Replies: 1 comment 2 replies
-
|
Hello @F-exf We currently have statuses for advisories. @knqyf263 wdyt? |
Beta Was this translation helpful? Give feedback.
-
|
Trivy currently doesn't show |
Beta Was this translation helpful? Give feedback.
-
|
As mentioned in the expected behavior there is at least one case which should be reported without impacting the size of the database. This is if a CVE is fixed in another OS release. It is "standard" for maintainer (i.e.: Red Hat Maintenance Support 1 Phase, ) to prioritize fixes in the upstream release of the OS and fix only an handful of CVE in previous releases. For other cases, I would agree that the database size could be an issue. Still I would prefer to have the choice between a scan with potential false positive results and scan with only confirmed vulnerabilities. That is either scan with a lightweight DB and a scan with a "paranoids" DB. In some cases, I rather handle vulnerabilities with a status "under investigation" from the vendor than handling the case where a vulnerability is exploited and have to provide answers to the following questions to management:
|
Beta Was this translation helpful? Give feedback.
-
Description
Trivy uses the official Alpine Linux secdb to report on vulnerabilities affecting Alpine Linux. In the first paragraph of the Alpine Linux Security Issue Tracker page its mentioned that the secdb database only includes the Alpine fixes. The complete list of vulnerabilities being provided by Alpine Linux Security Issue Tracker.
Therefore, Trivy only reports fixed Alpine vulnerabilities.
Desired Behavior
Report "all vulnerabilities affecting" Alpine Linux components and not only the fixed one of the secdb.
As Alpine Linux Security Issue Tracker contains vulnerabilities which could potentially affect components reporting all those vulnerabilities would lead to many false positive. Example of such false positive is the CVE-2023-28118 on the snappy package. The CVE-2023-28118 affect the knplabs/snappy php component and not the google snappy which is provided by Alpine.
That being said, Trivy should at least report vulnerabilities for which there is a fix in other version of Alpine Linux (see the reproduction steps) and vulnerabilities for which there is no fix like CVE-2018-14628 affecting Samba.
Actual Behavior
Only vulnerabilities listed in the Alpine Linux fixed vulnerabilities database of in Alpine Linux secdb are reported by Trivy.
Reproduction Steps
As reported here, the
cupscomponent with versions below 2.4.7 is not fixed in Alpine 3.17 but is fixed in Alpine 3.18.Search the CVE-2023-4504 in the Apline 3.18 secdb and in the Apline 3.17 secdb confirm the vulnerability have been fixed in 3.18 and not in 3.17.
One can create an image based on Alpine 3.17 with cups version 2.4.2-r3 and scan using Trivy as follows:
Create the following Dockerfile named
Dockerfile.cups_3.17Build the Dockerfile
docker build --tag LOCAL_REGISTRY_IP:LOCAL_REGISTRY_PORT/cups:3.17 -f Dockerfile.cups_3.17 .Push the image to a registry running locally
Scan the image using Trivy latest version and database and acknowledge that there is no vulnerability reported.
Then one can create an image based on Alpine 3.18 with cups version 2.4.2-r3 and scan using Trivy as follows:
Dockerfile.cups_3.18docker build --tag LOCAL_REGISTRY_IP:LOCAL_REGISTRY_PORT/cups:3.18 -f Dockerfile.cups_3.18 .Operating System
WSL
Version
Checklist
trivy image --resetBeta Was this translation helpful? Give feedback.
All reactions