Software vulnerabilities are weaknesses that can cause an accidental system failure or provide bad actors a means to compromise your software. Container Analysis provides two types of Java (Maven) package scanning:
The On-Demand Scanning API allows you to manually scan container images for vulnerabilities in Java packages, either locally on your computer or remotely in Container Registry or Artifact Registry.
The Container Scanning API allows you to scan Java application packages automatically each time you push an image to Artifact Registry (Preview).
See pricing to learn more about the costs associated with scanning container images.
The On-Demand Scanning API and the Container Scanning API support Java vulnerability scanning for Maven packages within a container image. The vulnerability data is obtained from the GitHub Advisory Database.
Java vulnerability scanning supports Maven packages that follow the Maven naming conventions. If the package version includes spaces, it won't be scanned.
Severity levels for vulnerabilities
On-Demand Scanning uses the following severity levels:
The severity levels are qualitative labels that reflect factors such as exploitability, scope, impact, and maturity of the vulnerability. For example, if a vulnerability enables a remote user to easily access a system and run arbitrary code without authentication or user interaction, that vulnerability would be classified as Critical.
Two types of severity are associated with each vulnerability:
Effective severity - Depending on the vulnerability type:
- OS packages - The severity level assigned by the Linux distribution. If distribution-specific severity levels are unavailable, On-Demand Scanning uses the severity level assigned by the note provider.
- Language packages - The severity level assigned by the GitHub Advisory Database, with a slight difference: Moderate is reported as Medium.
CVSS score - The Common Vulnerability Scoring System score and associated severity level, with two scoring versions:
For a given vulnerability, the severity derived from a calculated CVSS score might not match the effective severity. You can decide the vulnerability score relevant for your project.
- On-demand Java scanning Quickstart.
- Automate Java package scanning.
- Learn how automatic OS and Java scanning work together in Artifact Registry.