Detection of vulnerable root certificates in software containers

1. A method for detecting vulnerable root certificates in container images, comprising:

receiving an event to scan at least one container image hosted in a host device, wherein the at least one container image includes resources utilized to execute, by the host device, at least a respective application container;

extracting contents of layers of the at least one container image, wherein extracting the contents of layers of the at least one container image further comprises reformatting at least one base image into a data structure;

scanning the extracted contents to generate a first list designating all root certificates included in the at least one container image, wherein scanning the extracted contents further comprises searching for strings formatted according to a standard public key infrastructure (PKI) format;

generating a second list designating all root certificates trusted by the host device; comparing the first list to the second list to detect at least one root certificate designated in the first list but not in the second; and

determining the at least one detected root certificate as vulnerable, wherein the detection of vulnerabilities in the at least one base image is performed prior to the execution of the at least the respective application container.

2. The method of claim 1 , further comprising:

checking each root certificate designated in the first list for validity; and

determining any root certificate that failed the validity check as vulnerable.

3. The method of claim 2 , further comprising:

generating a detection event upon determination of at least one of the checked root certificates as vulnerable.

4. The method of claim 2 , wherein checking each root certificate designated in the first list for validity further comprises:

comparing contents of the root certificate to the contents of a respective trusted root certificate; and

when the compared certificates contents do not match, determining the root certificate as vulnerable.

5. The method of claim 1 , wherein scanning the extracted contents to generate the first list further comprises:

scanning the extracted contents to identify a plurality of identified root certificates; assigning a unique identifier for each of the plurality of identified root certificates; and

listing at least the unique identifier of each of the identified root certificate in the first list.

6. The method of claim 5 , wherein scanning the extracted contents to identify the root certificates further comprises:

searching for file name extensions of common digital certificates.

7. The method of claim 5 , wherein generating the second list further comprises:

retrieving the first list and the second list from a certificate directory in the host;

assigning a unique identifier for each of the retrieved root certificate list; and

listing at least the unique identifier of each of the retrieved root certificate list in the second list.

8. The method of claim 1 , wherein the data structure includes at least one of: a file having a standard format and a file system structure.

9. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for detecting vulnerable root certificates in container images, the process comprising:

receiving an event to scan at least one container image hosted in a host device, wherein the at least one container image includes resources utilized to execute, by the host device, at least a respective software container;

extracting contents of layers of the at least one container image, wherein extracting the contents of layers of the at least one container image further comprises reformatting at least one base image into a data structure;

scanning the extracted contents to generate a first list designating all root certificates included in the at least one container image, wherein scanning the extracted contents further comprises searching for strings formatted according to a standard public key infrastructure (PKI) format;

generating a second list designating all root certificates trusted by the host device; comparing the first list to the second list to detect at least one root certificate designated in the first list but not in the second; and

determining the at least one detected root certificate as vulnerable, wherein the detection of vulnerabilities in the at least one base image is performed prior to the execution of the at least the respective software application container.

10. A host device for detecting vulnerable root certificates in container images, comprising:

a processing system; and

a memory, the memory containing instructions that, when executed by the processing system, configure the host device to:

receive an event to scan at least one container image hosted in a host device, wherein the at least one container image includes resources utilized to execute, by the host device, at least a respective application container;

extract contents of layers of the at least one container image;

reformat at least one base image into a data structure;

scan the extracted contents to generate a first list designating all root certificates included in the at least one container image, wherein scanning the extracted contents further comprises searching for strings formatted according to a standard public key infrastructure (PKI) format;

generate a second list designating all root certificates trusted by the host device;

compare the first list to the second list to detect at least one root certificate designated in the first list but not in the second; and

determine the at least one detected root certificate as vulnerable, wherein the detection of vulnerabilities in the at least one base image is performed prior to the execution of the at least the respective application container.

11. The system of claim 10 , wherein the host device is further configured to: check each root certificate designated in the first list for validity; and determine any root certificate that failed the validity check as vulnerable.

12. The host device of claim 11 , wherein the host device is further configured to:

generate a detection event upon determination of at least one of the checked root certificates as vulnerable.

13. The host device of claim 11 , wherein the host device is further configured to:

for each root certificate, compare contents of the root certificate to the contents of a respective trusted root certificate; and

when the compared certificates' contents do not match for one of the root certificates, determining the root certificate as vulnerable.

14. The host device of claim 11 , wherein the host device is further configured to:

scan the extracted contents to identify a plurality of identified root certificates;

assign a unique identifier for each of the plurality of the identified root certificates; and

list at least the unique identifier of each of the identified root certificate in the first list.

15. The host device of claim 14 , wherein the host device is further configured to:

search file name extensions of common digital certificates.

16. The host device of claim 15 , wherein the host device is further configured to:

retrieve the first list and the second list from a certificate directory in the host;

assign a unique identifier for each of the retrieved root certificate list; and

list at least the unique identifier of each of the retrieved root certificate list in the second list.

17. The host device of claim 10 , wherein the data structure includes at least one of: a file having a standard format and a file system structure.