What changed in the base image?

Diff two syft SBOMs for consecutive base image builds with jq and sort. Find the upgraded compression library and the release line that carried a backdoor.

Terminal mission
Intermediate
3 objectives
0 of 3 solved

Briefing

The platform team rebuilt api-base from a newer distribution snapshot. Before rolling it out, compare the package lists of the old and new image.

In March 2024, xz-utils releases 5.6.0 and 5.6.1 were found to contain a backdoor in liblzma that targeted sshd (CVE-2024-3094). The fix was to go back to 5.4.x.

analyst@appsec-ws

appsec-ws · Supply chain

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@appsec-ws:~/sbom-diff$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.