Running with gitlab-runner 13.8.0 (775dd39d)
  on global-shared-gitlab-runner-89dbd4db8-mnp6b RKzCU9YR
section_start:1617910043:resolve_secrets
Resolving secrets
section_end:1617910043:resolve_secrets
section_start:1617910043:prepare_executor
Preparing the "kubernetes" executor
Using Kubernetes namespace: gitlab-runner
WARNING: Pulling GitLab Runner helper image from Docker Hub. Helper image is migrating to registry.gitlab.com, for more information see https://docs.gitlab.com/runner/configuration/advanced-configuration.html#migrating-helper-image-to-registrygitlabcom
Using Kubernetes executor with image ${GITLAB_INTERNAL_REGISTRY}/ironbank-tools/ironbank-pipeline/ib-pipeline-image:0.1 ...
section_end:1617910043:prepare_executor
section_start:1617910043:prepare_script
Preparing environment
Waiting for pod gitlab-runner/runner-rkzcu9yr-project-515-concurrent-0p5g7d to be running, status is Pending
Running on runner-rkzcu9yr-project-515-concurrent-0p5g7d via global-shared-gitlab-runner-89dbd4db8-mnp6b...
section_end:1617910047:prepare_script
section_start:1617910047:get_sources
Getting source from Git repository
Fetching changes with git depth set to 50...
Initialized empty Git repository in /builds/dsop/opensource/mbtest/mountebank/.git/
Created fresh repository.
Checking out e4a9748f as test-dev...

Skipping Git submodules setup
section_end:1617910047:get_sources
section_start:1617910047:download_artifacts
Downloading artifacts
Downloading artifacts for hardening_manifest (2652207)...
Downloading artifacts from coordinator... ok        id=2652207 responseStatus=200 OK token=8wepDeue
Downloading artifacts for load scripts (2652205)...
Downloading artifacts from coordinator... ok        id=2652205 responseStatus=200 OK token=6Evzz4sK
Downloading artifacts for wl compare lint (2652208)...
Downloading artifacts from coordinator... ok        id=2652208 responseStatus=200 OK token=t1sT2Hst
section_end:1617910047:download_artifacts
section_start:1617910047:step_script
Executing "step_script" stage of the job script
$ mkdir -p "${ARTIFACT_DIR}"
$ set +e
$ python3 "${PIPELINE_REPO_DIR}/stages/vat-finding-compare/vat_findings.py"
api set length: 150
db set length: 142
Findings are NOT the same!
There are CVEs from the api that are not returned by the query
There are CVEs from the query that are not returned by the api
Please run the development branch for this project before validating query/api data
Findings from api not in direct query
('CVE-2020-35512', 'anchore_cve', 'dbus-tools-1.12.8-12.el8_3\nhttps://access.redhat.com/security/cve/CVE-2020-35512', 'dbus-tools-1.12.8-12.el8_3', None)
('CVE-2020-13776', 'anchore_cve', 'systemd-libs-239-41.el8_3.1\nhttps://access.redhat.com/security/cve/CVE-2020-13776', 'systemd-libs-239-41.el8_3.1', None)
('CVE-2021-23841', 'anchore_cve', 'openssl-1.1.1g-15.el8_3\nhttps://access.redhat.com/security/cve/CVE-2021-23841', 'openssl-1.1.1g-15.el8_3', None)
('CVE-2021-23840', 'twistlock_cve', 'Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).', 'openssl-1.1.1g-15.el8_3', None)
('CVE-2020-13776', 'anchore_cve', 'systemd-239-41.el8_3.1\nhttps://access.redhat.com/security/cve/CVE-2020-13776', 'systemd-239-41.el8_3.1', None)
('CVE-2020-35512', 'anchore_cve', 'dbus-common-1.12.8-12.el8_3\nhttps://access.redhat.com/security/cve/CVE-2020-35512', 'dbus-common-1.12.8-12.el8_3', None)
('CVE-2020-7774', 'twistlock_cve', "This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require(\\'y18n\\')(); y18n.setLocale(\\'__proto__\\'); y18n.updateLocale({polluted: true}); console.log(polluted); // true", 'y18n-4.0.0', None)
('CVE-2020-7774', 'anchore_cve', 'y18n-4.0.0\nCVE ID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-7774\nVendor Specific Advisory URL: https://github.com/yargs/y18n/issues/96\nVendor Specific Solution URL: https://github.com/yargs/y18n/pull/108\nOther Advisory URL: https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306\nOther Advisory URL: https://snyk.io/vuln/SNYK-JS-Y18N-1021887\nGeneric Informational URL: https://us-cert.cisa.gov/ncas/bulletins/sb20-328\nRedHat RHSA: http://rhn.redhat.com/errata/RHSA-2020-5305.html\nBug Tracker: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976390\nRedHat RHSA: http://rhn.redhat.com/errata/RHSA-2020-5499.html\nVendor Specific Advisory URL: https://www.oracle.com/security-alerts/linuxbulletinjan2021.html\nVendor Specific Solution URL: https://github.com/yargs/y18n/commit/a9ac604abf756dec9687be3843e2c93bfe581f25\nBug Tracker: https://github.com/yargs/y18n/issues/112\nVendor Specific Solution URL: https://github.com/yargs/y18n/pull/107\nOther Solution URL: https://github.com/418sec/y18n/pull/1\nRedHat RHSA: http://rhn.redhat.com/errata/RHSA-2021-0421.html\nVendor Specific Advisory URL: https://www.ibm.com/support/pages/node/6412345\nRedHat RHSA: http://rhn.redhat.com/errata/RHSA-2021-0521.html\nRedHat RHSA: http://rhn.redhat.com/errata/RHSA-2021-0551.html\nRedHat RHSA: http://rhn.redhat.com/errata/RHSA-2021-0548.html\nVendor Specific Advisory URL: https://www.ibm.com/support/pages/node/6412225\nVendor Specific Advisory URL: https://www.ibm.com/support/pages/node/6415863\nVendor Specific Advisory URL: https://www.ibm.com/support/pages/node/6416159\nRedHat RHSA: http://rhn.redhat.com/errata/RHSA-2020-5633.html\n', 'y18n-4.0.0', '/usr/local/lib/node_modules/npm/node_modules/y18n/package.json')
('CVE-2021-23840', 'anchore_cve', 'openssl-1.1.1g-15.el8_3\nhttps://access.redhat.com/security/cve/CVE-2021-23840', 'openssl-1.1.1g-15.el8_3', None)
('GHSA-c4w7-xm78-47vh', 'anchore_cve', 'y18n-4.0.0\nhttps://github.com/advisories/GHSA-c4w7-xm78-47vh', 'y18n-4.0.0', '/usr/local/lib/node_modules/npm/node_modules/y18n/package.json')
('CVE-2020-35512', 'anchore_cve', 'dbus-daemon-1.12.8-12.el8_3\nhttps://access.redhat.com/security/cve/CVE-2020-35512', 'dbus-daemon-1.12.8-12.el8_3', None)
('CVE-2020-13776', 'twistlock_cve', 'systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.', 'systemd-239-41.el8_3.1', None)
('CVE-2020-13776', 'anchore_cve', 'systemd-pam-239-41.el8_3.1\nhttps://access.redhat.com/security/cve/CVE-2020-13776', 'systemd-pam-239-41.el8_3.1', None)
('CVE-2020-35512', 'anchore_cve', 'dbus-libs-1.12.8-12.el8_3\nhttps://access.redhat.com/security/cve/CVE-2020-35512', 'dbus-libs-1.12.8-12.el8_3', None)
('CVE-2021-23841', 'twistlock_cve', 'The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).', 'openssl-1.1.1g-15.el8_3', None)
('CVE-2020-35512', 'anchore_cve', 'dbus-1.12.8-12.el8_3\nhttps://access.redhat.com/security/cve/CVE-2020-35512', 'dbus-1.12.8-12.el8_3', None)
Findings from direct query not in api
('CVE-2020-13776', 'anchore_cve', 'systemd-239-41.el8_3.2\nhttps://access.redhat.com/security/cve/CVE-2020-13776', 'systemd-239-41.el8_3.2', None)
('CVE-2020-13776', 'anchore_cve', 'systemd-libs-239-41.el8_3.2\nhttps://access.redhat.com/security/cve/CVE-2020-13776', 'systemd-libs-239-41.el8_3.2', None)
('CVE-2020-13776', 'twistlock_cve', 'systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.', 'systemd-239-41.el8_3.2', None)
('CVE-2021-20305', 'twistlock_cve', 'A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.', 'nettle-3.4.1-2.el8', None)
('cbff271f45d32e78dcc1979dbca9c14d', 'anchore_comp', 'User root found as effective user, which is explicity not allowed\n Gate: dockerfile\n Trigger: effective_user\n Policy ID: DoDEffectiveUserChecks', None, None)
('CVE-2020-13776', 'anchore_cve', 'systemd-pam-239-41.el8_3.2\nhttps://access.redhat.com/security/cve/CVE-2020-13776', 'systemd-pam-239-41.el8_3.2', None)
('41cb7cdf04850e33a11f80c42bf660b3', 'anchore_comp', "Dockerfile directive 'HEALTHCHECK' not found, matching condition 'not_exists' check\n Gate: dockerfile\n Trigger: instruction\n Policy ID: DoDDockerfileChecks", None, None)
('CVE-2021-20305', 'twistlock_cve', 'A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.', 'gnutls-3.6.14-7.el8_3', None)
section_end:1617910048:step_script
section_start:1617910048:upload_artifacts_on_failure
Uploading artifacts for failed job
Uploading artifacts...
ci-artifacts/compare/: found 2 matching files and directories 
Uploading artifacts as "archive" to coordinator... ok  id=2652209 responseStatus=201 Created token=Vcrb9wz8
section_end:1617910049:upload_artifacts_on_failure
section_start:1617910049:cleanup_file_variables
Cleaning up file based variables
section_end:1617910049:cleanup_file_variables
ERROR: Job failed: command terminated with exit code 4