← Scan another repo

github.com/d2l-ai/d2l-zh

@ e6b18ccea714

Submitted 8/4/2026, 10:25:55 AM · Status: ok

Risk grade
F
100 / 100
Findings
48
0 critical5 high24 medium19 low0 info0 on CISA KEV0ATT&CK
Showing 48 of 48 findings

Findings

  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyci/docker/Dockerfile.d2l-builder:17
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyci/docker/Dockerfile.d2l-builder:18
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyci/docker/Dockerfile.d2l-builder:26
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyci/docker/Dockerfile.d2l-builder:14
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyci/docker/Dockerfile.d2l-zh-paddle:12
  • Ensure that COPY is used instead of ADD in Dockerfiles
    Ensure that COPY is used instead of ADD in Dockerfiles on /ci/docker/Dockerfile.d2l-zh-tf.ADD
    checkovci/docker/Dockerfile.d2l-zh-tf:8
  • Ensure that COPY is used instead of ADD in Dockerfiles
    Ensure that COPY is used instead of ADD in Dockerfiles on /ci/docker/Dockerfile.d2l-zh-torch.ADD
    checkovci/docker/Dockerfile.d2l-zh-torch:8
  • Ensure that COPY is used instead of ADD in Dockerfiles
    Ensure that COPY is used instead of ADD in Dockerfiles on /ci/docker/Dockerfile.d2l-zh-paddle.ADD
    checkovci/docker/Dockerfile.d2l-zh-paddle:8
  • Ensure that COPY is used instead of ADD in Dockerfiles
    Ensure that COPY is used instead of ADD in Dockerfiles on /ci/docker/Dockerfile.d2l-zh-mxnet.ADD
    checkovci/docker/Dockerfile.d2l-zh-mxnet:8
  • Ensure that COPY is used instead of ADD in Dockerfiles
    Ensure that COPY is used instead of ADD in Dockerfiles on /ci/docker/Dockerfile.d2l-builder.ADD
    checkovci/docker/Dockerfile.d2l-builder:7
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /ci/docker/Dockerfile.d2l-zh-tf.
    checkovci/docker/Dockerfile.d2l-zh-tf:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /ci/docker/Dockerfile.d2l-zh-torch.
    checkovci/docker/Dockerfile.d2l-zh-torch:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /ci/docker/Dockerfile.d2l-zh-paddle.
    checkovci/docker/Dockerfile.d2l-zh-paddle:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /ci/docker/Dockerfile.d2l-zh-mxnet.
    checkovci/docker/Dockerfile.d2l-zh-mxnet:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /ci/docker/Dockerfile.d2l-builder.
    checkovci/docker/Dockerfile.d2l-builder:1
  • Ensure the base image uses a non latest version tag
    Ensure the base image uses a non latest version tag on /ci/docker/Dockerfile.d2l-builder.FROM
    checkovci/docker/Dockerfile.d2l-builder:1
  • The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
    The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Build Docker Image)
    checkov.github/workflows/build-docker.yml:6
  • The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
    The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Clear CI Cache)
    checkov.github/workflows/clear-cache.yml:6
  • Incorrect Comparison in NumPy
    grypeCVE-2021-34141EPSS 1.6%
  • Requests `Session` object does not verify requests after making first request with verify=False
    grypeCVE-2024-35195EPSS 0.3%
  • Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
    grypeCVE-2026-25645EPSS 0.2%
  • Requests vulnerable to .netrc credentials leak via malicious URLs
    grypeCVE-2024-47081EPSS 0.9%
  • Unintended leak of Proxy-Authorization header in requests
    grypeCVE-2023-32681EPSS 3.0%
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepd2l/torch.py:379
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepd2l/mxnet.py:352
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepd2l/paddle.py:390
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepd2l/tensorflow.py:368
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepchapter_recurrent-modern/seq2seq_origin.md:63
  • ':latest' tag used
    When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated.
    trivyci/docker/Dockerfile.d2l-builder:1
  • ADD instead of COPY
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    trivyci/docker/Dockerfile.d2l-zh-torch:12
  • ADD instead of COPY
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    trivyci/docker/Dockerfile.d2l-zh-torch:26
  • ADD instead of COPY
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    trivyci/docker/Dockerfile.d2l-builder:7
  • ADD instead of COPY
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    trivyci/docker/Dockerfile.d2l-builder:11
  • ADD instead of COPY
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    trivyci/docker/Dockerfile.d2l-zh-mxnet:8
  • ADD instead of COPY
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    trivyci/docker/Dockerfile.d2l-zh-mxnet:12
  • ADD instead of COPY
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    trivyci/docker/Dockerfile.d2l-zh-mxnet:29
  • ADD instead of COPY
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    trivyci/docker/Dockerfile.d2l-zh-paddle:8
  • ADD instead of COPY
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    trivyci/docker/Dockerfile.d2l-zh-paddle:15
  • ADD instead of COPY
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    trivyci/docker/Dockerfile.d2l-zh-paddle:29
  • ADD instead of COPY
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    trivyci/docker/Dockerfile.d2l-zh-tf:8
  • ADD instead of COPY
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    trivyci/docker/Dockerfile.d2l-zh-tf:12
  • ADD instead of COPY
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    trivyci/docker/Dockerfile.d2l-zh-tf:26
  • ADD instead of COPY
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    trivyci/docker/Dockerfile.d2l-zh-torch:8
  • No HEALTHCHECK defined
    You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.
    trivyci/docker/Dockerfile.d2l-zh-torch:0
  • No HEALTHCHECK defined
    You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.
    trivyci/docker/Dockerfile.d2l-zh-tf:0
  • No HEALTHCHECK defined
    You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.
    trivyci/docker/Dockerfile.d2l-builder:0
  • No HEALTHCHECK defined
    You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.
    trivyci/docker/Dockerfile.d2l-zh-mxnet:0
  • No HEALTHCHECK defined
    You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.
    trivyci/docker/Dockerfile.d2l-zh-paddle:0

This report is public.