container_escape_audit v4.7.2 — rolling up the 4.7.x line A bigger update than the version bump suggests…
Liam R. — Freelance Penetration Tester
container_escape_audit v4.7.2 — rolling up the 4.7.x line
A bigger update than the version bump suggests. Since 4.6:
Container OS support actually fixed, not just claimed — Amazon Linux, SUSE, OpenShift/RHCOS, and Azure Linux nodes were silently falling through to "unknown" because of /etc/os-release ID mismatches the detection engine never accounted for. Each fix was verified against a real os-release dump for that distro before shipping.
Several detection-accuracy bugs fixed, the kind that matter if you're already relying on this: a confirmed module blacklist was being silently overridden back to CRITICAL by an unrelated check; a mitigation command in the CVE database had a shell-quoting bug that truncated it to a single word when copy-pasted; and runc CVE checks were showing a static advisory instead of using the tool's own live version detection.
New reporting options: --report-name lets you set a base filename and have the timestamp appended automatically, instead of constructing the full report path yourself. [MITIGATED] console labeling now distinguishes "genuinely downgraded by something we found" from "just not enough evidence yet" — same colour as the downgraded severity, so urgency still reads correctly at a glance.
Update checking: --check-updates checks the repo for a newer script version and CVE database, prints a simple summary, and exits cleanly — it doesn't also run a full scan.
If you're running an earlier version, this one's worth pulling — a couple of the fixes could have masked a real finding as mitigated when it wasn't.
🔗 github.com/liamromanis101/K8s-container_escape_audit
#Kubernetes #ContainerSecurity #DevSecOps #CloudSecurity #OpenSource
1 reactions · 0 comments
Topics: #devsecops, #kubernetes, #cloudsecurity, #containersecurity, #opensource