Demo repository showcasing some of the possibilities of Aqua Trivy.
Let's look at an example of scanning an image using Trivy:
> trivy image python:3.4-alpineThe output:
2023-05-06T15:29:29.058Z INFO Need to update DB
2023-05-06T15:29:29.058Z INFO DB Repository: ghcr.io/aquasecurity/trivy-db
2023-05-06T15:29:29.058Z INFO Downloading DB...
36.61 MiB / 36.61 MiB [----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 9.89 MiB p/s 3.9s
2023-05-06T15:29:34.194Z INFO Vulnerability scanning is enabled
2023-05-06T15:29:34.194Z INFO Secret scanning is enabled
2023-05-06T15:29:34.194Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-05-06T15:29:34.194Z INFO Please see also https://aquasecurity.github.io/trivy/v0.41/docs/secret/scanning/#recommendation for faster secret detection
2023-05-06T15:29:39.449Z INFO Detected OS: alpine
2023-05-06T15:29:39.450Z INFO Detecting Alpine vulnerabilities...
2023-05-06T15:29:39.450Z INFO Number of language-specific files: 1
2023-05-06T15:29:39.450Z INFO Detecting python-pkg vulnerabilities...
2023-05-06T15:29:39.452Z WARN This OS version is no longer supported by the distribution: alpine 3.9.2
2023-05-06T15:29:39.452Z WARN The vulnerability detection may be insufficient because security updates are not provided
python:3.4-alpine (alpine 3.9.2)
Total: 37 (UNKNOWN: 0, LOW: 4, MEDIUM: 16, HIGH: 13, CRITICAL: 4)
āāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāā¬āāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā Library ā Vulnerability ā Severity ā Installed Version ā Fixed Version ā Title ā
āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā expat ā CVE-2018-20843 ā HIGH ā 2.2.6-r0 ā 2.2.7-r0 ā expat: large number of colons in input makes parser consume ā
ā ā ā ā ā ā high amount... ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2018-20843 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2019-15903 ā ā ā 2.2.7-r1 ā expat: heap-based buffer over-read via crafted XML input ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-15903 ā
āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā libbz2 ā CVE-2019-12900 ā CRITICAL ā 1.0.6-r6 ā 1.0.6-r7 ā bzip2: out-of-bounds write in function BZ2_decompress ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-12900 ā
āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā libcrypto1.1 ā CVE-2019-1543 ā HIGH ā 1.1.1a-r1 ā 1.1.1b-r1 ā openssl: ChaCha20-Poly1305 with long nonces ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-1543 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2020-1967 ā ā ā 1.1.1g-r0 ā openssl: Segmentation fault in SSL_check_chain causes denial ā
ā ā ā ā ā ā of service ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2020-1967 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2021-23840 ā ā ā 1.1.1j-r0 ā openssl: integer overflow in CipherUpdate ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2021-23840 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2021-3450 ā ā ā 1.1.1k-r0 ā openssl: CA certificate check bypass with ā
ā ā ā ā ā ā X509_V_FLAG_X509_STRICT ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2021-3450 ā
ā āāāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¤ āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2019-1547 ā MEDIUM ā ā 1.1.1d-r0 ā openssl: side-channel weak encryption vulnerability ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-1547 ā
ā āāāāāāāāāāāāāāāāāā¤ ā ā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2019-1549 ā ā ā ā openssl: information disclosure in fork() ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-1549 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2019-1551 ā ā ā 1.1.1d-r2 ā openssl: Integer overflow in RSAZ modular exponentiation on ā
ā ā ā ā ā ā x86_64 ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-1551 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2020-1971 ā ā ā 1.1.1i-r0 ā openssl: EDIPARTYNAME NULL pointer de-reference ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2020-1971 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2021-23841 ā ā ā 1.1.1j-r0 ā openssl: NULL pointer dereference in ā
ā ā ā ā ā ā X509_issuer_and_serial_hash() ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2021-23841 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2021-3449 ā ā ā 1.1.1k-r0 ā openssl: NULL pointer dereference in signature_algorithms ā
ā ā ā ā ā ā processing ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2021-3449 ā
ā āāāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¤ āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2019-1563 ā LOW ā ā 1.1.1d-r0 ā openssl: information disclosure in PKCS7_dataDecode and ā
ā ā ā ā ā ā CMS_decrypt_set1_pkey ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-1563 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2021-23839 ā ā ā 1.1.1j-r0 ā openssl: incorrect SSLv2 rollback protection ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2021-23839 ā
āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¤ āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā libssl1.1 ā CVE-2019-1543 ā HIGH ā ā 1.1.1b-r1 ā openssl: ChaCha20-Poly1305 with long nonces ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-1543 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2020-1967 ā ā ā 1.1.1g-r0 ā openssl: Segmentation fault in SSL_check_chain causes denial ā
ā ā ā ā ā ā of service ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2020-1967 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2021-23840 ā ā ā 1.1.1j-r0 ā openssl: integer overflow in CipherUpdate ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2021-23840 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2021-3450 ā ā ā 1.1.1k-r0 ā openssl: CA certificate check bypass with ā
ā ā ā ā ā ā X509_V_FLAG_X509_STRICT ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2021-3450 ā
ā āāāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¤ āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2019-1547 ā MEDIUM ā ā 1.1.1d-r0 ā openssl: side-channel weak encryption vulnerability ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-1547 ā
ā āāāāāāāāāāāāāāāāāā¤ ā ā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2019-1549 ā ā ā ā openssl: information disclosure in fork() ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-1549 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2019-1551 ā ā ā 1.1.1d-r2 ā openssl: Integer overflow in RSAZ modular exponentiation on ā
ā ā ā ā ā ā x86_64 ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-1551 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2020-1971 ā ā ā 1.1.1i-r0 ā openssl: EDIPARTYNAME NULL pointer de-reference ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2020-1971 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2021-23841 ā ā ā 1.1.1j-r0 ā openssl: NULL pointer dereference in ā
ā ā ā ā ā ā X509_issuer_and_serial_hash() ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2021-23841 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2021-3449 ā ā ā 1.1.1k-r0 ā openssl: NULL pointer dereference in signature_algorithms ā
ā ā ā ā ā ā processing ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2021-3449 ā
ā āāāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¤ āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2019-1563 ā LOW ā ā 1.1.1d-r0 ā openssl: information disclosure in PKCS7_dataDecode and ā
ā ā ā ā ā ā CMS_decrypt_set1_pkey ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-1563 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2021-23839 ā ā ā 1.1.1j-r0 ā openssl: incorrect SSLv2 rollback protection ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2021-23839 ā
āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā musl ā CVE-2019-14697 ā CRITICAL ā 1.1.20-r4 ā 1.1.20-r5 ā musl libc through 1.1.23 has an x87 floating-point stack ā
ā ā ā ā ā ā adjustment im ...... ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-14697 ā
ā āāāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¤ āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2020-28928 ā MEDIUM ā ā 1.1.20-r6 ā In musl libc through 1.2.1, wcsnrtombs mishandles particular ā
ā ā ā ā ā ā combinati ... ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2020-28928 ā
āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¤ āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā musl-utils ā CVE-2019-14697 ā CRITICAL ā ā 1.1.20-r5 ā musl libc through 1.1.23 has an x87 floating-point stack ā
ā ā ā ā ā ā adjustment im ...... ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-14697 ā
ā āāāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¤ āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2020-28928 ā MEDIUM ā ā 1.1.20-r6 ā In musl libc through 1.2.1, wcsnrtombs mishandles particular ā
ā ā ā ā ā ā combinati ... ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2020-28928 ā
āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā sqlite-libs ā CVE-2019-8457 ā CRITICAL ā 3.26.0-r3 ā 3.28.0-r0 ā sqlite: heap out-of-bound read in function rtreenode() ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-8457 ā
ā āāāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¤ āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2019-19244 ā HIGH ā ā 3.28.0-r2 ā sqlite: allows a crash if a sub-select uses both DISTINCT ā
ā ā ā ā ā ā and window... ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-19244 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2019-5018 ā ā ā 3.28.0-r0 ā sqlite: Use-after-free in window function leading to remote ā
ā ā ā ā ā ā code execution ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-5018 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2020-11655 ā ā ā 3.28.0-r3 ā sqlite: malformed window-function query leads to DoS ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2020-11655 ā
ā āāāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¤ āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2019-16168 ā MEDIUM ā ā 3.28.0-r1 ā sqlite: Division by zero in whereLoopAddBtreeIndex in ā
ā ā ā ā ā ā sqlite3.c ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-16168 ā
ā āāāāāāāāāāāāāāāāāā¤ ā āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2019-19242 ā ā ā 3.28.0-r2 ā sqlite: SQL injection in sqlite3ExprCodeTarget in expr.c ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-19242 ā
āāāāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāā“āāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
2023-05-06T15:29:39.463Z INFO Table result includes only package filenames. Use '--format json' option to get the full path to the package file.
Python (python-pkg)
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 2, CRITICAL: 0)
āāāāāāāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāā¬āāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā Library ā Vulnerability ā Severity ā Installed Version ā Fixed Version ā Title ā
āāāāāāāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā pip (METADATA) ā CVE-2019-20916 ā HIGH ā 19.0.3 ā 19.2 ā python-pip: directory traversal in _download_http_url() ā
ā ā ā ā ā ā function in src/pip/_internal/download.py ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-20916 ā
ā āāāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¤ āāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā ā CVE-2021-3572 ā MEDIUM ā ā 21.1 ā python-pip: Incorrect handling of unicode separators in git ā
ā ā ā ā ā ā references ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2021-3572 ā
āāāāāāāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāā¤ āāāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā setuptools (METADATA) ā CVE-2022-40897 ā ā 40.8.0 ā 65.5.1 ā Regular Expression Denial of Service (ReDoS) in ā
ā ā ā ā ā ā package_index.py ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2022-40897 ā
āāāāāāāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā wheel (METADATA) ā CVE-2022-40898 ā HIGH ā 0.33.1 ā 0.38.1 ā remote attackers can cause denial of service via attacker ā
ā ā ā ā ā ā controlled input... ā
ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2022-40898 ā
āāāāāāāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāā“āāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
You can scan a Dockerfile by running the Trivy scan on the Dockerfile, e.g., scanning-targets/Dockerfile.
trivy config scanning-targets/DockerfileYou can also scan a Dockerfile by embedding and running the Trivy scan during the build, e.g., scanning-targets/Dockerfile.
docker build -t scanned-image scanning-targets/The --exit-code specifies the exit code when any security issues are found, thus running it with the example from the Dockerfile in scanning-targets/ will fail the Dockerbuild if the status code is 1 (which in this case it is).
The output:
[+] Building 16.2s (5/5) FINISHED => [internal] load build definition from Dockerfile 0.0s => => transferring dockerfile: 262B 0.0s => [internal] load .dockerignore 0.0s => => transferring context: 2B 0.0s => [internal] load metadata for docker.io/library/alpine:3.7 0.6s => CACHED [1/2] FROM docker.io/library/alpine:3.7@sha256:8421d9a84432575381bfabd248f1eb56f3aa21d9d7cd2511583c68c9 0.0s => ERROR [2/2] RUN apk add curl && curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/master/con 15.5s ------ > [2/2] RUN apk add curl && curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/master/contrib/install.sh | sh -s -- -b /usr/local/bin && trivy filesystem --exit-code 1 --no-progress /: #5 0.366 fetch http://dl-cdn.alpinelinux.org/alpine/v3.7/main/x86_64/APKINDEX.tar.gz #5 0.634 fetch http://dl-cdn.alpinelinux.org/alpine/v3.7/community/x86_64/APKINDEX.tar.gz #5 0.778 (1/4) Installing ca-certificates (20190108-r0) #5 0.852 (2/4) Installing libssh2 (1.9.0-r1) #5 0.912 (3/4) Installing libcurl (7.61.1-r3) #5 0.986 (4/4) Installing curl (7.61.1-r3) #5 1.051 Executing busybox-1.27.2-r11.trigger #5 1.056 Executing ca-certificates-20190108-r0.trigger #5 1.119 OK: 6 MiB in 17 packages #5 1.330 aquasecurity/trivy info checking GitHub for latest tag #5 1.892 aquasecurity/trivy info found version: 0.41.0 for v0.41.0/Linux/64bit #5 8.685 aquasecurity/trivy info installed /usr/local/bin/trivy #5 9.131 2023-05-07T07:28:11.532Z INFO Need to update DB #5 9.131 2023-05-07T07:28:11.532Z INFO DB Repository: ghcr.io/aquasecurity/trivy-db #5 9.131 2023-05-07T07:28:11.532Z INFO Downloading DB... #5 14.80 2023-05-07T07:28:17.195Z INFO Vulnerability scanning is enabled #5 14.80 2023-05-07T07:28:17.196Z INFO Secret scanning is enabled #5 14.80 2023-05-07T07:28:17.196Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning #5 14.80 2023-05-07T07:28:17.196Z INFO Please see also https://aquasecurity.github.io/trivy/v0.41/docs/secret/scanning/#recommendation for faster secret detection #5 14.99 2023-05-07T07:28:17.393Z INFO Detected OS: alpine #5 14.99 2023-05-07T07:28:17.393Z INFO Detecting Alpine vulnerabilities... #5 14.99 2023-05-07T07:28:17.394Z INFO Number of language-specific files: 0 #5 14.99 2023-05-07T07:28:17.394Z WARN This OS version is no longer supported by the distribution: alpine 3.7.3 #5 14.99 2023-05-07T07:28:17.394Z WARN The vulnerability detection may be insufficient because security updates are not provided #5 15.00 #5 15.00 localhost (alpine 3.7.3) #5 15.00 ======================== #5 15.00 Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 2) #5 15.00 #5 15.00 āāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāā¬āāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā #5 15.00 ā Library ā Vulnerability ā Severity ā Installed Version ā Fixed Version ā Title ā #5 15.00 āāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤ #5 15.00 ā musl ā CVE-2019-14697 ā CRITICAL ā 1.1.18-r3 ā 1.1.18-r4 ā musl libc through 1.1.23 has an x87 floating-point stack ā #5 15.00 ā ā ā ā ā ā adjustment im ...... ā #5 15.00 ā ā ā ā ā ā https://avd.aquasec.com/nvd/cve-2019-14697 ā #5 15.00 āāāāāāāāāāāāāā¤ ā ā ā ā ā #5 15.00 ā musl-utils ā ā ā ā ā ā #5 15.00 ā ā ā ā ā ā ā #5 15.00 ā ā ā ā ā ā ā #5 15.00 āāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāā“āāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā ------ executor failed running [/bin/sh -c apk add curl && curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/master/contrib/install.sh | sh -s -- -b /usr/local/bin && trivy filesystem --exit-code 1 --no-progress /]: exit code: 1The .github/workflows/trivy-scann.yaml show how to integrate Dockerfile scanning using Trivy and GH Action. You will find the results in the Security tab in GH.
To create a cluster, run the following command:
kind create cluster --name trivy-demokind get kubeconfig --name trivy-demo > ~/.kube/configFollowing the instructions here to install Trivy using Helm.
k get vulnerabilityreports.aquasecurity.github.io
k get vulnerabilityreports.aquasecurity.github.io {report-name} -o yaml