tquizzle/clamav-alpine

ClamAV on Alpine

Hi , I'm Travis Quinnelly

About me

• 🔭 I’m currently working on Leadership and Engagement.

• 📝 I occasionally write articles on TravisQ.com

• 💬 Ask me about Virutalization, bash, linux, security, leadership, engineering, architecture, microservices, etc...

• ⚡ Fun fact I'm mostly ambidextrous and love to DJ!

Docker Contribs

ClamAV-Alpine

Ghost-Docker

Softwares and Tools

Github Stats

---

Let's Connect..!

clamav-alpine's Issues

max file size doesn't work in post arguments

logs:

08/12/2023 7:11:19 PM
ERROR: Incorrect argument format for option --max-filesize
08/12/2023 7:11:19 PM
ERROR: Can't parse command line options

my command line is

-i --cross-fs=yes -alert-encrypted=yes --max-filesize=2G --move /infected --bell

Clamav with Nextcloud

NC keeps asking for the default streamlength yet this doesn't seem to be a confinable variable. I set the max file size to 400M using the variables and 419430400 bytes in NC. No joy, any ideas?

?

--log= host or container path?

With the --log option, is this a host or container path? Both of them have given me errors!

Critical error with current release

I posted this error in the support thread but thought it wouldn’t hurt to post the issue here as well. After the most recent update I’m getting this error flooding my logs-
LibClamAV Error: CRITICAL: fmap() failed

I still get notifications that the scan completed successfully even though it appears to be failing.

There are multiple reports of this in the support thread. It seems to have been an issue which was fixed previously in ClamAV but perhaps there is some regression?

[Question] How would I give my pc/Docker more time to pull the database?

Every time I build the database it seems like the container gets stuck at a different place when pulling the database.

Example:
Time: 4.7s, ETA: 4.0s [=============> ] 55.22MiB/101.46MiB
Personally I think that this has to do with the connection timeout. How would I increase for example the ReceiveTimeout proptery from the config?

This only happens when I build my own image. When I pull this image:
docker run -it -v /opt:/scan:ro tquinnelly/clamav-alpine -i
The download does get completed. But I would like to make my own Image.

Unraid: Icon Url is not valid anymore

Hi,

can you please update the Icon Url for Unraid? It´s not valid anymore.

NEW VALUE: https://raw.githubusercontent.com/tquizzle/clamav-alpine/master/img/clamav.png

and if you add "--user=99:100" to the Extra Parameters: you don´t need to do any manually permission changes on the filesystem itself anymore. The Docker App would work directly without any changes.

Thanks!

3 libraries with 9 high CVE's

+--------------+------------------+----------+-------------------+---------------+---------------------------------------+
|   LIBRARY    | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
+--------------+------------------+----------+-------------------+---------------+---------------------------------------+
| libcrypto1.1 | CVE-2021-23839   | HIGH     | 1.1.1i-r0         | 1.1.1j-r0     | openssl: incorrect SSLv2              |
|              |                  |          |                   |               | rollback protection                   |
|              |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-23839 |
+              +------------------+          +                   +               +---------------------------------------+
|              | CVE-2021-23840   |          |                   |               | openssl: integer                      |
|              |                  |          |                   |               | overflow in CipherUpdate              |
|              |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-23840 |
+              +------------------+          +                   +               +---------------------------------------+
|              | CVE-2021-23841   |          |                   |               | openssl: NULL pointer dereference     |
|              |                  |          |                   |               | in X509_issuer_and_serial_hash()      |
|              |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-23841 |
+--------------+------------------+          +                   +               +---------------------------------------+
| libssl1.1    | CVE-2021-23839   |          |                   |               | openssl: incorrect SSLv2              |
|              |                  |          |                   |               | rollback protection                   |
|              |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-23839 |
+              +------------------+          +                   +               +---------------------------------------+
|              | CVE-2021-23840   |          |                   |               | openssl: integer                      |
|              |                  |          |                   |               | overflow in CipherUpdate              |
|              |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-23840 |
+              +------------------+          +                   +               +---------------------------------------+
|              | CVE-2021-23841   |          |                   |               | openssl: NULL pointer dereference     |
|              |                  |          |                   |               | in X509_issuer_and_serial_hash()      |
|              |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-23841 |
+--------------+------------------+          +                   +               +---------------------------------------+
| openssl      | CVE-2021-23839   |          |                   |               | openssl: incorrect SSLv2              |
|              |                  |          |                   |               | rollback protection                   |
|              |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-23839 |
+              +------------------+          +                   +               +---------------------------------------+
|              | CVE-2021-23840   |          |                   |               | openssl: integer                      |
|              |                  |          |                   |               | overflow in CipherUpdate              |
|              |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-23840 |
+              +------------------+          +                   +               +---------------------------------------+
|              | CVE-2021-23841   |          |                   |               | openssl: NULL pointer dereference     |
|              |                  |          |                   |               | in X509_issuer_and_serial_hash()      |
|              |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-23841 |
+--------------+------------------+----------+-------------------+---------------+---------------------------------------+

Support for ClamAV Version 1.0?

Recently I've been getting this error while scanning some files

LibClamAV Warning: crtmgr_rsa_verify: verification failed: fp_exptmod failed with 1

Looks like it was addressed in ClamAV itself with in issue here: Cisco-Talos/clamav#604

Only problem with that is that it looks like the merge is only going to be supported for version 1.0 as per this merge from October: Cisco-Talos/clamav#727 (comment)

So was mainly wondering if there are any current plans to or if it would be feasible to add support for/update to ClamAV Version 1.0?

Use of optional parameter?

Can you expose an optional parameter --file-list=FILE - scan files from FILE? More details on https://www.clamav.net/documents/scanning

Why? I have multiple /mnt/points/and/many/folders/hundreds of thousands of files/ and would ideally define a file which contains the much smaller subset of /mnt/point/folders I want to have scanned.

Currently it takes over a day to scan all the files and thrashes my poor drives for the duration!

scan folder when autmatic when files is dropped

It would be a great function to have, if the container scanned when files got dropped scanned folder

DB not updating and no files scanned

After the latest updates, the ClamAV database is no longer updating, and its not scanning any files.

Digest: sha256:c165d10772857a9003ca4b44314241372065fcda81f62cccb943039058ab95d7
Status: Downloaded newer image for tquinnelly/clamav-alpine:latest
----------- SCAN SUMMARY -----------
Known viruses: 0
Engine version: 0.102.1
Scanned directories: 0
Scanned files: 0
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 0.003 sec (0 m 0 s)