the CVE data required for analyzing Bitnami’s packaged applications, tools, and libraries, which enables us to report the vulnerabilities affecting each Bitnami component, and periodically update them.

Bitnami Vulnerability Database follows the Open Source Vulnerability schema — a standard format for distributing vulnerability information for open source — to create the JSON files that will assemble the security feed. Additionally, this enables the inclusion of the Bitnami Vulnerability Database as a part of the aggregated vulnerability database available at the Open Source Vulnerability Database (OSV). We see this as a significant accomplishment that can benefit our users as this initiative has been developed in collaboration with Open Source communities and has been adopted by several important security advisories. Also, this makes it possible for any security scanner that supports OSV schema to consume the Bitnami CVE security feed. 

As a culmination of all this work, we have been able to set up the Bitnami CVE security feed on GitHub, which can be browsed by anyone to find information about vulnerabilities in Bitnami components.

Integration of Bitnami Vulnerability database with Trivy

Trivy v0.42.0 came with support for analyzing Bitnami images’ SPDX files, and since then Trivy has been able to detect Bitnami SBOMs. However, Trivy couldn’t report vulnerabilities affecting the Bitnami components described in the SBOMs till now, as there was not a Bitnami CVE security feed available. 

After the Bitnami Vulnerability Database was published, the Bitnami team actively collaborated with Trivy to include this security feed as a part of its scanning capabilities. This enhancement was added as an experimental feature on version v0.45.0 and highlighted on Trivy release notes:

Trivy announcement of the Bitnami Vulnerability database integration 

Bitnami container images have a long-standing reputation for trustworthiness and security, consistently adhering to industry best security practices. We take pride in this integration, as it enhances users' awareness of Bitnami components, which have been specifically designed to contribute to a more secure software supply chain.

Trivy becomes the first security scanner to consume Bitnami Vulnerability Database but the journey doesn't end here. We will continue working on ensuring other popular security scanners consume it. Meanwhile, users who don’t use Trivy as their primary vulnerability scanner can also consume it since it is publicly available and works with any security scanner that supports OSV schema, and there are already a few scanners that have capabilities for detecting Bitnami SBOMs.

Support and Resources

Refer to the Bitnami and VMware Tanzu Application Catalog documentation to learn more about Kubernetes and Bitnami Helm charts and containers. 

To solve the problems you may have with the Bitnami community packages — including deployment support, operational support, and bug fixes — please open an issue in the Bitnami Helm charts or containers GitHub repository.  Also, if you want to contribute to the catalog, feel free to send us a pull request, and the team will check it and guide you in the process for a successful merge.   

If you are interested in learning more about the enterprise version of Bitnami packages — VMware Tanzu Application Catalog —  check out the product webpage, Tech Zone page,  application library, and additional resources. If you would like to get in touch,  contact us.

Use Enterprise-Grade Bitnami Apps in Production with VMware Application Catalog

Originally published on the VMware Tanzu blog

Shagun Tewari and Raquel Campuzano Godoy co-wrote this post.

For the past fifteen years, the Bitnami team has delivered pre-packaged open source applications to millions of developers. Over that time, we have evolved our application catalog from delivering our stacks in the form of installers and virtual machines, to cloud native applications, containers, and Helm charts that help you build applications on any platform. Developers use the Bitnami solutions through the Bitnami Application Catalog, which is our name for the catalog available through marketplaces and on Bitnami.com. 

With over three million developers using our solutions today, there’s no doubt that Bitnami Application Catalog solutions are extremely popular and are ideal for testing purposes in development environments. 

There are, however, constraints with trying to deploy any open-source software in production/enterprise environments, including those from Bitnami Application Catalog. According to a VMware Tanzu survey taken in 2021 on the state of the software supply chain, 95 percent of respondents mentioned that there is no guarantee that vulnerabilities will be remediated, given that ownership of open-source software, in general, remains unclear. Moreover, respondents stated that it’s difficult to keep up-to-date on vulnerabilities so that they can be addressed in time. In reality, keeping up-to-date on every software and dependency vulnerability, and patching in upstream source code, is an enormous effort that few organizations can afford. It is not viable for developer teams to manually track every dependency and to make sure that application components are always updated, healthy, and patched with the latest vulnerability fixes—while guaranteeing internal compliance—instead of focusing on building new business solutions. 

This is where VMware Application Catalog comes in. With VMware Application Catalog, development teams can utilize a rich library of custom, pre-packaged, and trusted building blocks for private enterprise consumption delivered as containers, Helm charts, and virtual machines. These application building blocks are tested on multiple deployment platforms and are continuously and automatically updated for every new vulnerability fix, including those for all dependencies, thanks to an internal automatic build pipeline. 

What is VMware Application Catalog? 

Developers love open source software because it helps energize their application development cycles and offers a wide variety of community-backed technology to choose from. How do we bring these benefits into enterprise environments while avoiding any potential security pitfalls? 

VMware Application Catalog is a customizable selection of trusted, pre-packaged open-source application components that are continuously maintained and verifiably tested for use in production environments.  

It is a library of production-ready Open Virtual Appliances (OVAs), containers, and Helm charts ranging from solutions to integrated code, development applications, automation tools, databases, and other backing services. These catalog images can be plugged into any stage of your company's software lifecycle.

VMware Application Catalog brings users a rich library of pre-packaged open source components in the form of Helm charts, containers, and OVAs. 

So what exactly is special about these images? This catalog can be custom-packaged on any base operating system (OS) provided by a customer. Customers may provide custom golden base OS images or choose from a set of OS images provided by VMware. 

Then, multiple functional and verification tests are run on the packaged image, including build-time Common Vulnerabilities and Exposures (CVE), antivirus scanning, and deployment testing on various platforms. 

Finally, the hardened image, along with the image metadata that contains all vulnerability, antivirus scan, and deployment test results, is pushed to a registry of the customer’s choice for secure, private consumption. 

And last but not the least, VMware Application Catalog offers continuous monitoring of upstream source code changes to automatically trigger image rebuild, testing, and pushes to register new and fixed images. This means that the catalog is always up-to-date. 

How is VMware Application Catalog different from Bitnami Application Catalog?  

A legitimate question for current Bitnami Application Catalog users is: how does VMware Application Catalog differ from Bitnami’s free content? We can sum up the differences by saying that Bitnami Application Catalog is a standard catalog built for the community, while VMware Application Catalog is a custom catalog designed for the enterprise. This statement condenses a list of significant differences such as: 

• Individual vs enterprise: Bitnami Application Catalog provides software that is intended for a wide range of developers, while VMware Application Catalog supplies a library of assets specifically built to address the security needs of a specific enterprise. 
• Customization flexibility: Bitnami Application Catalog stacks are built on only one standardized base OS image: Debian. VMware Application Catalog customers can choose to have their images packaged on top of their own golden image (e.g., their own Center for Internet Security-certified Photon OS image), or choose from several hardened Linux flavors provided by VMware Application Catalog.

VMware Application Catalog provides many different base OS images to choose from.

 

• Automatic image library refresh: Bitnami Application Catalog releases a new version of its images every time there is a security fix, patch, or new major version available in the upstream code. However, if they’d like to use the refreshed images, developers are required to navigate to the catalog and redeploy the image to update it. With VMware Application Catalog, images are automatically rebuilt and pushed to the private registry every time there is a new version available in the upstream community to ensure the catalog is always fresh. 
• Detailed bill of materials and metadata for proof of provenance: To get information about the stacks they are running, Bitnami users go to DockerHub or GitHub repositories. VMware Application Catalog users have direct access to extensive metadata in their repositories, which eliminates the need to monitor any external sources. Extensive metadata is served in a JSON file that has information on how to consume the asset, its digest, its build, and release dates, and a complete list of included subcomponents or libraries with license information. We also provide detailed results for CVE, antivirus, and deployment to platform tests, as well as other functional and verification tests conducted on the image for full transparency and visibility. Further, this metadata is digitally signed using a cosignatory to protect it from tampering, which adds another layer of security to the catalog. 

Each asset available in the catalog provides users with all the information they need to consume it.

An example of a test results report which shows all the tests the application went through before being added to the customer’s catalog.

How Bitnami Application Catalog users can benefit from VMware Application Catalog 

Bitnami Application Catalog images are ideal for personal use or development environments, where the stakes are not so high. When it comes to enterprise-grade applications, software supply chain security is of the utmost importance, and developers must abide by strict IT compliance and security rules. VMware Application Catalog provides the goodness of open-source software that developers need to move faster while adhering to security and compliance regulations demanded by the operations and security teams. 

If an enterprise manages a dozen sites, this level of transparency and compliance may be achievable with the work of a single developer or by a small team. However, for large enterprises, moving to production usually means managing hundreds of thousands of applications and sites. In this scenario, companies are forced to dedicate part of their development and site-reliability engineering resources to more tedious tasks, such as tracking all application dependencies and making sure that they are kept up-to-date and patched with the latest CVE fixes to ensure internal compliance. 

VMware Application Catalog allows customers to request images that are custom-packaged on an OS of choice, hardened, security tested, and delivered to a private repository. This frees up developers from the necessity of building their own compliant application components, as well as monitoring external sources and the upstream code to keep their open-source images current. It also provides the security and operations team with detailed metadata for increased visibility and assurance that their software is secure and up-to-date. VMware Application Catalog promotes developer productivity while boosting operator and security team confidence.

Learn more about VMware Application Catalog 

To learn more about VMware Application Catalog, join our webinar session on June 23 at 10 AM PT. Register now for the session! 

For additional information, read about VMware Application Catalog on our product page, browse through all applications available on VMware Application Catalog, or read our newly updated technical documentation. 

For more questions, reach out to the product team directly at app-catalog@vmware.com.

Deploy Applications with Confidence and Control with VMware Application Catalog™ and Sealed Secrets

Raquel Campuzano and Juan Ariza co-wrote this blog post

As more organizations adopt Kubernetes as the preferred infrastructure for running their IT resources, enterprise SRE teams tend to adopt a GitOps mindset.  

The GitOps approach consists of embracing different practices that manage infrastructure configuration as a code. This means that Git becomes the single source of truth and as such, all operations are tracked via commits and pull requests. Thus, every action performed on the infrastructure will leave a trace and can be reverted if needed.  

This practice brings a lot of benefits to IT admins, since automation and ease of managing Kubernetes configurations are extremely important to them. 

Despite this, there’s a high probability of discovering security risks when managing access to the applications running in a Kubernetes cluster. This is where Sealed Secrets comes in. Sealed Secrets is a  Kubernetes controller and a tool for one-way encrypted Secrets.  

Why should every cluster controller use Sealed Secrets to protect their deployments?  

When cluster operators and administrators follow the GitOps approach, they usually find that they can manage all Kubernetes configurations through Git except secrets. Sealed Secrets solves this problem by encrypting the secret into a new Kubernetes object called “SealedSecret” which is safe to store even in public repositories.  

Sealed Secrets is a popular Open-Source project led by Bitnami that helps Kubernetes operators and administrators keep their deployments safe and under control. Sealed Secrets can only be decrypted by those who have access to the sealing private key — usually the cluster administrator — ensuring that nobody else, even the original author, is able to obtain the secret given in a Sealed Secret manifest file. 

Sealed Secrets is now available as a Helm chart in VMware Application Catalog! VMware Application Catalog is a customizable selection of trusted, pre-packaged open-source application components that are continuously maintained and verifiably tested for use in enterprise production environments – the ideal option to procure secure application building blocks.  

Depending on your requirements, you can either navigate to the ongoing Open-Source project located in the Bitnami GitHub repository and download the tool and test it out, or if your organization requires a more stable, secure, and compliant image, you can deploy Sealed Secrets on your cluster through VMware Application Catalog.  

Deploy Sealed Secrets on Kubernetes through VMware Application Catalog

The following steps describe how to navigate to VMware Application Catalog — formerly known as Tanzu Application Catalog — and deploy Sealed Secrets in your cluster. 

Once you have it installed, you will be able to deploy any application — this blog post uses MariaDB as an example, but you can pick another solution existing in your catalog — and encrypt its secrets using a Sealed Secret.   

This post assumes that you already have: 

• Sealed Secrets and MariaDB added to your VMware Application Catalog 
• Kubeseal was previously installed on your computer. 

Navigate to app-catalog.vmware.com and sign in with your VMware account to your catalog. 

In the “My Applications” section, search for Sealed Secrets Helm chart and click “Details”. 

On the next screen, you will find the instructions for deploying the chart on your cluster. Make sure that your cluster is up and running by executing kubectl cluster-info. Then, run the commands you will find under the “Consume your Helm Chart” section.  

Once you have installed the Sealed Secrets chart, it is time to use it to encrypt the required secrets to manage the MariaDB credentials. Fortunately, the MariaDB Helm chart supports retrieving the credentials from an existing secret. 

To use that feature, you must make sure that you know which is the expected format for the MariaDB secret. You can obtain that information by checking in the MariaDB chart’s README file the “common parameters” section as shown below: 

Based on this information, you can use kubeseal to create a Sealed Secret with encrypted credentials for MariaDB by executing the command below: 

kubectl create secret generic mariadb-secret --dry-run=client \ 

  --from-literal=mariadb-root-password=ROOT_PASSWORD \ 

  --from-literal=mariadb-replication-password=REPLICATION_PASSWORD \ 

  --from-literal=mariadb-password=SOME_PASSWORD \ 

  -o yaml | kubeseal --controller-name=CONTROLLER_NAME \ 

  --controller-name=CONTROLLER_NAMESPACE \ 

  --format yaml > mariadb-sealedsecret.yaml 

Note: Remember to replace the ROOT_PASSWORD, REPLICATION_PASSWORD, and SOME_PASSWORD placeholders with the passwords you want to use to configure MariaDB. Also, replace the CONTROLLER_NAME and CONTROLLER_NAMESPACE with the name and namespace of your Sealed Secrets controller, respectively. This information is displayed in the NOTES when installing the Sealed Secret chart. 

The command above creates a new yaml file named mariadb-sealedsecret.yaml which contains the encrypted MariaDB credentials. That file should look like it is shown below: 

At this point, you can safely add this file to your Git repository. Once you have a Sealed Secret manifest, you can deploy it in your Kubernetes cluster running the command below: 

kubectl create -f mariadb-sealedsecret.yaml 

Use the following command to double-check that the Sealed Secret — and the associated secret — was successfully created: 

kubectl get sealedsecret mariadb-secret 

kubectl get secret mariadb-secret  

Now, you can deploy the MariaDB Helm chart retrieving the credentials from the existing “mariadb-secret” secret.  

To do so, back to the VMware Application Catalog and search for the MariaDB details page. Then, execute the command you will find in the “Consume your Helm Chart” by appending the following flag: 

--set auth.existingSecret=mariadb-secret 

Once the chart is installed, you can start to operate your MariaDB database as described in its installation notes. 

The last step is to obtain the chart installation values and save them in a file using the command below: 

helm get values MARIADB_RELEASE > mariadb-values.yaml 

Note: Remember to replace the MARIADB_RELEASE placeholder with the name you used for your MariaDB release. 

You can now add this mariadb-values.yaml to your Git repository.  

By committing both this and the mariadb-sealedsecret.yaml file in your repository you can record the status of your infrastructure in a reproducible manner – allowing you to again embrace the GitOps mindset.  Thanks to Sealed Secrets, now you can also publish your changes in any public repository without exposing your database credentials. 

Deploy Applications with Confidence and Control 

As shown in this blog post, the combination of Sealed Secrets and VMware Application Catalog allows you to deploy applications in your cluster with complete confidence. Apart from keeping your applications automatically updated and monitored thanks to VMware Application Catalog, now you can rely on the efficiency of Sealed Secrets for keeping your deployments locked and safe against misuse.  

Learn more about VMware Application Catalog by checking its product page on vmware.com. You can also check out technical documentation for VMware Application catalog here. You can also contact the VMware Application Catalog team directly at vac@vmware.com.

If you are interested in contributing to the Sealed Secrets Open Source project, check out the GitHub repository and do not hesitate to send us a pull request. The BItnami engineering team will check it and guide you in the process for a successful merge.