diff --git a/dev/docs/configuration/skipping/index.html b/dev/docs/configuration/skipping/index.html
index 62f98f4485..fc4e1b1765 100644
--- a/dev/docs/configuration/skipping/index.html
+++ b/dev/docs/configuration/skipping/index.html
@@ -3758,7 +3758,7 @@ For example, it may be useful when your file name of Dockerfile doesn't match th
 <p>A file pattern contains the analyzer it is used for, and the pattern itself, joined by a semicolon. For example:
 <div class="highlight"><pre><span></span><code>--file-patterns &quot;dockerfile:.*.docker&quot; --file-patterns &quot;kubernetes:*.tpl&quot; --file-patterns &quot;pip:requirements-.*\.txt&quot;
 </code></pre></div></p>
-<p>The prefixes are listed <a href="https://github.com/aquasecurity/trivy/tree/0c3e2f08b72c20395c8865e15dc853d91ea01ec9/pkg/fanal/analyzer/const.go">here</a></p>
+<p>The prefixes are listed <a href="https://github.com/aquasecurity/trivy/tree/cbbd1ce1f07ea2a440c08b6902958f0af6977b25/pkg/fanal/analyzer/const.go">here</a></p>
 
               
             </article>
diff --git a/dev/docs/scanner/misconfiguration/policy/exceptions/index.html b/dev/docs/scanner/misconfiguration/policy/exceptions/index.html
index 976c10780b..c151d0334c 100644
--- a/dev/docs/scanner/misconfiguration/policy/exceptions/index.html
+++ b/dev/docs/scanner/misconfiguration/policy/exceptions/index.html
@@ -3611,7 +3611,7 @@ exception[ns] {
 </code></pre></div>
 </div>
 <p>This example exempts all built-in policies for Kubernetes.</p>
-<p>For more details, see <a href="https://github.com/aquasecurity/trivy/tree/0c3e2f08b72c20395c8865e15dc853d91ea01ec9/examples/misconf/namespace-exception">an example</a>.</p>
+<p>For more details, see <a href="https://github.com/aquasecurity/trivy/tree/cbbd1ce1f07ea2a440c08b6902958f0af6977b25/examples/misconf/namespace-exception">an example</a>.</p>
 <h2 id="rule-based-exceptions">Rule-based exceptions</h2>
 <p>There are some cases where you need more flexibility and granularity in defining which cases to exempt.
 Rule-based exceptions lets you granularly choose which individual rules to exempt, while also declaring under which conditions to exempt them.</p>
@@ -3663,7 +3663,7 @@ exception[rules] {
 </div>
 <p>This exception is applied to <a href="https://github.com/aquasecurity/defsec/blob/master/internal/rules/kubernetes/policies/pss/restricted/3_runs_as_root.rego">KSV012</a> in defsec.
 You can get the package names in the <a href="https://github.com/aquasecurity/defsec/">defsec repository</a> or the JSON output from Trivy.</p>
-<p>For more details, see <a href="https://github.com/aquasecurity/trivy/tree/0c3e2f08b72c20395c8865e15dc853d91ea01ec9/examples/misconf/rule-exception">an example</a>.</p>
+<p>For more details, see <a href="https://github.com/aquasecurity/trivy/tree/cbbd1ce1f07ea2a440c08b6902958f0af6977b25/examples/misconf/rule-exception">an example</a>.</p>
 
               
             </article>
diff --git a/dev/docs/scanner/vulnerability/index.html b/dev/docs/scanner/vulnerability/index.html
index 02a29c428f..6cca0e86ec 100644
--- a/dev/docs/scanner/vulnerability/index.html
+++ b/dev/docs/scanner/vulnerability/index.html
@@ -3867,6 +3867,7 @@ You're not viewing the latest version.
 <ul>
 <li><a href="#os-packages">OS packages</a></li>
 <li><a href="#language-specific-packages">Language-specific packages</a></li>
+<li><a href="#kubernetes-components-control-plane-node-and-addons">Kubernetes components (control plane, node and addons)</a></li>
 </ul>
 <p>Trivy also detects known vulnerabilities in Kubernetes components using KBOM (Kubernetes bill of Material) scanning. To learn more, see the <a href="../../target/kubernetes/#KBOM">documentation for Kubernetes scanning</a>.</p>
 <h2 id="os-packages">OS Packages</h2>
diff --git a/dev/search/search_index.json b/dev/search/search_index.json
index 63a4a437d1..3e69a2c7a3 100644
--- a/dev/search/search_index.json
+++ b/dev/search/search_index.json
@@ -1 +1 @@
-{"config":{"indexing":"full","lang":["en"],"min_search_length":3,"prebuild_index":false,"separator":"[\\s\\-]+"},"docs":[{"location":"","text":"Trivy Documentation \ud83d\udc4b Welcome to Trivy Documentation! To help you get around, please notice the different sections at the top global menu: You are currently in the Getting Started section where you can find general information and help with first steps. In the Tutorials section you can find step-by-step guides that help you accomplish specific tasks. In the Docs section you can find the complete reference documentation for all of the different features and settings that Trivy has to offer. In the Ecosystem section you can find how Trivy works together with other tools and applications that you might already use. In the Contributing section you can find technical developer documentation and contribution guidelines. About Trivy Trivy ( pronunciation ) is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues. Targets (what Trivy can scan): Container Image Filesystem Git Repository (remote) Virtual Machine Image Kubernetes AWS Scanners (what Trivy can find there): OS packages and software dependencies in use (SBOM) Known vulnerabilities (CVEs) IaC issues and misconfigurations Sensitive information and secrets Software licenses Trivy supports most popular programming languages, operating systems, and platforms. For a complete list, see the Scanning Coverage page. To learn more, go to the Trivy homepage for feature highlights, or to the Documentation site for detailed information. Quick Start Get Trivy Trivy is available in most common distribution channels. The complete list of installation options is available in the Installation page. Here are a few popular examples: brew install trivy docker run aquasec/trivy Download binary from https://github.com/aquasecurity/trivy/releases/latest/ See Installation for more Trivy is integrated with many popular platforms and applications. The complete list of integrations is available in the Ecosystem page. Here are a few popular options examples: GitHub Actions Kubernetes operator VS Code plugin See Ecosystem for more General usage trivy <target> [ --scanners <scanner1,scanner2> ] <subject> Examples: trivy image python:3.4-alpine Result Demo: Vulnerability Detection trivy fs --scanners vuln,secret,config myproject/ Result Demo: Misconfiguration Detection trivy k8s --report summary cluster Result Demo: Secret Detection Want more? Check out Aqua If you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering. You can find a high level comparison table specific to Trivy users here . In addition check out the https://aquasec.com website for more information about our products and services. If you'd like to contact Aqua or request a demo, please use this form: https://www.aquasec.com/demo Trivy is an Aqua Security open source project. Learn about our open source work and portfolio here . Contact us about any matter by opening a GitHub Discussion here","title":"Overview"},{"location":"#trivy-documentation","text":"\ud83d\udc4b Welcome to Trivy Documentation! To help you get around, please notice the different sections at the top global menu: You are currently in the Getting Started section where you can find general information and help with first steps. In the Tutorials section you can find step-by-step guides that help you accomplish specific tasks. In the Docs section you can find the complete reference documentation for all of the different features and settings that Trivy has to offer. In the Ecosystem section you can find how Trivy works together with other tools and applications that you might already use. In the Contributing section you can find technical developer documentation and contribution guidelines.","title":"Trivy Documentation"},{"location":"#about-trivy","text":"Trivy ( pronunciation ) is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues. Targets (what Trivy can scan): Container Image Filesystem Git Repository (remote) Virtual Machine Image Kubernetes AWS Scanners (what Trivy can find there): OS packages and software dependencies in use (SBOM) Known vulnerabilities (CVEs) IaC issues and misconfigurations Sensitive information and secrets Software licenses Trivy supports most popular programming languages, operating systems, and platforms. For a complete list, see the Scanning Coverage page. To learn more, go to the Trivy homepage for feature highlights, or to the Documentation site for detailed information.","title":"About Trivy"},{"location":"#quick-start","text":"","title":"Quick Start"},{"location":"#get-trivy","text":"Trivy is available in most common distribution channels. The complete list of installation options is available in the Installation page. Here are a few popular examples: brew install trivy docker run aquasec/trivy Download binary from https://github.com/aquasecurity/trivy/releases/latest/ See Installation for more Trivy is integrated with many popular platforms and applications. The complete list of integrations is available in the Ecosystem page. Here are a few popular options examples: GitHub Actions Kubernetes operator VS Code plugin See Ecosystem for more","title":"Get Trivy"},{"location":"#general-usage","text":"trivy <target> [ --scanners <scanner1,scanner2> ] <subject> Examples: trivy image python:3.4-alpine Result Demo: Vulnerability Detection trivy fs --scanners vuln,secret,config myproject/ Result Demo: Misconfiguration Detection trivy k8s --report summary cluster Result Demo: Secret Detection","title":"General usage"},{"location":"#want-more-check-out-aqua","text":"If you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering. You can find a high level comparison table specific to Trivy users here . In addition check out the https://aquasec.com website for more information about our products and services. If you'd like to contact Aqua or request a demo, please use this form: https://www.aquasec.com/demo Trivy is an Aqua Security open source project. Learn about our open source work and portfolio here . Contact us about any matter by opening a GitHub Discussion here","title":"Want more? Check out Aqua"},{"location":"community/contribute/discussion/","text":"Discussions Thank you for taking interest in contributing to Trivy! Trivy uses GitHub Discussion for bug reports, feature requests, and questions. If maintainers decide to accept a new feature or confirm that it is a bug, they will close the discussion and create a GitHub Issue associated with that discussion. Feel free to open discussions for any reason. When you open a new discussion, you'll have to select a discussion category as described below. Please spend a small amount of time giving due diligence to the issue/discussion tracker. Your discussion might be a duplicate. If it is, please add your comment to the existing issue/discussion. Remember that users might search for your issue/discussion in the future, so please give it a meaningful title to help others. The issue should clearly explain the reason for opening, the proposal if you have any, and any relevant technical information. There are 4 categories: \ud83d\udca1 Ideas Share ideas for new features \ud83d\udd0e False Detection Report false positives/negatives \ud83d\udc1b Bugs Report something that is not working as expected \ud83d\ude4f Q&A Ask the community for help Note If you find any false positives or false negatives, please make sure to report them under the \"False Detection\" category, not \"Bugs\". False detection Trivy depends on multiple data sources . Sometime these databases contain mistakes. If Trivy can't detect any CVE-IDs or shows false positive result, at first please follow the next steps: Run Trivy with -f json that shows data sources. According to the shown data source, make sure that the security advisory in the data source is correct. If the data source is correct and Trivy shows wrong results, please raise an issue on Trivy. GitHub Advisory Database Visit here and search CVE-ID. If you find a problem, it'll be nice to fix it: How to contribute to a GitHub security advisory GitLab Advisory Database Visit here and search CVE-ID. If you find a problem, it'll be nice to fix it: Create an issue to GitLab Advisory Database Red Hat CVE Database Visit here and search CVE-ID.","title":"Discussions"},{"location":"community/contribute/discussion/#discussions","text":"Thank you for taking interest in contributing to Trivy! Trivy uses GitHub Discussion for bug reports, feature requests, and questions. If maintainers decide to accept a new feature or confirm that it is a bug, they will close the discussion and create a GitHub Issue associated with that discussion. Feel free to open discussions for any reason. When you open a new discussion, you'll have to select a discussion category as described below. Please spend a small amount of time giving due diligence to the issue/discussion tracker. Your discussion might be a duplicate. If it is, please add your comment to the existing issue/discussion. Remember that users might search for your issue/discussion in the future, so please give it a meaningful title to help others. The issue should clearly explain the reason for opening, the proposal if you have any, and any relevant technical information. There are 4 categories: \ud83d\udca1 Ideas Share ideas for new features \ud83d\udd0e False Detection Report false positives/negatives \ud83d\udc1b Bugs Report something that is not working as expected \ud83d\ude4f Q&A Ask the community for help Note If you find any false positives or false negatives, please make sure to report them under the \"False Detection\" category, not \"Bugs\".","title":"Discussions"},{"location":"community/contribute/discussion/#false-detection","text":"Trivy depends on multiple data sources . Sometime these databases contain mistakes. If Trivy can't detect any CVE-IDs or shows false positive result, at first please follow the next steps: Run Trivy with -f json that shows data sources. According to the shown data source, make sure that the security advisory in the data source is correct. If the data source is correct and Trivy shows wrong results, please raise an issue on Trivy.","title":"False detection"},{"location":"community/contribute/discussion/#github-advisory-database","text":"Visit here and search CVE-ID. If you find a problem, it'll be nice to fix it: How to contribute to a GitHub security advisory","title":"GitHub Advisory Database"},{"location":"community/contribute/discussion/#gitlab-advisory-database","text":"Visit here and search CVE-ID. If you find a problem, it'll be nice to fix it: Create an issue to GitLab Advisory Database","title":"GitLab Advisory Database"},{"location":"community/contribute/discussion/#red-hat-cve-database","text":"Visit here and search CVE-ID.","title":"Red Hat CVE Database"},{"location":"community/contribute/issue/","text":"Issues Thank you for taking interest in contributing to Trivy! Trivy uses GitHub Discussion for bug reports, feature requests, and questions. Warning Issues created by non-maintainers will be immediately closed.","title":"Issues"},{"location":"community/contribute/issue/#issues","text":"Thank you for taking interest in contributing to Trivy! Trivy uses GitHub Discussion for bug reports, feature requests, and questions. Warning Issues created by non-maintainers will be immediately closed.","title":"Issues"},{"location":"community/contribute/pr/","text":"Thank you for taking interest in contributing to Trivy! Every Pull Request should have an associated bug or feature issue unless you are fixing a trivial documentation issue. Please add the associated Issue link in the PR description. Your PR is more likely to be accepted if it focuses on just one change. There's no need to add or tag reviewers. If a reviewer commented on your code or asked for changes, please remember to respond with comment. Do not mark discussion as resolved. It's up to reviewer to mark it resolved (in case if suggested fix addresses problem properly). PRs with unresolved issues should not be merged (even if the comment is unclear or requires no action from your side). Please include a comment with the results before and after your change. Your PR is more likely to be accepted if it includes tests (We have not historically been very strict about tests, but we would like to improve this!). If your PR affects the user experience in some way, please update the README.md and the CLI help accordingly. Development Install the necessary tools for development by following their respective installation instructions. Go Mage Build After making changes to the Go source code, build the project with the following command: $ mage build $ ./trivy -h Lint You must pass the linter checks: $ mage lint:run Additionally, you need to have run go mod tidy , so execute the following command as well: $ mage tidy To autofix linters use the following command: $ mage lint:fix Unit tests Your PR must pass all the unit tests. You can test it as below. $ mage test:unit Integration tests Your PR must pass all the integration tests. You can test it as below. $ mage test:integration Documentation If you update CLI flags, you need to generate the CLI references. The test will fail if they are not up-to-date. $ mage docs:generate You can build the documents as below and view it at http://localhost:8000. $ mage docs:serve Title It is not that strict, but we use the title conventions in this repository. Each commit message doesn't have to follow the conventions as long as it is clear and descriptive since it will be squashed and merged. Format of the title <type>(<scope>): <subject> The type and scope should always be lowercase as shown below. Allowed <type> values: feat for a new feature for the user, not a new feature for build script. Such commit will trigger a release bumping a MINOR version. fix for a bug fix for the user, not a fix to a build script. Such commit will trigger a release bumping a PATCH version. perf for performance improvements. Such commit will trigger a release bumping a PATCH version. docs for changes to the documentation. style for formatting changes, missing semicolons, etc. refactor for refactoring production code, e.g. renaming a variable. test for adding missing tests, refactoring tests; no production code change. build for updating build configuration, development tools or other changes irrelevant to the user. chore for updates that do not apply to the above, such as dependency updates. ci for changes to CI configuration files and scripts revert for revert to a previous commit Allowed <scope> values: checks: vuln misconf secret license mode: image fs repo sbom k8s server aws vm os: alpine redhat alma rocky mariner oracle debian ubuntu amazon suse photon distroless language: ruby php python nodejs rust dotnet java go elixir dart vuln: os lang config: kubernetes dockerfile terraform cloudformation container docker podman containerd oci cli: cli flag SBOM: cyclonedx spdx purl others: helm report db deps The <scope> can be empty (e.g. if the change is a global or difficult to assign to a single component), in which case the parentheses are omitted. Example titles feat(alma): add support for AlmaLinux fix(oracle): handle advisories with ksplice versions docs(misconf): add comparison with Conftest and TFsec chore(deps): bump go.uber.org/zap from 1.19.1 to 1.20.0 NOTE : please do not use chore(deps): update fanal and something like that if you add new features or fix bugs in Trivy-related projects. The PR title should describe what the PR adds or fixes even though it just updates the dependency in Trivy. Commits Understand where your pull request belongs Trivy is composed of several repositories that work together: Trivy is the client-side, user-facing, command line tool. vuln-list is a vulnerability database, aggregated from different sources, and normalized for easy consumption. Think of this as the \"server\" side of the trivy command line tool. There should be no pull requests to this repo vuln-list-update is the code that maintains the vuln-list database. trivy-db maintains the vulnerability database pulled by Trivy CLI. go-dep-parser is a library for parsing lock files such as package-lock.json and Gemfile.lock.","title":"Pull Requests"},{"location":"community/contribute/pr/#development","text":"Install the necessary tools for development by following their respective installation instructions. Go Mage","title":"Development"},{"location":"community/contribute/pr/#build","text":"After making changes to the Go source code, build the project with the following command: $ mage build $ ./trivy -h","title":"Build"},{"location":"community/contribute/pr/#lint","text":"You must pass the linter checks: $ mage lint:run Additionally, you need to have run go mod tidy , so execute the following command as well: $ mage tidy To autofix linters use the following command: $ mage lint:fix","title":"Lint"},{"location":"community/contribute/pr/#unit-tests","text":"Your PR must pass all the unit tests. You can test it as below. $ mage test:unit","title":"Unit tests"},{"location":"community/contribute/pr/#integration-tests","text":"Your PR must pass all the integration tests. You can test it as below. $ mage test:integration","title":"Integration tests"},{"location":"community/contribute/pr/#documentation","text":"If you update CLI flags, you need to generate the CLI references. The test will fail if they are not up-to-date. $ mage docs:generate You can build the documents as below and view it at http://localhost:8000. $ mage docs:serve","title":"Documentation"},{"location":"community/contribute/pr/#title","text":"It is not that strict, but we use the title conventions in this repository. Each commit message doesn't have to follow the conventions as long as it is clear and descriptive since it will be squashed and merged.","title":"Title"},{"location":"community/contribute/pr/#format-of-the-title","text":"<type>(<scope>): <subject> The type and scope should always be lowercase as shown below. Allowed <type> values: feat for a new feature for the user, not a new feature for build script. Such commit will trigger a release bumping a MINOR version. fix for a bug fix for the user, not a fix to a build script. Such commit will trigger a release bumping a PATCH version. perf for performance improvements. Such commit will trigger a release bumping a PATCH version. docs for changes to the documentation. style for formatting changes, missing semicolons, etc. refactor for refactoring production code, e.g. renaming a variable. test for adding missing tests, refactoring tests; no production code change. build for updating build configuration, development tools or other changes irrelevant to the user. chore for updates that do not apply to the above, such as dependency updates. ci for changes to CI configuration files and scripts revert for revert to a previous commit Allowed <scope> values: checks: vuln misconf secret license mode: image fs repo sbom k8s server aws vm os: alpine redhat alma rocky mariner oracle debian ubuntu amazon suse photon distroless language: ruby php python nodejs rust dotnet java go elixir dart vuln: os lang config: kubernetes dockerfile terraform cloudformation container docker podman containerd oci cli: cli flag SBOM: cyclonedx spdx purl others: helm report db deps The <scope> can be empty (e.g. if the change is a global or difficult to assign to a single component), in which case the parentheses are omitted.","title":"Format of the title"},{"location":"community/contribute/pr/#example-titles","text":"feat(alma): add support for AlmaLinux fix(oracle): handle advisories with ksplice versions docs(misconf): add comparison with Conftest and TFsec chore(deps): bump go.uber.org/zap from 1.19.1 to 1.20.0 NOTE : please do not use chore(deps): update fanal and something like that if you add new features or fix bugs in Trivy-related projects. The PR title should describe what the PR adds or fixes even though it just updates the dependency in Trivy.","title":"Example titles"},{"location":"community/contribute/pr/#commits","text":"","title":"Commits"},{"location":"community/contribute/pr/#understand-where-your-pull-request-belongs","text":"Trivy is composed of several repositories that work together: Trivy is the client-side, user-facing, command line tool. vuln-list is a vulnerability database, aggregated from different sources, and normalized for easy consumption. Think of this as the \"server\" side of the trivy command line tool. There should be no pull requests to this repo vuln-list-update is the code that maintains the vuln-list database. trivy-db maintains the vulnerability database pulled by Trivy CLI. go-dep-parser is a library for parsing lock files such as package-lock.json and Gemfile.lock.","title":"Understand where your pull request belongs"},{"location":"community/maintainer/help-wanted/","text":"Overview We use two labels help wanted and good first issue to identify issues that have been specially groomed for new contributors. The good first issue label is a subset of help wanted label, indicating that members have committed to providing extra assistance for new contributors. All good first issue items also have the help wanted label. Help Wanted Items marked with the help wanted label need to ensure that they are: Low Barrier to Entry It should be tractable for new contributors. Documentation on how that type of change should be made should already exist. Clear Task The task is agreed upon and does not require further discussions in the community. Call out if that area of code is untested and requires new fixtures. API / CLI behavior is decided and included in the OP issue, for example: \"The new command syntax is trivy --format yaml IMAGE_NAME \"_ with expected validations called out. Goldilocks priority Not too high that a core contributor should do it, but not too low that it isn't useful enough for a core contributor to spend time to review it, answer questions, help get it into a release, etc. Up-To-Date Often these issues become obsolete and have already been done, are no longer desired, no longer make sense, have changed priority or difficulty , etc. Good First Issue Items marked with the good first issue label are intended for first-time contributors . It indicates that members will keep an eye out for these pull requests and shepherd it through our processes. These items need to ensure that they follow the guidelines for help wanted labels (above) in addition to meeting the following criteria: No Barrier to Entry The task is something that a new contributor can tackle without advanced setup, or domain knowledge. Solution Explained The recommended solution is clearly described in the issue. Provides Context If background knowledge is required, this should be explicitly mentioned and a list of suggested readings included. Gives Examples Link to examples of similar implementations so new contributors have a reference guide for their changes. Identifies Relevant Code The relevant code and tests to be changed should be linked in the issue. Ready to Test There should be existing tests that can be modified, or existing test cases fit to be copied. If the area of code doesn't have tests, before labeling the issue, add a test fixture. This prep often makes a great help wanted task!","title":"Help Wanted"},{"location":"community/maintainer/help-wanted/#overview","text":"We use two labels help wanted and good first issue to identify issues that have been specially groomed for new contributors. The good first issue label is a subset of help wanted label, indicating that members have committed to providing extra assistance for new contributors. All good first issue items also have the help wanted label.","title":"Overview"},{"location":"community/maintainer/help-wanted/#help-wanted","text":"Items marked with the help wanted label need to ensure that they are: Low Barrier to Entry It should be tractable for new contributors. Documentation on how that type of change should be made should already exist. Clear Task The task is agreed upon and does not require further discussions in the community. Call out if that area of code is untested and requires new fixtures. API / CLI behavior is decided and included in the OP issue, for example: \"The new command syntax is trivy --format yaml IMAGE_NAME \"_ with expected validations called out. Goldilocks priority Not too high that a core contributor should do it, but not too low that it isn't useful enough for a core contributor to spend time to review it, answer questions, help get it into a release, etc. Up-To-Date Often these issues become obsolete and have already been done, are no longer desired, no longer make sense, have changed priority or difficulty , etc.","title":"Help Wanted"},{"location":"community/maintainer/help-wanted/#good-first-issue","text":"Items marked with the good first issue label are intended for first-time contributors . It indicates that members will keep an eye out for these pull requests and shepherd it through our processes. These items need to ensure that they follow the guidelines for help wanted labels (above) in addition to meeting the following criteria: No Barrier to Entry The task is something that a new contributor can tackle without advanced setup, or domain knowledge. Solution Explained The recommended solution is clearly described in the issue. Provides Context If background knowledge is required, this should be explicitly mentioned and a list of suggested readings included. Gives Examples Link to examples of similar implementations so new contributors have a reference guide for their changes. Identifies Relevant Code The relevant code and tests to be changed should be linked in the issue. Ready to Test There should be existing tests that can be modified, or existing test cases fit to be copied. If the area of code doesn't have tests, before labeling the issue, add a test fixture. This prep often makes a great help wanted task!","title":"Good First Issue"},{"location":"community/maintainer/triage/","text":"Triage Triage is an important part of maintaining the health of the trivy repo. A well organized repo allows maintainers to prioritize feature requests, fix bugs, and respond to users facing difficulty with the tool as quickly as possible. Triage includes: Labeling issues Responding to issues Closing issues Daily Triage Daily triage has two goals: Responsiveness for new issues Responsiveness when explicitly requested information was provided It covers: Issues without a kind/ or triage/ label Issues without a priority/ label triage/needs-information issues which the user has followed up on, and now require a response. Categorization The most important level of categorizing the issue is defining what type it is. We typically want at least one of the following labels on every issue, and some issues may fall into multiple categories: triage/support - The default for most incoming issues kind/bug - When it\u2019s a bug or we aren\u2019t delivering the best user experience Other possibilities: - kind/feature - Identify new feature requests - kind/testing - Update or fix unit/integration tests - kind/cleanup - Cleaning up/refactoring the codebase - kind/documentation - Updates or additions to trivy documentation If the issue is specific to a driver for OS packages or libraries: co/[driver for OS packages] co/alpine co/amazon co/debian co/oracle co/photon co/redhat co/suse co/ubuntu co/[driver for libraries of programming languages] co/bundler co/cargo co/composer co/npm co/yarn co/pipenv co/poetry Help wanted? Good First Issue - bug has a proposed solution, can be implemented w/o further discussion. Help wanted - if the bug could use help from a contributor Prioritization If the issue is not triage/support , it needs a priority label. priority/critical-urgent - someones top priority ASAP, such as security issue, user-visible bug, or build breakage. Rarely used. priority/important-soon : in time for the next two releases. It should be attached to a milestone. priority/important-longterm : 2-4 releases from now priority/backlog : agreed that this would be good to have, but no one is available at the moment. Consider tagging as help wanted priority/awaiting-more-evidence : may be useful, but there is not yet enough support. Weekly Triage Weekly triage has three goals: Catching up on unresponded issues Reviewing and closing PR\u2019s Closing stale issues Post-Release Triage Post-release triage occurs after a major release (around every 4-6 weeks). It focuses on: Closing bugs that have been resolved by the release Reprioritizing bugs that have not been resolved by the release Letting users know if we believe that there is still an issue This includes reviewing: Every issue that hasn\u2019t been touched in the last 2 days Re-evaluation of long-term issues Re-evaluation of short-term issues Responding to Issues Needs More Information A sample response to ask for more info: I don\u2019t yet have a clear way to replicate this issue. Do you mind adding some additional details. Here is additional information that would be helpful: * The exact trivy command line used * The exact image you want to scan * The full output of the trivy command, preferably with --debug for extra logging. Thank you for sharing your experience! Then: Label with triage/needs-information . Issue might be resolved If you think a release may have resolved an issue, ask the author to see if their issue has been resolved: Could you please check to see if trivy addresses this issue? We've made some changes with how this is handled, and improved the trivy logs output to help us debug tricky cases like this. Then: Label with triage/needs-information . Closing with Care Issues typically need to be closed for the following reasons: The issue has been addressed The issue is a duplicate of an existing issue There has been a lack of information over a long period of time In any of these situations, we aim to be kind when closing the issue, and offer the author action items should they need to reopen their issue or still require a solution. Samples responses for these situations include: Issue has been addressed @author: I believe this issue is now addressed by trivy v1.0.0, as it . If you still see this issue with trivy v1.0 or higher, please reopen this issue. Thank you for reporting this issue! Then: Close the issue Duplicate Issue This issue appears to be a duplicate of #X, do you mind if we move the conversation there? This way we can centralize the content relating to the issue. If you feel that this issue is not in fact a duplicate, please re-open it. If you have additional information to share, please add it to the new issue. Thank you for reporting this! Then: Label with triage/duplicate and close the issue. Lack of Information If an issue hasn't been active for more than four weeks, and the author has been pinged at least once, then the issue can be closed. Hey @author -- hopefully it's OK if I close this - there wasn't enough information to make it actionable, and some time has already passed. If you are able to provide additional details, you may reopen it at any point. Here is additional information that may be helpful to us: * Whether the issue occurs with the latest trivy release * The exact trivy command line used * The exact image you want to scan * The full output of the trivy command, preferably with --debug for extra logging. Thank you for sharing your experience! Then: Close the issue. Help Wanted issues We use two labels help wanted and good first issue to identify issues that have been specially groomed for new contributors. We have specific guidelines for how to use these labels. If you see an issue that satisfies these guidelines, you can add the help wanted label and the good first issue label. Please note that adding the good first issue label must also add the help wanted label. If an issue has these labels but does not satisfy the guidelines, please ask for more details to be added to the issue or remove the labels.","title":"Triage"},{"location":"community/maintainer/triage/#triage","text":"Triage is an important part of maintaining the health of the trivy repo. A well organized repo allows maintainers to prioritize feature requests, fix bugs, and respond to users facing difficulty with the tool as quickly as possible. Triage includes: Labeling issues Responding to issues Closing issues","title":"Triage"},{"location":"community/maintainer/triage/#daily-triage","text":"Daily triage has two goals: Responsiveness for new issues Responsiveness when explicitly requested information was provided It covers: Issues without a kind/ or triage/ label Issues without a priority/ label triage/needs-information issues which the user has followed up on, and now require a response.","title":"Daily Triage"},{"location":"community/maintainer/triage/#categorization","text":"The most important level of categorizing the issue is defining what type it is. We typically want at least one of the following labels on every issue, and some issues may fall into multiple categories: triage/support - The default for most incoming issues kind/bug - When it\u2019s a bug or we aren\u2019t delivering the best user experience Other possibilities: - kind/feature - Identify new feature requests - kind/testing - Update or fix unit/integration tests - kind/cleanup - Cleaning up/refactoring the codebase - kind/documentation - Updates or additions to trivy documentation If the issue is specific to a driver for OS packages or libraries: co/[driver for OS packages] co/alpine co/amazon co/debian co/oracle co/photon co/redhat co/suse co/ubuntu co/[driver for libraries of programming languages] co/bundler co/cargo co/composer co/npm co/yarn co/pipenv co/poetry Help wanted? Good First Issue - bug has a proposed solution, can be implemented w/o further discussion. Help wanted - if the bug could use help from a contributor","title":"Categorization"},{"location":"community/maintainer/triage/#prioritization","text":"If the issue is not triage/support , it needs a priority label. priority/critical-urgent - someones top priority ASAP, such as security issue, user-visible bug, or build breakage. Rarely used. priority/important-soon : in time for the next two releases. It should be attached to a milestone. priority/important-longterm : 2-4 releases from now priority/backlog : agreed that this would be good to have, but no one is available at the moment. Consider tagging as help wanted priority/awaiting-more-evidence : may be useful, but there is not yet enough support.","title":"Prioritization"},{"location":"community/maintainer/triage/#weekly-triage","text":"Weekly triage has three goals: Catching up on unresponded issues Reviewing and closing PR\u2019s Closing stale issues","title":"Weekly Triage"},{"location":"community/maintainer/triage/#post-release-triage","text":"Post-release triage occurs after a major release (around every 4-6 weeks). It focuses on: Closing bugs that have been resolved by the release Reprioritizing bugs that have not been resolved by the release Letting users know if we believe that there is still an issue This includes reviewing: Every issue that hasn\u2019t been touched in the last 2 days Re-evaluation of long-term issues Re-evaluation of short-term issues","title":"Post-Release Triage"},{"location":"community/maintainer/triage/#responding-to-issues","text":"","title":"Responding to Issues"},{"location":"community/maintainer/triage/#needs-more-information","text":"A sample response to ask for more info: I don\u2019t yet have a clear way to replicate this issue. Do you mind adding some additional details. Here is additional information that would be helpful: * The exact trivy command line used * The exact image you want to scan * The full output of the trivy command, preferably with --debug for extra logging. Thank you for sharing your experience! Then: Label with triage/needs-information .","title":"Needs More Information"},{"location":"community/maintainer/triage/#issue-might-be-resolved","text":"If you think a release may have resolved an issue, ask the author to see if their issue has been resolved: Could you please check to see if trivy addresses this issue? We've made some changes with how this is handled, and improved the trivy logs output to help us debug tricky cases like this. Then: Label with triage/needs-information .","title":"Issue might be resolved"},{"location":"community/maintainer/triage/#closing-with-care","text":"Issues typically need to be closed for the following reasons: The issue has been addressed The issue is a duplicate of an existing issue There has been a lack of information over a long period of time In any of these situations, we aim to be kind when closing the issue, and offer the author action items should they need to reopen their issue or still require a solution. Samples responses for these situations include:","title":"Closing with Care"},{"location":"community/maintainer/triage/#issue-has-been-addressed","text":"@author: I believe this issue is now addressed by trivy v1.0.0, as it . If you still see this issue with trivy v1.0 or higher, please reopen this issue. Thank you for reporting this issue! Then: Close the issue","title":"Issue has been addressed"},{"location":"community/maintainer/triage/#duplicate-issue","text":"This issue appears to be a duplicate of #X, do you mind if we move the conversation there? This way we can centralize the content relating to the issue. If you feel that this issue is not in fact a duplicate, please re-open it. If you have additional information to share, please add it to the new issue. Thank you for reporting this! Then: Label with triage/duplicate and close the issue.","title":"Duplicate Issue"},{"location":"community/maintainer/triage/#lack-of-information","text":"If an issue hasn't been active for more than four weeks, and the author has been pinged at least once, then the issue can be closed. Hey @author -- hopefully it's OK if I close this - there wasn't enough information to make it actionable, and some time has already passed. If you are able to provide additional details, you may reopen it at any point. Here is additional information that may be helpful to us: * Whether the issue occurs with the latest trivy release * The exact trivy command line used * The exact image you want to scan * The full output of the trivy command, preferably with --debug for extra logging. Thank you for sharing your experience! Then: Close the issue.","title":"Lack of Information"},{"location":"community/maintainer/triage/#help-wanted-issues","text":"We use two labels help wanted and good first issue to identify issues that have been specially groomed for new contributors. We have specific guidelines for how to use these labels. If you see an issue that satisfies these guidelines, you can add the help wanted label and the good first issue label. Please note that adding the good first issue label must also add the help wanted label. If an issue has these labels but does not satisfy the guidelines, please ask for more details to be added to the issue or remove the labels.","title":"Help Wanted issues"},{"location":"docs/","text":"Docs In this section you can find the complete reference documentation for all of the different features and settings that Trivy has to offer. \ud83d\udc48 Please use the side-navigation on the left in order to browse the different topics.","title":"Overview"},{"location":"docs/#docs","text":"In this section you can find the complete reference documentation for all of the different features and settings that Trivy has to offer. \ud83d\udc48 Please use the side-navigation on the left in order to browse the different topics.","title":"Docs"},{"location":"docs/advanced/air-gap/","text":"Air-Gapped Environment Trivy can be used in air-gapped environments. Note that an allowlist is here . Air-Gapped Environment for vulnerabilities Download the vulnerability database At first, you need to download the vulnerability database for use in air-gapped environments. Trivy oras >= v0.13.0 oras < v0.13.0 TRIVY_TEMP_DIR=$(mktemp -d) trivy --cache-dir $TRIVY_TEMP_DIR image --download-db-only tar -cf ./db.tar.gz -C $TRIVY_TEMP_DIR/db metadata.json trivy.db rm -rf $TRIVY_TEMP_DIR Please follow oras installation instruction . Download db.tar.gz : $ oras pull ghcr.io/aquasecurity/trivy-db:2 Please follow oras installation instruction . Download db.tar.gz : $ oras pull -a ghcr.io/aquasecurity/trivy-db:2 Download the Java index database 1 Java users also need to download the Java index database for use in air-gapped environments. Note You container image may contain JAR files even though you don't use Java directly. In that case, you also need to download the Java index database. Trivy oras >= v0.13.0 oras < v0.13.0 TRIVY_TEMP_DIR=$(mktemp -d) trivy --cache-dir $TRIVY_TEMP_DIR image --download-java-db-only tar -cf ./javadb.tar.gz -C $TRIVY_TEMP_DIR/java-db metadata.json trivy-java.db rm -rf $TRIVY_TEMP_DIR Please follow oras installation instruction . Download javadb.tar.gz : $ oras pull ghcr.io/aquasecurity/trivy-java-db:1 Please follow oras installation instruction . Download javadb.tar.gz : $ oras pull -a ghcr.io/aquasecurity/trivy-java-db:1 Transfer the DB files into the air-gapped environment The way of transfer depends on the environment. Vulnerability db Java index db 1 $ rsync -av -e ssh /path/to/db.tar.gz [user]@[host]:dst $ rsync -av -e ssh /path/to/javadb.tar.gz [user]@[host]:dst Put the DB files in Trivy's cache directory You have to know where to put the DB files. The following command shows the default cache directory. $ ssh user@host $ trivy -h | grep cache --cache-dir value cache directory (default: \"/home/myuser/.cache/trivy\") [$TRIVY_CACHE_DIR] Vulnerability db Java index db 1 Put the DB file in the cache directory + /db . $ mkdir -p /home/myuser/.cache/trivy/db $ cd /home/myuser/.cache/trivy/db $ tar xvf /path/to/db.tar.gz -C /home/myuser/.cache/trivy/db x trivy.db x metadata.json $ rm /path/to/db.tar.gz Put the DB file in the cache directory + /java-db . $ mkdir -p /home/myuser/.cache/trivy/java-db $ cd /home/myuser/.cache/trivy/java-db $ tar xvf /path/to/javadb.tar.gz -C /home/myuser/.cache/trivy/java-db x trivy-java.db x metadata.json $ rm /path/to/javadb.tar.gz In an air-gapped environment it is your responsibility to update the Trivy databases on a regular basis, so that the scanner can detect recently-identified vulnerabilities. Run Trivy with the specific flags. In an air-gapped environment, you have to specify --skip-db-update and --skip-java-db-update 1 so that Trivy doesn't attempt to download the latest database files. In addition, if you want to scan pom.xml dependencies, you need to specify --offline-scan since Trivy tries to issue API requests for scanning Java applications by default. $ trivy image --skip-db-update --skip-java-db-update --offline-scan alpine:3.12 Air-Gapped Environment for misconfigurations No special measures are required to detect misconfigurations in an air-gapped environment. Run Trivy with --skip-policy-update option In an air-gapped environment, specify --skip-policy-update so that Trivy doesn't attempt to download the latest misconfiguration policies. $ trivy conf --skip-policy-update /path/to/conf This is only required to scan jar files. More information about Java index db here \u21a9 \u21a9 \u21a9 \u21a9","title":"Air-Gapped Environment"},{"location":"docs/advanced/air-gap/#air-gapped-environment","text":"Trivy can be used in air-gapped environments. Note that an allowlist is here .","title":"Air-Gapped Environment"},{"location":"docs/advanced/air-gap/#air-gapped-environment-for-vulnerabilities","text":"","title":"Air-Gapped Environment for vulnerabilities"},{"location":"docs/advanced/air-gap/#download-the-vulnerability-database","text":"At first, you need to download the vulnerability database for use in air-gapped environments. Trivy oras >= v0.13.0 oras < v0.13.0 TRIVY_TEMP_DIR=$(mktemp -d) trivy --cache-dir $TRIVY_TEMP_DIR image --download-db-only tar -cf ./db.tar.gz -C $TRIVY_TEMP_DIR/db metadata.json trivy.db rm -rf $TRIVY_TEMP_DIR Please follow oras installation instruction . Download db.tar.gz : $ oras pull ghcr.io/aquasecurity/trivy-db:2 Please follow oras installation instruction . Download db.tar.gz : $ oras pull -a ghcr.io/aquasecurity/trivy-db:2","title":"Download the vulnerability database"},{"location":"docs/advanced/air-gap/#download-the-java-index-database1","text":"Java users also need to download the Java index database for use in air-gapped environments. Note You container image may contain JAR files even though you don't use Java directly. In that case, you also need to download the Java index database. Trivy oras >= v0.13.0 oras < v0.13.0 TRIVY_TEMP_DIR=$(mktemp -d) trivy --cache-dir $TRIVY_TEMP_DIR image --download-java-db-only tar -cf ./javadb.tar.gz -C $TRIVY_TEMP_DIR/java-db metadata.json trivy-java.db rm -rf $TRIVY_TEMP_DIR Please follow oras installation instruction . Download javadb.tar.gz : $ oras pull ghcr.io/aquasecurity/trivy-java-db:1 Please follow oras installation instruction . Download javadb.tar.gz : $ oras pull -a ghcr.io/aquasecurity/trivy-java-db:1","title":"Download the Java index database1"},{"location":"docs/advanced/air-gap/#transfer-the-db-files-into-the-air-gapped-environment","text":"The way of transfer depends on the environment. Vulnerability db Java index db 1 $ rsync -av -e ssh /path/to/db.tar.gz [user]@[host]:dst $ rsync -av -e ssh /path/to/javadb.tar.gz [user]@[host]:dst","title":"Transfer the DB files into the air-gapped environment"},{"location":"docs/advanced/air-gap/#put-the-db-files-in-trivys-cache-directory","text":"You have to know where to put the DB files. The following command shows the default cache directory. $ ssh user@host $ trivy -h | grep cache --cache-dir value cache directory (default: \"/home/myuser/.cache/trivy\") [$TRIVY_CACHE_DIR] Vulnerability db Java index db 1 Put the DB file in the cache directory + /db . $ mkdir -p /home/myuser/.cache/trivy/db $ cd /home/myuser/.cache/trivy/db $ tar xvf /path/to/db.tar.gz -C /home/myuser/.cache/trivy/db x trivy.db x metadata.json $ rm /path/to/db.tar.gz Put the DB file in the cache directory + /java-db . $ mkdir -p /home/myuser/.cache/trivy/java-db $ cd /home/myuser/.cache/trivy/java-db $ tar xvf /path/to/javadb.tar.gz -C /home/myuser/.cache/trivy/java-db x trivy-java.db x metadata.json $ rm /path/to/javadb.tar.gz In an air-gapped environment it is your responsibility to update the Trivy databases on a regular basis, so that the scanner can detect recently-identified vulnerabilities.","title":"Put the DB files in Trivy's cache directory"},{"location":"docs/advanced/air-gap/#run-trivy-with-the-specific-flags","text":"In an air-gapped environment, you have to specify --skip-db-update and --skip-java-db-update 1 so that Trivy doesn't attempt to download the latest database files. In addition, if you want to scan pom.xml dependencies, you need to specify --offline-scan since Trivy tries to issue API requests for scanning Java applications by default. $ trivy image --skip-db-update --skip-java-db-update --offline-scan alpine:3.12","title":"Run Trivy with the specific flags."},{"location":"docs/advanced/air-gap/#air-gapped-environment-for-misconfigurations","text":"No special measures are required to detect misconfigurations in an air-gapped environment.","title":"Air-Gapped Environment for misconfigurations"},{"location":"docs/advanced/air-gap/#run-trivy-with-skip-policy-update-option","text":"In an air-gapped environment, specify --skip-policy-update so that Trivy doesn't attempt to download the latest misconfiguration policies. $ trivy conf --skip-policy-update /path/to/conf This is only required to scan jar files. More information about Java index db here \u21a9 \u21a9 \u21a9 \u21a9","title":"Run Trivy with --skip-policy-update option"},{"location":"docs/advanced/modules/","text":"Modules EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy provides a module feature to allow others to extend the Trivy CLI without the need to change the Trivy code base. It changes the behavior during scanning by WebAssembly. Overview Trivy modules are add-on tools that integrate seamlessly with Trivy. They provide a way to extend the core feature set of Trivy, but without updating the Trivy binary. They can be added and removed from a Trivy installation without impacting the core Trivy tool. They can be written in any programming language supporting WebAssembly. It supports only TinyGo at the moment. You can write your own detection logic. Evaluate complex vulnerability conditions like Spring4Shell Detect a shell script communicating with malicious domains Detect malicious python install script (setup.py) Even detect misconfigurations in WordPress setting etc. Then, you can update the scan result however you want. Change a severity Remove a vulnerability Add a new vulnerability etc. Modules should be distributed in OCI registries like GitHub Container Registry. Warning WebAssembly doesn't allow file access and network access by default. Modules can read required files only, but cannot overwrite them. WebAssembly is sandboxed and secure by design, but Trivy modules available in public are not audited for security. You should install and run third-party modules at your own risk even though Under the hood Trivy leverages wazero to run WebAssembly modules without CGO. Installing a Module A module can be installed using the trivy module install command. This command takes an url. It will download the module and install it in the module cache. Trivy adheres to the XDG specification, so the location depends on whether XDG_DATA_HOME is set. Trivy will now search XDG_DATA_HOME for the location of the Trivy modules cache. The preference order is as follows: XDG_DATA_HOME if set and .trivy/plugins exists within the XDG_DATA_HOME dir $HOME/.trivy/plugins For example, to download the WebAssembly module, you can execute the following command: $ trivy module install ghcr.io/aquasecurity/trivy-module-spring4shell Using Modules Once the module is installed, Trivy will load all available modules in the cache on the start of the next Trivy execution. The modules may inject custom logic into scanning and change the result. You can run Trivy as usual and modules are loaded automatically. You will see the log messages about WASM modules. $ trivy image ghcr.io/aquasecurity/trivy-test-images:spring4shell-jre8 2022 -06-12T12:57:13.210+0300 INFO Loading ghcr.io/aquasecurity/trivy-module-spring4shell/spring4shell.wasm... 2022 -06-12T12:57:13.596+0300 INFO Registering WASM module: spring4shell@v1 ... 2022 -06-12T12:57:14.865+0300 INFO Module spring4shell: Java Version: 8 , Tomcat Version: 8 .5.77 2022 -06-12T12:57:14.865+0300 INFO Module spring4shell: change CVE-2022-22965 severity from CRITICAL to LOW Java ( jar ) Total: 9 ( UNKNOWN: 1 , LOW: 3 , MEDIUM: 2 , HIGH: 3 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 org.springframework.boot:spring-boot ( helloworld.war ) \u2502 CVE-2022-22965 \u2502 LOW \u2502 2 .6.3 \u2502 2 .5.12, 2 .6.6 \u2502 spring-framework: RCE via Data Binding on JDK 9 + \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-22965 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 ... ( snip ) ... In the above example, the Spring4Shell module changed the severity from CRITICAL to LOW because the application doesn't satisfy one of conditions. Uninstalling Modules Specify a module repository with trivy module uninstall command. $ trivy module uninstall ghcr.io/aquasecurity/trivy-module-spring4shell Building Modules It supports TinyGo only at the moment. TinyGo Trivy provides Go SDK including three interfaces. Your own module needs to implement either or both Analyzer and PostScanner in addition to Module . type Module interface { Version () int Name () string } type Analyzer interface { RequiredFiles () [] string Analyze ( filePath string ) ( * serialize . AnalysisResult , error ) } type PostScanner interface { PostScanSpec () serialize . PostScanSpec PostScan ( serialize . Results ) ( serialize . Results , error ) } In the following tutorial, it creates a WordPress module that detects a WordPress version and a critical vulnerability accordingly. Tips You can use logging functions such as Debug and Info for debugging. See examples for the detail. Initialize your module Replace the repository name with yours. $ go mod init github.com/aquasecurity/trivy-module-wordpress Module interface Version() returns your module version and should be incremented after updates. Name() returns your module name. package main const ( version = 1 name = \"wordpress-module\" ) type WordpressModule struct { // Cannot define fields as modules can't keep state. } func ( WordpressModule ) Version () int { return version } func ( WordpressModule ) Name () string { return name } Info A struct cannot have any fields. Each method invocation is performed in different states. Analyzer interface If you implement the Analyzer interface, Analyze method is called when the file path is matched to file patterns returned by RequiredFiles() . A file pattern must be a regular expression. The syntax detail is here . Analyze takes the matched file path, then the file can be opened by os.Open() . const typeWPVersion = \"wordpress-version\" func ( WordpressModule ) RequiredFiles () [] string { return [] string { `wp-includes\\/version.php` , } } func ( WordpressModule ) Analyze ( filePath string ) ( * serialize . AnalysisResult , error ) { f , err := os . Open ( filePath ) // e.g. filePath: /usr/src/wordpress/wp-includes/version.php if err != nil { return nil , err } defer f . Close () var wpVersion string scanner := bufio . NewScanner ( f ) for scanner . Scan () { line := scanner . Text () if ! strings . HasPrefix ( line , \"$wp_version=\" ) { continue } ss := strings . Split ( line , \"=\" ) if len ( ss ) != 2 { return nil , fmt . Errorf ( \"invalid wordpress version: %s\" , line ) } // NOTE: it is an example; you actually need to handle comments, etc ss [ 1 ] = strings . TrimSpace ( ss [ 1 ]) wpVersion = strings . Trim ( ss [ 1 ], `\";` ) } if err = scanner . Err (); err != nil { return nil , err } return & serialize . AnalysisResult { CustomResources : [] serialize . CustomResource { { Type : typeWPVersion , FilePath : filePath , Data : wpVersion , }, }, }, nil } Tips Trivy caches analysis results according to the module version. We'd recommend cleaning the cache or changing the module version every time you update Analyzer . PostScanner interface PostScan is called after scanning and takes the scan result as an argument from Trivy. In post scanning, your module can perform one of three actions: Insert Add a new security finding e.g. Add a new vulnerability and misconfiguration Update Update the detected vulnerability and misconfiguration e.g. Change a severity Delete Delete the detected vulnerability and misconfiguration e.g. Remove Spring4Shell because it is not actually affected. PostScanSpec() returns which action the module does. If it is Update or Delete , it also needs to return IDs such as CVE-ID and misconfiguration ID, which your module wants to update or delete. serialize.Results contains the filtered results matching IDs you specified. Also, it includes CustomResources with the values your Analyze returns, so you can modify the scan result according to the custom resources. func ( WordpressModule ) PostScanSpec () serialize . PostScanSpec { return serialize . PostScanSpec { Action : api . ActionInsert , // Add new vulnerabilities } } func ( WordpressModule ) PostScan ( results serialize . Results ) ( serialize . Results , error ) { // e.g. results // [ // { // \"Target\": \"\", // \"Class\": \"custom\", // \"CustomResources\": [ // { // \"Type\": \"wordpress-version\", // \"FilePath\": \"/usr/src/wordpress/wp-includes/version.php\", // \"Layer\": { // \"DiffID\": \"sha256:057649e61046e02c975b84557c03c6cca095b8c9accd3bd20eb4e432f7aec887\" // }, // \"Data\": \"5.7.1\" // } // ] // } // ] var wpVersion int for _ , result := range results { if result . Class != types . ClassCustom { continue } for _ , c := range result . CustomResources { if c . Type != typeWPVersion { continue } wpVersion = c . Data .( string ) wasm . Info ( fmt . Sprintf ( \"WordPress Version: %s\" , wpVersion )) ... snip ... if affectedVersion . Check ( ver ) { vulnerable = true } break } } if vulnerable { // Add CVE-2020-36326 results = append ( results , serialize . Result { Target : wpPath , Class : types . ClassLangPkg , Type : \"wordpress\" , Vulnerabilities : [] types . DetectedVulnerability { { VulnerabilityID : \"CVE-2020-36326\" , PkgName : \"wordpress\" , InstalledVersion : wpVersion , FixedVersion : \"5.7.2\" , Vulnerability : dbTypes . Vulnerability { Title : \"PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname.\" , Severity : \"CRITICAL\" , }, }, }, }) } return results , nil } The new vulnerability will be added to the scan results. This example shows how the module inserts a new finding. If you are interested in Update , you can see an example of Spring4Shell . In the Delete action, PostScan needs to return results you want to delete. If PostScan returns an empty, Trivy will not delete anything. Build Follow the install guide and install TinyGo. $ tinygo build -o wordpress.wasm -scheduler = none -target = wasi --no-debug wordpress.go Put the built binary to the module directory that is under the home directory by default. $ mkdir -p ~/.trivy/modules $ cp spring4shell.wasm ~/.trivy/modules Distribute Your Module You can distribute your own module in OCI registries. Please follow the oras installation instruction . oras push ghcr.io/aquasecurity/trivy-module-wordpress:latest wordpress.wasm:application/vnd.module.wasm.content.layer.v1+wasm Uploading 3daa3dac086b wordpress.wasm Pushed ghcr.io/aquasecurity/trivy-module-wordpress:latest Digest: sha256:6416d0199d66ce52ced19f01d75454b22692ff3aa7737e45f7a189880840424f Examples Spring4Shell WordPress","title":"Modules"},{"location":"docs/advanced/modules/#modules","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy provides a module feature to allow others to extend the Trivy CLI without the need to change the Trivy code base. It changes the behavior during scanning by WebAssembly.","title":"Modules"},{"location":"docs/advanced/modules/#overview","text":"Trivy modules are add-on tools that integrate seamlessly with Trivy. They provide a way to extend the core feature set of Trivy, but without updating the Trivy binary. They can be added and removed from a Trivy installation without impacting the core Trivy tool. They can be written in any programming language supporting WebAssembly. It supports only TinyGo at the moment. You can write your own detection logic. Evaluate complex vulnerability conditions like Spring4Shell Detect a shell script communicating with malicious domains Detect malicious python install script (setup.py) Even detect misconfigurations in WordPress setting etc. Then, you can update the scan result however you want. Change a severity Remove a vulnerability Add a new vulnerability etc. Modules should be distributed in OCI registries like GitHub Container Registry. Warning WebAssembly doesn't allow file access and network access by default. Modules can read required files only, but cannot overwrite them. WebAssembly is sandboxed and secure by design, but Trivy modules available in public are not audited for security. You should install and run third-party modules at your own risk even though Under the hood Trivy leverages wazero to run WebAssembly modules without CGO.","title":"Overview"},{"location":"docs/advanced/modules/#installing-a-module","text":"A module can be installed using the trivy module install command. This command takes an url. It will download the module and install it in the module cache. Trivy adheres to the XDG specification, so the location depends on whether XDG_DATA_HOME is set. Trivy will now search XDG_DATA_HOME for the location of the Trivy modules cache. The preference order is as follows: XDG_DATA_HOME if set and .trivy/plugins exists within the XDG_DATA_HOME dir $HOME/.trivy/plugins For example, to download the WebAssembly module, you can execute the following command: $ trivy module install ghcr.io/aquasecurity/trivy-module-spring4shell","title":"Installing a Module"},{"location":"docs/advanced/modules/#using-modules","text":"Once the module is installed, Trivy will load all available modules in the cache on the start of the next Trivy execution. The modules may inject custom logic into scanning and change the result. You can run Trivy as usual and modules are loaded automatically. You will see the log messages about WASM modules. $ trivy image ghcr.io/aquasecurity/trivy-test-images:spring4shell-jre8 2022 -06-12T12:57:13.210+0300 INFO Loading ghcr.io/aquasecurity/trivy-module-spring4shell/spring4shell.wasm... 2022 -06-12T12:57:13.596+0300 INFO Registering WASM module: spring4shell@v1 ... 2022 -06-12T12:57:14.865+0300 INFO Module spring4shell: Java Version: 8 , Tomcat Version: 8 .5.77 2022 -06-12T12:57:14.865+0300 INFO Module spring4shell: change CVE-2022-22965 severity from CRITICAL to LOW Java ( jar ) Total: 9 ( UNKNOWN: 1 , LOW: 3 , MEDIUM: 2 , HIGH: 3 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 org.springframework.boot:spring-boot ( helloworld.war ) \u2502 CVE-2022-22965 \u2502 LOW \u2502 2 .6.3 \u2502 2 .5.12, 2 .6.6 \u2502 spring-framework: RCE via Data Binding on JDK 9 + \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-22965 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 ... ( snip ) ... In the above example, the Spring4Shell module changed the severity from CRITICAL to LOW because the application doesn't satisfy one of conditions.","title":"Using Modules"},{"location":"docs/advanced/modules/#uninstalling-modules","text":"Specify a module repository with trivy module uninstall command. $ trivy module uninstall ghcr.io/aquasecurity/trivy-module-spring4shell","title":"Uninstalling Modules"},{"location":"docs/advanced/modules/#building-modules","text":"It supports TinyGo only at the moment.","title":"Building Modules"},{"location":"docs/advanced/modules/#tinygo","text":"Trivy provides Go SDK including three interfaces. Your own module needs to implement either or both Analyzer and PostScanner in addition to Module . type Module interface { Version () int Name () string } type Analyzer interface { RequiredFiles () [] string Analyze ( filePath string ) ( * serialize . AnalysisResult , error ) } type PostScanner interface { PostScanSpec () serialize . PostScanSpec PostScan ( serialize . Results ) ( serialize . Results , error ) } In the following tutorial, it creates a WordPress module that detects a WordPress version and a critical vulnerability accordingly. Tips You can use logging functions such as Debug and Info for debugging. See examples for the detail.","title":"TinyGo"},{"location":"docs/advanced/modules/#initialize-your-module","text":"Replace the repository name with yours. $ go mod init github.com/aquasecurity/trivy-module-wordpress","title":"Initialize your module"},{"location":"docs/advanced/modules/#module-interface","text":"Version() returns your module version and should be incremented after updates. Name() returns your module name. package main const ( version = 1 name = \"wordpress-module\" ) type WordpressModule struct { // Cannot define fields as modules can't keep state. } func ( WordpressModule ) Version () int { return version } func ( WordpressModule ) Name () string { return name } Info A struct cannot have any fields. Each method invocation is performed in different states.","title":"Module interface"},{"location":"docs/advanced/modules/#analyzer-interface","text":"If you implement the Analyzer interface, Analyze method is called when the file path is matched to file patterns returned by RequiredFiles() . A file pattern must be a regular expression. The syntax detail is here . Analyze takes the matched file path, then the file can be opened by os.Open() . const typeWPVersion = \"wordpress-version\" func ( WordpressModule ) RequiredFiles () [] string { return [] string { `wp-includes\\/version.php` , } } func ( WordpressModule ) Analyze ( filePath string ) ( * serialize . AnalysisResult , error ) { f , err := os . Open ( filePath ) // e.g. filePath: /usr/src/wordpress/wp-includes/version.php if err != nil { return nil , err } defer f . Close () var wpVersion string scanner := bufio . NewScanner ( f ) for scanner . Scan () { line := scanner . Text () if ! strings . HasPrefix ( line , \"$wp_version=\" ) { continue } ss := strings . Split ( line , \"=\" ) if len ( ss ) != 2 { return nil , fmt . Errorf ( \"invalid wordpress version: %s\" , line ) } // NOTE: it is an example; you actually need to handle comments, etc ss [ 1 ] = strings . TrimSpace ( ss [ 1 ]) wpVersion = strings . Trim ( ss [ 1 ], `\";` ) } if err = scanner . Err (); err != nil { return nil , err } return & serialize . AnalysisResult { CustomResources : [] serialize . CustomResource { { Type : typeWPVersion , FilePath : filePath , Data : wpVersion , }, }, }, nil } Tips Trivy caches analysis results according to the module version. We'd recommend cleaning the cache or changing the module version every time you update Analyzer .","title":"Analyzer interface"},{"location":"docs/advanced/modules/#postscanner-interface","text":"PostScan is called after scanning and takes the scan result as an argument from Trivy. In post scanning, your module can perform one of three actions: Insert Add a new security finding e.g. Add a new vulnerability and misconfiguration Update Update the detected vulnerability and misconfiguration e.g. Change a severity Delete Delete the detected vulnerability and misconfiguration e.g. Remove Spring4Shell because it is not actually affected. PostScanSpec() returns which action the module does. If it is Update or Delete , it also needs to return IDs such as CVE-ID and misconfiguration ID, which your module wants to update or delete. serialize.Results contains the filtered results matching IDs you specified. Also, it includes CustomResources with the values your Analyze returns, so you can modify the scan result according to the custom resources. func ( WordpressModule ) PostScanSpec () serialize . PostScanSpec { return serialize . PostScanSpec { Action : api . ActionInsert , // Add new vulnerabilities } } func ( WordpressModule ) PostScan ( results serialize . Results ) ( serialize . Results , error ) { // e.g. results // [ // { // \"Target\": \"\", // \"Class\": \"custom\", // \"CustomResources\": [ // { // \"Type\": \"wordpress-version\", // \"FilePath\": \"/usr/src/wordpress/wp-includes/version.php\", // \"Layer\": { // \"DiffID\": \"sha256:057649e61046e02c975b84557c03c6cca095b8c9accd3bd20eb4e432f7aec887\" // }, // \"Data\": \"5.7.1\" // } // ] // } // ] var wpVersion int for _ , result := range results { if result . Class != types . ClassCustom { continue } for _ , c := range result . CustomResources { if c . Type != typeWPVersion { continue } wpVersion = c . Data .( string ) wasm . Info ( fmt . Sprintf ( \"WordPress Version: %s\" , wpVersion )) ... snip ... if affectedVersion . Check ( ver ) { vulnerable = true } break } } if vulnerable { // Add CVE-2020-36326 results = append ( results , serialize . Result { Target : wpPath , Class : types . ClassLangPkg , Type : \"wordpress\" , Vulnerabilities : [] types . DetectedVulnerability { { VulnerabilityID : \"CVE-2020-36326\" , PkgName : \"wordpress\" , InstalledVersion : wpVersion , FixedVersion : \"5.7.2\" , Vulnerability : dbTypes . Vulnerability { Title : \"PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname.\" , Severity : \"CRITICAL\" , }, }, }, }) } return results , nil } The new vulnerability will be added to the scan results. This example shows how the module inserts a new finding. If you are interested in Update , you can see an example of Spring4Shell . In the Delete action, PostScan needs to return results you want to delete. If PostScan returns an empty, Trivy will not delete anything.","title":"PostScanner interface"},{"location":"docs/advanced/modules/#build","text":"Follow the install guide and install TinyGo. $ tinygo build -o wordpress.wasm -scheduler = none -target = wasi --no-debug wordpress.go Put the built binary to the module directory that is under the home directory by default. $ mkdir -p ~/.trivy/modules $ cp spring4shell.wasm ~/.trivy/modules","title":"Build"},{"location":"docs/advanced/modules/#distribute-your-module","text":"You can distribute your own module in OCI registries. Please follow the oras installation instruction . oras push ghcr.io/aquasecurity/trivy-module-wordpress:latest wordpress.wasm:application/vnd.module.wasm.content.layer.v1+wasm Uploading 3daa3dac086b wordpress.wasm Pushed ghcr.io/aquasecurity/trivy-module-wordpress:latest Digest: sha256:6416d0199d66ce52ced19f01d75454b22692ff3aa7737e45f7a189880840424f","title":"Distribute Your Module"},{"location":"docs/advanced/modules/#examples","text":"Spring4Shell WordPress","title":"Examples"},{"location":"docs/advanced/plugins/","text":"Plugins Trivy provides a plugin feature to allow others to extend the Trivy CLI without the need to change the Trivycode base. This plugin system was inspired by the plugin system used in kubectl , Helm , and Conftest . Overview Trivy plugins are add-on tools that integrate seamlessly with Trivy. They provide a way to extend the core feature set of Trivy, but without requiring every new feature to be written in Go and added to the core tool. They can be added and removed from a Trivy installation without impacting the core Trivy tool. They can be written in any programming language. They integrate with Trivy, and will show up in Trivy help and subcommands. Warning Trivy plugins available in public are not audited for security. You should install and run third-party plugins at your own risk, since they are arbitrary programs running on your machine. Installing a Plugin A plugin can be installed using the trivy plugin install command. This command takes a url and will download the plugin and install it in the plugin cache. Trivy adheres to the XDG specification, so the location depends on whether XDG_DATA_HOME is set. Trivy will now search XDG_DATA_HOME for the location of the Trivy plugins cache. The preference order is as follows: XDG_DATA_HOME if set and .trivy/plugins exists within the XDG_DATA_HOME dir ~/.trivy/plugins Under the hood Trivy leverages go-getter to download plugins. This means the following protocols are supported for downloading plugins: OCI Registries Local Files Git HTTP/HTTPS Mercurial Amazon S3 Google Cloud Storage For example, to download the Kubernetes Trivy plugin you can execute the following command: $ trivy plugin install github.com/aquasecurity/trivy-plugin-kubectl Also, Trivy plugin can be installed from a local archive: $ trivy plugin install myplugin.tar.gz Using Plugins Once the plugin is installed, Trivy will load all available plugins in the cache on the start of the next Trivy execution. A plugin will be made in the Trivy CLI based on the plugin name. To display all plugins, you can list them by trivy --help $ trivy --help NAME: trivy - A simple and comprehensive vulnerability scanner for containers USAGE: trivy [ global options ] command [ command options ] target VERSION: dev COMMANDS: image, i scan an image filesystem, fs scan local filesystem repository, repo scan remote repository client, c client mode server, s server mode plugin, p manage plugins kubectl scan kubectl resources help, h Shows a list of commands or help for one command As shown above, kubectl subcommand exists in the COMMANDS section. To call the kubectl plugin and scan existing Kubernetes deployments, you can execute the following command: $ trivy kubectl deployment <deployment-id> -- --ignore-unfixed --severity CRITICAL Internally the kubectl plugin calls the kubectl binary to fetch information about that deployment and passes the using images to Trivy. You can see the detail here . If you want to omit even the subcommand, you can use TRIVY_RUN_AS_PLUGIN environment variable. $ TRIVY_RUN_AS_PLUGIN = kubectl trivy job your-job -- --format json Installing and Running Plugins on the fly trivy plugin run installs a plugin and runs it on the fly. If the plugin is already present in the cache, the installation is skipped. trivy plugin run github.com/aquasecurity/trivy-plugin-kubectl pod your-pod -- --exit-code 1 Uninstalling Plugins Specify a plugin name with trivy plugin uninstall command. $ trivy plugin uninstall kubectl Building Plugins Each plugin has a top-level directory, and then a plugin.yaml file. your-plugin/ | | - plugin.yaml | - your-plugin.sh In the example above, the plugin is contained inside of a directory named your-plugin . It has two files: plugin.yaml (required) and an executable script, your-plugin.sh (optional). The core of a plugin is a simple YAML file named plugin.yaml. Here is an example YAML of trivy-plugin-kubectl plugin that adds support for Kubernetes scanning. name : \"kubectl\" repository : github.com/aquasecurity/trivy-plugin-kubectl version : \"0.1.0\" usage : scan kubectl resources description : |- A Trivy plugin that scans the images of a kubernetes resource. Usage: trivy kubectl TYPE[.VERSION][.GROUP] NAME platforms : - selector : # optional os : darwin arch : amd64 uri : ./trivy-kubectl # where the execution file is (local file, http, git, etc.) bin : ./trivy-kubectl # path to the execution file - selector : # optional os : linux arch : amd64 uri : https://github.com/aquasecurity/trivy-plugin-kubectl/releases/download/v0.1.0/trivy-kubectl.tar.gz bin : ./trivy-kubectl The plugin.yaml field should contain the following information: name: The name of the plugin. This also determines how the plugin will be made available in the Trivy CLI. For example, if the plugin is named kubectl, you can call the plugin with trivy kubectl . (required) version: The version of the plugin. (required) usage: A short usage description. (required) description: A long description of the plugin. This is where you could provide a helpful documentation of your plugin. (required) platforms: (required) selector: The OS/Architecture specific variations of a execution file. (optional) os: OS information based on GOOS (linux, darwin, etc.) (optional) arch: The architecture information based on GOARCH (amd64, arm64, etc.) (optional) uri: Where the executable file is. Relative path from the root directory of the plugin or remote URL such as HTTP and S3. (required) bin: Which file to call when the plugin is executed. Relative path from the root directory of the plugin. (required) The following rules will apply in deciding which platform to select: If both os and arch under selector match the current platform, search will stop and the platform will be used. If selector is not present, the platform will be used. If os matches and there is no more specific arch match, the platform will be used. If no platform match is found, Trivy will exit with an error. After determining platform, Trivy will download the execution file from uri and store it in the plugin cache. When the plugin is called via Trivy CLI, bin command will be executed. The plugin is responsible for handling flags and arguments. Any arguments are passed to the plugin from the trivy command. A plugin should be archived *.tar.gz . $ tar -czvf myplugin.tar.gz plugin.yaml script.py plugin.yaml script.py $ trivy plugin install myplugin.tar.gz 2023 -03-03T19:04:42.026+0600 INFO Installing the plugin from myplugin.tar.gz... 2023 -03-03T19:04:42.026+0600 INFO Loading the plugin metadata... $ trivy myplugin Hello from Trivy demo plugin! Example https://github.com/aquasecurity/trivy-plugin-kubectl","title":"Plugins"},{"location":"docs/advanced/plugins/#plugins","text":"Trivy provides a plugin feature to allow others to extend the Trivy CLI without the need to change the Trivycode base. This plugin system was inspired by the plugin system used in kubectl , Helm , and Conftest .","title":"Plugins"},{"location":"docs/advanced/plugins/#overview","text":"Trivy plugins are add-on tools that integrate seamlessly with Trivy. They provide a way to extend the core feature set of Trivy, but without requiring every new feature to be written in Go and added to the core tool. They can be added and removed from a Trivy installation without impacting the core Trivy tool. They can be written in any programming language. They integrate with Trivy, and will show up in Trivy help and subcommands. Warning Trivy plugins available in public are not audited for security. You should install and run third-party plugins at your own risk, since they are arbitrary programs running on your machine.","title":"Overview"},{"location":"docs/advanced/plugins/#installing-a-plugin","text":"A plugin can be installed using the trivy plugin install command. This command takes a url and will download the plugin and install it in the plugin cache. Trivy adheres to the XDG specification, so the location depends on whether XDG_DATA_HOME is set. Trivy will now search XDG_DATA_HOME for the location of the Trivy plugins cache. The preference order is as follows: XDG_DATA_HOME if set and .trivy/plugins exists within the XDG_DATA_HOME dir ~/.trivy/plugins Under the hood Trivy leverages go-getter to download plugins. This means the following protocols are supported for downloading plugins: OCI Registries Local Files Git HTTP/HTTPS Mercurial Amazon S3 Google Cloud Storage For example, to download the Kubernetes Trivy plugin you can execute the following command: $ trivy plugin install github.com/aquasecurity/trivy-plugin-kubectl Also, Trivy plugin can be installed from a local archive: $ trivy plugin install myplugin.tar.gz","title":"Installing a Plugin"},{"location":"docs/advanced/plugins/#using-plugins","text":"Once the plugin is installed, Trivy will load all available plugins in the cache on the start of the next Trivy execution. A plugin will be made in the Trivy CLI based on the plugin name. To display all plugins, you can list them by trivy --help $ trivy --help NAME: trivy - A simple and comprehensive vulnerability scanner for containers USAGE: trivy [ global options ] command [ command options ] target VERSION: dev COMMANDS: image, i scan an image filesystem, fs scan local filesystem repository, repo scan remote repository client, c client mode server, s server mode plugin, p manage plugins kubectl scan kubectl resources help, h Shows a list of commands or help for one command As shown above, kubectl subcommand exists in the COMMANDS section. To call the kubectl plugin and scan existing Kubernetes deployments, you can execute the following command: $ trivy kubectl deployment <deployment-id> -- --ignore-unfixed --severity CRITICAL Internally the kubectl plugin calls the kubectl binary to fetch information about that deployment and passes the using images to Trivy. You can see the detail here . If you want to omit even the subcommand, you can use TRIVY_RUN_AS_PLUGIN environment variable. $ TRIVY_RUN_AS_PLUGIN = kubectl trivy job your-job -- --format json","title":"Using Plugins"},{"location":"docs/advanced/plugins/#installing-and-running-plugins-on-the-fly","text":"trivy plugin run installs a plugin and runs it on the fly. If the plugin is already present in the cache, the installation is skipped. trivy plugin run github.com/aquasecurity/trivy-plugin-kubectl pod your-pod -- --exit-code 1","title":"Installing and Running Plugins on the fly"},{"location":"docs/advanced/plugins/#uninstalling-plugins","text":"Specify a plugin name with trivy plugin uninstall command. $ trivy plugin uninstall kubectl","title":"Uninstalling Plugins"},{"location":"docs/advanced/plugins/#building-plugins","text":"Each plugin has a top-level directory, and then a plugin.yaml file. your-plugin/ | | - plugin.yaml | - your-plugin.sh In the example above, the plugin is contained inside of a directory named your-plugin . It has two files: plugin.yaml (required) and an executable script, your-plugin.sh (optional). The core of a plugin is a simple YAML file named plugin.yaml. Here is an example YAML of trivy-plugin-kubectl plugin that adds support for Kubernetes scanning. name : \"kubectl\" repository : github.com/aquasecurity/trivy-plugin-kubectl version : \"0.1.0\" usage : scan kubectl resources description : |- A Trivy plugin that scans the images of a kubernetes resource. Usage: trivy kubectl TYPE[.VERSION][.GROUP] NAME platforms : - selector : # optional os : darwin arch : amd64 uri : ./trivy-kubectl # where the execution file is (local file, http, git, etc.) bin : ./trivy-kubectl # path to the execution file - selector : # optional os : linux arch : amd64 uri : https://github.com/aquasecurity/trivy-plugin-kubectl/releases/download/v0.1.0/trivy-kubectl.tar.gz bin : ./trivy-kubectl The plugin.yaml field should contain the following information: name: The name of the plugin. This also determines how the plugin will be made available in the Trivy CLI. For example, if the plugin is named kubectl, you can call the plugin with trivy kubectl . (required) version: The version of the plugin. (required) usage: A short usage description. (required) description: A long description of the plugin. This is where you could provide a helpful documentation of your plugin. (required) platforms: (required) selector: The OS/Architecture specific variations of a execution file. (optional) os: OS information based on GOOS (linux, darwin, etc.) (optional) arch: The architecture information based on GOARCH (amd64, arm64, etc.) (optional) uri: Where the executable file is. Relative path from the root directory of the plugin or remote URL such as HTTP and S3. (required) bin: Which file to call when the plugin is executed. Relative path from the root directory of the plugin. (required) The following rules will apply in deciding which platform to select: If both os and arch under selector match the current platform, search will stop and the platform will be used. If selector is not present, the platform will be used. If os matches and there is no more specific arch match, the platform will be used. If no platform match is found, Trivy will exit with an error. After determining platform, Trivy will download the execution file from uri and store it in the plugin cache. When the plugin is called via Trivy CLI, bin command will be executed. The plugin is responsible for handling flags and arguments. Any arguments are passed to the plugin from the trivy command. A plugin should be archived *.tar.gz . $ tar -czvf myplugin.tar.gz plugin.yaml script.py plugin.yaml script.py $ trivy plugin install myplugin.tar.gz 2023 -03-03T19:04:42.026+0600 INFO Installing the plugin from myplugin.tar.gz... 2023 -03-03T19:04:42.026+0600 INFO Loading the plugin metadata... $ trivy myplugin Hello from Trivy demo plugin!","title":"Building Plugins"},{"location":"docs/advanced/plugins/#example","text":"https://github.com/aquasecurity/trivy-plugin-kubectl","title":"Example"},{"location":"docs/advanced/container/embed-in-dockerfile/","text":"Embed in Dockerfile Scan your image as part of the build process by embedding Trivy in the Dockerfile. This approach can be used to update Dockerfiles currently using Aqua\u2019s Microscanner . $ cat Dockerfile FROM alpine:3.7 RUN apk add curl \\ && curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin \\ && trivy rootfs --exit-code 1 --no-progress / $ docker build -t vulnerable-image . Alternatively you can use Trivy in a multistage build. Thus avoiding the insecure curl | sh . Also the image is not changed. [ ... ] # Run vulnerability scan on build image FROM build AS vulnscan COPY --from = aquasec/trivy:latest /usr/local/bin/trivy /usr/local/bin/trivy RUN trivy rootfs --exit-code 1 --no-progress / [ ... ]","title":"Embed in Dockerfile"},{"location":"docs/advanced/container/embed-in-dockerfile/#embed-in-dockerfile","text":"Scan your image as part of the build process by embedding Trivy in the Dockerfile. This approach can be used to update Dockerfiles currently using Aqua\u2019s Microscanner . $ cat Dockerfile FROM alpine:3.7 RUN apk add curl \\ && curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin \\ && trivy rootfs --exit-code 1 --no-progress / $ docker build -t vulnerable-image . Alternatively you can use Trivy in a multistage build. Thus avoiding the insecure curl | sh . Also the image is not changed. [ ... ] # Run vulnerability scan on build image FROM build AS vulnscan COPY --from = aquasec/trivy:latest /usr/local/bin/trivy /usr/local/bin/trivy RUN trivy rootfs --exit-code 1 --no-progress / [ ... ]","title":"Embed in Dockerfile"},{"location":"docs/advanced/container/unpacked-filesystem/","text":"Unpacked Filesystem Scan an unpacked container image filesystem. In this case, Trivy works the same way when scanning containers $ docker export $( docker create alpine:3.10.2 ) | tar -C /tmp/rootfs -xvf - $ trivy rootfs /tmp/rootfs Result 2021 -03-08T05:22:26.378Z INFO Need to update DB 2021 -03-08T05:22:26.380Z INFO Downloading DB... 20 .37 MiB / 20 .37 MiB [ ------------------------------------------------------------------------------------------------------------------------------------- ] 100 .00% 8 .24 MiB p/s 2s 2021 -03-08T05:22:30.134Z INFO Detecting Alpine vulnerabilities... /tmp/rootfs ( alpine 3 .10.2 ) =========================== Total: 20 ( UNKNOWN: 0 , LOW: 2 , MEDIUM: 10 , HIGH: 8 , CRITICAL: 0 ) +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | libcrypto1.1 | CVE-2020-1967 | HIGH | 1 .1.1c-r0 | 1 .1.1g-r0 | openssl: Segmentation | | | | | | | fault in SSL_check_chain | | | | | | | causes denial of service | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1967 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2021-23839 | | | 1 .1.1j-r0 | openssl: incorrect SSLv2 | | | | | | | rollback protection | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23839 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23840 | | | | openssl: integer | | | | | | | overflow in CipherUpdate | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23840 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23841 | | | | openssl: NULL pointer dereference | | | | | | | in X509_issuer_and_serial_hash () | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23841 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1547 | MEDIUM | | 1 .1.1d-r0 | openssl: side-channel weak | | | | | | | encryption vulnerability | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1547 | + +------------------+ + + +---------------------------------------+ | | CVE-2019-1549 | | | | openssl: information | | | | | | | disclosure in fork () | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1549 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2019-1551 | | | 1 .1.1d-r2 | openssl: Integer overflow in RSAZ | | | | | | | modular exponentiation on x86_64 | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1551 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2020-1971 | | | 1 .1.1i-r0 | openssl: EDIPARTYNAME | | | | | | | NULL pointer de-reference | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1971 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1563 | LOW | | 1 .1.1d-r0 | openssl: information | | | | | | | disclosure in PKCS7_dataDecode | | | | | | | and CMS_decrypt_set1_pkey | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1563 | +--------------+------------------+----------+ +---------------+---------------------------------------+ | libssl1.1 | CVE-2020-1967 | HIGH | | 1 .1.1g-r0 | openssl: Segmentation | | | | | | | fault in SSL_check_chain | | | | | | | causes denial of service | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1967 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2021-23839 | | | 1 .1.1j-r0 | openssl: incorrect SSLv2 | | | | | | | rollback protection | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23839 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23840 | | | | openssl: integer | | | | | | | overflow in CipherUpdate | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23840 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23841 | | | | openssl: NULL pointer dereference | | | | | | | in X509_issuer_and_serial_hash () | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23841 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1547 | MEDIUM | | 1 .1.1d-r0 | openssl: side-channel weak | | | | | | | encryption vulnerability | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1547 | + +------------------+ + + +---------------------------------------+ | | CVE-2019-1549 | | | | openssl: information | | | | | | | disclosure in fork () | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1549 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2019-1551 | | | 1 .1.1d-r2 | openssl: Integer overflow in RSAZ | | | | | | | modular exponentiation on x86_64 | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1551 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2020-1971 | | | 1 .1.1i-r0 | openssl: EDIPARTYNAME | | | | | | | NULL pointer de-reference | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1971 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1563 | LOW | | 1 .1.1d-r0 | openssl: information | | | | | | | disclosure in PKCS7_dataDecode | | | | | | | and CMS_decrypt_set1_pkey | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1563 | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | musl | CVE-2020-28928 | MEDIUM | 1 .1.22-r3 | 1 .1.22-r4 | In musl libc through 1 .2.1, | | | | | | | wcsnrtombs mishandles particular | | | | | | | combinations of destination buffer... | | | | | | | -->avd.aquasec.com/nvd/cve-2020-28928 | +--------------+ + + + + + | musl-utils | | | | | | | | | | | | | | | | | | | | | | | | | | | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+","title":"Unpacked container image filesystem"},{"location":"docs/advanced/container/unpacked-filesystem/#unpacked-filesystem","text":"Scan an unpacked container image filesystem. In this case, Trivy works the same way when scanning containers $ docker export $( docker create alpine:3.10.2 ) | tar -C /tmp/rootfs -xvf - $ trivy rootfs /tmp/rootfs Result 2021 -03-08T05:22:26.378Z INFO Need to update DB 2021 -03-08T05:22:26.380Z INFO Downloading DB... 20 .37 MiB / 20 .37 MiB [ ------------------------------------------------------------------------------------------------------------------------------------- ] 100 .00% 8 .24 MiB p/s 2s 2021 -03-08T05:22:30.134Z INFO Detecting Alpine vulnerabilities... /tmp/rootfs ( alpine 3 .10.2 ) =========================== Total: 20 ( UNKNOWN: 0 , LOW: 2 , MEDIUM: 10 , HIGH: 8 , CRITICAL: 0 ) +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | libcrypto1.1 | CVE-2020-1967 | HIGH | 1 .1.1c-r0 | 1 .1.1g-r0 | openssl: Segmentation | | | | | | | fault in SSL_check_chain | | | | | | | causes denial of service | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1967 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2021-23839 | | | 1 .1.1j-r0 | openssl: incorrect SSLv2 | | | | | | | rollback protection | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23839 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23840 | | | | openssl: integer | | | | | | | overflow in CipherUpdate | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23840 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23841 | | | | openssl: NULL pointer dereference | | | | | | | in X509_issuer_and_serial_hash () | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23841 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1547 | MEDIUM | | 1 .1.1d-r0 | openssl: side-channel weak | | | | | | | encryption vulnerability | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1547 | + +------------------+ + + +---------------------------------------+ | | CVE-2019-1549 | | | | openssl: information | | | | | | | disclosure in fork () | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1549 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2019-1551 | | | 1 .1.1d-r2 | openssl: Integer overflow in RSAZ | | | | | | | modular exponentiation on x86_64 | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1551 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2020-1971 | | | 1 .1.1i-r0 | openssl: EDIPARTYNAME | | | | | | | NULL pointer de-reference | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1971 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1563 | LOW | | 1 .1.1d-r0 | openssl: information | | | | | | | disclosure in PKCS7_dataDecode | | | | | | | and CMS_decrypt_set1_pkey | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1563 | +--------------+------------------+----------+ +---------------+---------------------------------------+ | libssl1.1 | CVE-2020-1967 | HIGH | | 1 .1.1g-r0 | openssl: Segmentation | | | | | | | fault in SSL_check_chain | | | | | | | causes denial of service | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1967 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2021-23839 | | | 1 .1.1j-r0 | openssl: incorrect SSLv2 | | | | | | | rollback protection | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23839 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23840 | | | | openssl: integer | | | | | | | overflow in CipherUpdate | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23840 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23841 | | | | openssl: NULL pointer dereference | | | | | | | in X509_issuer_and_serial_hash () | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23841 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1547 | MEDIUM | | 1 .1.1d-r0 | openssl: side-channel weak | | | | | | | encryption vulnerability | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1547 | + +------------------+ + + +---------------------------------------+ | | CVE-2019-1549 | | | | openssl: information | | | | | | | disclosure in fork () | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1549 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2019-1551 | | | 1 .1.1d-r2 | openssl: Integer overflow in RSAZ | | | | | | | modular exponentiation on x86_64 | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1551 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2020-1971 | | | 1 .1.1i-r0 | openssl: EDIPARTYNAME | | | | | | | NULL pointer de-reference | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1971 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1563 | LOW | | 1 .1.1d-r0 | openssl: information | | | | | | | disclosure in PKCS7_dataDecode | | | | | | | and CMS_decrypt_set1_pkey | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1563 | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | musl | CVE-2020-28928 | MEDIUM | 1 .1.22-r3 | 1 .1.22-r4 | In musl libc through 1 .2.1, | | | | | | | wcsnrtombs mishandles particular | | | | | | | combinations of destination buffer... | | | | | | | -->avd.aquasec.com/nvd/cve-2020-28928 | +--------------+ + + + + + | musl-utils | | | | | | | | | | | | | | | | | | | | | | | | | | | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+","title":"Unpacked Filesystem"},{"location":"docs/advanced/private-registries/","text":"Trivy can download images from a private registry without the need for installing Docker or any other 3rd party tools. This makes it easy to run within a CI process. Credential To use Trivy with private images, simply install it and provide your credentials: $ TRIVY_USERNAME = YOUR_USERNAME TRIVY_PASSWORD = YOUR_PASSWORD trivy image YOUR_PRIVATE_IMAGE Trivy also supports providing credentials through CLI flags: $ TRIVY_PASSWORD = YOUR_PASSWORD trivy image --username YOUR_USERNAME YOUR_PRIVATE_IMAGE Warning The CLI flag --password is available, but its use is not recommended for security reasons. You can also store your credentials in trivy.yaml . For more information, please refer to the documentation . It can handle multiple sets of credentials as well: $ export TRIVY_USERNAME = USERNAME1,USERNAME2 $ export TRIVY_PASSWORD = PASSWORD1,PASSWORD2 $ trivy image YOUR_PRIVATE_IMAGE In the example above, Trivy attempts to use two pairs of credentials: USERNAME1/PASSWORD1 USERNAME2/PASSWORD2 Please note that the number of usernames and passwords must be the same. docker login If you have Docker configured locally and have set up the credentials, Trivy can access them. $ docker login ghcr.io Username: Password: $ trivy image ghcr.io/your/private_image Note docker login can be used with any container runtime, such as Podman.","title":"Overview"},{"location":"docs/advanced/private-registries/#credential","text":"To use Trivy with private images, simply install it and provide your credentials: $ TRIVY_USERNAME = YOUR_USERNAME TRIVY_PASSWORD = YOUR_PASSWORD trivy image YOUR_PRIVATE_IMAGE Trivy also supports providing credentials through CLI flags: $ TRIVY_PASSWORD = YOUR_PASSWORD trivy image --username YOUR_USERNAME YOUR_PRIVATE_IMAGE Warning The CLI flag --password is available, but its use is not recommended for security reasons. You can also store your credentials in trivy.yaml . For more information, please refer to the documentation . It can handle multiple sets of credentials as well: $ export TRIVY_USERNAME = USERNAME1,USERNAME2 $ export TRIVY_PASSWORD = PASSWORD1,PASSWORD2 $ trivy image YOUR_PRIVATE_IMAGE In the example above, Trivy attempts to use two pairs of credentials: USERNAME1/PASSWORD1 USERNAME2/PASSWORD2 Please note that the number of usernames and passwords must be the same.","title":"Credential"},{"location":"docs/advanced/private-registries/#docker-login","text":"If you have Docker configured locally and have set up the credentials, Trivy can access them. $ docker login ghcr.io Username: Password: $ trivy image ghcr.io/your/private_image Note docker login can be used with any container runtime, such as Podman.","title":"docker login"},{"location":"docs/advanced/private-registries/acr/","text":"Requirements None, Trivy uses Azure SDK for Go. You don't need to install az command. Privileges Service principal must have the AcrPull permissions. Creation of a service principal export SP_DATA = $( az ad sp create-for-rbac --name TrivyTest --role AcrPull --scope \"/subscriptions/<subscription_id>/resourceGroups/<resource_group>/providers/Microsoft.ContainerRegistry/registries/<registry_name>\" ) Usage # must set TRIVY_USERNAME empty char export AZURE_CLIENT_ID = $( echo $SP_DATA | jq -r '.appId' ) export AZURE_CLIENT_SECRET = $( echo $SP_DATA | jq -r '.password' ) export AZURE_TENANT_ID = $( echo $SP_DATA | jq -r '.tenant' ) Testing You can test credentials in the following manner. docker run -it --rm -v /tmp:/tmp \\ -e AZURE_CLIENT_ID -e AZURE_CLIENT_SECRET -e AZURE_TENANT_ID \\ aquasec/trivy image your_special_project.azurecr.io/your_special_image:your_special_tag","title":"ACR (Azure Container Registry)"},{"location":"docs/advanced/private-registries/acr/#requirements","text":"None, Trivy uses Azure SDK for Go. You don't need to install az command.","title":"Requirements"},{"location":"docs/advanced/private-registries/acr/#privileges","text":"Service principal must have the AcrPull permissions.","title":"Privileges"},{"location":"docs/advanced/private-registries/acr/#creation-of-a-service-principal","text":"export SP_DATA = $( az ad sp create-for-rbac --name TrivyTest --role AcrPull --scope \"/subscriptions/<subscription_id>/resourceGroups/<resource_group>/providers/Microsoft.ContainerRegistry/registries/<registry_name>\" )","title":"Creation of a service principal"},{"location":"docs/advanced/private-registries/acr/#usage","text":"# must set TRIVY_USERNAME empty char export AZURE_CLIENT_ID = $( echo $SP_DATA | jq -r '.appId' ) export AZURE_CLIENT_SECRET = $( echo $SP_DATA | jq -r '.password' ) export AZURE_TENANT_ID = $( echo $SP_DATA | jq -r '.tenant' )","title":"Usage"},{"location":"docs/advanced/private-registries/acr/#testing","text":"You can test credentials in the following manner. docker run -it --rm -v /tmp:/tmp \\ -e AZURE_CLIENT_ID -e AZURE_CLIENT_SECRET -e AZURE_TENANT_ID \\ aquasec/trivy image your_special_project.azurecr.io/your_special_image:your_special_tag","title":"Testing"},{"location":"docs/advanced/private-registries/docker-hub/","text":"See here for the detail. You don't need to provide a credential when download from public repository.","title":"Docker Hub"},{"location":"docs/advanced/private-registries/ecr/","text":"Trivy uses AWS SDK. You don't need to install aws CLI tool. You can use AWS CLI's ENV Vars . AWS private registry permissions You may need to grant permissions to allow Trivy to pull images from private ECR. It depends on how you want to provide AWS Role to trivy. IAM Role Service account Kube2iam or Kiam IAM Role Service account Add the AWS role in trivy's service account annotations: trivy : serviceAccount : annotations : {} # eks.amazonaws.com/role-arn: arn:aws:iam::ACCOUNT_ID:role/IAM_ROLE_NAME Kube2iam or Kiam Add the AWS role to pod's annotations: podAnnotations : {} ## kube2iam/kiam annotation # iam.amazonaws.com/role: arn:aws:iam::ACCOUNT_ID:role/IAM_ROLE_NAME","title":"AWS ECR (Elastic Container Registry)"},{"location":"docs/advanced/private-registries/ecr/#aws-private-registry-permissions","text":"You may need to grant permissions to allow Trivy to pull images from private ECR. It depends on how you want to provide AWS Role to trivy. IAM Role Service account Kube2iam or Kiam","title":"AWS private registry permissions"},{"location":"docs/advanced/private-registries/ecr/#iam-role-service-account","text":"Add the AWS role in trivy's service account annotations: trivy : serviceAccount : annotations : {} # eks.amazonaws.com/role-arn: arn:aws:iam::ACCOUNT_ID:role/IAM_ROLE_NAME","title":"IAM Role Service account"},{"location":"docs/advanced/private-registries/ecr/#kube2iam-or-kiam","text":"Add the AWS role to pod's annotations: podAnnotations : {} ## kube2iam/kiam annotation # iam.amazonaws.com/role: arn:aws:iam::ACCOUNT_ID:role/IAM_ROLE_NAME","title":"Kube2iam or Kiam"},{"location":"docs/advanced/private-registries/gcr/","text":"Requirements None, Trivy uses Google Cloud SDK. You don't need to install gcloud command. Privileges Credential file must have the roles/storage.objectViewer permissions. More information can be found in Google's documentation JSON File Format The JSON file specified should have the following format provided by google's service account mechanisms: { \"type\" : \"service_account\" , \"project_id\" : \"your_special_project\" , \"private_key_id\" : \"XXXXXXXXXXXXXXXXXXXXxx\" , \"private_key\" : \"-----BEGIN PRIVATE KEY-----\\nNONONONO\\n-----END PRIVATE KEY-----\\n\" , \"client_email\" : \"somedude@your_special_project.iam.gserviceaccount.com\" , \"client_id\" : \"1234567890\" , \"auth_uri\" : \"https://accounts.google.com/o/oauth2/auth\" , \"token_uri\" : \"https://oauth2.googleapis.com/token\" , \"auth_provider_x509_cert_url\" : \"https://www.googleapis.com/oauth2/v1/certs\" , \"client_x509_cert_url\" : \"https://www.googleapis.com/robot/v1/metadata/x509/somedude%40your_special_project.iam.gserviceaccount.com\" } Usage If you want to use target project's repository, you can set them via GOOGLE_APPLICATION_CREDENTIALS . # must set TRIVY_USERNAME empty char export GOOGLE_APPLICATION_CREDENTIALS = /path/to/credential.json Testing You can test credentials in the following manner (assuming they are in /tmp on host machine). docker run -it --rm -v /tmp:/tmp \\ -e GOOGLE_APPLICATION_CREDENTIALS = /tmp/service_account.json \\ aquasec/trivy image gcr.io/your_special_project/your_special_image:your_special_tag","title":"GCR (Google Container Registry)"},{"location":"docs/advanced/private-registries/gcr/#requirements","text":"None, Trivy uses Google Cloud SDK. You don't need to install gcloud command.","title":"Requirements"},{"location":"docs/advanced/private-registries/gcr/#privileges","text":"Credential file must have the roles/storage.objectViewer permissions. More information can be found in Google's documentation","title":"Privileges"},{"location":"docs/advanced/private-registries/gcr/#json-file-format","text":"The JSON file specified should have the following format provided by google's service account mechanisms: { \"type\" : \"service_account\" , \"project_id\" : \"your_special_project\" , \"private_key_id\" : \"XXXXXXXXXXXXXXXXXXXXxx\" , \"private_key\" : \"-----BEGIN PRIVATE KEY-----\\nNONONONO\\n-----END PRIVATE KEY-----\\n\" , \"client_email\" : \"somedude@your_special_project.iam.gserviceaccount.com\" , \"client_id\" : \"1234567890\" , \"auth_uri\" : \"https://accounts.google.com/o/oauth2/auth\" , \"token_uri\" : \"https://oauth2.googleapis.com/token\" , \"auth_provider_x509_cert_url\" : \"https://www.googleapis.com/oauth2/v1/certs\" , \"client_x509_cert_url\" : \"https://www.googleapis.com/robot/v1/metadata/x509/somedude%40your_special_project.iam.gserviceaccount.com\" }","title":"JSON File Format"},{"location":"docs/advanced/private-registries/gcr/#usage","text":"If you want to use target project's repository, you can set them via GOOGLE_APPLICATION_CREDENTIALS . # must set TRIVY_USERNAME empty char export GOOGLE_APPLICATION_CREDENTIALS = /path/to/credential.json","title":"Usage"},{"location":"docs/advanced/private-registries/gcr/#testing","text":"You can test credentials in the following manner (assuming they are in /tmp on host machine). docker run -it --rm -v /tmp:/tmp \\ -e GOOGLE_APPLICATION_CREDENTIALS = /tmp/service_account.json \\ aquasec/trivy image gcr.io/your_special_project/your_special_image:your_special_tag","title":"Testing"},{"location":"docs/advanced/private-registries/self/","text":"BasicAuth server needs TRIVY_USERNAME and TRIVY_PASSWORD . export TRIVY_USERNAME ={ USERNAME } export TRIVY_PASSWORD ={ PASSWORD } # if you want to use 80 port, use NonSSL export TRIVY_NON_SSL = true","title":"Self-Hosted"},{"location":"docs/compliance/compliance/","text":"Compliance Reports EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy\u2019s compliance flag lets you curate a specific set of checks into a report. In a typical Trivy scan, there are hundreds of different checks for many different components and configurations, but sometimes you already know which specific checks you are interested in. Often this would be an industry accepted set of checks such as CIS, or some vendor specific guideline, or your own organization policy that you want to comply with. These are all possible using the flexible compliance infrastructure that's built into Trivy. Compliance reports are defined as simple YAML documents that select checks to include in the report. Usage Compliance report is currently supported in the following targets (trivy sub-commands): trivy image trivy aws trivy k8s Add the --compliance flag to the command line, and set it's value to desired report. For example: trivy k8s cluster --compliance k8s-nsa (see below for built-in and custom reports) Options The following flags are compatible with --compliance flag and allows customizing it's output: flag effect --report summary shows a summary of the results. for every control shows the number of failed checks. --report all shows fully detailed results. for every control shows where it failed and why. --format table shows results in textual table format (good for human readability). --format json shows results in json format (good for machine readability). Built-in compliance Trivy has a number of built-in compliance reports that you can asses right out of the box. to specify a built-in compliance report, select it by ID like trivy --compliance <compliance_id> . For the list of built-in compliance reports, please see the relevant section: Docker compliance Kubernetes compliance AWS compliance Custom compliance You can create your own custom compliance report. A compliance report is a simple YAML document in the following format: spec : id : \"k8s-myreport\" # report unique identifier. this should not container spaces. title : \"My custom Kubernetes report\" # report title. Any one-line title. description : \"Describe your report\" # description of the report. Any text. relatedResources : - https://some.url # useful references. URLs only. version : \"1.0\" # spec version (string) controls : - name : \"Non-root containers\" # Name for the control (appears in the report as is). Any one-line name. description : 'Check that container is not running as root' # Description (appears in the report as is). Any text. id : \"1.0\" # control identifier (string) checks : # list of existing Trivy checks that define the control - id : AVD-KSV-0012 # check ID. Must start with `AVD-` or `CVE-` severity : \"MEDIUM\" # Severity for the control (note that checks severity isn't used) - name : \"Immutable container file systems\" description : 'Check that container root file system is immutable' id : \"1.1\" checks : - id : AVD-KSV-0014 severity : \"LOW\" The check id field ( controls[].checks[].id ) is referring to existing check by it's \"AVD ID\". This AVD ID is easily located in the check's source code metadata header, or by browsing Aqua vulnerability DB , specifically in the Misconfigurations and Vulnerabilities sections. Once you have a compliance spec, you can select it by file path: trivy --compliance @</path/to/compliance.yaml> (note the @ indicating file path instead of report id).","title":"Reports"},{"location":"docs/compliance/compliance/#compliance-reports","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy\u2019s compliance flag lets you curate a specific set of checks into a report. In a typical Trivy scan, there are hundreds of different checks for many different components and configurations, but sometimes you already know which specific checks you are interested in. Often this would be an industry accepted set of checks such as CIS, or some vendor specific guideline, or your own organization policy that you want to comply with. These are all possible using the flexible compliance infrastructure that's built into Trivy. Compliance reports are defined as simple YAML documents that select checks to include in the report.","title":"Compliance Reports"},{"location":"docs/compliance/compliance/#usage","text":"Compliance report is currently supported in the following targets (trivy sub-commands): trivy image trivy aws trivy k8s Add the --compliance flag to the command line, and set it's value to desired report. For example: trivy k8s cluster --compliance k8s-nsa (see below for built-in and custom reports)","title":"Usage"},{"location":"docs/compliance/compliance/#options","text":"The following flags are compatible with --compliance flag and allows customizing it's output: flag effect --report summary shows a summary of the results. for every control shows the number of failed checks. --report all shows fully detailed results. for every control shows where it failed and why. --format table shows results in textual table format (good for human readability). --format json shows results in json format (good for machine readability).","title":"Options"},{"location":"docs/compliance/compliance/#built-in-compliance","text":"Trivy has a number of built-in compliance reports that you can asses right out of the box. to specify a built-in compliance report, select it by ID like trivy --compliance <compliance_id> . For the list of built-in compliance reports, please see the relevant section: Docker compliance Kubernetes compliance AWS compliance","title":"Built-in compliance"},{"location":"docs/compliance/compliance/#custom-compliance","text":"You can create your own custom compliance report. A compliance report is a simple YAML document in the following format: spec : id : \"k8s-myreport\" # report unique identifier. this should not container spaces. title : \"My custom Kubernetes report\" # report title. Any one-line title. description : \"Describe your report\" # description of the report. Any text. relatedResources : - https://some.url # useful references. URLs only. version : \"1.0\" # spec version (string) controls : - name : \"Non-root containers\" # Name for the control (appears in the report as is). Any one-line name. description : 'Check that container is not running as root' # Description (appears in the report as is). Any text. id : \"1.0\" # control identifier (string) checks : # list of existing Trivy checks that define the control - id : AVD-KSV-0012 # check ID. Must start with `AVD-` or `CVE-` severity : \"MEDIUM\" # Severity for the control (note that checks severity isn't used) - name : \"Immutable container file systems\" description : 'Check that container root file system is immutable' id : \"1.1\" checks : - id : AVD-KSV-0014 severity : \"LOW\" The check id field ( controls[].checks[].id ) is referring to existing check by it's \"AVD ID\". This AVD ID is easily located in the check's source code metadata header, or by browsing Aqua vulnerability DB , specifically in the Misconfigurations and Vulnerabilities sections. Once you have a compliance spec, you can select it by file path: trivy --compliance @</path/to/compliance.yaml> (note the @ indicating file path instead of report id).","title":"Custom compliance"},{"location":"docs/configuration/","text":"Configuration Trivy can be configured using the following ways. Each item takes precedence over the item below it: CLI flags Environment variables Configuration file CLI Flags You can view the list of available flags using the --help option. For more details, please refer to the CLI reference . Environment Variables Trivy can be customized by environment variables. The environment variable key is the flag name converted by the following procedure. Add TRIVY_ prefix Make it all uppercase Replace - with _ For example, --debug => TRIVY_DEBUG --cache-dir => TRIVY_CACHE_DIR $ TRIVY_DEBUG=true TRIVY_SEVERITY=CRITICAL trivy image alpine:3.15 Configuration File By default, Trivy reads the trivy.yaml file. For more details, please refer to the page .","title":"Overview"},{"location":"docs/configuration/#configuration","text":"Trivy can be configured using the following ways. Each item takes precedence over the item below it: CLI flags Environment variables Configuration file","title":"Configuration"},{"location":"docs/configuration/#cli-flags","text":"You can view the list of available flags using the --help option. For more details, please refer to the CLI reference .","title":"CLI Flags"},{"location":"docs/configuration/#environment-variables","text":"Trivy can be customized by environment variables. The environment variable key is the flag name converted by the following procedure. Add TRIVY_ prefix Make it all uppercase Replace - with _ For example, --debug => TRIVY_DEBUG --cache-dir => TRIVY_CACHE_DIR $ TRIVY_DEBUG=true TRIVY_SEVERITY=CRITICAL trivy image alpine:3.15","title":"Environment Variables"},{"location":"docs/configuration/#configuration-file","text":"By default, Trivy reads the trivy.yaml file. For more details, please refer to the page .","title":"Configuration File"},{"location":"docs/configuration/cache/","text":"Cache The cache directory includes Vulnerability Database 1 Java Index Database 2 Misconfiguration Policies 3 Cache of previous scans. The cache option is common to all scanners. Clear Caches The --clear-cache option removes caches. The scan is not performed. $ trivy image --clear-cache Result 2019-11-15T15:13:26.209+0200 INFO Reopening vulnerability DB 2019-11-15T15:13:26.209+0200 INFO Removing image caches... Cache Directory Specify where the cache is stored with --cache-dir . $ trivy --cache-dir /tmp/trivy/ image python:3.4-alpine3.9 Cache Backend EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy supports local filesystem and Redis as the cache backend. This option is useful especially for client/server mode. Two options: fs the cache path can be specified by --cache-dir redis:// redis://[HOST]:[PORT] TTL can be configured via --cache-ttl $ trivy server --cache-backend redis://localhost:6379 If you want to use TLS with Redis, you can enable it by specifying the --redis-tls flag. $ trivy server --cache-backend redis://localhost:6379 --redis-tls Trivy also supports for connecting to Redis with your certificates. You need to specify --redis-ca , --redis-cert , and --redis-key options. $ trivy server --cache-backend redis://localhost:6379 \\ --redis-ca /path/to/ca-cert.pem \\ --redis-cert /path/to/cert.pem \\ --redis-key /path/to/key.pem Downloaded when scanning for vulnerabilities \u21a9 Downloaded when scanning jar/war/par/ear files \u21a9 Downloaded when scanning for misconfigurations \u21a9","title":"Cache"},{"location":"docs/configuration/cache/#cache","text":"The cache directory includes Vulnerability Database 1 Java Index Database 2 Misconfiguration Policies 3 Cache of previous scans. The cache option is common to all scanners.","title":"Cache"},{"location":"docs/configuration/cache/#clear-caches","text":"The --clear-cache option removes caches. The scan is not performed. $ trivy image --clear-cache Result 2019-11-15T15:13:26.209+0200 INFO Reopening vulnerability DB 2019-11-15T15:13:26.209+0200 INFO Removing image caches...","title":"Clear Caches"},{"location":"docs/configuration/cache/#cache-directory","text":"Specify where the cache is stored with --cache-dir . $ trivy --cache-dir /tmp/trivy/ image python:3.4-alpine3.9","title":"Cache Directory"},{"location":"docs/configuration/cache/#cache-backend","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy supports local filesystem and Redis as the cache backend. This option is useful especially for client/server mode. Two options: fs the cache path can be specified by --cache-dir redis:// redis://[HOST]:[PORT] TTL can be configured via --cache-ttl $ trivy server --cache-backend redis://localhost:6379 If you want to use TLS with Redis, you can enable it by specifying the --redis-tls flag. $ trivy server --cache-backend redis://localhost:6379 --redis-tls Trivy also supports for connecting to Redis with your certificates. You need to specify --redis-ca , --redis-cert , and --redis-key options. $ trivy server --cache-backend redis://localhost:6379 \\ --redis-ca /path/to/ca-cert.pem \\ --redis-cert /path/to/cert.pem \\ --redis-key /path/to/key.pem Downloaded when scanning for vulnerabilities \u21a9 Downloaded when scanning jar/war/par/ear files \u21a9 Downloaded when scanning for misconfigurations \u21a9","title":"Cache Backend"},{"location":"docs/configuration/db/","text":"DB Scanner Supported Vulnerability \u2713 Misconfiguration Secret License The vulnerability database and the Java index database are needed only for vulnerability scanning. See here for the detail. Vulnerability Database Skip update of vulnerability DB If you want to skip downloading the vulnerability database, use the --skip-db-update option. $ trivy image --skip-db-update python:3.4-alpine3.9 Result 2019-05-16T12:48:08.703+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 (alpine 3.9.2) =================================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+--------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+--------------------------------+ | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 | | | | | | | with long nonces | +---------+------------------+----------+-------------------+---------------+--------------------------------+ Only download vulnerability database You can also ask Trivy to simply retrieve the vulnerability database. This is useful to initialize workers in Continuous Integration systems. $ trivy image --download-db-only DB Repository Trivy could also download the vulnerability database from an external OCI registry by using --db-repository option. $ trivy image --db-repository registry.gitlab.com/gitlab-org/security-products/dependencies/trivy-db Java Index Database The same options are also available for the Java index DB, which is used for scanning Java applications. Skipping an update can be done by using the --skip-java-db-update option, while --download-java-db-only can be used to only download the Java index DB. Downloading the Java index DB from an external OCI registry can be done by using the --java-db-repository option. $ trivy image --java-db-repository registry.gitlab.com/gitlab-org/security-products/dependencies/trivy-java-db --download-java-db-only Note In Client/Server mode, Java index DB is currently only used on the client side. Remove DBs The --reset flag removes all caches and databases. $ trivy image --reset","title":"DB"},{"location":"docs/configuration/db/#db","text":"Scanner Supported Vulnerability \u2713 Misconfiguration Secret License The vulnerability database and the Java index database are needed only for vulnerability scanning. See here for the detail.","title":"DB"},{"location":"docs/configuration/db/#vulnerability-database","text":"","title":"Vulnerability Database"},{"location":"docs/configuration/db/#skip-update-of-vulnerability-db","text":"If you want to skip downloading the vulnerability database, use the --skip-db-update option. $ trivy image --skip-db-update python:3.4-alpine3.9 Result 2019-05-16T12:48:08.703+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 (alpine 3.9.2) =================================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+--------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+--------------------------------+ | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 | | | | | | | with long nonces | +---------+------------------+----------+-------------------+---------------+--------------------------------+","title":"Skip update of vulnerability DB"},{"location":"docs/configuration/db/#only-download-vulnerability-database","text":"You can also ask Trivy to simply retrieve the vulnerability database. This is useful to initialize workers in Continuous Integration systems. $ trivy image --download-db-only","title":"Only download vulnerability database"},{"location":"docs/configuration/db/#db-repository","text":"Trivy could also download the vulnerability database from an external OCI registry by using --db-repository option. $ trivy image --db-repository registry.gitlab.com/gitlab-org/security-products/dependencies/trivy-db","title":"DB Repository"},{"location":"docs/configuration/db/#java-index-database","text":"The same options are also available for the Java index DB, which is used for scanning Java applications. Skipping an update can be done by using the --skip-java-db-update option, while --download-java-db-only can be used to only download the Java index DB. Downloading the Java index DB from an external OCI registry can be done by using the --java-db-repository option. $ trivy image --java-db-repository registry.gitlab.com/gitlab-org/security-products/dependencies/trivy-java-db --download-java-db-only Note In Client/Server mode, Java index DB is currently only used on the client side.","title":"Java Index Database"},{"location":"docs/configuration/db/#remove-dbs","text":"The --reset flag removes all caches and databases. $ trivy image --reset","title":"Remove DBs"},{"location":"docs/configuration/filtering/","text":"Filtering Trivy provides various methods for filtering the results. By Status Scanner Supported Vulnerability \u2713 Misconfiguration Secret License Trivy supports the following vulnerability statuses: unknown not_affected : this package is not affected by this vulnerability on this platform affected : this package is affected by this vulnerability on this platform, but there is no patch released yet fixed : this vulnerability is fixed on this platform under_investigation : it is currently unknown whether or not this vulnerability affects this package on this platform, and it is under investigation will_not_fix : this package is affected by this vulnerability on this platform, but there is currently no intention to fix it (this would primarily be for flaws that are of Low or Moderate impact that pose no significant risk to customers) fix_deferred : this package is affected by this vulnerability on this platform, and may be fixed in the future end_of_life : this package has been identified to contain the impacted component, but analysis to determine whether it is affected or not by this vulnerability was not performed Note that vulnerabilities with the unknown , not_affected or under_investigation status are not detected. These are only defined for comprehensiveness, and you will not have the opportunity to specify these statuses. Some statuses are supported in limited distributions. OS Fixed Affected Under Investigation Will Not Fix Fix Deferred End of Life Debian \u2713 \u2713 \u2713 \u2713 RHEL \u2713 \u2713 \u2713 \u2713 \u2713 \u2713 Other OSes \u2713 \u2713 To ignore vulnerabilities with specific statuses, use the --ignore-status <list_of_statuses> option. $ trivy image --ignore-status affected,fixed ruby:2.4.0 Result 2019-05-16T12:50:14.786+0900 INFO Detecting Debian vulnerabilities... ruby:2.4.0 (debian 8.7) ======================= Total: 527 (UNKNOWN: 0, LOW: 276, MEDIUM: 83, HIGH: 158, CRITICAL: 10) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Status \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 binutils \u2502 CVE-2014-9939 \u2502 CRITICAL \u2502 will_not_fix \u2502 2.25-5 \u2502 \u2502 binutils: buffer overflow in ihex.c \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2014-9939 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2017-6969 \u2502 \u2502 \u2502 \u2502 \u2502 binutils: Heap-based buffer over-read in readelf when \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 processing corrupt RL78 binaries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2017-6969 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 ... Tip To skip all unfixed vulnerabilities, you can use the --ignore-unfixed flag . It is a shorthand of --ignore-status affected,will_not_fix,fix_deferred,end_of_life . It displays \"fixed\" vulnerabilities only. $ trivy image --ignore-unfixed ruby:2.4.0 By Severity Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 Use --severity option. $ trivy image --severity HIGH,CRITICAL ruby:2.4.0 Result 2019 -05-16T01:51:46.255+0900 INFO Updating vulnerability database... 2019 -05-16T01:51:49.213+0900 INFO Detecting Debian vulnerabilities... ruby:2.4.0 ( debian 8 .7 ) ======================= Total: 1785 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 1680 , CRITICAL: 105 ) +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ | apt | CVE-2019-3462 | CRITICAL | 1 .0.9.8.3 | 1 .0.9.8.5 | Incorrect sanitation of the | | | | | | | 302 redirect field in HTTP | | | | | | | transport method of... | +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ | bash | CVE-2019-9924 | HIGH | 4 .3-11 | 4 .3-11+deb8u2 | bash: BASH_CMD is writable in | | | | | | | restricted bash shells | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2016-7543 | | | 4 .3-11+deb8u1 | bash: Specially crafted | | | | | | | SHELLOPTS+PS4 variables allows | | | | | | | command substitution | +-----------------------------+------------------+ +---------------------------+----------------------------------+-------------------------------------------------+ | binutils | CVE-2017-8421 | | 2 .25-5 | | binutils: Memory exhaustion in | | | | | | | objdump via a crafted PE file | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2017-14930 | | | | binutils: Memory leak in | | | | | | | decode_line_info | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2017-7614 | | | | binutils: NULL | | | | | | | pointer dereference in | | | | | | | bfd_elf_final_link function | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2014-9939 | | | | binutils: buffer overflow in | | | | | | | ihex.c | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2017-13716 | | | | binutils: Memory leak with the | | | | | | | C++ symbol demangler routine | | | | | | | in libiberty | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2018-12699 | | | | binutils: heap-based buffer | | | | | | | overflow in finish_stab in | | | | | | | stabs.c | +-----------------------------+------------------+ +---------------------------+----------------------------------+-------------------------------------------------+ | bsdutils | CVE-2015-5224 | | 2 .25.2-6 | | util-linux: File name | | | | | | | collision due to incorrect | | | | | | | mkstemp use | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2016-2779 | | | | util-linux: runuser tty hijack | | | | | | | via TIOCSTI ioctl | +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ trivy conf --severity HIGH,CRITICAL examples/misconf/mixed Result 2022 -05-16T13:50:42.718+0100 INFO Detected config files: 3 Dockerfile ( dockerfile ) ======================= Tests: 17 ( SUCCESSES: 16 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 1 , CRITICAL: 0 ) HIGH: Last USER command in Dockerfile should not be 'root' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:3 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 3 [ USER root \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml ( kubernetes ) ============================ Tests: 8 ( SUCCESSES: 8 , FAILURES: 0 , EXCEPTIONS: 0 ) Failures: 0 ( HIGH: 0 , CRITICAL: 0 ) main.tf ( terraform ) =================== Tests: 1 ( SUCCESSES: 0 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 0 , CRITICAL: 1 ) CRITICAL: Classic resources should not be used. \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 AWS Classic resources run in a shared environment with infrastructure owned by other AWS customers. You should run resources in a VPC instead. See https://avd.aquasec.com/misconfig/avd-aws-0081 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 main.tf:2-4 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 2 \u250c resource \"aws_db_security_group\" \"sg\" { 3 \u2502 4 \u2514 } \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 By Finding IDs Trivy supports the .trivyignore and .trivyignore.yaml ignore files. .trivyignore Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License $ cat .trivyignore # Accept the risk CVE-2018-14618 # Accept the risk until 2023-01-01 CVE-2019-14697 exp:2023-01-01 # No impact in our settings CVE-2019-1543 # Ignore misconfigurations AVD-DS-0002 # Ignore secrets generic-unwanted-rule aws-account-id $ trivy image python:3.4-alpine3.9 Result 2019 -05-16T12:53:10.076+0900 INFO Updating vulnerability database... 2019 -05-16T12:53:28.134+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 ( alpine 3 .9.2 ) =================================== Total: 0 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 ) .trivyignore.yaml Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 EXPERIMENTAL This feature might change without preserving backwards compatibility. When the extension of the specified ignore file is either .yml or .yaml , Trivy will load the file as YAML. For the .trivyignore.yaml file, you can set ignored IDs separately for vulnerabilities , misconfigurations , secrets , or licenses 1 . Available fields: Field Required Type Description id \u2713 string The identifier of the vulnerability, misconfiguration, secret, or license 1 . paths string array The list of file paths to be ignored. If paths is not set, the ignore finding is applied to all files. expired_at date ( yyyy-mm-dd ) The expiration date of the ignore finding. If expired_at is not set, the ignore finding is always valid. statement string The reason for ignoring the finding. (This field is not used for filtering.) $ cat .trivyignore.yaml vulnerabilities: - id: CVE-2022-40897 paths: - \"usr/local/lib/python3.9/site-packages/setuptools-58.1.0.dist-info/METADATA\" statement: Accept the risk - id: CVE-2023-2650 - id: CVE-2023-3446 - id: CVE-2023-3817 - id: CVE-2023-29491 expired_at: 2023 -09-01 misconfigurations: - id: AVD-DS-0001 - id: AVD-DS-0002 paths: - \"docs/Dockerfile\" statement: The image needs root privileges secrets: - id: aws-access-key-id - id: aws-secret-access-key paths: - \"foo/bar/aws.secret\" licenses: - id: GPL-3.0 # License name is used as ID paths: - \"usr/share/gcc/python/libstdcxx/v6/__init__.py\" Since this feature is experimental, you must explicitly specify the YAML file path using the --ignorefile flag. Once this functionality is stable, the YAML file will be loaded automatically. $ trivy image --ignorefile ./.trivyignore.yaml python:3.9.16-alpine3.16 Result 2023 -08-31T11:10:27.155+0600 INFO Vulnerability scanning is enabled 2023 -08-31T11:10:27.155+0600 INFO Secret scanning is enabled 2023 -08-31T11:10:27.155+0600 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2023 -08-31T11:10:27.155+0600 INFO Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection 2023 -08-31T11:10:29.164+0600 INFO Detected OS: alpine 2023 -08-31T11:10:29.164+0600 INFO Detecting Alpine vulnerabilities... 2023 -08-31T11:10:29.169+0600 INFO Number of language-specific files: 1 2023 -08-31T11:10:29.170+0600 INFO Detecting python-pkg vulnerabilities... python:3.9.16-alpine3.16 ( alpine 3 .16.5 ) ======================================== Total: 0 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 ) By Vulnerability Target Scanner Supported Vulnerability \u2713 Misconfiguration Secret License Use --vuln-type option. $ trivy image --vuln-type os ruby:2.4.0 Available values: library os Result 2019 -05-22T19:36:50.530+0200 \u001b [ 34mINFO\u001b [ 0m Updating vulnerability database... 2019 -05-22T19:36:51.681+0200 \u001b [ 34mINFO\u001b [ 0m Detecting Alpine vulnerabilities... 2019 -05-22T19:36:51.685+0200 \u001b [ 34mINFO\u001b [ 0m Updating npm Security DB... 2019 -05-22T19:36:52.389+0200 \u001b [ 34mINFO\u001b [ 0m Detecting npm vulnerabilities... 2019 -05-22T19:36:52.390+0200 \u001b [ 34mINFO\u001b [ 0m Updating pipenv Security DB... 2019 -05-22T19:36:53.406+0200 \u001b [ 34mINFO\u001b [ 0m Detecting pipenv vulnerabilities... ruby:2.4.0 ( debian 8 .7 ) ======================= Total: 7 ( UNKNOWN: 0 , LOW: 1 , MEDIUM: 1 , HIGH: 3 , CRITICAL: 2 ) +---------+------------------+----------+-------------------+---------------+----------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | curl | CVE-2018-14618 | CRITICAL | 7 .61.0-r0 | 7 .61.1-r0 | curl: NTLM password overflow | | | | | | | via integer overflow | + +------------------+----------+ +---------------+----------------------------------+ | | CVE-2018-16839 | HIGH | | 7 .61.1-r1 | curl: Integer overflow leading | | | | | | | to heap-based buffer overflow in | | | | | | | Curl_sasl_create_plain_message () | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | git | CVE-2018-17456 | HIGH | 2 .15.2-r0 | 2 .15.3-r0 | git: arbitrary code execution | | | | | | | via .gitmodules | + +------------------+ + + +----------------------------------+ | | CVE-2018-19486 | | | | git: Improper handling of | | | | | | | PATH allows for commands to be | | | | | | | executed from... | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | libssh2 | CVE-2019-3855 | CRITICAL | 1 .8.0-r2 | 1 .8.1-r0 | libssh2: Integer overflow in | | | | | | | transport read resulting in | | | | | | | out of bounds write... | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | sqlite | CVE-2018-20346 | MEDIUM | 3 .21.0-r1 | 3 .25.3-r0 | CVE-2018-20505 CVE-2018-20506 | | | | | | | sqlite: Multiple flaws in | | | | | | | sqlite which can be triggered | | | | | | | via... | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | tar | CVE-2018-20482 | LOW | 1 .29-r1 | 1 .31-r0 | tar: Infinite read loop in | | | | | | | sparse_dump_region function in | | | | | | | sparse.c | +---------+------------------+----------+-------------------+---------------+----------------------------------+ By Open Policy Agent Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy supports Open Policy Agent (OPA) to filter vulnerabilities. You can specify a Rego file with --ignore-policy option. The Rego package name must be trivy and it must include a rule called ignore which determines if each individual vulnerability should be excluded (ignore=true) or not (ignore=false). In the policy, each vulnerability will be available for inspection as the input variable. The structure of each vulnerability input is the same as for the Trivy JSON output. There is a built-in Rego library with helper functions that you can import into your policy using: import data.lib.trivy . For more info about the helper functions, look at the library here To get started, see the example policy . $ trivy image --ignore-policy contrib/example_policy/basic.rego centos:7 Result centos:7 ( centos 7 .9.2009 ) ========================== Total: 9 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 4 , CRITICAL: 5 ) +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | glib2 | CVE-2015-8385 | HIGH | 2 .56.1-7.el7 | | pcre: buffer overflow caused | | | | | | | by named forward reference | | | | | | | to duplicate group number... | | | | | | | -->avd.aquasec.com/nvd/cve-2015-8385 | + +------------------+ + +-------------------+-----------------------------------------+ | | CVE-2016-3191 | | | | pcre: workspace overflow for | | | | | | | ( *ACCEPT ) with deeply nested | | | | | | | parentheses ( 8 .39/13, 10 .22/12 ) | | | | | | | -->avd.aquasec.com/nvd/cve-2016-3191 | + +------------------+ + +-------------------+-----------------------------------------+ | | CVE-2021-27219 | | | 2 .56.1-9.el7_9 | glib: integer overflow in | | | | | | | g_bytes_new function on | | | | | | | 64 -bit platforms due to an... | | | | | | | -->avd.aquasec.com/nvd/cve-2021-27219 | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | glibc | CVE-2019-1010022 | CRITICAL | 2 .17-317.el7 | | glibc: stack guard protection bypass | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1010022 | +--------------+ + + +-------------------+ + | glibc-common | | | | | | | | | | | | | +--------------+------------------+ +-------------------+-------------------+-----------------------------------------+ | nss | CVE-2021-43527 | | 3 .53.1-3.el7_9 | 3 .67.0-4.el7_9 | nss: Memory corruption in | | | | | | | decodeECorDsaSignature with | | | | | | | DSA signatures ( and RSA-PSS ) | | | | | | | -->avd.aquasec.com/nvd/cve-2021-43527 | +--------------+ + + + + + | nss-sysinit | | | | | | | | | | | | | | | | | | | | | | | | | | | +--------------+ + + + + + | nss-tools | | | | | | | | | | | | | | | | | | | | | | | | | | | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | openssl-libs | CVE-2020-1971 | HIGH | 1 :1.0.2k-19.el7 | 1 :1.0.2k-21.el7_9 | openssl: EDIPARTYNAME | | | | | | | NULL pointer de-reference | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1971 | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ By Inline Comments Scanner Supported Vulnerability Misconfiguration \u2713 Secret License Some configuration file formats (e.g. Terraform) support inline comments. In cases where trivy can detect comments of a specific format immediately adjacent to resource definitions, it is possible to filter/ignore findings from a single point of resource definition (in contrast to .trivyignore , which has a directory-wide scope on all of the files scanned). The format for these comments is trivy:ignore:<Vulnerability ID> immediately following the format-specific line-comment token. For example, to filter a Vulnerability ID \"AVD-GCP-0051\" in a Terraform HCL file: #trivy:ignore:AVD-GCP-0051 resource \"google_container_cluster\" \"one_off_test\" { name = var.cluster_name location = var.region } license name is used as id for .trivyignore.yaml files \u21a9 \u21a9","title":"Filtering"},{"location":"docs/configuration/filtering/#filtering","text":"Trivy provides various methods for filtering the results.","title":"Filtering"},{"location":"docs/configuration/filtering/#by-status","text":"Scanner Supported Vulnerability \u2713 Misconfiguration Secret License Trivy supports the following vulnerability statuses: unknown not_affected : this package is not affected by this vulnerability on this platform affected : this package is affected by this vulnerability on this platform, but there is no patch released yet fixed : this vulnerability is fixed on this platform under_investigation : it is currently unknown whether or not this vulnerability affects this package on this platform, and it is under investigation will_not_fix : this package is affected by this vulnerability on this platform, but there is currently no intention to fix it (this would primarily be for flaws that are of Low or Moderate impact that pose no significant risk to customers) fix_deferred : this package is affected by this vulnerability on this platform, and may be fixed in the future end_of_life : this package has been identified to contain the impacted component, but analysis to determine whether it is affected or not by this vulnerability was not performed Note that vulnerabilities with the unknown , not_affected or under_investigation status are not detected. These are only defined for comprehensiveness, and you will not have the opportunity to specify these statuses. Some statuses are supported in limited distributions. OS Fixed Affected Under Investigation Will Not Fix Fix Deferred End of Life Debian \u2713 \u2713 \u2713 \u2713 RHEL \u2713 \u2713 \u2713 \u2713 \u2713 \u2713 Other OSes \u2713 \u2713 To ignore vulnerabilities with specific statuses, use the --ignore-status <list_of_statuses> option. $ trivy image --ignore-status affected,fixed ruby:2.4.0 Result 2019-05-16T12:50:14.786+0900 INFO Detecting Debian vulnerabilities... ruby:2.4.0 (debian 8.7) ======================= Total: 527 (UNKNOWN: 0, LOW: 276, MEDIUM: 83, HIGH: 158, CRITICAL: 10) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Status \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 binutils \u2502 CVE-2014-9939 \u2502 CRITICAL \u2502 will_not_fix \u2502 2.25-5 \u2502 \u2502 binutils: buffer overflow in ihex.c \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2014-9939 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2017-6969 \u2502 \u2502 \u2502 \u2502 \u2502 binutils: Heap-based buffer over-read in readelf when \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 processing corrupt RL78 binaries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2017-6969 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 ... Tip To skip all unfixed vulnerabilities, you can use the --ignore-unfixed flag . It is a shorthand of --ignore-status affected,will_not_fix,fix_deferred,end_of_life . It displays \"fixed\" vulnerabilities only. $ trivy image --ignore-unfixed ruby:2.4.0","title":"By Status"},{"location":"docs/configuration/filtering/#by-severity","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 Use --severity option. $ trivy image --severity HIGH,CRITICAL ruby:2.4.0 Result 2019 -05-16T01:51:46.255+0900 INFO Updating vulnerability database... 2019 -05-16T01:51:49.213+0900 INFO Detecting Debian vulnerabilities... ruby:2.4.0 ( debian 8 .7 ) ======================= Total: 1785 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 1680 , CRITICAL: 105 ) +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ | apt | CVE-2019-3462 | CRITICAL | 1 .0.9.8.3 | 1 .0.9.8.5 | Incorrect sanitation of the | | | | | | | 302 redirect field in HTTP | | | | | | | transport method of... | +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ | bash | CVE-2019-9924 | HIGH | 4 .3-11 | 4 .3-11+deb8u2 | bash: BASH_CMD is writable in | | | | | | | restricted bash shells | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2016-7543 | | | 4 .3-11+deb8u1 | bash: Specially crafted | | | | | | | SHELLOPTS+PS4 variables allows | | | | | | | command substitution | +-----------------------------+------------------+ +---------------------------+----------------------------------+-------------------------------------------------+ | binutils | CVE-2017-8421 | | 2 .25-5 | | binutils: Memory exhaustion in | | | | | | | objdump via a crafted PE file | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2017-14930 | | | | binutils: Memory leak in | | | | | | | decode_line_info | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2017-7614 | | | | binutils: NULL | | | | | | | pointer dereference in | | | | | | | bfd_elf_final_link function | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2014-9939 | | | | binutils: buffer overflow in | | | | | | | ihex.c | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2017-13716 | | | | binutils: Memory leak with the | | | | | | | C++ symbol demangler routine | | | | | | | in libiberty | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2018-12699 | | | | binutils: heap-based buffer | | | | | | | overflow in finish_stab in | | | | | | | stabs.c | +-----------------------------+------------------+ +---------------------------+----------------------------------+-------------------------------------------------+ | bsdutils | CVE-2015-5224 | | 2 .25.2-6 | | util-linux: File name | | | | | | | collision due to incorrect | | | | | | | mkstemp use | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2016-2779 | | | | util-linux: runuser tty hijack | | | | | | | via TIOCSTI ioctl | +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ trivy conf --severity HIGH,CRITICAL examples/misconf/mixed Result 2022 -05-16T13:50:42.718+0100 INFO Detected config files: 3 Dockerfile ( dockerfile ) ======================= Tests: 17 ( SUCCESSES: 16 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 1 , CRITICAL: 0 ) HIGH: Last USER command in Dockerfile should not be 'root' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:3 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 3 [ USER root \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml ( kubernetes ) ============================ Tests: 8 ( SUCCESSES: 8 , FAILURES: 0 , EXCEPTIONS: 0 ) Failures: 0 ( HIGH: 0 , CRITICAL: 0 ) main.tf ( terraform ) =================== Tests: 1 ( SUCCESSES: 0 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 0 , CRITICAL: 1 ) CRITICAL: Classic resources should not be used. \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 AWS Classic resources run in a shared environment with infrastructure owned by other AWS customers. You should run resources in a VPC instead. See https://avd.aquasec.com/misconfig/avd-aws-0081 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 main.tf:2-4 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 2 \u250c resource \"aws_db_security_group\" \"sg\" { 3 \u2502 4 \u2514 } \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500","title":"By Severity"},{"location":"docs/configuration/filtering/#by-finding-ids","text":"Trivy supports the .trivyignore and .trivyignore.yaml ignore files.","title":"By Finding IDs"},{"location":"docs/configuration/filtering/#trivyignore","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License $ cat .trivyignore # Accept the risk CVE-2018-14618 # Accept the risk until 2023-01-01 CVE-2019-14697 exp:2023-01-01 # No impact in our settings CVE-2019-1543 # Ignore misconfigurations AVD-DS-0002 # Ignore secrets generic-unwanted-rule aws-account-id $ trivy image python:3.4-alpine3.9 Result 2019 -05-16T12:53:10.076+0900 INFO Updating vulnerability database... 2019 -05-16T12:53:28.134+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 ( alpine 3 .9.2 ) =================================== Total: 0 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 )","title":".trivyignore"},{"location":"docs/configuration/filtering/#trivyignoreyaml","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 EXPERIMENTAL This feature might change without preserving backwards compatibility. When the extension of the specified ignore file is either .yml or .yaml , Trivy will load the file as YAML. For the .trivyignore.yaml file, you can set ignored IDs separately for vulnerabilities , misconfigurations , secrets , or licenses 1 . Available fields: Field Required Type Description id \u2713 string The identifier of the vulnerability, misconfiguration, secret, or license 1 . paths string array The list of file paths to be ignored. If paths is not set, the ignore finding is applied to all files. expired_at date ( yyyy-mm-dd ) The expiration date of the ignore finding. If expired_at is not set, the ignore finding is always valid. statement string The reason for ignoring the finding. (This field is not used for filtering.) $ cat .trivyignore.yaml vulnerabilities: - id: CVE-2022-40897 paths: - \"usr/local/lib/python3.9/site-packages/setuptools-58.1.0.dist-info/METADATA\" statement: Accept the risk - id: CVE-2023-2650 - id: CVE-2023-3446 - id: CVE-2023-3817 - id: CVE-2023-29491 expired_at: 2023 -09-01 misconfigurations: - id: AVD-DS-0001 - id: AVD-DS-0002 paths: - \"docs/Dockerfile\" statement: The image needs root privileges secrets: - id: aws-access-key-id - id: aws-secret-access-key paths: - \"foo/bar/aws.secret\" licenses: - id: GPL-3.0 # License name is used as ID paths: - \"usr/share/gcc/python/libstdcxx/v6/__init__.py\" Since this feature is experimental, you must explicitly specify the YAML file path using the --ignorefile flag. Once this functionality is stable, the YAML file will be loaded automatically. $ trivy image --ignorefile ./.trivyignore.yaml python:3.9.16-alpine3.16 Result 2023 -08-31T11:10:27.155+0600 INFO Vulnerability scanning is enabled 2023 -08-31T11:10:27.155+0600 INFO Secret scanning is enabled 2023 -08-31T11:10:27.155+0600 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2023 -08-31T11:10:27.155+0600 INFO Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection 2023 -08-31T11:10:29.164+0600 INFO Detected OS: alpine 2023 -08-31T11:10:29.164+0600 INFO Detecting Alpine vulnerabilities... 2023 -08-31T11:10:29.169+0600 INFO Number of language-specific files: 1 2023 -08-31T11:10:29.170+0600 INFO Detecting python-pkg vulnerabilities... python:3.9.16-alpine3.16 ( alpine 3 .16.5 ) ======================================== Total: 0 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 )","title":".trivyignore.yaml"},{"location":"docs/configuration/filtering/#by-vulnerability-target","text":"Scanner Supported Vulnerability \u2713 Misconfiguration Secret License Use --vuln-type option. $ trivy image --vuln-type os ruby:2.4.0 Available values: library os Result 2019 -05-22T19:36:50.530+0200 \u001b [ 34mINFO\u001b [ 0m Updating vulnerability database... 2019 -05-22T19:36:51.681+0200 \u001b [ 34mINFO\u001b [ 0m Detecting Alpine vulnerabilities... 2019 -05-22T19:36:51.685+0200 \u001b [ 34mINFO\u001b [ 0m Updating npm Security DB... 2019 -05-22T19:36:52.389+0200 \u001b [ 34mINFO\u001b [ 0m Detecting npm vulnerabilities... 2019 -05-22T19:36:52.390+0200 \u001b [ 34mINFO\u001b [ 0m Updating pipenv Security DB... 2019 -05-22T19:36:53.406+0200 \u001b [ 34mINFO\u001b [ 0m Detecting pipenv vulnerabilities... ruby:2.4.0 ( debian 8 .7 ) ======================= Total: 7 ( UNKNOWN: 0 , LOW: 1 , MEDIUM: 1 , HIGH: 3 , CRITICAL: 2 ) +---------+------------------+----------+-------------------+---------------+----------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | curl | CVE-2018-14618 | CRITICAL | 7 .61.0-r0 | 7 .61.1-r0 | curl: NTLM password overflow | | | | | | | via integer overflow | + +------------------+----------+ +---------------+----------------------------------+ | | CVE-2018-16839 | HIGH | | 7 .61.1-r1 | curl: Integer overflow leading | | | | | | | to heap-based buffer overflow in | | | | | | | Curl_sasl_create_plain_message () | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | git | CVE-2018-17456 | HIGH | 2 .15.2-r0 | 2 .15.3-r0 | git: arbitrary code execution | | | | | | | via .gitmodules | + +------------------+ + + +----------------------------------+ | | CVE-2018-19486 | | | | git: Improper handling of | | | | | | | PATH allows for commands to be | | | | | | | executed from... | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | libssh2 | CVE-2019-3855 | CRITICAL | 1 .8.0-r2 | 1 .8.1-r0 | libssh2: Integer overflow in | | | | | | | transport read resulting in | | | | | | | out of bounds write... | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | sqlite | CVE-2018-20346 | MEDIUM | 3 .21.0-r1 | 3 .25.3-r0 | CVE-2018-20505 CVE-2018-20506 | | | | | | | sqlite: Multiple flaws in | | | | | | | sqlite which can be triggered | | | | | | | via... | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | tar | CVE-2018-20482 | LOW | 1 .29-r1 | 1 .31-r0 | tar: Infinite read loop in | | | | | | | sparse_dump_region function in | | | | | | | sparse.c | +---------+------------------+----------+-------------------+---------------+----------------------------------+","title":"By Vulnerability Target"},{"location":"docs/configuration/filtering/#by-open-policy-agent","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy supports Open Policy Agent (OPA) to filter vulnerabilities. You can specify a Rego file with --ignore-policy option. The Rego package name must be trivy and it must include a rule called ignore which determines if each individual vulnerability should be excluded (ignore=true) or not (ignore=false). In the policy, each vulnerability will be available for inspection as the input variable. The structure of each vulnerability input is the same as for the Trivy JSON output. There is a built-in Rego library with helper functions that you can import into your policy using: import data.lib.trivy . For more info about the helper functions, look at the library here To get started, see the example policy . $ trivy image --ignore-policy contrib/example_policy/basic.rego centos:7 Result centos:7 ( centos 7 .9.2009 ) ========================== Total: 9 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 4 , CRITICAL: 5 ) +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | glib2 | CVE-2015-8385 | HIGH | 2 .56.1-7.el7 | | pcre: buffer overflow caused | | | | | | | by named forward reference | | | | | | | to duplicate group number... | | | | | | | -->avd.aquasec.com/nvd/cve-2015-8385 | + +------------------+ + +-------------------+-----------------------------------------+ | | CVE-2016-3191 | | | | pcre: workspace overflow for | | | | | | | ( *ACCEPT ) with deeply nested | | | | | | | parentheses ( 8 .39/13, 10 .22/12 ) | | | | | | | -->avd.aquasec.com/nvd/cve-2016-3191 | + +------------------+ + +-------------------+-----------------------------------------+ | | CVE-2021-27219 | | | 2 .56.1-9.el7_9 | glib: integer overflow in | | | | | | | g_bytes_new function on | | | | | | | 64 -bit platforms due to an... | | | | | | | -->avd.aquasec.com/nvd/cve-2021-27219 | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | glibc | CVE-2019-1010022 | CRITICAL | 2 .17-317.el7 | | glibc: stack guard protection bypass | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1010022 | +--------------+ + + +-------------------+ + | glibc-common | | | | | | | | | | | | | +--------------+------------------+ +-------------------+-------------------+-----------------------------------------+ | nss | CVE-2021-43527 | | 3 .53.1-3.el7_9 | 3 .67.0-4.el7_9 | nss: Memory corruption in | | | | | | | decodeECorDsaSignature with | | | | | | | DSA signatures ( and RSA-PSS ) | | | | | | | -->avd.aquasec.com/nvd/cve-2021-43527 | +--------------+ + + + + + | nss-sysinit | | | | | | | | | | | | | | | | | | | | | | | | | | | +--------------+ + + + + + | nss-tools | | | | | | | | | | | | | | | | | | | | | | | | | | | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | openssl-libs | CVE-2020-1971 | HIGH | 1 :1.0.2k-19.el7 | 1 :1.0.2k-21.el7_9 | openssl: EDIPARTYNAME | | | | | | | NULL pointer de-reference | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1971 | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+","title":"By Open Policy Agent"},{"location":"docs/configuration/filtering/#by-inline-comments","text":"Scanner Supported Vulnerability Misconfiguration \u2713 Secret License Some configuration file formats (e.g. Terraform) support inline comments. In cases where trivy can detect comments of a specific format immediately adjacent to resource definitions, it is possible to filter/ignore findings from a single point of resource definition (in contrast to .trivyignore , which has a directory-wide scope on all of the files scanned). The format for these comments is trivy:ignore:<Vulnerability ID> immediately following the format-specific line-comment token. For example, to filter a Vulnerability ID \"AVD-GCP-0051\" in a Terraform HCL file: #trivy:ignore:AVD-GCP-0051 resource \"google_container_cluster\" \"one_off_test\" { name = var.cluster_name location = var.region } license name is used as id for .trivyignore.yaml files \u21a9 \u21a9","title":"By Inline Comments"},{"location":"docs/configuration/others/","text":"Others Enable/Disable Scanners You can enable/disable scanners with the --scanners flag. Supported values: vuln config secret license For example, container image scanning enables vulnerability and secret scanners by default. If you don't need secret scanning, it can be disabled. $ trivy image --scanners vuln alpine:3.15 Exit Code Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 By default, Trivy exits with code 0 even when security issues are detected. Use the --exit-code option if you want to exit with a non-zero exit code. $ trivy image --exit-code 1 python:3.4-alpine3.9 Result 2019-05-16T12:51:43.500+0900 INFO Updating vulnerability database... 2019-05-16T12:52:00.387+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 (alpine 3.9.2) =================================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+--------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+--------------------------------+ | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 | | | | | | | with long nonces | +---------+------------------+----------+-------------------+---------------+--------------------------------+ This option is useful for CI/CD. In the following example, the test will fail only when a critical vulnerability is found. $ trivy image --exit-code 0 --severity MEDIUM,HIGH ruby:2.4.0 $ trivy image --exit-code 1 --severity CRITICAL ruby:2.4.0 Exit on EOL Scanner Supported Vulnerability \u2713 Misconfiguration Secret License Sometimes you may surprisingly get 0 vulnerabilities in an old image: Enabling --ignore-unfixed option while all packages have no fixed versions. Scanning a rather outdated OS (e.g. Ubuntu 10.04). An OS at the end of service/life (EOL) usually gets into this situation, which is definitely full of vulnerabilities. --exit-on-eol can fail scanning on EOL OS with a non-zero code. This flag is available with the following targets. Container images ( trivy image ) Virtual machine images ( trivy vm ) SBOM ( trivy sbom ) Root filesystem ( trivy rootfs ) $ trivy image --exit-on-eol 1 alpine:3.10 Result 2023-03-01T11:07:15.455+0200 INFO Vulnerability scanning is enabled ... 2023-03-01T11:07:17.938+0200 WARN This OS version is no longer supported by the distribution: alpine 3.10.9 2023-03-01T11:07:17.938+0200 WARN The vulnerability detection may be insufficient because security updates are not provided alpine:3.10 (alpine 3.10.9) =========================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 apk-tools \u2502 CVE-2021-36159 \u2502 CRITICAL \u2502 2.10.6-r0 \u2502 2.10.7-r0 \u2502 libfetch before 2021-07-26, as used in apk-tools, xbps, and \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 other products, mishandles... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-36159 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 2023-03-01T11:07:17.941+0200 ERROR Detected EOL OS: alpine 3.10.9 This option is useful for CI/CD. The following example will fail when a critical vulnerability is found or the OS is EOSL: $ trivy image --exit-code 1 --exit-on-eol 1 --severity CRITICAL alpine:3.16.3","title":"Others"},{"location":"docs/configuration/others/#others","text":"","title":"Others"},{"location":"docs/configuration/others/#enabledisable-scanners","text":"You can enable/disable scanners with the --scanners flag. Supported values: vuln config secret license For example, container image scanning enables vulnerability and secret scanners by default. If you don't need secret scanning, it can be disabled. $ trivy image --scanners vuln alpine:3.15","title":"Enable/Disable Scanners"},{"location":"docs/configuration/others/#exit-code","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 By default, Trivy exits with code 0 even when security issues are detected. Use the --exit-code option if you want to exit with a non-zero exit code. $ trivy image --exit-code 1 python:3.4-alpine3.9 Result 2019-05-16T12:51:43.500+0900 INFO Updating vulnerability database... 2019-05-16T12:52:00.387+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 (alpine 3.9.2) =================================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+--------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+--------------------------------+ | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 | | | | | | | with long nonces | +---------+------------------+----------+-------------------+---------------+--------------------------------+ This option is useful for CI/CD. In the following example, the test will fail only when a critical vulnerability is found. $ trivy image --exit-code 0 --severity MEDIUM,HIGH ruby:2.4.0 $ trivy image --exit-code 1 --severity CRITICAL ruby:2.4.0","title":"Exit Code"},{"location":"docs/configuration/others/#exit-on-eol","text":"Scanner Supported Vulnerability \u2713 Misconfiguration Secret License Sometimes you may surprisingly get 0 vulnerabilities in an old image: Enabling --ignore-unfixed option while all packages have no fixed versions. Scanning a rather outdated OS (e.g. Ubuntu 10.04). An OS at the end of service/life (EOL) usually gets into this situation, which is definitely full of vulnerabilities. --exit-on-eol can fail scanning on EOL OS with a non-zero code. This flag is available with the following targets. Container images ( trivy image ) Virtual machine images ( trivy vm ) SBOM ( trivy sbom ) Root filesystem ( trivy rootfs ) $ trivy image --exit-on-eol 1 alpine:3.10 Result 2023-03-01T11:07:15.455+0200 INFO Vulnerability scanning is enabled ... 2023-03-01T11:07:17.938+0200 WARN This OS version is no longer supported by the distribution: alpine 3.10.9 2023-03-01T11:07:17.938+0200 WARN The vulnerability detection may be insufficient because security updates are not provided alpine:3.10 (alpine 3.10.9) =========================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 apk-tools \u2502 CVE-2021-36159 \u2502 CRITICAL \u2502 2.10.6-r0 \u2502 2.10.7-r0 \u2502 libfetch before 2021-07-26, as used in apk-tools, xbps, and \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 other products, mishandles... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-36159 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 2023-03-01T11:07:17.941+0200 ERROR Detected EOL OS: alpine 3.10.9 This option is useful for CI/CD. The following example will fail when a critical vulnerability is found or the OS is EOSL: $ trivy image --exit-code 1 --exit-on-eol 1 --severity CRITICAL alpine:3.16.3","title":"Exit on EOL"},{"location":"docs/configuration/reporting/","text":"Reporting Supported Formats Trivy supports the following formats: Table JSON SARIF Template SBOM GitHub dependency snapshot Table (Default) Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 $ trivy image -f table golang:1.12-alpine Show origins of vulnerable dependencies Scanner Supported Vulnerability \u2713 Misconfiguration Secret License EXPERIMENTAL This feature might change without preserving backwards compatibility. Modern software development relies on the use of third-party libraries. Third-party dependencies also depend on others so a list of dependencies can be represented as a dependency graph. In some cases, vulnerable dependencies are not linked directly, and it requires analyses of the tree. To make this task simpler Trivy can show a dependency origin tree with the --dependency-tree flag. This flag is only available with the --format table flag. The following packages/languages are currently supported: OS packages apk dpkg rpm Node.js npm: package-lock.json pnpm: pnpm-lock.yaml yarn: yarn.lock .NET NuGet: packages.lock.json Python Poetry: poetry.lock Ruby Bundler: Gemfile.lock Rust Binaries built with cargo-auditable Go Modules: go.mod PHP Composer Java Maven: pom.xml This tree is the reverse of the npm list command. However, if you want to resolve a vulnerability in a particular indirect dependency, the reversed tree is useful to know where that dependency comes from and identify which package you actually need to update. In table output, it looks like: $ trivy fs --severity HIGH,CRITICAL --dependency-tree /path/to/your_node_project package-lock.json ( npm ) ======================= Total: 2 ( HIGH: 1 , CRITICAL: 1 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 follow-redirects \u2502 CVE-2022-0155 \u2502 HIGH \u2502 1 .14.6 \u2502 1 .14.7 \u2502 follow-redirects: Exposure of Private Personal Information \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 to an Unauthorized Actor \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-0155 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 glob-parent \u2502 CVE-2020-28469 \u2502 CRITICAL \u2502 3 .1.0 \u2502 5 .1.2 \u2502 nodejs-glob-parent: Regular expression denial of service \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2020-28469 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Dependency Origin Tree ( Reversed ) ================================= package-lock.json \u251c\u2500\u2500 follow-redirects@1.14.6, ( HIGH: 1 , CRITICAL: 0 ) \u2502 \u2514\u2500\u2500 axios@0.21.4 \u2514\u2500\u2500 glob-parent@3.1.0, ( HIGH: 0 , CRITICAL: 1 ) \u2514\u2500\u2500 chokidar@2.1.8 \u2514\u2500\u2500 watchpack-chokidar2@2.0.1 \u2514\u2500\u2500 watchpack@1.7.5 \u2514\u2500\u2500 webpack@4.46.0 \u2514\u2500\u2500 cra-append-sw@2.7.0 Vulnerable dependencies are shown in the top level of the tree. Lower levels show how those vulnerabilities are introduced. In the example above axios@0.21.4 included in the project directly depends on the vulnerable follow-redirects@1.14.6 . Also, glob-parent@3.1.0 with some vulnerabilities is included through chain of dependencies that is added by cra-append-sw@2.7.0 . Then, you can try to update axios@0.21.4 and cra-append-sw@2.7.0 to resolve vulnerabilities in follow-redirects@1.14.6 and glob-parent@3.1.0 . JSON Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 $ trivy image -f json -o results.json golang:1.12-alpine Result 2019-05-16T01:46:31.777+0900 INFO Updating vulnerability database... 2019-05-16T01:47:03.007+0900 INFO Detecting Alpine vulnerabilities... JSON [ { \"Target\": \"php-app/composer.lock\", \"Vulnerabilities\": null }, { \"Target\": \"node-app/package-lock.json\", \"Vulnerabilities\": [ { \"VulnerabilityID\": \"CVE-2018-16487\", \"PkgName\": \"lodash\", \"InstalledVersion\": \"4.17.4\", \"FixedVersion\": \"\\u003e=4.17.11\", \"Title\": \"lodash: Prototype pollution in utilities function\", \"Description\": \"A prototype pollution vulnerability was found in lodash \\u003c4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.\", \"Severity\": \"HIGH\", \"References\": [ \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16487\", ] } ] }, { \"Target\": \"trivy-ci-test (alpine 3.7.1)\", \"Vulnerabilities\": [ { \"VulnerabilityID\": \"CVE-2018-16840\", \"PkgName\": \"curl\", \"InstalledVersion\": \"7.61.0-r0\", \"FixedVersion\": \"7.61.1-r1\", \"Title\": \"curl: Use-after-free when closing \\\"easy\\\" handle in Curl_close()\", \"Description\": \"A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. \", \"Severity\": \"HIGH\", \"References\": [ \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16840\", ] }, { \"VulnerabilityID\": \"CVE-2019-3822\", \"PkgName\": \"curl\", \"InstalledVersion\": \"7.61.0-r0\", \"FixedVersion\": \"7.61.1-r2\", \"Title\": \"curl: NTLMv2 type-3 header stack buffer overflow\", \"Description\": \"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. \", \"Severity\": \"HIGH\", \"References\": [ \"https://curl.haxx.se/docs/CVE-2019-3822.html\", \"https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f@%3Cdevnull.infra.apache.org%3E\" ] }, { \"VulnerabilityID\": \"CVE-2018-16839\", \"PkgName\": \"curl\", \"InstalledVersion\": \"7.61.0-r0\", \"FixedVersion\": \"7.61.1-r1\", \"Title\": \"curl: Integer overflow leading to heap-based buffer overflow in Curl_sasl_create_plain_message()\", \"Description\": \"Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.\", \"Severity\": \"HIGH\", \"References\": [ \"https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5\", ] }, { \"VulnerabilityID\": \"CVE-2018-19486\", \"PkgName\": \"git\", \"InstalledVersion\": \"2.15.2-r0\", \"FixedVersion\": \"2.15.3-r0\", \"Title\": \"git: Improper handling of PATH allows for commands to be executed from the current directory\", \"Description\": \"Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.\", \"Severity\": \"HIGH\", \"References\": [ \"https://usn.ubuntu.com/3829-1/\", ] }, { \"VulnerabilityID\": \"CVE-2018-17456\", \"PkgName\": \"git\", \"InstalledVersion\": \"2.15.2-r0\", \"FixedVersion\": \"2.15.3-r0\", \"Title\": \"git: arbitrary code execution via .gitmodules\", \"Description\": \"Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \\\"git clone\\\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.\", \"Severity\": \"HIGH\", \"References\": [ \"http://www.securitytracker.com/id/1041811\", ] } ] }, { \"Target\": \"python-app/Pipfile.lock\", \"Vulnerabilities\": null }, { \"Target\": \"ruby-app/Gemfile.lock\", \"Vulnerabilities\": null }, { \"Target\": \"rust-app/Cargo.lock\", \"Vulnerabilities\": null } ] VulnerabilityID , PkgName , InstalledVersion , and Severity in Vulnerabilities are always filled with values, but other fields might be empty. SARIF Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 SARIF can be generated with the --format sarif flag. $ trivy image --format sarif -o report.sarif golang:1.12-alpine This SARIF file can be uploaded to GitHub code scanning results, and there is a Trivy GitHub Action for automating this process. GitHub dependency snapshot Trivy supports the following packages. OS packages Language-specific packages GitHub dependency snapshots can be generated with the --format github flag. $ trivy image --format github -o report.gsbom alpine This snapshot file can be submitted to your GitHub repository. Template Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 Custom Template $ trivy image --format template --template \"{{ range . }} {{ .Target }} {{ end }}\" golang:1.12-alpine Result 2020-01-02T18:02:32.856+0100 INFO Detecting Alpine vulnerabilities... golang:1.12-alpine (alpine 3.10.2) You can compute different figures within the template using sprig functions. As an example you can summarize the different classes of issues: $ trivy image --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if eq .Severity \"CRITICAL\" }}{{- $critical = add $critical 1 }}{{- end }}{{- if eq .Severity \"HIGH\" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' golang:1.12-alpine Result Critical: 0, High: 2 For other features of sprig, see the official sprig documentation. Load templates from a file You can load templates from a file prefixing the template path with an @. $ trivy image --format template --template \"@/path/to/template\" golang:1.12-alpine Default Templates If Trivy is installed using rpm then default templates can be found at /usr/local/share/trivy/templates . JUnit Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License In the following example using the template junit.tpl XML can be generated. $ trivy image --format template --template \"@contrib/junit.tpl\" -o junit-report.xml golang:1.12-alpine ASFF Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License Trivy also supports an ASFF template for reporting findings to AWS Security Hub HTML Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License $ trivy image --format template --template \"@contrib/html.tpl\" -o report.html golang:1.12-alpine The following example shows use of default HTML template when Trivy is installed using rpm. $ trivy image --format template --template \"@/usr/local/share/trivy/templates/html.tpl\" -o report.html golang:1.12-alpine SBOM See here for details. Converting To generate multiple reports, you can generate the JSON report first and convert it to other formats with the convert subcommand. $ trivy image --format json -o result.json --list-all-pkgs debian:11 $ trivy convert --format cyclonedx --output result.cdx result.json Note Please note that if you want to convert to a format that requires a list of packages, such as SBOM, you need to add the --list-all-pkgs flag when outputting in JSON. Filtering options such as --severity are also available with convert . # Output all severities in JSON $ trivy image --format json -o result.json --list-all-pkgs debian:11 # Output only critical issues in table format $ trivy convert --format table --severity CRITICAL result.json Note JSON reports from \"trivy aws\" and \"trivy k8s\" are not yet supported.","title":"Reporting"},{"location":"docs/configuration/reporting/#reporting","text":"","title":"Reporting"},{"location":"docs/configuration/reporting/#supported-formats","text":"Trivy supports the following formats: Table JSON SARIF Template SBOM GitHub dependency snapshot","title":"Supported Formats"},{"location":"docs/configuration/reporting/#table-default","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 $ trivy image -f table golang:1.12-alpine","title":"Table (Default)"},{"location":"docs/configuration/reporting/#show-origins-of-vulnerable-dependencies","text":"Scanner Supported Vulnerability \u2713 Misconfiguration Secret License EXPERIMENTAL This feature might change without preserving backwards compatibility. Modern software development relies on the use of third-party libraries. Third-party dependencies also depend on others so a list of dependencies can be represented as a dependency graph. In some cases, vulnerable dependencies are not linked directly, and it requires analyses of the tree. To make this task simpler Trivy can show a dependency origin tree with the --dependency-tree flag. This flag is only available with the --format table flag. The following packages/languages are currently supported: OS packages apk dpkg rpm Node.js npm: package-lock.json pnpm: pnpm-lock.yaml yarn: yarn.lock .NET NuGet: packages.lock.json Python Poetry: poetry.lock Ruby Bundler: Gemfile.lock Rust Binaries built with cargo-auditable Go Modules: go.mod PHP Composer Java Maven: pom.xml This tree is the reverse of the npm list command. However, if you want to resolve a vulnerability in a particular indirect dependency, the reversed tree is useful to know where that dependency comes from and identify which package you actually need to update. In table output, it looks like: $ trivy fs --severity HIGH,CRITICAL --dependency-tree /path/to/your_node_project package-lock.json ( npm ) ======================= Total: 2 ( HIGH: 1 , CRITICAL: 1 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 follow-redirects \u2502 CVE-2022-0155 \u2502 HIGH \u2502 1 .14.6 \u2502 1 .14.7 \u2502 follow-redirects: Exposure of Private Personal Information \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 to an Unauthorized Actor \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-0155 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 glob-parent \u2502 CVE-2020-28469 \u2502 CRITICAL \u2502 3 .1.0 \u2502 5 .1.2 \u2502 nodejs-glob-parent: Regular expression denial of service \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2020-28469 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Dependency Origin Tree ( Reversed ) ================================= package-lock.json \u251c\u2500\u2500 follow-redirects@1.14.6, ( HIGH: 1 , CRITICAL: 0 ) \u2502 \u2514\u2500\u2500 axios@0.21.4 \u2514\u2500\u2500 glob-parent@3.1.0, ( HIGH: 0 , CRITICAL: 1 ) \u2514\u2500\u2500 chokidar@2.1.8 \u2514\u2500\u2500 watchpack-chokidar2@2.0.1 \u2514\u2500\u2500 watchpack@1.7.5 \u2514\u2500\u2500 webpack@4.46.0 \u2514\u2500\u2500 cra-append-sw@2.7.0 Vulnerable dependencies are shown in the top level of the tree. Lower levels show how those vulnerabilities are introduced. In the example above axios@0.21.4 included in the project directly depends on the vulnerable follow-redirects@1.14.6 . Also, glob-parent@3.1.0 with some vulnerabilities is included through chain of dependencies that is added by cra-append-sw@2.7.0 . Then, you can try to update axios@0.21.4 and cra-append-sw@2.7.0 to resolve vulnerabilities in follow-redirects@1.14.6 and glob-parent@3.1.0 .","title":"Show origins of vulnerable dependencies"},{"location":"docs/configuration/reporting/#json","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 $ trivy image -f json -o results.json golang:1.12-alpine Result 2019-05-16T01:46:31.777+0900 INFO Updating vulnerability database... 2019-05-16T01:47:03.007+0900 INFO Detecting Alpine vulnerabilities... JSON [ { \"Target\": \"php-app/composer.lock\", \"Vulnerabilities\": null }, { \"Target\": \"node-app/package-lock.json\", \"Vulnerabilities\": [ { \"VulnerabilityID\": \"CVE-2018-16487\", \"PkgName\": \"lodash\", \"InstalledVersion\": \"4.17.4\", \"FixedVersion\": \"\\u003e=4.17.11\", \"Title\": \"lodash: Prototype pollution in utilities function\", \"Description\": \"A prototype pollution vulnerability was found in lodash \\u003c4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.\", \"Severity\": \"HIGH\", \"References\": [ \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16487\", ] } ] }, { \"Target\": \"trivy-ci-test (alpine 3.7.1)\", \"Vulnerabilities\": [ { \"VulnerabilityID\": \"CVE-2018-16840\", \"PkgName\": \"curl\", \"InstalledVersion\": \"7.61.0-r0\", \"FixedVersion\": \"7.61.1-r1\", \"Title\": \"curl: Use-after-free when closing \\\"easy\\\" handle in Curl_close()\", \"Description\": \"A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. \", \"Severity\": \"HIGH\", \"References\": [ \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16840\", ] }, { \"VulnerabilityID\": \"CVE-2019-3822\", \"PkgName\": \"curl\", \"InstalledVersion\": \"7.61.0-r0\", \"FixedVersion\": \"7.61.1-r2\", \"Title\": \"curl: NTLMv2 type-3 header stack buffer overflow\", \"Description\": \"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. \", \"Severity\": \"HIGH\", \"References\": [ \"https://curl.haxx.se/docs/CVE-2019-3822.html\", \"https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f@%3Cdevnull.infra.apache.org%3E\" ] }, { \"VulnerabilityID\": \"CVE-2018-16839\", \"PkgName\": \"curl\", \"InstalledVersion\": \"7.61.0-r0\", \"FixedVersion\": \"7.61.1-r1\", \"Title\": \"curl: Integer overflow leading to heap-based buffer overflow in Curl_sasl_create_plain_message()\", \"Description\": \"Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.\", \"Severity\": \"HIGH\", \"References\": [ \"https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5\", ] }, { \"VulnerabilityID\": \"CVE-2018-19486\", \"PkgName\": \"git\", \"InstalledVersion\": \"2.15.2-r0\", \"FixedVersion\": \"2.15.3-r0\", \"Title\": \"git: Improper handling of PATH allows for commands to be executed from the current directory\", \"Description\": \"Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.\", \"Severity\": \"HIGH\", \"References\": [ \"https://usn.ubuntu.com/3829-1/\", ] }, { \"VulnerabilityID\": \"CVE-2018-17456\", \"PkgName\": \"git\", \"InstalledVersion\": \"2.15.2-r0\", \"FixedVersion\": \"2.15.3-r0\", \"Title\": \"git: arbitrary code execution via .gitmodules\", \"Description\": \"Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \\\"git clone\\\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.\", \"Severity\": \"HIGH\", \"References\": [ \"http://www.securitytracker.com/id/1041811\", ] } ] }, { \"Target\": \"python-app/Pipfile.lock\", \"Vulnerabilities\": null }, { \"Target\": \"ruby-app/Gemfile.lock\", \"Vulnerabilities\": null }, { \"Target\": \"rust-app/Cargo.lock\", \"Vulnerabilities\": null } ] VulnerabilityID , PkgName , InstalledVersion , and Severity in Vulnerabilities are always filled with values, but other fields might be empty.","title":"JSON"},{"location":"docs/configuration/reporting/#sarif","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 SARIF can be generated with the --format sarif flag. $ trivy image --format sarif -o report.sarif golang:1.12-alpine This SARIF file can be uploaded to GitHub code scanning results, and there is a Trivy GitHub Action for automating this process.","title":"SARIF"},{"location":"docs/configuration/reporting/#github-dependency-snapshot","text":"Trivy supports the following packages. OS packages Language-specific packages GitHub dependency snapshots can be generated with the --format github flag. $ trivy image --format github -o report.gsbom alpine This snapshot file can be submitted to your GitHub repository.","title":"GitHub dependency snapshot"},{"location":"docs/configuration/reporting/#template","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713","title":"Template"},{"location":"docs/configuration/reporting/#custom-template","text":"$ trivy image --format template --template \"{{ range . }} {{ .Target }} {{ end }}\" golang:1.12-alpine Result 2020-01-02T18:02:32.856+0100 INFO Detecting Alpine vulnerabilities... golang:1.12-alpine (alpine 3.10.2) You can compute different figures within the template using sprig functions. As an example you can summarize the different classes of issues: $ trivy image --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if eq .Severity \"CRITICAL\" }}{{- $critical = add $critical 1 }}{{- end }}{{- if eq .Severity \"HIGH\" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' golang:1.12-alpine Result Critical: 0, High: 2 For other features of sprig, see the official sprig documentation.","title":"Custom Template"},{"location":"docs/configuration/reporting/#load-templates-from-a-file","text":"You can load templates from a file prefixing the template path with an @. $ trivy image --format template --template \"@/path/to/template\" golang:1.12-alpine","title":"Load templates from a file"},{"location":"docs/configuration/reporting/#default-templates","text":"If Trivy is installed using rpm then default templates can be found at /usr/local/share/trivy/templates .","title":"Default Templates"},{"location":"docs/configuration/reporting/#junit","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License In the following example using the template junit.tpl XML can be generated. $ trivy image --format template --template \"@contrib/junit.tpl\" -o junit-report.xml golang:1.12-alpine","title":"JUnit"},{"location":"docs/configuration/reporting/#asff","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License Trivy also supports an ASFF template for reporting findings to AWS Security Hub","title":"ASFF"},{"location":"docs/configuration/reporting/#html","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License $ trivy image --format template --template \"@contrib/html.tpl\" -o report.html golang:1.12-alpine The following example shows use of default HTML template when Trivy is installed using rpm. $ trivy image --format template --template \"@/usr/local/share/trivy/templates/html.tpl\" -o report.html golang:1.12-alpine","title":"HTML"},{"location":"docs/configuration/reporting/#sbom","text":"See here for details.","title":"SBOM"},{"location":"docs/configuration/reporting/#converting","text":"To generate multiple reports, you can generate the JSON report first and convert it to other formats with the convert subcommand. $ trivy image --format json -o result.json --list-all-pkgs debian:11 $ trivy convert --format cyclonedx --output result.cdx result.json Note Please note that if you want to convert to a format that requires a list of packages, such as SBOM, you need to add the --list-all-pkgs flag when outputting in JSON. Filtering options such as --severity are also available with convert . # Output all severities in JSON $ trivy image --format json -o result.json --list-all-pkgs debian:11 # Output only critical issues in table format $ trivy convert --format table --severity CRITICAL result.json Note JSON reports from \"trivy aws\" and \"trivy k8s\" are not yet supported.","title":"Converting"},{"location":"docs/configuration/skipping/","text":"Skipping Files and Directories This section details ways to specify the files and directories that Trivy should not scan. Skip Files Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 By default, Trivy traverses directories and searches for all necessary files for scanning. You can skip files that you don't maintain using the --skip-files flag, or the equivalent Trivy YAML config option. Using the --skip-files flag: $ trivy image --skip-files \"/Gemfile.lock\" --skip-files \"/var/lib/gems/2.5.0/gems/http_parser.rb-0.6.0/Gemfile.lock\" quay.io/fluentd_elasticsearch/fluentd:v2.9.0 Using the Trivy YAML configuration: image : skip-files : - foo - \"testdata/*/bar\" It's possible to specify globs as part of the value. $ trivy image --skip-files \"./testdata/*/bar\" . This will skip any file named bar in the subdirectories of testdata. $ trivy config --skip-files \"./foo/**/*.tf\" . This will skip any files with the extension .tf in subdirectories of foo at any depth. Skip Directories Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 By default, Trivy traverses directories and searches for all necessary files for scanning. You can skip directories that you don't maintain using the --skip-dirs flag, or the equivalent Trivy YAML config option. Using the --skip-dirs flag: $ trivy image --skip-dirs /var/lib/gems/2.5.0/gems/fluent-plugin-detect-exceptions-0.0.13 --skip-dirs \"/var/lib/gems/2.5.0/gems/http_parser.rb-0.6.0\" quay.io/fluentd_elasticsearch/fluentd:v2.9.0 Using the Trivy YAML configuration: image : skip-dirs : - foo/bar/ - \"**/.terraform\" It's possible to specify globs as part of the value. $ trivy image --skip-dirs \"./testdata/*\" . This will skip all subdirectories of the testdata directory. $ trivy config --skip-dirs \"**/.terraform\" . This will skip subdirectories at any depth named .terraform/ . (Note: this will match ./foo/.terraform or ./foo/bar/.terraform , but not ./.terraform .) Tip Glob patterns work with any trivy subcommand (image, config, etc.) and can be specified to skip both directories (with --skip-dirs ) and files (with --skip-files ). Advanced globbing Trivy also supports bash style extended glob pattern matching. $ trivy image --skip-files \"**/foo\" image:tag This will skip the file foo that happens to be nested under any parent(s). File patterns Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License When a directory is given as an input, Trivy will recursively look for and test all files based on file patterns. The default file patterns are here . In addition to the default file patterns, the --file-patterns option takes regexp patterns to look for your files. For example, it may be useful when your file name of Dockerfile doesn't match the default patterns. This can be repeated for specifying multiple file patterns. A file pattern contains the analyzer it is used for, and the pattern itself, joined by a semicolon. For example: --file-patterns \"dockerfile:.*.docker\" --file-patterns \"kubernetes:*.tpl\" --file-patterns \"pip:requirements-.*\\.txt\" The prefixes are listed here","title":"Skipping Files"},{"location":"docs/configuration/skipping/#skipping-files-and-directories","text":"This section details ways to specify the files and directories that Trivy should not scan.","title":"Skipping Files and Directories"},{"location":"docs/configuration/skipping/#skip-files","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 By default, Trivy traverses directories and searches for all necessary files for scanning. You can skip files that you don't maintain using the --skip-files flag, or the equivalent Trivy YAML config option. Using the --skip-files flag: $ trivy image --skip-files \"/Gemfile.lock\" --skip-files \"/var/lib/gems/2.5.0/gems/http_parser.rb-0.6.0/Gemfile.lock\" quay.io/fluentd_elasticsearch/fluentd:v2.9.0 Using the Trivy YAML configuration: image : skip-files : - foo - \"testdata/*/bar\" It's possible to specify globs as part of the value. $ trivy image --skip-files \"./testdata/*/bar\" . This will skip any file named bar in the subdirectories of testdata. $ trivy config --skip-files \"./foo/**/*.tf\" . This will skip any files with the extension .tf in subdirectories of foo at any depth.","title":"Skip Files"},{"location":"docs/configuration/skipping/#skip-directories","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 By default, Trivy traverses directories and searches for all necessary files for scanning. You can skip directories that you don't maintain using the --skip-dirs flag, or the equivalent Trivy YAML config option. Using the --skip-dirs flag: $ trivy image --skip-dirs /var/lib/gems/2.5.0/gems/fluent-plugin-detect-exceptions-0.0.13 --skip-dirs \"/var/lib/gems/2.5.0/gems/http_parser.rb-0.6.0\" quay.io/fluentd_elasticsearch/fluentd:v2.9.0 Using the Trivy YAML configuration: image : skip-dirs : - foo/bar/ - \"**/.terraform\" It's possible to specify globs as part of the value. $ trivy image --skip-dirs \"./testdata/*\" . This will skip all subdirectories of the testdata directory. $ trivy config --skip-dirs \"**/.terraform\" . This will skip subdirectories at any depth named .terraform/ . (Note: this will match ./foo/.terraform or ./foo/bar/.terraform , but not ./.terraform .) Tip Glob patterns work with any trivy subcommand (image, config, etc.) and can be specified to skip both directories (with --skip-dirs ) and files (with --skip-files ).","title":"Skip Directories"},{"location":"docs/configuration/skipping/#advanced-globbing","text":"Trivy also supports bash style extended glob pattern matching. $ trivy image --skip-files \"**/foo\" image:tag This will skip the file foo that happens to be nested under any parent(s).","title":"Advanced globbing"},{"location":"docs/configuration/skipping/#file-patterns","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License When a directory is given as an input, Trivy will recursively look for and test all files based on file patterns. The default file patterns are here . In addition to the default file patterns, the --file-patterns option takes regexp patterns to look for your files. For example, it may be useful when your file name of Dockerfile doesn't match the default patterns. This can be repeated for specifying multiple file patterns. A file pattern contains the analyzer it is used for, and the pattern itself, joined by a semicolon. For example: --file-patterns \"dockerfile:.*.docker\" --file-patterns \"kubernetes:*.tpl\" --file-patterns \"pip:requirements-.*\\.txt\" The prefixes are listed here","title":"File patterns"},{"location":"docs/coverage/","text":"Scanning Coverage Trivy can detect security issues in many different platforms, languages and configuration files. This section gives a general overview of that coverage, and can help answer the frequently asked question \"Does Trivy support X?\". For more detailed information about the specific platforms and languages, check the relevant documentation. OS Packages Language-specific Packages IaC files Kubernetes clusters","title":"Overview"},{"location":"docs/coverage/#scanning-coverage","text":"Trivy can detect security issues in many different platforms, languages and configuration files. This section gives a general overview of that coverage, and can help answer the frequently asked question \"Does Trivy support X?\". For more detailed information about the specific platforms and languages, check the relevant documentation. OS Packages Language-specific Packages IaC files Kubernetes clusters","title":"Scanning Coverage"},{"location":"docs/coverage/kubernetes/","text":"Kubernetes When scanning a Kubernetes cluster, Trivy differentiates between the following: Cluster infrastructure (e.g api-server, kubelet, addons) Cluster configuration (e.g Roles, ClusterRoles). Application workloads (e.g nginx, postgresql). Whenever Trivy scans either of these Kubernetes resources, the container image is scanned separately to the Kubernetes resource definition (the YAML manifest) that defines the resource. When scanning any of the above, the container image is scanned separately to the Kubernetes resource definition (the YAML manifest) that defines the resource. Container image is scanned for: - Vulnerabilities - Misconfigurations - Exposed secrets Kubernetes resource definition is scanned for: - Vulnerabilities - partially supported through KBOM scanning - Misconfigurations - Exposed secrets To learn more, please see the documentation for Kubernetes scanning","title":"Kubernetes"},{"location":"docs/coverage/kubernetes/#kubernetes","text":"When scanning a Kubernetes cluster, Trivy differentiates between the following: Cluster infrastructure (e.g api-server, kubelet, addons) Cluster configuration (e.g Roles, ClusterRoles). Application workloads (e.g nginx, postgresql). Whenever Trivy scans either of these Kubernetes resources, the container image is scanned separately to the Kubernetes resource definition (the YAML manifest) that defines the resource. When scanning any of the above, the container image is scanned separately to the Kubernetes resource definition (the YAML manifest) that defines the resource. Container image is scanned for: - Vulnerabilities - Misconfigurations - Exposed secrets Kubernetes resource definition is scanned for: - Vulnerabilities - partially supported through KBOM scanning - Misconfigurations - Exposed secrets To learn more, please see the documentation for Kubernetes scanning","title":"Kubernetes"},{"location":"docs/coverage/iac/","text":"Infrastructure as Code Scanner Trivy scans Infrastructure as Code (IaC) files for Misconfigurations Secrets Supported configurations Config type File patterns Kubernetes .yml, .yaml, *.json Docker Dockerfile, Containerfile Terraform .tf, .tf.json, *.tfvars, CloudFormation .yml, .yaml, *.json Azure ARM Template *.json Helm .yaml, .tpl, *.tar.gz, etc.","title":"Overview"},{"location":"docs/coverage/iac/#infrastructure-as-code","text":"","title":"Infrastructure as Code"},{"location":"docs/coverage/iac/#scanner","text":"Trivy scans Infrastructure as Code (IaC) files for Misconfigurations Secrets","title":"Scanner"},{"location":"docs/coverage/iac/#supported-configurations","text":"Config type File patterns Kubernetes .yml, .yaml, *.json Docker Dockerfile, Containerfile Terraform .tf, .tf.json, *.tfvars, CloudFormation .yml, .yaml, *.json Azure ARM Template *.json Helm .yaml, .tpl, *.tar.gz, etc.","title":"Supported configurations"},{"location":"docs/coverage/iac/azure-arm/","text":"Azure ARM Template Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following configurations: Format Supported ARM template \u2713 Bicep \u2713 1 To scan Bicep codes, you need to convert them into ARM templates first. az bicep build -f main.bicep or bicep build main.bicep Misconfiguration Trivy recursively searches directories and scans all found Azure ARM templates. Secret The secret scan is performed on plain text files, with no special treatment for Azure ARM templates. Bicep is not natively supported. It needs to be converted into Azure ARM templates. \u21a9","title":"Azure ARM Template"},{"location":"docs/coverage/iac/azure-arm/#azure-arm-template","text":"Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following configurations: Format Supported ARM template \u2713 Bicep \u2713 1 To scan Bicep codes, you need to convert them into ARM templates first. az bicep build -f main.bicep or bicep build main.bicep","title":"Azure ARM Template"},{"location":"docs/coverage/iac/azure-arm/#misconfiguration","text":"Trivy recursively searches directories and scans all found Azure ARM templates.","title":"Misconfiguration"},{"location":"docs/coverage/iac/azure-arm/#secret","text":"The secret scan is performed on plain text files, with no special treatment for Azure ARM templates. Bicep is not natively supported. It needs to be converted into Azure ARM templates. \u21a9","title":"Secret"},{"location":"docs/coverage/iac/cloudformation/","text":"CloudFormation Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following formats. Format Supported JSON \u2713 YAML \u2713 Misconfiguration Trivy recursively searches directories and scans all found CloudFormation files. It evaluates properties, functions, and other elements within CloudFormation files to detect misconfigurations. Secret The secret scan is performed on plain text files, with no special treatment for CloudFormation.","title":"CloudFormation"},{"location":"docs/coverage/iac/cloudformation/#cloudformation","text":"Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following formats. Format Supported JSON \u2713 YAML \u2713","title":"CloudFormation"},{"location":"docs/coverage/iac/cloudformation/#misconfiguration","text":"Trivy recursively searches directories and scans all found CloudFormation files. It evaluates properties, functions, and other elements within CloudFormation files to detect misconfigurations.","title":"Misconfiguration"},{"location":"docs/coverage/iac/cloudformation/#secret","text":"The secret scan is performed on plain text files, with no special treatment for CloudFormation.","title":"Secret"},{"location":"docs/coverage/iac/docker/","text":"Docker Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following configurations. Config Supported Dockerfile \u2713 Containerfile \u2713 Compose - Misconfiguration Trivy recursively searches directories and scans all found Docker files. Secret The secret scan is performed on plain text files, with no special treatment for Dockerfile.","title":"Docker"},{"location":"docs/coverage/iac/docker/#docker","text":"Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following configurations. Config Supported Dockerfile \u2713 Containerfile \u2713 Compose -","title":"Docker"},{"location":"docs/coverage/iac/docker/#misconfiguration","text":"Trivy recursively searches directories and scans all found Docker files.","title":"Misconfiguration"},{"location":"docs/coverage/iac/docker/#secret","text":"The secret scan is performed on plain text files, with no special treatment for Dockerfile.","title":"Secret"},{"location":"docs/coverage/iac/helm/","text":"Helm Trivy supports two types of Helm scanning, templates and packaged charts. The following scanners are supported. Format Misconfiguration Secret Template \u2713 \u2713 Chart \u2713 - Misconfiguration Trivy recursively searches directories and scans all found Helm files. It evaluates variables, functions, and other elements within Helm templates and resolve the chart to Kubernetes manifests then run the Kubernetes checks. See here for more details on the built-in policies. Value overrides There are a number of options for overriding values in Helm charts. When override values are passed to the Helm scanner, the values will be used during the Manifest rendering process and will become part of the scanned artifact. Setting inline value overrides Overrides can be set inline on the command line trivy conf --helm-set securityContext.runAsUser = 0 ./charts/mySql Setting value file overrides Overrides can be in a file that has the key=value set. # Example override file (overrides.yaml) securityContext : runAsUser : 0 trivy conf --helm-values overrides.yaml ./charts/mySql Setting value as explicit string the --helm-set-string is the same as --helm-set but explicitly retains the value as a string trivy config --helm-set-string name = false ./infrastructure/tf Setting specific values from files Specific override values can come from specific files trivy conf --helm-set-file environment = dev.values.yaml ./charts/mySql Secret The secret scan is performed on plain text files, with no special treatment for Helm. Secret scanning is not conducted on the contents of packaged Charts, such as tar or tar.gz.","title":"Helm"},{"location":"docs/coverage/iac/helm/#helm","text":"Trivy supports two types of Helm scanning, templates and packaged charts. The following scanners are supported. Format Misconfiguration Secret Template \u2713 \u2713 Chart \u2713 -","title":"Helm"},{"location":"docs/coverage/iac/helm/#misconfiguration","text":"Trivy recursively searches directories and scans all found Helm files. It evaluates variables, functions, and other elements within Helm templates and resolve the chart to Kubernetes manifests then run the Kubernetes checks. See here for more details on the built-in policies.","title":"Misconfiguration"},{"location":"docs/coverage/iac/helm/#value-overrides","text":"There are a number of options for overriding values in Helm charts. When override values are passed to the Helm scanner, the values will be used during the Manifest rendering process and will become part of the scanned artifact.","title":"Value overrides"},{"location":"docs/coverage/iac/helm/#setting-inline-value-overrides","text":"Overrides can be set inline on the command line trivy conf --helm-set securityContext.runAsUser = 0 ./charts/mySql","title":"Setting inline value overrides"},{"location":"docs/coverage/iac/helm/#setting-value-file-overrides","text":"Overrides can be in a file that has the key=value set. # Example override file (overrides.yaml) securityContext : runAsUser : 0 trivy conf --helm-values overrides.yaml ./charts/mySql","title":"Setting value file overrides"},{"location":"docs/coverage/iac/helm/#setting-value-as-explicit-string","text":"the --helm-set-string is the same as --helm-set but explicitly retains the value as a string trivy config --helm-set-string name = false ./infrastructure/tf","title":"Setting value as explicit string"},{"location":"docs/coverage/iac/helm/#setting-specific-values-from-files","text":"Specific override values can come from specific files trivy conf --helm-set-file environment = dev.values.yaml ./charts/mySql","title":"Setting specific values from files"},{"location":"docs/coverage/iac/helm/#secret","text":"The secret scan is performed on plain text files, with no special treatment for Helm. Secret scanning is not conducted on the contents of packaged Charts, such as tar or tar.gz.","title":"Secret"},{"location":"docs/coverage/iac/kubernetes/","text":"Kubernetes Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 In addition to raw YAML and JSON, it supports the following templates: Template Supported Helm \u2713 Kustomize \u2713 1 Note Trivy does not support Kustomize overlays, so it scans files defined in the base. Or, you can scan the output of kustomize build . Misconfiguration Trivy recursively searches directories and scans all found Kubernetes files. Secret The secret scan is performed on plain text files, with no special treatment for Kubernetes. This means that Base64 encoded secrets are not scanned, and only secrets written in plain text are detected. Kustomize is not natively supported. \u21a9","title":"Kubernetes"},{"location":"docs/coverage/iac/kubernetes/#kubernetes","text":"Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 In addition to raw YAML and JSON, it supports the following templates: Template Supported Helm \u2713 Kustomize \u2713 1 Note Trivy does not support Kustomize overlays, so it scans files defined in the base. Or, you can scan the output of kustomize build .","title":"Kubernetes"},{"location":"docs/coverage/iac/kubernetes/#misconfiguration","text":"Trivy recursively searches directories and scans all found Kubernetes files.","title":"Misconfiguration"},{"location":"docs/coverage/iac/kubernetes/#secret","text":"The secret scan is performed on plain text files, with no special treatment for Kubernetes. This means that Base64 encoded secrets are not scanned, and only secrets written in plain text are detected. Kustomize is not natively supported. \u21a9","title":"Secret"},{"location":"docs/coverage/iac/terraform/","text":"Terraform Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following formats: Format Supported JSON \u2713 HCL \u2713 Plan JSON \u2713 Trivy can scan the results of terraform plan . You can scan by passing the file generated as shown below to Trivy: $ terraform plan --out tfplan.binary $ terraform show -json tfplan.binary > tfplan.json Misconfiguration Trivy recursively searches directories and scans all found Terraform files. It also evaluates variables, imports, and other elements within Terraform files to detect misconfigurations. Value Overrides You can provide tf-vars files to Trivy to override default values specified in the Terraform HCL code. trivy conf --tf-vars dev.terraform.tfvars ./infrastructure/tf Exclude Downloaded Terraform Modules By default, downloaded modules are also scanned. If you don't want to scan modules downloaded into the .terraform directory, you can use the --tf-exclude-downloaded-modules flag. trivy conf --tf-exclude-downloaded-modules ./configs Secret The secret scan is performed on plain text files, with no special treatment for Terraform.","title":"Terraform"},{"location":"docs/coverage/iac/terraform/#terraform","text":"Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following formats: Format Supported JSON \u2713 HCL \u2713 Plan JSON \u2713 Trivy can scan the results of terraform plan . You can scan by passing the file generated as shown below to Trivy: $ terraform plan --out tfplan.binary $ terraform show -json tfplan.binary > tfplan.json","title":"Terraform"},{"location":"docs/coverage/iac/terraform/#misconfiguration","text":"Trivy recursively searches directories and scans all found Terraform files. It also evaluates variables, imports, and other elements within Terraform files to detect misconfigurations.","title":"Misconfiguration"},{"location":"docs/coverage/iac/terraform/#value-overrides","text":"You can provide tf-vars files to Trivy to override default values specified in the Terraform HCL code. trivy conf --tf-vars dev.terraform.tfvars ./infrastructure/tf","title":"Value Overrides"},{"location":"docs/coverage/iac/terraform/#exclude-downloaded-terraform-modules","text":"By default, downloaded modules are also scanned. If you don't want to scan modules downloaded into the .terraform directory, you can use the --tf-exclude-downloaded-modules flag. trivy conf --tf-exclude-downloaded-modules ./configs","title":"Exclude Downloaded Terraform Modules"},{"location":"docs/coverage/iac/terraform/#secret","text":"The secret scan is performed on plain text files, with no special treatment for Terraform.","title":"Secret"},{"location":"docs/coverage/language/","text":"Programming Language Trivy supports programming languages for SBOM Vulnerabilities Licenses Supported languages The files analyzed vary depending on the target. This is because Trivy primarily categorizes targets into two groups: Pre-build Post-build If the target is a pre-build project, like a code repository, Trivy will analyze files used for building, such as lock files. On the other hand, when the target is a post-build artifact, like a container image, Trivy will analyze installed package metadata like .gemspec , binary files, and so on. Language File Image 5 Rootfs 6 Filesystem 7 Repository 8 Ruby Gemfile.lock - - \u2705 \u2705 gemspec \u2705 \u2705 - - Python Pipfile.lock - - \u2705 \u2705 poetry.lock - - \u2705 \u2705 requirements.txt - - \u2705 \u2705 egg package 1 \u2705 \u2705 - - wheel package 2 \u2705 \u2705 - - conda package 3 \u2705 \u2705 - - PHP composer.lock \u2705 \u2705 \u2705 \u2705 Node.js package-lock.json - - \u2705 \u2705 yarn.lock - - \u2705 \u2705 pnpm-lock.yaml - - \u2705 \u2705 package.json \u2705 \u2705 - - .NET packages.lock.json \u2705 \u2705 \u2705 \u2705 packages.config \u2705 \u2705 \u2705 \u2705 .deps.json \u2705 \u2705 \u2705 \u2705 Java JAR/WAR/PAR/EAR 4 \u2705 \u2705 - - pom.xml - - \u2705 \u2705 *gradle.lockfile - - \u2705 \u2705 Go Binaries built by Go \u2705 \u2705 - - go.mod - - \u2705 \u2705 Rust Cargo.lock \u2705 \u2705 \u2705 \u2705 Binaries built with cargo-auditable \u2705 \u2705 - - C/C++ conan.lock - - \u2705 \u2705 Elixir mix.lock 10 - - \u2705 \u2705 Dart pubspec.lock - - \u2705 \u2705 Swift Podfile.lock - - \u2705 \u2705 Package.resolved - - \u2705 \u2705 The path of these files does not matter. Example: Dockerfile *.egg-info , *.egg-info/PKG-INFO , *.egg and EGG-INFO/PKG-INFO \u21a9 .dist-info/META-DATA \u21a9 envs/*/conda-meta/*.json \u21a9 *.jar , *.war , *.par and *.ear \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the image scanning \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the rootfs scanning \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the filesystem scanning \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the git repository scanning \u21a9 \u2705 means that Trivy detects line numbers where each dependency is declared in the scanned file. Only supported in json and sarif formats. SARIF uses startline == 1 and endline == 1 for unsupported file types \u21a9 To scan a filename other than the default filename use file-patterns \u21a9","title":"Overview"},{"location":"docs/coverage/language/#programming-language","text":"Trivy supports programming languages for SBOM Vulnerabilities Licenses","title":"Programming Language"},{"location":"docs/coverage/language/#supported-languages","text":"The files analyzed vary depending on the target. This is because Trivy primarily categorizes targets into two groups: Pre-build Post-build If the target is a pre-build project, like a code repository, Trivy will analyze files used for building, such as lock files. On the other hand, when the target is a post-build artifact, like a container image, Trivy will analyze installed package metadata like .gemspec , binary files, and so on. Language File Image 5 Rootfs 6 Filesystem 7 Repository 8 Ruby Gemfile.lock - - \u2705 \u2705 gemspec \u2705 \u2705 - - Python Pipfile.lock - - \u2705 \u2705 poetry.lock - - \u2705 \u2705 requirements.txt - - \u2705 \u2705 egg package 1 \u2705 \u2705 - - wheel package 2 \u2705 \u2705 - - conda package 3 \u2705 \u2705 - - PHP composer.lock \u2705 \u2705 \u2705 \u2705 Node.js package-lock.json - - \u2705 \u2705 yarn.lock - - \u2705 \u2705 pnpm-lock.yaml - - \u2705 \u2705 package.json \u2705 \u2705 - - .NET packages.lock.json \u2705 \u2705 \u2705 \u2705 packages.config \u2705 \u2705 \u2705 \u2705 .deps.json \u2705 \u2705 \u2705 \u2705 Java JAR/WAR/PAR/EAR 4 \u2705 \u2705 - - pom.xml - - \u2705 \u2705 *gradle.lockfile - - \u2705 \u2705 Go Binaries built by Go \u2705 \u2705 - - go.mod - - \u2705 \u2705 Rust Cargo.lock \u2705 \u2705 \u2705 \u2705 Binaries built with cargo-auditable \u2705 \u2705 - - C/C++ conan.lock - - \u2705 \u2705 Elixir mix.lock 10 - - \u2705 \u2705 Dart pubspec.lock - - \u2705 \u2705 Swift Podfile.lock - - \u2705 \u2705 Package.resolved - - \u2705 \u2705 The path of these files does not matter. Example: Dockerfile *.egg-info , *.egg-info/PKG-INFO , *.egg and EGG-INFO/PKG-INFO \u21a9 .dist-info/META-DATA \u21a9 envs/*/conda-meta/*.json \u21a9 *.jar , *.war , *.par and *.ear \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the image scanning \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the rootfs scanning \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the filesystem scanning \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the git repository scanning \u21a9 \u2705 means that Trivy detects line numbers where each dependency is declared in the scanned file. Only supported in json and sarif formats. SARIF uses startline == 1 and endline == 1 for unsupported file types \u21a9 To scan a filename other than the default filename use file-patterns \u21a9","title":"Supported languages"},{"location":"docs/coverage/language/c/","text":"C/C++ Trivy supports Conan C/C++ Package Manager. The following scanners are supported. Package manager SBOM Vulnerability License Conan \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Conan conan.lock 1 \u2713 Excluded \u2713 \u2713 Conan In order to detect dependencies, Trivy searches for conan.lock 1 . conan.lock is default name. To scan a custom filename use file-patterns \u21a9 \u21a9","title":"C/C++"},{"location":"docs/coverage/language/c/#cc","text":"Trivy supports Conan C/C++ Package Manager. The following scanners are supported. Package manager SBOM Vulnerability License Conan \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Conan conan.lock 1 \u2713 Excluded \u2713 \u2713","title":"C/C++"},{"location":"docs/coverage/language/c/#conan","text":"In order to detect dependencies, Trivy searches for conan.lock 1 . conan.lock is default name. To scan a custom filename use file-patterns \u21a9 \u21a9","title":"Conan"},{"location":"docs/coverage/language/dart/","text":"Dart Trivy supports Dart . The following scanners are supported. Package manager SBOM Vulnerability License Dart \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Dart pubspec.lock \u2713 Included - - Dart In order to detect dependencies, Trivy searches for pubspec.lock . Trivy marks indirect dependencies, but pubspec.lock file doesn't have options to separate root and dev transitive dependencies. So Trivy includes all dependencies in report.","title":"Dart"},{"location":"docs/coverage/language/dart/#dart","text":"Trivy supports Dart . The following scanners are supported. Package manager SBOM Vulnerability License Dart \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Dart pubspec.lock \u2713 Included - -","title":"Dart"},{"location":"docs/coverage/language/dart/#dart_1","text":"In order to detect dependencies, Trivy searches for pubspec.lock . Trivy marks indirect dependencies, but pubspec.lock file doesn't have options to separate root and dev transitive dependencies. So Trivy includes all dependencies in report.","title":"Dart"},{"location":"docs/coverage/language/dotnet/","text":".NET Trivy supports .NET core and NuGet package managers. The following scanners are supported. Artifact SBOM Vulnerability License .Net Core \u2713 \u2713 - NuGet \u2713 \u2713 \u2713 The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position .Net Core *.deps.json \u2713 Excluded - \u2713 NuGet packages.config \u2713 Excluded - - NuGet packages.lock.json \u2713 Included \u2713 \u2713 *.deps.json Trivy parses *.deps.json files. Trivy currently excludes dev dependencies from the report. packages.config Trivy only finds dependency names and versions from packages.config files. To build dependency graph, it is better to use packages.lock.json files. license detection packages.config files don't have information about the licenses used. Trivy uses *.nuspec files from global packages folder to detect licenses. Note The licenseUrl field is deprecated . Trivy doesn't parse this field and only checks the license field (license expression type only). Currently only the default path and NUGET_PACKAGES environment variable are supported. packages.lock.json Don't forgot to enable lock files in your project. Tip Please make sure your lock file is up-to-date after modifying dependencies. license detection Same as packages.config","title":".NET"},{"location":"docs/coverage/language/dotnet/#net","text":"Trivy supports .NET core and NuGet package managers. The following scanners are supported. Artifact SBOM Vulnerability License .Net Core \u2713 \u2713 - NuGet \u2713 \u2713 \u2713 The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position .Net Core *.deps.json \u2713 Excluded - \u2713 NuGet packages.config \u2713 Excluded - - NuGet packages.lock.json \u2713 Included \u2713 \u2713","title":".NET"},{"location":"docs/coverage/language/dotnet/#depsjson","text":"Trivy parses *.deps.json files. Trivy currently excludes dev dependencies from the report.","title":"*.deps.json"},{"location":"docs/coverage/language/dotnet/#packagesconfig","text":"Trivy only finds dependency names and versions from packages.config files. To build dependency graph, it is better to use packages.lock.json files.","title":"packages.config"},{"location":"docs/coverage/language/dotnet/#license-detection","text":"packages.config files don't have information about the licenses used. Trivy uses *.nuspec files from global packages folder to detect licenses. Note The licenseUrl field is deprecated . Trivy doesn't parse this field and only checks the license field (license expression type only). Currently only the default path and NUGET_PACKAGES environment variable are supported.","title":"license detection"},{"location":"docs/coverage/language/dotnet/#packageslockjson","text":"Don't forgot to enable lock files in your project. Tip Please make sure your lock file is up-to-date after modifying dependencies.","title":"packages.lock.json"},{"location":"docs/coverage/language/dotnet/#license-detection_1","text":"Same as packages.config","title":"license detection"},{"location":"docs/coverage/language/elixir/","text":"Elixir Trivy supports Hex repository for Elixir . The following scanners are supported. Package manager SBOM Vulnerability License hex \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position hex mix.lock 1 \u2713 Excluded - \u2713 Hex In order to detect dependencies, Trivy searches for mix.lock 1 . Configure your project to use mix.lock 1 file. mix.lock is default name. To scan a custom filename use file-patterns \u21a9 \u21a9 \u21a9","title":"Elixir"},{"location":"docs/coverage/language/elixir/#elixir","text":"Trivy supports Hex repository for Elixir . The following scanners are supported. Package manager SBOM Vulnerability License hex \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position hex mix.lock 1 \u2713 Excluded - \u2713","title":"Elixir"},{"location":"docs/coverage/language/elixir/#hex","text":"In order to detect dependencies, Trivy searches for mix.lock 1 . Configure your project to use mix.lock 1 file. mix.lock is default name. To scan a custom filename use file-patterns \u21a9 \u21a9 \u21a9","title":"Hex"},{"location":"docs/coverage/language/golang/","text":"Go Features Trivy supports two types of Go scanning, Go Modules and binaries built by Go. The following scanners are supported. Artifact SBOM Vulnerability License Modules \u2713 \u2713 \u2713 2 Binaries \u2713 \u2713 - The table below provides an outline of the features Trivy offers. Artifact Offline 1 Dev dependencies Dependency graph Modules \u2705 Include \u2705 2 Binaries \u2705 Exclude - Note Trivy scans only dependencies of the Go project. Let's say you scan the Docker binary, Trivy doesn't detect vulnerabilities of Docker itself. Also, when you scan go.mod in Kubernetes, the Kubernetes vulnerabilities will not be found. Go Modules Depending on Go versions, the required files are different. Version Required files Offline >=1.17 go.mod \u2705 <1.17 go.mod, go.sum \u2705 In Go 1.17+ projects, Trivy uses go.mod for direct/indirect dependencies. On the other hand, it uses go.mod for direct dependencies and go.sum for indirect dependencies in Go 1.16 or less. Go 1.17+ holds actually needed indirect dependencies in go.mod , and it reduces false detection. go.sum in Go 1.16 or less contains all indirect dependencies that are even not needed for compiling. If you want to have better detection, please consider updating the Go version in your project. Note The Go version doesn't mean your CLI version, but the Go version in your go.mod. module github.com/aquasecurity/trivy go 1.18 require ( github.com/CycloneDX/cyclonedx-go v0.5.0 ... ) To update the Go version in your project, you need to run the following command. $ go mod tidy -go=1.18 To identify licenses and dependency relationships, you need to download modules to local cache beforehand, such as go mod download , go mod tidy , etc. Trivy traverses $GOPATH/pkg/mod and collects those extra information. Go binaries Trivy scans binaries built by Go. If there is a Go binary in your container image, Trivy automatically finds and scans it. Also, you can scan your local binaries. $ trivy fs ./your_binary Note It doesn't work with UPX-compressed binaries. It doesn't require the Internet access. \u21a9 Need to download modules to local cache beforehand \u21a9 \u21a9","title":"Go"},{"location":"docs/coverage/language/golang/#go","text":"","title":"Go"},{"location":"docs/coverage/language/golang/#features","text":"Trivy supports two types of Go scanning, Go Modules and binaries built by Go. The following scanners are supported. Artifact SBOM Vulnerability License Modules \u2713 \u2713 \u2713 2 Binaries \u2713 \u2713 - The table below provides an outline of the features Trivy offers. Artifact Offline 1 Dev dependencies Dependency graph Modules \u2705 Include \u2705 2 Binaries \u2705 Exclude - Note Trivy scans only dependencies of the Go project. Let's say you scan the Docker binary, Trivy doesn't detect vulnerabilities of Docker itself. Also, when you scan go.mod in Kubernetes, the Kubernetes vulnerabilities will not be found.","title":"Features"},{"location":"docs/coverage/language/golang/#go-modules","text":"Depending on Go versions, the required files are different. Version Required files Offline >=1.17 go.mod \u2705 <1.17 go.mod, go.sum \u2705 In Go 1.17+ projects, Trivy uses go.mod for direct/indirect dependencies. On the other hand, it uses go.mod for direct dependencies and go.sum for indirect dependencies in Go 1.16 or less. Go 1.17+ holds actually needed indirect dependencies in go.mod , and it reduces false detection. go.sum in Go 1.16 or less contains all indirect dependencies that are even not needed for compiling. If you want to have better detection, please consider updating the Go version in your project. Note The Go version doesn't mean your CLI version, but the Go version in your go.mod. module github.com/aquasecurity/trivy go 1.18 require ( github.com/CycloneDX/cyclonedx-go v0.5.0 ... ) To update the Go version in your project, you need to run the following command. $ go mod tidy -go=1.18 To identify licenses and dependency relationships, you need to download modules to local cache beforehand, such as go mod download , go mod tidy , etc. Trivy traverses $GOPATH/pkg/mod and collects those extra information.","title":"Go Modules"},{"location":"docs/coverage/language/golang/#go-binaries","text":"Trivy scans binaries built by Go. If there is a Go binary in your container image, Trivy automatically finds and scans it. Also, you can scan your local binaries. $ trivy fs ./your_binary Note It doesn't work with UPX-compressed binaries. It doesn't require the Internet access. \u21a9 Need to download modules to local cache beforehand \u21a9 \u21a9","title":"Go binaries"},{"location":"docs/coverage/language/java/","text":"Java Trivy supports three types of Java scanning: JAR/WAR/PAR/EAR , pom.xml and *gradle.lockfile files. Each artifact supports the following scanners: Artifact SBOM Vulnerability License JAR/WAR/PAR/EAR \u2713 \u2713 - pom.xml \u2713 \u2713 \u2713 *gradle.lockfile \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Artifact Internet access Dev dependencies Dependency graph JAR/WAR/PAR/EAR Trivy Java DB Include - pom.xml Maven repository 1 Exclude \u2713 *gradle.lockfile - Exclude - These may be enabled or disabled depending on the target. See here for the detail. JAR/WAR/PAR/EAR To find information about your JAR 2 file, Trivy parses pom.properties and MANIFEST.MF files in your JAR 2 file and takes required properties 3 . If those files don't exist or don't contain enough information - Trivy will try to find this JAR 2 file in trivy-java-db . The Java DB will be automatically downloaded/updated when any JAR 2 file is found. It is stored in the cache directory . EXPERIMENTAL Finding JARs in trivy-java-db is an experimental function. Base JAR 2 may contain inner JARs 2 within itself. To find information about these JARs 2 , the same logic is used as for the base JAR 2 . table format only contains the name of root JAR 2 . To get the full path to inner JARs 2 use the json format. pom.xml Trivy parses your pom.xml file and tries to find files with dependencies from these local locations. project directory 4 relativePath field 5 local repository directory 6 . If your machine doesn't have the necessary files - Trivy tries to find the information about these dependencies in the maven repository . Note Trivy only takes information about packages. We don't take a list of vulnerabilities for packages from the maven repository . Information about data sources for Java you can see here . You can disable connecting to the maven repository with the --offline-scan flag. The --offline-scan flag does not affect the Trivy database. The vulnerability database will be downloaded anyway. Warning Trivy may skip some dependencies (that were not found on your local machine) when the --offline-scan flag is passed. Gradle.lock gradle.lock files contain all necessary information about used dependencies. Trivy simply parses the file, extract dependencies, and finds vulnerabilities for them. It doesn't require the internet access. Uses maven repository to get information about dependencies. Internet access required. \u21a9 It means *.jar , *.war , *.par and *.ear file \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 ArtifactID , GroupID and Version \u21a9 e.g. when parent pom.xml file has ../pom.xml path \u21a9 When you use dependency path in relativePath field in pom.xml file \u21a9 /Users/<username>/.m2/repository (for Linux and Mac) and C:/Users/<username>/.m2/repository (for Windows) by default \u21a9","title":"Java"},{"location":"docs/coverage/language/java/#java","text":"Trivy supports three types of Java scanning: JAR/WAR/PAR/EAR , pom.xml and *gradle.lockfile files. Each artifact supports the following scanners: Artifact SBOM Vulnerability License JAR/WAR/PAR/EAR \u2713 \u2713 - pom.xml \u2713 \u2713 \u2713 *gradle.lockfile \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Artifact Internet access Dev dependencies Dependency graph JAR/WAR/PAR/EAR Trivy Java DB Include - pom.xml Maven repository 1 Exclude \u2713 *gradle.lockfile - Exclude - These may be enabled or disabled depending on the target. See here for the detail.","title":"Java"},{"location":"docs/coverage/language/java/#jarwarparear","text":"To find information about your JAR 2 file, Trivy parses pom.properties and MANIFEST.MF files in your JAR 2 file and takes required properties 3 . If those files don't exist or don't contain enough information - Trivy will try to find this JAR 2 file in trivy-java-db . The Java DB will be automatically downloaded/updated when any JAR 2 file is found. It is stored in the cache directory . EXPERIMENTAL Finding JARs in trivy-java-db is an experimental function. Base JAR 2 may contain inner JARs 2 within itself. To find information about these JARs 2 , the same logic is used as for the base JAR 2 . table format only contains the name of root JAR 2 . To get the full path to inner JARs 2 use the json format.","title":"JAR/WAR/PAR/EAR"},{"location":"docs/coverage/language/java/#pomxml","text":"Trivy parses your pom.xml file and tries to find files with dependencies from these local locations. project directory 4 relativePath field 5 local repository directory 6 . If your machine doesn't have the necessary files - Trivy tries to find the information about these dependencies in the maven repository . Note Trivy only takes information about packages. We don't take a list of vulnerabilities for packages from the maven repository . Information about data sources for Java you can see here . You can disable connecting to the maven repository with the --offline-scan flag. The --offline-scan flag does not affect the Trivy database. The vulnerability database will be downloaded anyway. Warning Trivy may skip some dependencies (that were not found on your local machine) when the --offline-scan flag is passed.","title":"pom.xml"},{"location":"docs/coverage/language/java/#gradlelock","text":"gradle.lock files contain all necessary information about used dependencies. Trivy simply parses the file, extract dependencies, and finds vulnerabilities for them. It doesn't require the internet access. Uses maven repository to get information about dependencies. Internet access required. \u21a9 It means *.jar , *.war , *.par and *.ear file \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 ArtifactID , GroupID and Version \u21a9 e.g. when parent pom.xml file has ../pom.xml path \u21a9 When you use dependency path in relativePath field in pom.xml file \u21a9 /Users/<username>/.m2/repository (for Linux and Mac) and C:/Users/<username>/.m2/repository (for Windows) by default \u21a9","title":"Gradle.lock"},{"location":"docs/coverage/language/nodejs/","text":"Node.js Trivy supports three types of Node.js package managers: npm , Yarn and pnpm . The following scanners are supported. Artifact SBOM Vulnerability License npm \u2713 \u2713 \u2713 Yarn \u2713 \u2713 \u2713 pnpm \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position npm package-lock.json \u2713 Excluded \u2713 \u2713 Yarn yarn.lock \u2713 Excluded \u2713 \u2713 pnpm pnpm-lock.yaml \u2713 Excluded \u2713 - In addition, Trivy scans installed packages with package.json . File Dependency graph Position License package.json - - \u2705 These may be enabled or disabled depending on the target. See here for the detail. Package managers Trivy parses your files generated by package managers in filesystem/repository scanning. Tip Please make sure your lock file is up-to-date after modifying package.json . npm Trivy parses package-lock.json . To identify licenses, you need to download dependencies to node_modules beforehand. Trivy analyzes node_modules for licenses. By default, Trivy doesn't report development dependencies. Use the --include-dev-deps flag to include them. Yarn Trivy parses yarn.lock , which doesn't contain information about development dependencies. To exclude devDependencies, package.json also needs to be present next to yarn.lock . Trivy analyzes .yarn (Yarn 2+) or node_modules (Yarn Classic) folder next to the yarn.lock file to detect licenses. By default, Trivy doesn't report development dependencies. Use the --include-dev-deps flag to include them. pnpm Trivy parses pnpm-lock.yaml , then finds production dependencies and builds a tree of dependencies with vulnerabilities. Packages Trivy parses the manifest files of installed packages in container image scanning and so on. package.json Trivy searches for package.json files under node_modules and identifies installed packages. It only extracts package names, versions and licenses for those packages.","title":"Node.js"},{"location":"docs/coverage/language/nodejs/#nodejs","text":"Trivy supports three types of Node.js package managers: npm , Yarn and pnpm . The following scanners are supported. Artifact SBOM Vulnerability License npm \u2713 \u2713 \u2713 Yarn \u2713 \u2713 \u2713 pnpm \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position npm package-lock.json \u2713 Excluded \u2713 \u2713 Yarn yarn.lock \u2713 Excluded \u2713 \u2713 pnpm pnpm-lock.yaml \u2713 Excluded \u2713 - In addition, Trivy scans installed packages with package.json . File Dependency graph Position License package.json - - \u2705 These may be enabled or disabled depending on the target. See here for the detail.","title":"Node.js"},{"location":"docs/coverage/language/nodejs/#package-managers","text":"Trivy parses your files generated by package managers in filesystem/repository scanning. Tip Please make sure your lock file is up-to-date after modifying package.json .","title":"Package managers"},{"location":"docs/coverage/language/nodejs/#npm","text":"Trivy parses package-lock.json . To identify licenses, you need to download dependencies to node_modules beforehand. Trivy analyzes node_modules for licenses. By default, Trivy doesn't report development dependencies. Use the --include-dev-deps flag to include them.","title":"npm"},{"location":"docs/coverage/language/nodejs/#yarn","text":"Trivy parses yarn.lock , which doesn't contain information about development dependencies. To exclude devDependencies, package.json also needs to be present next to yarn.lock . Trivy analyzes .yarn (Yarn 2+) or node_modules (Yarn Classic) folder next to the yarn.lock file to detect licenses. By default, Trivy doesn't report development dependencies. Use the --include-dev-deps flag to include them.","title":"Yarn"},{"location":"docs/coverage/language/nodejs/#pnpm","text":"Trivy parses pnpm-lock.yaml , then finds production dependencies and builds a tree of dependencies with vulnerabilities.","title":"pnpm"},{"location":"docs/coverage/language/nodejs/#packages","text":"Trivy parses the manifest files of installed packages in container image scanning and so on.","title":"Packages"},{"location":"docs/coverage/language/nodejs/#packagejson","text":"Trivy searches for package.json files under node_modules and identifies installed packages. It only extracts package names, versions and licenses for those packages.","title":"package.json"},{"location":"docs/coverage/language/php/","text":"PHP Trivy supports Composer , which is a tool for dependency management in PHP. The following scanners are supported. Package manager SBOM Vulnerability License Composer \u2713 \u2713 \u2713 The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Composer composer.lock \u2713 Excluded \u2713 \u2713 Composer In order to detect dependencies, Trivy searches for composer.lock . Trivy also supports dependency trees; however, to display an accurate tree, it needs to know whether each package is a direct dependency of the project. Since this information is not included in composer.lock , Trivy parses composer.json , which should be located next to composer.lock . If you want to see the dependency tree, please ensure that composer.json is present.","title":"PHP"},{"location":"docs/coverage/language/php/#php","text":"Trivy supports Composer , which is a tool for dependency management in PHP. The following scanners are supported. Package manager SBOM Vulnerability License Composer \u2713 \u2713 \u2713 The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Composer composer.lock \u2713 Excluded \u2713 \u2713","title":"PHP"},{"location":"docs/coverage/language/php/#composer","text":"In order to detect dependencies, Trivy searches for composer.lock . Trivy also supports dependency trees; however, to display an accurate tree, it needs to know whether each package is a direct dependency of the project. Since this information is not included in composer.lock , Trivy parses composer.json , which should be located next to composer.lock . If you want to see the dependency tree, please ensure that composer.json is present.","title":"Composer"},{"location":"docs/coverage/language/python/","text":"Python Trivy supports three types of Python package managers: pip , Pipenv and Poetry . The following scanners are supported for package managers. Package manager SBOM Vulnerability License pip \u2713 \u2713 - Pipenv \u2713 \u2713 - Poetry \u2713 \u2713 - In addition, Trivy supports three formats of Python packages: egg , wheel and conda . The following scanners are supported for Python packages. Packaging SBOM Vulnerability License Egg \u2713 \u2713 \u2713 Wheel \u2713 \u2713 \u2713 Conda \u2713 - - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position pip requirements.txt - Include - - Pipenv Pipfile.lock \u2713 Include - \u2713 Poetry poetry.lock \u2713 Exclude \u2713 Packaging Dependency graph Egg \u2713 Wheel \u2713 These may be enabled or disabled depending on the target. See here for the detail. Package managers Trivy parses your files generated by package managers in filesystem/repository scanning. pip requirements.txt files usually contain only the direct dependencies and not contain the transitive dependencies. Therefore, Trivy scans only for the direct dependencies with requirements.txt . To detect transitive dependencies as well, you need to generate requirements.txt with pip freeze . $ cat requirements.txt # it will only find `requests@2.28.2`. requests == 2 .28.2 $ pip install -r requirements.txt ... $ pip freeze > requirements.txt $ cat requirements.txt # it will also find the transitive dependencies of `requests@2.28.2`. certifi == 2022 .12.7 charset-normalizer == 3 .1.0 idna == 3 .4 PyJWT == 2 .1.0 requests == 2 .28.2 urllib3 == 1 .26.15 pip freeze also helps to resolve extras (optional) dependencies (like package[extras]=0.0.0 ). requirements.txt files don't contain information about dependencies used for development. Trivy could detect vulnerabilities on the development packages, which not affect your production environment. License detection is not supported for pip . Pipenv Trivy parses Pipfile.lock . Pipfile.lock files don't contain information about dependencies used for development. Trivy could detect vulnerabilities on the development packages, which not affect your production environment. License detection is not supported for Pipenv . Poetry Trivy uses poetry.lock to identify dependencies and find vulnerabilities. To build the correct dependency graph, pyproject.toml also needs to be present next to poetry.lock . License detection is not supported for Poetry . Packaging Trivy parses the manifest files of installed packages in container image scanning and so on. See here for the detail. Egg Trivy looks for *.egg-info , *.egg-info/PKG-INFO , *.egg and EGG-INFO/PKG-INFO to identify Python packages. Wheel Trivy looks for .dist-info/META-DATA to identify Python packages.","title":"Python"},{"location":"docs/coverage/language/python/#python","text":"Trivy supports three types of Python package managers: pip , Pipenv and Poetry . The following scanners are supported for package managers. Package manager SBOM Vulnerability License pip \u2713 \u2713 - Pipenv \u2713 \u2713 - Poetry \u2713 \u2713 - In addition, Trivy supports three formats of Python packages: egg , wheel and conda . The following scanners are supported for Python packages. Packaging SBOM Vulnerability License Egg \u2713 \u2713 \u2713 Wheel \u2713 \u2713 \u2713 Conda \u2713 - - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position pip requirements.txt - Include - - Pipenv Pipfile.lock \u2713 Include - \u2713 Poetry poetry.lock \u2713 Exclude \u2713 Packaging Dependency graph Egg \u2713 Wheel \u2713 These may be enabled or disabled depending on the target. See here for the detail.","title":"Python"},{"location":"docs/coverage/language/python/#package-managers","text":"Trivy parses your files generated by package managers in filesystem/repository scanning.","title":"Package managers"},{"location":"docs/coverage/language/python/#pip","text":"requirements.txt files usually contain only the direct dependencies and not contain the transitive dependencies. Therefore, Trivy scans only for the direct dependencies with requirements.txt . To detect transitive dependencies as well, you need to generate requirements.txt with pip freeze . $ cat requirements.txt # it will only find `requests@2.28.2`. requests == 2 .28.2 $ pip install -r requirements.txt ... $ pip freeze > requirements.txt $ cat requirements.txt # it will also find the transitive dependencies of `requests@2.28.2`. certifi == 2022 .12.7 charset-normalizer == 3 .1.0 idna == 3 .4 PyJWT == 2 .1.0 requests == 2 .28.2 urllib3 == 1 .26.15 pip freeze also helps to resolve extras (optional) dependencies (like package[extras]=0.0.0 ). requirements.txt files don't contain information about dependencies used for development. Trivy could detect vulnerabilities on the development packages, which not affect your production environment. License detection is not supported for pip .","title":"pip"},{"location":"docs/coverage/language/python/#pipenv","text":"Trivy parses Pipfile.lock . Pipfile.lock files don't contain information about dependencies used for development. Trivy could detect vulnerabilities on the development packages, which not affect your production environment. License detection is not supported for Pipenv .","title":"Pipenv"},{"location":"docs/coverage/language/python/#poetry","text":"Trivy uses poetry.lock to identify dependencies and find vulnerabilities. To build the correct dependency graph, pyproject.toml also needs to be present next to poetry.lock . License detection is not supported for Poetry .","title":"Poetry"},{"location":"docs/coverage/language/python/#packaging","text":"Trivy parses the manifest files of installed packages in container image scanning and so on. See here for the detail.","title":"Packaging"},{"location":"docs/coverage/language/python/#egg","text":"Trivy looks for *.egg-info , *.egg-info/PKG-INFO , *.egg and EGG-INFO/PKG-INFO to identify Python packages.","title":"Egg"},{"location":"docs/coverage/language/python/#wheel","text":"Trivy looks for .dist-info/META-DATA to identify Python packages.","title":"Wheel"},{"location":"docs/coverage/language/ruby/","text":"Ruby Trivy supports Bundler and RubyGems . The following scanners are supported for Cargo. Package manager SBOM Vulnerability License Bundler \u2713 \u2713 - RubyGems \u2713 \u2713 \u2713 The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Bundler Gemfile.lock \u2713 Included \u2713 \u2713 RubyGems .gemspec - Included - - Bundler Trivy searches for Gemfile.lock to detect dependencies. RubyGems .gemspec files doesn't contains transitive dependencies. You need to scan each .gemspec file separately.","title":"Ruby"},{"location":"docs/coverage/language/ruby/#ruby","text":"Trivy supports Bundler and RubyGems . The following scanners are supported for Cargo. Package manager SBOM Vulnerability License Bundler \u2713 \u2713 - RubyGems \u2713 \u2713 \u2713 The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Bundler Gemfile.lock \u2713 Included \u2713 \u2713 RubyGems .gemspec - Included - -","title":"Ruby"},{"location":"docs/coverage/language/ruby/#bundler","text":"Trivy searches for Gemfile.lock to detect dependencies.","title":"Bundler"},{"location":"docs/coverage/language/ruby/#rubygems","text":".gemspec files doesn't contains transitive dependencies. You need to scan each .gemspec file separately.","title":"RubyGems"},{"location":"docs/coverage/language/rust/","text":"Rust Trivy supports Cargo , which is the Rust package manager. The following scanners are supported for Cargo. Package manager SBOM Vulnerability License Cargo \u2713 \u2713 - In addition, it supports binaries built with cargo-auditable . Artifact SBOM Vulnerability License Binaries \u2713 \u2713 - Features The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Cargo Cargo.lock \u2713 Excluded 1 \u2713 \u2713 Artifact Transitive dependencies Dev dependencies Dependency graph Position Binaries \u2713 Excluded - - Cargo Trivy searches for Cargo.lock to detect dependencies. Trivy also supports dependency trees; however, to display an accurate tree, it needs to know whether each package is a direct dependency of the project. Since this information is not included in Cargo.lock , Trivy parses Cargo.toml , which should be located next to Cargo.lock . If you want to see the dependency tree, please ensure that Cargo.toml is present. Scan Cargo.lock and Cargo.toml together also removes developer dependencies. Binaries Trivy scans binaries built with cargo-auditable . If such a binary exists, Trivy will identify it as being built with cargo-audit and scan it. When you scan Cargo.lock and Cargo.toml together. \u21a9","title":"Rust"},{"location":"docs/coverage/language/rust/#rust","text":"Trivy supports Cargo , which is the Rust package manager. The following scanners are supported for Cargo. Package manager SBOM Vulnerability License Cargo \u2713 \u2713 - In addition, it supports binaries built with cargo-auditable . Artifact SBOM Vulnerability License Binaries \u2713 \u2713 -","title":"Rust"},{"location":"docs/coverage/language/rust/#features","text":"The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Cargo Cargo.lock \u2713 Excluded 1 \u2713 \u2713 Artifact Transitive dependencies Dev dependencies Dependency graph Position Binaries \u2713 Excluded - -","title":"Features"},{"location":"docs/coverage/language/rust/#cargo","text":"Trivy searches for Cargo.lock to detect dependencies. Trivy also supports dependency trees; however, to display an accurate tree, it needs to know whether each package is a direct dependency of the project. Since this information is not included in Cargo.lock , Trivy parses Cargo.toml , which should be located next to Cargo.lock . If you want to see the dependency tree, please ensure that Cargo.toml is present. Scan Cargo.lock and Cargo.toml together also removes developer dependencies.","title":"Cargo"},{"location":"docs/coverage/language/rust/#binaries","text":"Trivy scans binaries built with cargo-auditable . If such a binary exists, Trivy will identify it as being built with cargo-audit and scan it. When you scan Cargo.lock and Cargo.toml together. \u21a9","title":"Binaries"},{"location":"docs/coverage/language/swift/","text":"Swift Trivy supports CocoaPods and Swift package managers. The following scanners are supported. Package manager SBOM Vulnerability License Swift \u2713 \u2713 - CocoaPods \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Swift Package.resolved \u2713 Included - \u2713 CocoaPods Podfile.lock \u2713 Included \u2713 - These may be enabled or disabled depending on the target. See here for the detail. Swift Trivy parses Package.resolved file to find dependencies. Don't forget to update ( swift package update command) this file before scanning. CocoaPods CocoaPods uses package names in PodFile.lock , but GitHub Advisory Database (GHSA) Trivy relies on uses Git URLs. We parse the CocoaPods Specs to match package names and links. Limitation Since GHSA holds only Git URLs, such as github.com/apple/swift-nio, Trivy can't identify affected submodules, and detect all submodules maintained by the same URL. For example, SwiftNIOHTTP1 and SwiftNIOWebSocket both are maintained under github.com/apple/swift-nio , and Trivy detect CVE-2022-3215 for both of them, even though only SwiftNIOHTTP1 is actually affected.","title":"Swift"},{"location":"docs/coverage/language/swift/#swift","text":"Trivy supports CocoaPods and Swift package managers. The following scanners are supported. Package manager SBOM Vulnerability License Swift \u2713 \u2713 - CocoaPods \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Swift Package.resolved \u2713 Included - \u2713 CocoaPods Podfile.lock \u2713 Included \u2713 - These may be enabled or disabled depending on the target. See here for the detail.","title":"Swift"},{"location":"docs/coverage/language/swift/#swift_1","text":"Trivy parses Package.resolved file to find dependencies. Don't forget to update ( swift package update command) this file before scanning.","title":"Swift"},{"location":"docs/coverage/language/swift/#cocoapods","text":"CocoaPods uses package names in PodFile.lock , but GitHub Advisory Database (GHSA) Trivy relies on uses Git URLs. We parse the CocoaPods Specs to match package names and links. Limitation Since GHSA holds only Git URLs, such as github.com/apple/swift-nio, Trivy can't identify affected submodules, and detect all submodules maintained by the same URL. For example, SwiftNIOHTTP1 and SwiftNIOWebSocket both are maintained under github.com/apple/swift-nio , and Trivy detect CVE-2022-3215 for both of them, even though only SwiftNIOHTTP1 is actually affected.","title":"CocoaPods"},{"location":"docs/coverage/os/","text":"OS Scanner Trivy supports operating systems for SBOM Vulnerabilities Licenses Supported OS OS Supported Versions Package Managers Alpine Linux 2.2 - 2.7, 3.0 - 3.18, edge apk Wolfi Linux (n/a) apk Chainguard (n/a) apk Red Hat Enterprise Linux 6, 7, 8 dnf/yum/rpm CentOS 1 6, 7, 8 dnf/yum/rpm AlmaLinux 8, 9 dnf/yum/rpm Rocky Linux 8, 9 dnf/yum/rpm Oracle Linux 5, 6, 7, 8 dnf/yum/rpm CBL-Mariner 1.0, 2.0 dnf/yum/rpm Amazon Linux 1, 2, 2023 dnf/yum/rpm openSUSE Leap 42, 15 zypper/rpm SUSE Enterprise Linux 11, 12, 15 zypper/rpm Photon OS 1.0, 2.0, 3.0, 4.0 tndf/yum/rpm Debian GNU/Linux 7, 8, 9, 10, 11, 12 apt/dpkg Ubuntu All versions supported by Canonical apt/dpkg Supported container images Container image Supported Versions Package Managers Google Distroless 2 Any apt/dpkg Bitnami Any - Each page gives more details. CentOS Stream is not supported \u21a9 https://github.com/GoogleContainerTools/distroless \u21a9","title":"Overview"},{"location":"docs/coverage/os/#os","text":"","title":"OS"},{"location":"docs/coverage/os/#scanner","text":"Trivy supports operating systems for SBOM Vulnerabilities Licenses","title":"Scanner"},{"location":"docs/coverage/os/#supported-os","text":"OS Supported Versions Package Managers Alpine Linux 2.2 - 2.7, 3.0 - 3.18, edge apk Wolfi Linux (n/a) apk Chainguard (n/a) apk Red Hat Enterprise Linux 6, 7, 8 dnf/yum/rpm CentOS 1 6, 7, 8 dnf/yum/rpm AlmaLinux 8, 9 dnf/yum/rpm Rocky Linux 8, 9 dnf/yum/rpm Oracle Linux 5, 6, 7, 8 dnf/yum/rpm CBL-Mariner 1.0, 2.0 dnf/yum/rpm Amazon Linux 1, 2, 2023 dnf/yum/rpm openSUSE Leap 42, 15 zypper/rpm SUSE Enterprise Linux 11, 12, 15 zypper/rpm Photon OS 1.0, 2.0, 3.0, 4.0 tndf/yum/rpm Debian GNU/Linux 7, 8, 9, 10, 11, 12 apt/dpkg Ubuntu All versions supported by Canonical apt/dpkg","title":"Supported OS"},{"location":"docs/coverage/os/#supported-container-images","text":"Container image Supported Versions Package Managers Google Distroless 2 Any apt/dpkg Bitnami Any - Each page gives more details. CentOS Stream is not supported \u21a9 https://github.com/GoogleContainerTools/distroless \u21a9","title":"Supported container images"},{"location":"docs/coverage/os/alma/","text":"AlmaLinux Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as dnf and yum . Vulnerability AlmaLinux offers its own security advisories, and these are utilized when scanning AlmaLinux for vulnerabilities. Data Source See here . Fixed Version When looking at fixed versions, it's crucial to consider the patches supplied by AlmaLinux. For example, for CVE-2023-0464, the fixed version for AlmaLinux 9 is listed as 3.0.7-16.el9_2 in their advisory . Note that this is different from the upstream fixed version, which is 3.0.9 , 3.1.1 , and son on. Typically, only the upstream information gets listed on NVD , so it's important not to get confused. Severity Trivy calculates the severity of an issue based on the severity provided by AlmaLinux. If the severity is not provided or defined yet by AlmaLinux, the severity from the NVD is taken into account. Using CVE-2023-0464 as an example, while it is rated as \"High\" in NVD, AlmaLinux has marked as \"moderate\" . As a result, Trivy will display it as \"Medium\". The table below is the mapping of AlmaLinux's severity to Trivy's severity levels. AlmaLinux Trivy Low Low Moderate Medium Important High Critical Critical Status Trivy supports the following vulnerability statuses for AlmaLinux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Trivy identifies licenses by examining the metadata of RPM packages.","title":"AlmaLinux"},{"location":"docs/coverage/os/alma/#almalinux","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"AlmaLinux"},{"location":"docs/coverage/os/alma/#sbom","text":"Trivy detects packages that have been installed through package managers such as dnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/alma/#vulnerability","text":"AlmaLinux offers its own security advisories, and these are utilized when scanning AlmaLinux for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/alma/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/alma/#fixed-version","text":"When looking at fixed versions, it's crucial to consider the patches supplied by AlmaLinux. For example, for CVE-2023-0464, the fixed version for AlmaLinux 9 is listed as 3.0.7-16.el9_2 in their advisory . Note that this is different from the upstream fixed version, which is 3.0.9 , 3.1.1 , and son on. Typically, only the upstream information gets listed on NVD , so it's important not to get confused.","title":"Fixed Version"},{"location":"docs/coverage/os/alma/#severity","text":"Trivy calculates the severity of an issue based on the severity provided by AlmaLinux. If the severity is not provided or defined yet by AlmaLinux, the severity from the NVD is taken into account. Using CVE-2023-0464 as an example, while it is rated as \"High\" in NVD, AlmaLinux has marked as \"moderate\" . As a result, Trivy will display it as \"Medium\". The table below is the mapping of AlmaLinux's severity to Trivy's severity levels. AlmaLinux Trivy Low Low Moderate Medium Important High Critical Critical","title":"Severity"},{"location":"docs/coverage/os/alma/#status","text":"Trivy supports the following vulnerability statuses for AlmaLinux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/alma/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages.","title":"License"},{"location":"docs/coverage/os/alpine/","text":"Alpine Linux Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages that have been installed through apk . Vulnerability Alpine Linux offers its own security advisories, and these are utilized when scanning Alpine for vulnerabilities. Data Source See here . Fixed Version When looking at fixed versions, it's crucial to consider the patches supplied by Alpine. For example, for CVE-2023-0464, the fixed version for Alpine Linux is listed as 3.1.0-r1 in the secfixes . Note that this is different from the upstream fixed version, which is 3.1.1 . Typically, only the upstream information gets listed on NVD , so it's important not to get confused. Severity For Alpine vulnerabilities, the severity is determined using the values set by NVD. Status Trivy supports the following vulnerability statuses for Alpine. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Trivy identifies licenses by examining the metadata of APK packages.","title":"Alpine Linux"},{"location":"docs/coverage/os/alpine/#alpine-linux","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"Alpine Linux"},{"location":"docs/coverage/os/alpine/#sbom","text":"Trivy detects packages that have been installed through apk .","title":"SBOM"},{"location":"docs/coverage/os/alpine/#vulnerability","text":"Alpine Linux offers its own security advisories, and these are utilized when scanning Alpine for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/alpine/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/alpine/#fixed-version","text":"When looking at fixed versions, it's crucial to consider the patches supplied by Alpine. For example, for CVE-2023-0464, the fixed version for Alpine Linux is listed as 3.1.0-r1 in the secfixes . Note that this is different from the upstream fixed version, which is 3.1.1 . Typically, only the upstream information gets listed on NVD , so it's important not to get confused.","title":"Fixed Version"},{"location":"docs/coverage/os/alpine/#severity","text":"For Alpine vulnerabilities, the severity is determined using the values set by NVD.","title":"Severity"},{"location":"docs/coverage/os/alpine/#status","text":"Trivy supports the following vulnerability statuses for Alpine. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/alpine/#license","text":"Trivy identifies licenses by examining the metadata of APK packages.","title":"License"},{"location":"docs/coverage/os/amazon/","text":"Amazon Linux Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as dnf and yum . Vulnerability Amazon Linux offers its own security advisories, and these are utilized when scanning Amazon Linux for vulnerabilities. Data Source See here . Fixed Version When looking at fixed versions, it's crucial to consider the patches supplied by Amazon. For example, for CVE-2023-0464, the fixed version for Amazon Linux 2023 is listed as 3.0.8-1.amzn2023.0.2 in ALAS2023-2023-181 . Note that this is different from the upstream fixed version, which is 3.0.9 , 3.1.1 , and so on. Typically, only the upstream information gets listed on NVD , so it's important not to get confused. Severity Trivy determines vulnerability severity based on the severity metric provided by Amazon. For example, the security patch for CVE-2023-0464 in Amazon Linux 2023 is provided as ALAS2023-2023-181 . Its severity is rated as \"Medium\". Thus, even though it's evaluated as \"HIGH\" in the NVD, Trivy displays it with a severity of \"MEDIUM\". The table below is the mapping of Amazon's severity to Trivy's severity levels. Amazon Trivy Low Low Medium Medium Important High Critical Critical Status Trivy supports the following vulnerability statuses for Amazon Linux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Trivy identifies licenses by examining the metadata of RPM packages.","title":"Amazon Linux"},{"location":"docs/coverage/os/amazon/#amazon-linux","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"Amazon Linux"},{"location":"docs/coverage/os/amazon/#sbom","text":"Trivy detects packages that have been installed through package managers such as dnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/amazon/#vulnerability","text":"Amazon Linux offers its own security advisories, and these are utilized when scanning Amazon Linux for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/amazon/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/amazon/#fixed-version","text":"When looking at fixed versions, it's crucial to consider the patches supplied by Amazon. For example, for CVE-2023-0464, the fixed version for Amazon Linux 2023 is listed as 3.0.8-1.amzn2023.0.2 in ALAS2023-2023-181 . Note that this is different from the upstream fixed version, which is 3.0.9 , 3.1.1 , and so on. Typically, only the upstream information gets listed on NVD , so it's important not to get confused.","title":"Fixed Version"},{"location":"docs/coverage/os/amazon/#severity","text":"Trivy determines vulnerability severity based on the severity metric provided by Amazon. For example, the security patch for CVE-2023-0464 in Amazon Linux 2023 is provided as ALAS2023-2023-181 . Its severity is rated as \"Medium\". Thus, even though it's evaluated as \"HIGH\" in the NVD, Trivy displays it with a severity of \"MEDIUM\". The table below is the mapping of Amazon's severity to Trivy's severity levels. Amazon Trivy Low Low Medium Medium Important High Critical Critical","title":"Severity"},{"location":"docs/coverage/os/amazon/#status","text":"Trivy supports the following vulnerability statuses for Amazon Linux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/amazon/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages.","title":"License"},{"location":"docs/coverage/os/bitnami/","text":"Bitnami Images EXPERIMENTAL Scanning results may be inaccurate. While it is not an OS, this page describes the details of the container images provided by Bitnami . Bitnami images are based on Debian . Please see the Debian page for OS packages. Trivy supports the following scanners for Bitnami packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph - SBOM Trivy analyzes the SBOM information contained within the container images provided by Bitnami. The SBOM files are located at /opt/bitnami/<component>/.spdx-<component>.spdx . Vulnerability Since Bitnami has its own vulnerability database , it uses these for vulnerability detection of applications and packages distributed by Bitnami. Note Trivy does not support vulnerability detection of independently compiled binaries, so even if you scan container images like nginx:1.15.2 , vulnerabilities in Nginx cannot be detected. This is because main applications like Nginx are not installed by the package manager . However, in the case of Bitnami images, since these SBOMs are stored within the image, scanning bitnami/nginx:1.15.2 allows for the detection of vulnerabilities in Nginx. Fixed Version Trivy refers to the Bitnami database . Please note that these may differ from the upstream fixed versions. Severity Similar to Fixed versions, it follows Bitnami's vulnerability database. Status Trivy supports the following vulnerability statuses for Bitnami packages. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License If licenses are included in the SBOM distributed by Bitnami, they will be used for scanning.","title":"Bitnami (Images)"},{"location":"docs/coverage/os/bitnami/#bitnami-images","text":"EXPERIMENTAL Scanning results may be inaccurate. While it is not an OS, this page describes the details of the container images provided by Bitnami . Bitnami images are based on Debian . Please see the Debian page for OS packages. Trivy supports the following scanners for Bitnami packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph -","title":"Bitnami Images"},{"location":"docs/coverage/os/bitnami/#sbom","text":"Trivy analyzes the SBOM information contained within the container images provided by Bitnami. The SBOM files are located at /opt/bitnami/<component>/.spdx-<component>.spdx .","title":"SBOM"},{"location":"docs/coverage/os/bitnami/#vulnerability","text":"Since Bitnami has its own vulnerability database , it uses these for vulnerability detection of applications and packages distributed by Bitnami. Note Trivy does not support vulnerability detection of independently compiled binaries, so even if you scan container images like nginx:1.15.2 , vulnerabilities in Nginx cannot be detected. This is because main applications like Nginx are not installed by the package manager . However, in the case of Bitnami images, since these SBOMs are stored within the image, scanning bitnami/nginx:1.15.2 allows for the detection of vulnerabilities in Nginx.","title":"Vulnerability"},{"location":"docs/coverage/os/bitnami/#fixed-version","text":"Trivy refers to the Bitnami database . Please note that these may differ from the upstream fixed versions.","title":"Fixed Version"},{"location":"docs/coverage/os/bitnami/#severity","text":"Similar to Fixed versions, it follows Bitnami's vulnerability database.","title":"Severity"},{"location":"docs/coverage/os/bitnami/#status","text":"Trivy supports the following vulnerability statuses for Bitnami packages. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/bitnami/#license","text":"If licenses are included in the SBOM distributed by Bitnami, they will be used for scanning.","title":"License"},{"location":"docs/coverage/os/cbl-mariner/","text":"CBL-Mariner Trivy supports the following scanners for OS packages. Version SBOM Vulnerability License 1.0 \u2714 \u2714 \u2714 1.0 (Distroless) \u2714 \u2714 2.0 \u2714 \u2714 \u2714 2.0 (Distroless) \u2714 \u2714 The following table provides an outline of the targets Trivy supports. Version Container image Virtual machine Arch 1.0 \u2714 \u2714 amd64, arm64 2.0 \u2714 \u2714 amd64, arm64 The table below outlines the features offered by Trivy. Feature Supported Detect unfixed vulnerabilities \u2713 Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as dnf and yum . Vulnerability CBL-Mariner offers its own security advisories, and these are utilized when scanning CBL-Mariner for vulnerabilities. Data Source See here . Fixed Version Trivy takes fixed versions from CBL-Mariner OVAL . Severity Trivy calculates the severity of an issue based on the severity provided in CBL-Mariner OVAL . Status Trivy supports the following vulnerability statuses for CBL-Mariner. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Trivy identifies licenses by examining the metadata of RPM packages. Note License detection is not supported for CBL-Mariner Distroless.","title":"CBL-Mariner"},{"location":"docs/coverage/os/cbl-mariner/#cbl-mariner","text":"Trivy supports the following scanners for OS packages. Version SBOM Vulnerability License 1.0 \u2714 \u2714 \u2714 1.0 (Distroless) \u2714 \u2714 2.0 \u2714 \u2714 \u2714 2.0 (Distroless) \u2714 \u2714 The following table provides an outline of the targets Trivy supports. Version Container image Virtual machine Arch 1.0 \u2714 \u2714 amd64, arm64 2.0 \u2714 \u2714 amd64, arm64 The table below outlines the features offered by Trivy. Feature Supported Detect unfixed vulnerabilities \u2713 Dependency graph \u2713","title":"CBL-Mariner"},{"location":"docs/coverage/os/cbl-mariner/#sbom","text":"Trivy detects packages that have been installed through package managers such as dnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/cbl-mariner/#vulnerability","text":"CBL-Mariner offers its own security advisories, and these are utilized when scanning CBL-Mariner for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/cbl-mariner/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/cbl-mariner/#fixed-version","text":"Trivy takes fixed versions from CBL-Mariner OVAL .","title":"Fixed Version"},{"location":"docs/coverage/os/cbl-mariner/#severity","text":"Trivy calculates the severity of an issue based on the severity provided in CBL-Mariner OVAL .","title":"Severity"},{"location":"docs/coverage/os/cbl-mariner/#status","text":"Trivy supports the following vulnerability statuses for CBL-Mariner. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/cbl-mariner/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages. Note License detection is not supported for CBL-Mariner Distroless.","title":"License"},{"location":"docs/coverage/os/centos/","text":"CentOS Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities \u2713 Dependency graph \u2713 SBOM Same as RHEL . Vulnerability CentOS does not provide straightforward machine-readable security advisories. As a result, Trivy utilizes the security advisories from Red Hat Enterprise Linux (RHEL) for detecting vulnerabilities in CentOS. This approach might lead to situations where, even though Trivy displays a fixed version, CentOS might not have the patch available yet. Since patches released for RHEL often become available in CentOS after some time, it's usually just a matter of waiting. Note The case for CentOS Stream, which is not supported by Trivy, is entirely different from CentOS. As Trivy relies on Red Hat's advisories, please refer to Red Hat for details regarding vulnerability severity and status. License Same as RHEL .","title":"CentOS"},{"location":"docs/coverage/os/centos/#centos","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities \u2713 Dependency graph \u2713","title":"CentOS"},{"location":"docs/coverage/os/centos/#sbom","text":"Same as RHEL .","title":"SBOM"},{"location":"docs/coverage/os/centos/#vulnerability","text":"CentOS does not provide straightforward machine-readable security advisories. As a result, Trivy utilizes the security advisories from Red Hat Enterprise Linux (RHEL) for detecting vulnerabilities in CentOS. This approach might lead to situations where, even though Trivy displays a fixed version, CentOS might not have the patch available yet. Since patches released for RHEL often become available in CentOS after some time, it's usually just a matter of waiting. Note The case for CentOS Stream, which is not supported by Trivy, is entirely different from CentOS. As Trivy relies on Red Hat's advisories, please refer to Red Hat for details regarding vulnerability severity and status.","title":"Vulnerability"},{"location":"docs/coverage/os/centos/#license","text":"Same as RHEL .","title":"License"},{"location":"docs/coverage/os/chainguard/","text":"Chainguard Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Detect unfixed vulnerabilities - Dependency graph \u2713 SBOM Same as Alpine Linux . Vulnerability Chainguard offers its own security advisories, and these are utilized when scanning Chainguard for vulnerabilities. Everything else is the same as Alpine Linux . Data Source See here . License Same as Alpine Linux .","title":"Chainguard"},{"location":"docs/coverage/os/chainguard/#chainguard","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Detect unfixed vulnerabilities - Dependency graph \u2713","title":"Chainguard"},{"location":"docs/coverage/os/chainguard/#sbom","text":"Same as Alpine Linux .","title":"SBOM"},{"location":"docs/coverage/os/chainguard/#vulnerability","text":"Chainguard offers its own security advisories, and these are utilized when scanning Chainguard for vulnerabilities. Everything else is the same as Alpine Linux .","title":"Vulnerability"},{"location":"docs/coverage/os/chainguard/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/chainguard/#license","text":"Same as Alpine Linux .","title":"License"},{"location":"docs/coverage/os/debian/","text":"Debian Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities \u2713 Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as apt and dpkg . While there are some exceptions, like Go binaries and JAR files, it's important to note that binaries that have been custom-built using make or tools installed via curl are generally not detected. Vulnerability Debian offers its own security advisories, and these are utilized when scanning Debian for vulnerabilities. Data Source See here . Fixed Version When looking at fixed versions, it's crucial to consider the patches supplied by Debian. For example, for CVE-2023-3269, the fixed version for Debian 12 (bookworm) is listed as 6.1.37-1 in the Security Tracker . This patch is provided in DSA-5448-1 . Note that this is different from the upstream fixed version, which is 6.5 . Typically, only the upstream information gets listed on NVD , so it's important not to get confused. Severity Trivy calculates the severity of an issue based on the 'Urgency' metric found in the Security Tracker. If 'Urgency' isn't provided by Debian, the severity from the NVD is taken into account. Using CVE-2019-15052 as an example, while it is rated as \"Critical\" in NVD, Debian has marked its \"Urgency\" as \"Low\" . As a result, Trivy will display it as \"Low\". Status Trivy supports the following vulnerability statuses for Debian. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred \u2713 End of Life \u2713 License To identify the license of a package, Trivy checks the copyright file located at /usr/share/doc/*/copyright . However, this method has its limitations as the file isn't machine-readable, leading to situations where the license isn't detected. In such scenarios, the --license-full flag can be passed. It compares the contents of known licenses with the copyright file to discern the license in question. Please be aware that using this flag can increase memory usage, so it's disabled by default for efficiency.","title":"Debian"},{"location":"docs/coverage/os/debian/#debian","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities \u2713 Dependency graph \u2713","title":"Debian"},{"location":"docs/coverage/os/debian/#sbom","text":"Trivy detects packages that have been installed through package managers such as apt and dpkg . While there are some exceptions, like Go binaries and JAR files, it's important to note that binaries that have been custom-built using make or tools installed via curl are generally not detected.","title":"SBOM"},{"location":"docs/coverage/os/debian/#vulnerability","text":"Debian offers its own security advisories, and these are utilized when scanning Debian for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/debian/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/debian/#fixed-version","text":"When looking at fixed versions, it's crucial to consider the patches supplied by Debian. For example, for CVE-2023-3269, the fixed version for Debian 12 (bookworm) is listed as 6.1.37-1 in the Security Tracker . This patch is provided in DSA-5448-1 . Note that this is different from the upstream fixed version, which is 6.5 . Typically, only the upstream information gets listed on NVD , so it's important not to get confused.","title":"Fixed Version"},{"location":"docs/coverage/os/debian/#severity","text":"Trivy calculates the severity of an issue based on the 'Urgency' metric found in the Security Tracker. If 'Urgency' isn't provided by Debian, the severity from the NVD is taken into account. Using CVE-2019-15052 as an example, while it is rated as \"Critical\" in NVD, Debian has marked its \"Urgency\" as \"Low\" . As a result, Trivy will display it as \"Low\".","title":"Severity"},{"location":"docs/coverage/os/debian/#status","text":"Trivy supports the following vulnerability statuses for Debian. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred \u2713 End of Life \u2713","title":"Status"},{"location":"docs/coverage/os/debian/#license","text":"To identify the license of a package, Trivy checks the copyright file located at /usr/share/doc/*/copyright . However, this method has its limitations as the file isn't machine-readable, leading to situations where the license isn't detected. In such scenarios, the --license-full flag can be passed. It compares the contents of known licenses with the copyright file to discern the license in question. Please be aware that using this flag can increase memory usage, so it's disabled by default for efficiency.","title":"License"},{"location":"docs/coverage/os/google-distroless/","text":"Google Distroless Images Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages pre-installed in distroless images. Vulnerability Google Distroless is based on Debian ; see there for details. License Google Distroless is based on Debian ; see there for details.","title":"Google Distroless (Images)"},{"location":"docs/coverage/os/google-distroless/#google-distroless-images","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"Google Distroless Images"},{"location":"docs/coverage/os/google-distroless/#sbom","text":"Trivy detects packages pre-installed in distroless images.","title":"SBOM"},{"location":"docs/coverage/os/google-distroless/#vulnerability","text":"Google Distroless is based on Debian ; see there for details.","title":"Vulnerability"},{"location":"docs/coverage/os/google-distroless/#license","text":"Google Distroless is based on Debian ; see there for details.","title":"License"},{"location":"docs/coverage/os/oracle/","text":"Oracle Linux Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as dnf and yum . Vulnerability Oracle Linux offers its own security advisories, and these are utilized when scanning Oracle Linux for vulnerabilities. Data Source See here . Fixed Version Trivy takes fixed versions from Oracle security advisories . Severity Trivy determines vulnerability severity based on the severity metric provided in Oracle security advisories . For example, the security patch for CVE-2023-0464 is provided as ELSA-2023-2645 . Its severity is rated as \"MODERATE\". Thus, even though it's evaluated as \"HIGH\" in the NVD, Trivy displays it with a severity of \"MEDIUM\". The table below is the mapping of Oracle's threat to Trivy's severity levels. Oracle Trivy Low Low Moderate Medium Important High Critical Critical Status Trivy supports the following vulnerability statuses for Oracle Linux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Trivy identifies licenses by examining the metadata of RPM packages.","title":"Oracle Linux"},{"location":"docs/coverage/os/oracle/#oracle-linux","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"Oracle Linux"},{"location":"docs/coverage/os/oracle/#sbom","text":"Trivy detects packages that have been installed through package managers such as dnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/oracle/#vulnerability","text":"Oracle Linux offers its own security advisories, and these are utilized when scanning Oracle Linux for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/oracle/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/oracle/#fixed-version","text":"Trivy takes fixed versions from Oracle security advisories .","title":"Fixed Version"},{"location":"docs/coverage/os/oracle/#severity","text":"Trivy determines vulnerability severity based on the severity metric provided in Oracle security advisories . For example, the security patch for CVE-2023-0464 is provided as ELSA-2023-2645 . Its severity is rated as \"MODERATE\". Thus, even though it's evaluated as \"HIGH\" in the NVD, Trivy displays it with a severity of \"MEDIUM\". The table below is the mapping of Oracle's threat to Trivy's severity levels. Oracle Trivy Low Low Moderate Medium Important High Critical Critical","title":"Severity"},{"location":"docs/coverage/os/oracle/#status","text":"Trivy supports the following vulnerability statuses for Oracle Linux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/oracle/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages.","title":"License"},{"location":"docs/coverage/os/photon/","text":"Photon OS Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as tdnf and yum . Vulnerability Photon OS offers its own security advisories, and these are utilized when scanning Photon OS for vulnerabilities. Data Source See here . Fixed Version Trivy takes fixed versions from Photon CVE metadata . Severity Trivy determines the severity of vulnerabilities based on the CVSSv3 score provided by Photon OS. See here for the conversion table from CVSS score to severity. Status Trivy supports the following vulnerability statuses for Photon OS. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Trivy identifies licenses by examining the metadata of RPM packages.","title":"Photon OS"},{"location":"docs/coverage/os/photon/#photon-os","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"Photon OS"},{"location":"docs/coverage/os/photon/#sbom","text":"Trivy detects packages that have been installed through package managers such as tdnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/photon/#vulnerability","text":"Photon OS offers its own security advisories, and these are utilized when scanning Photon OS for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/photon/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/photon/#fixed-version","text":"Trivy takes fixed versions from Photon CVE metadata .","title":"Fixed Version"},{"location":"docs/coverage/os/photon/#severity","text":"Trivy determines the severity of vulnerabilities based on the CVSSv3 score provided by Photon OS. See here for the conversion table from CVSS score to severity.","title":"Severity"},{"location":"docs/coverage/os/photon/#status","text":"Trivy supports the following vulnerability statuses for Photon OS. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/photon/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages.","title":"License"},{"location":"docs/coverage/os/rhel/","text":"Red Hat Enterprise Linux Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities \u2713 Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as dnf and yum . Vulnerability Red Hat offers its own security advisories, and these are utilized when scanning Red Hat Enterprise Linux (RHEL) for vulnerabilities. Data Source See here . Fixed Version When looking at fixed versions, it's crucial to consider the patches supplied by Red Hat. For example, for CVE-2023-0464, the fixed version for RHEL 9 is listed as 3.0.7-16.el9_2 in their advisory . This patch is provided in RHSA-2023:3722 . Note that this is different from the upstream fixed version, which is 3.0.9 , 3.1.1 , and so on. Typically, only the upstream information gets listed on NVD , so it's important not to get confused. Severity Trivy calculates the severity of a vulnerability based on the 'Impact' metric provided by Red Hat. If the impact is not provided or defined yet by Red Hat, the severity from the NVD is taken into account. Using CVE-2023-0464 as an example, while it is rated as \"HIGH\" in NVD, Red Hat has marked its 'Impact' as \"Low\" . As a result, Trivy will display it as \"Low\". The table below is the mapping of Red Hat's impact to Trivy's severity levels. Red Hat Trivy Low Low Moderate Medium Important High Critical Critical Status Trivy supports the following vulnerability statuses for RHEL. Status Supported Fixed \u2713 Affected \u2713 Under Investigation \u2713 Will Not Fix \u2713 Fix Deferred \u2713 End of Life \u2713 When a vulnerability status is listed as \"End of Life\", it means a vulnerability with the impact level assigned to this CVE is no longer covered by its current support lifecycle phase. The product has been identified to contain the impacted component, but analysis to determine whether it is affected or not by this vulnerability was not performed. Red Hat advises that the product should be assumed to be affected. Therefore, Trivy detects vulnerabilities with this status as \"End of Life\". On the other hand, for those marked \"Under Investigation,\" the impact is unclear as they are still being examined, so Trivy does not detect them. Once the investigation is completed, the status should be updated. Abstract Vulnerabilities with a status of \"End of Life\", where the presence or absence of impact is unclear, are detected by Trivy. However, those with a status of \"Under Investigation\" are not detected. License Trivy identifies licenses by examining the metadata of RPM packages.","title":"Red Hat"},{"location":"docs/coverage/os/rhel/#red-hat-enterprise-linux","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities \u2713 Dependency graph \u2713","title":"Red Hat Enterprise Linux"},{"location":"docs/coverage/os/rhel/#sbom","text":"Trivy detects packages that have been installed through package managers such as dnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/rhel/#vulnerability","text":"Red Hat offers its own security advisories, and these are utilized when scanning Red Hat Enterprise Linux (RHEL) for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/rhel/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/rhel/#fixed-version","text":"When looking at fixed versions, it's crucial to consider the patches supplied by Red Hat. For example, for CVE-2023-0464, the fixed version for RHEL 9 is listed as 3.0.7-16.el9_2 in their advisory . This patch is provided in RHSA-2023:3722 . Note that this is different from the upstream fixed version, which is 3.0.9 , 3.1.1 , and so on. Typically, only the upstream information gets listed on NVD , so it's important not to get confused.","title":"Fixed Version"},{"location":"docs/coverage/os/rhel/#severity","text":"Trivy calculates the severity of a vulnerability based on the 'Impact' metric provided by Red Hat. If the impact is not provided or defined yet by Red Hat, the severity from the NVD is taken into account. Using CVE-2023-0464 as an example, while it is rated as \"HIGH\" in NVD, Red Hat has marked its 'Impact' as \"Low\" . As a result, Trivy will display it as \"Low\". The table below is the mapping of Red Hat's impact to Trivy's severity levels. Red Hat Trivy Low Low Moderate Medium Important High Critical Critical","title":"Severity"},{"location":"docs/coverage/os/rhel/#status","text":"Trivy supports the following vulnerability statuses for RHEL. Status Supported Fixed \u2713 Affected \u2713 Under Investigation \u2713 Will Not Fix \u2713 Fix Deferred \u2713 End of Life \u2713 When a vulnerability status is listed as \"End of Life\", it means a vulnerability with the impact level assigned to this CVE is no longer covered by its current support lifecycle phase. The product has been identified to contain the impacted component, but analysis to determine whether it is affected or not by this vulnerability was not performed. Red Hat advises that the product should be assumed to be affected. Therefore, Trivy detects vulnerabilities with this status as \"End of Life\". On the other hand, for those marked \"Under Investigation,\" the impact is unclear as they are still being examined, so Trivy does not detect them. Once the investigation is completed, the status should be updated. Abstract Vulnerabilities with a status of \"End of Life\", where the presence or absence of impact is unclear, are detected by Trivy. However, those with a status of \"Under Investigation\" are not detected.","title":"Status"},{"location":"docs/coverage/os/rhel/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages.","title":"License"},{"location":"docs/coverage/os/rocky/","text":"Rocky Linux Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as dnf and yum . Vulnerability Rocky Linux offers its own security advisories, and these are utilized when scanning Rocky Linux for vulnerabilities. Data Source See here . Fixed Version Trivy takes fixed versions from Rocky Linux Errata , not NVD or somewhere else. See here for more details. Architectures There are cases when the vulnerability affects packages of not all architectures. For example, vulnerable packages for CVE-2023-0361 are only aarch64 packages. Trivy only detects vulnerabilities for packages of your architecture. Severity Trivy calculates the severity of an issue based on the severity provided in Rocky Linux Errata . The table below is the mapping of Rocky Linux's severity to Trivy's severity levels. Rocky Linux Trivy Low Low Moderate Medium Important High Critical Critical Status Trivy supports the following vulnerability statuses for Rocky Linux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Trivy identifies licenses by examining the metadata of RPM packages.","title":"Rocky Linux"},{"location":"docs/coverage/os/rocky/#rocky-linux","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"Rocky Linux"},{"location":"docs/coverage/os/rocky/#sbom","text":"Trivy detects packages that have been installed through package managers such as dnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/rocky/#vulnerability","text":"Rocky Linux offers its own security advisories, and these are utilized when scanning Rocky Linux for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/rocky/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/rocky/#fixed-version","text":"Trivy takes fixed versions from Rocky Linux Errata , not NVD or somewhere else. See here for more details. Architectures There are cases when the vulnerability affects packages of not all architectures. For example, vulnerable packages for CVE-2023-0361 are only aarch64 packages. Trivy only detects vulnerabilities for packages of your architecture.","title":"Fixed Version"},{"location":"docs/coverage/os/rocky/#severity","text":"Trivy calculates the severity of an issue based on the severity provided in Rocky Linux Errata . The table below is the mapping of Rocky Linux's severity to Trivy's severity levels. Rocky Linux Trivy Low Low Moderate Medium Important High Critical Critical","title":"Severity"},{"location":"docs/coverage/os/rocky/#status","text":"Trivy supports the following vulnerability statuses for Rocky Linux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/rocky/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages.","title":"License"},{"location":"docs/coverage/os/suse/","text":"SUSE Trivy supports the following distributions: openSUSE Leap SUSE Enterprise Linux (SLE) Please see here for supported versions. Trivy supports these scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as dnf and yum . Vulnerability SUSE offers its own security advisories , and these are utilized when scanning openSUSE/SLE for vulnerabilities. Data Source See here . License Trivy identifies licenses by examining the metadata of RPM packages.","title":"SUSE"},{"location":"docs/coverage/os/suse/#suse","text":"Trivy supports the following distributions: openSUSE Leap SUSE Enterprise Linux (SLE) Please see here for supported versions. Trivy supports these scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"SUSE"},{"location":"docs/coverage/os/suse/#sbom","text":"Trivy detects packages that have been installed through package managers such as dnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/suse/#vulnerability","text":"SUSE offers its own security advisories , and these are utilized when scanning openSUSE/SLE for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/suse/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/suse/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages.","title":"License"},{"location":"docs/coverage/os/ubuntu/","text":"Ubuntu Trivy supports these scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The following table provides an outline of the features Trivy offers. Feature Supported Detect unfixed vulnerabilities \u2713 Dependency graph \u2713 SBOM Same as Debian . Vulnerability Ubuntu offers its own security advisories, and these are utilized when scanning Ubuntu for vulnerabilities. Data Source See here . Fixed Version When looking at fixed versions, it's crucial to consider the patches supplied by Ubuntu. As an illustration, for CVE-2023-3269, the fixed version for Ubuntu 23.04 (lunar) is listed as 6.2.0-26.26 in the Security Tracker . It's essential to recognize that this differs from the upstream fixed version, which stands at 6.5 . Typically, only the upstream information gets listed on NVD , so it's important not to get confused. Severity Trivy calculates the severity of an issue based on the 'Priority' metric found in the Security Tracker. If 'Priority' isn't provided by Ubuntu, the severity from the NVD is taken into account. Using CVE-2019-15052 as an example, while it is rated as \"Critical\" in NVD , Ubuntu has marked its \"Priority\" as \"Medium\" . As a result, Trivy will display it as \"Medium\". Status Trivy supports the following vulnerability statuses for Ubuntu. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Same as Debian .","title":"Ubuntu"},{"location":"docs/coverage/os/ubuntu/#ubuntu","text":"Trivy supports these scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The following table provides an outline of the features Trivy offers. Feature Supported Detect unfixed vulnerabilities \u2713 Dependency graph \u2713","title":"Ubuntu"},{"location":"docs/coverage/os/ubuntu/#sbom","text":"Same as Debian .","title":"SBOM"},{"location":"docs/coverage/os/ubuntu/#vulnerability","text":"Ubuntu offers its own security advisories, and these are utilized when scanning Ubuntu for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/ubuntu/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/ubuntu/#fixed-version","text":"When looking at fixed versions, it's crucial to consider the patches supplied by Ubuntu. As an illustration, for CVE-2023-3269, the fixed version for Ubuntu 23.04 (lunar) is listed as 6.2.0-26.26 in the Security Tracker . It's essential to recognize that this differs from the upstream fixed version, which stands at 6.5 . Typically, only the upstream information gets listed on NVD , so it's important not to get confused.","title":"Fixed Version"},{"location":"docs/coverage/os/ubuntu/#severity","text":"Trivy calculates the severity of an issue based on the 'Priority' metric found in the Security Tracker. If 'Priority' isn't provided by Ubuntu, the severity from the NVD is taken into account. Using CVE-2019-15052 as an example, while it is rated as \"Critical\" in NVD , Ubuntu has marked its \"Priority\" as \"Medium\" . As a result, Trivy will display it as \"Medium\".","title":"Severity"},{"location":"docs/coverage/os/ubuntu/#status","text":"Trivy supports the following vulnerability statuses for Ubuntu. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/ubuntu/#license","text":"Same as Debian .","title":"License"},{"location":"docs/coverage/os/wolfi/","text":"Wolfi Linux Trivy supports these scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Detect unfixed vulnerabilities - Dependency graph \u2713 SBOM Same as Alpine Linux . Vulnerability Wolfi Linux offers its own security advisories, and these are utilized when scanning Wolfi for vulnerabilities. Everything else is the same as Alpine Linux . Data Source See here . License Same as Alpine Linux .","title":"Wolfi"},{"location":"docs/coverage/os/wolfi/#wolfi-linux","text":"Trivy supports these scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Detect unfixed vulnerabilities - Dependency graph \u2713","title":"Wolfi Linux"},{"location":"docs/coverage/os/wolfi/#sbom","text":"Same as Alpine Linux .","title":"SBOM"},{"location":"docs/coverage/os/wolfi/#vulnerability","text":"Wolfi Linux offers its own security advisories, and these are utilized when scanning Wolfi for vulnerabilities. Everything else is the same as Alpine Linux .","title":"Vulnerability"},{"location":"docs/coverage/os/wolfi/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/wolfi/#license","text":"Same as Alpine Linux .","title":"License"},{"location":"docs/references/troubleshooting/","text":"Troubleshooting Scan Timeout Error $ trivy image ... ... analyze error: timeout: context deadline exceeded Your scan may time out. Java takes a particularly long time to scan. Try increasing the value of the ---timeout option such as --timeout 15m . Certification Error Error: x509: certificate signed by unknown authority TRIVY_INSECURE can be used to allow insecure connections to a container registry when using SSL. $ TRIVY_INSECURE=true trivy image [YOUR_IMAGE] GitHub Rate limiting Error $ trivy image ... ... API rate limit exceeded for xxx.xxx.xxx.xxx. Specify GITHUB_TOKEN for authentication https://developer.github.com/v3/#rate-limiting $ GITHUB_TOKEN=XXXXXXXXXX trivy alpine:3.10 Unable to open JAR files Error $ trivy image ... ... failed to analyze file: failed to analyze usr/lib/jvm/java-1.8-openjdk/lib/tools.jar: unable to open usr/lib/jvm/java-1.8-openjdk/lib/tools.jar: failed to open: unable to read the file: stream error: stream ID 9 ; PROTOCOL_ERROR ; received from peer Currently, we're investigating this issue. As a temporary mitigation, you may be able to avoid this issue by downloading the Java DB in advance. $ trivy image --download-java-db-only 2023 -02-01T16:57:04.322+0900 INFO Downloading the Java DB... $ trivy image [ YOUR_JAVA_IMAGE ] Running in parallel takes same time as series run When running trivy on multiple images simultaneously, it will take same time as running trivy in series. This is because of a limitation of boltdb. Bolt obtains a file lock on the data file so multiple processes cannot open the same database at the same time. Opening an already open Bolt database will cause it to hang until the other process closes it. Reference : boltdb: Opening a database . Multiple Trivy servers Error $ trivy image --server http://xxx.com:xxxx test-image ... - twirp error internal: failed scan, test-image: failed to apply layers: layer cache missing: sha256:***** To run multiple Trivy servers, you need to use Redis as the cache backend so that those servers can share the cache. Follow this instruction to do so. Problems with /tmp on remote Git repository scans Error FATAL repository scan error: scan error: unable to initialize a scanner: unable to initialize a filesystem scanner: git clone error: write /tmp/fanal-remote... Trivy clones remote Git repositories under the /tmp directory before scanning them. If /tmp doesn't work for you, you can change it by setting the TMPDIR environment variable. Try: $ TMPDIR=/my/custom/path trivy repo ... Running out of space during image scans Error image scan failed: failed to copy the image: write /tmp/fanal-3323732142: no space left on device Trivy uses the /tmp directory during image scan, if the image is large or /tmp is of insufficient size then the scan fails You can set the TMPDIR environment variable to use redirect trivy to use a directory with adequate storage. Try: $ TMPDIR=/my/custom/path trivy image ... DB Old DB schema Error --skip-update cannot be specified with the old DB schema. Trivy v0.23.0 or later requires Trivy DB v2. Please update your local database or follow the instruction of air-gapped environment . Error downloading vulnerability DB Error FATAL failed to download vulnerability DB If trivy is running behind corporate firewall, you have to add the following urls to your allowlist. ghcr.io pkg-containers.githubusercontent.com Denied Error GET https://ghcr.io/token?scope=repository%3Aaquasecurity%2Ftrivy-db%3Apull&service=ghcr.io: DENIED: denied Your local GHCR (GitHub Container Registry) token might be expired. Please remove the token and try downloading the DB again. docker logout ghcr.io Homebrew Scope error Error Error: Your macOS keychain GitHub credentials do not have sufficient scope! $ brew tap aquasecurity/trivy Error: Your macOS keychain GitHub credentials do not have sufficient scope! Scopes they need: none Scopes they have: Create a personal access token: https://github.com/settings/tokens/new?scopes=gist,public_repo&description=Homebrew echo 'export HOMEBREW_GITHUB_API_TOKEN=your_token_here' >> ~/.zshrc Try: $ printf \"protocol=https\\nhost=github.com\\n\" | git credential-osxkeychain erase Already installed Error Error: aquasecurity/trivy/trivy 64 already installed $ brew upgrade ... Error: aquasecurity/trivy/trivy 64 already installed Try: $ brew unlink trivy && brew uninstall trivy ($ rm -rf /usr/local/Cellar/trivy/64) $ brew install aquasecurity/trivy/trivy Others Unknown error Try again with --reset option: $ trivy image --reset","title":"Troubleshooting"},{"location":"docs/references/troubleshooting/#troubleshooting","text":"","title":"Troubleshooting"},{"location":"docs/references/troubleshooting/#scan","text":"","title":"Scan"},{"location":"docs/references/troubleshooting/#timeout","text":"Error $ trivy image ... ... analyze error: timeout: context deadline exceeded Your scan may time out. Java takes a particularly long time to scan. Try increasing the value of the ---timeout option such as --timeout 15m .","title":"Timeout"},{"location":"docs/references/troubleshooting/#certification","text":"Error Error: x509: certificate signed by unknown authority TRIVY_INSECURE can be used to allow insecure connections to a container registry when using SSL. $ TRIVY_INSECURE=true trivy image [YOUR_IMAGE]","title":"Certification"},{"location":"docs/references/troubleshooting/#github-rate-limiting","text":"Error $ trivy image ... ... API rate limit exceeded for xxx.xxx.xxx.xxx. Specify GITHUB_TOKEN for authentication https://developer.github.com/v3/#rate-limiting $ GITHUB_TOKEN=XXXXXXXXXX trivy alpine:3.10","title":"GitHub Rate limiting"},{"location":"docs/references/troubleshooting/#unable-to-open-jar-files","text":"Error $ trivy image ... ... failed to analyze file: failed to analyze usr/lib/jvm/java-1.8-openjdk/lib/tools.jar: unable to open usr/lib/jvm/java-1.8-openjdk/lib/tools.jar: failed to open: unable to read the file: stream error: stream ID 9 ; PROTOCOL_ERROR ; received from peer Currently, we're investigating this issue. As a temporary mitigation, you may be able to avoid this issue by downloading the Java DB in advance. $ trivy image --download-java-db-only 2023 -02-01T16:57:04.322+0900 INFO Downloading the Java DB... $ trivy image [ YOUR_JAVA_IMAGE ]","title":"Unable to open JAR files"},{"location":"docs/references/troubleshooting/#running-in-parallel-takes-same-time-as-series-run","text":"When running trivy on multiple images simultaneously, it will take same time as running trivy in series. This is because of a limitation of boltdb. Bolt obtains a file lock on the data file so multiple processes cannot open the same database at the same time. Opening an already open Bolt database will cause it to hang until the other process closes it. Reference : boltdb: Opening a database .","title":"Running in parallel takes same time as series run"},{"location":"docs/references/troubleshooting/#multiple-trivy-servers","text":"Error $ trivy image --server http://xxx.com:xxxx test-image ... - twirp error internal: failed scan, test-image: failed to apply layers: layer cache missing: sha256:***** To run multiple Trivy servers, you need to use Redis as the cache backend so that those servers can share the cache. Follow this instruction to do so.","title":"Multiple Trivy servers"},{"location":"docs/references/troubleshooting/#problems-with-tmp-on-remote-git-repository-scans","text":"Error FATAL repository scan error: scan error: unable to initialize a scanner: unable to initialize a filesystem scanner: git clone error: write /tmp/fanal-remote... Trivy clones remote Git repositories under the /tmp directory before scanning them. If /tmp doesn't work for you, you can change it by setting the TMPDIR environment variable. Try: $ TMPDIR=/my/custom/path trivy repo ...","title":"Problems with /tmp on remote Git repository scans"},{"location":"docs/references/troubleshooting/#running-out-of-space-during-image-scans","text":"Error image scan failed: failed to copy the image: write /tmp/fanal-3323732142: no space left on device Trivy uses the /tmp directory during image scan, if the image is large or /tmp is of insufficient size then the scan fails You can set the TMPDIR environment variable to use redirect trivy to use a directory with adequate storage. Try: $ TMPDIR=/my/custom/path trivy image ...","title":"Running out of space during image scans"},{"location":"docs/references/troubleshooting/#db","text":"","title":"DB"},{"location":"docs/references/troubleshooting/#old-db-schema","text":"Error --skip-update cannot be specified with the old DB schema. Trivy v0.23.0 or later requires Trivy DB v2. Please update your local database or follow the instruction of air-gapped environment .","title":"Old DB schema"},{"location":"docs/references/troubleshooting/#error-downloading-vulnerability-db","text":"Error FATAL failed to download vulnerability DB If trivy is running behind corporate firewall, you have to add the following urls to your allowlist. ghcr.io pkg-containers.githubusercontent.com","title":"Error downloading vulnerability DB"},{"location":"docs/references/troubleshooting/#denied","text":"Error GET https://ghcr.io/token?scope=repository%3Aaquasecurity%2Ftrivy-db%3Apull&service=ghcr.io: DENIED: denied Your local GHCR (GitHub Container Registry) token might be expired. Please remove the token and try downloading the DB again. docker logout ghcr.io","title":"Denied"},{"location":"docs/references/troubleshooting/#homebrew","text":"","title":"Homebrew"},{"location":"docs/references/troubleshooting/#scope-error","text":"Error Error: Your macOS keychain GitHub credentials do not have sufficient scope! $ brew tap aquasecurity/trivy Error: Your macOS keychain GitHub credentials do not have sufficient scope! Scopes they need: none Scopes they have: Create a personal access token: https://github.com/settings/tokens/new?scopes=gist,public_repo&description=Homebrew echo 'export HOMEBREW_GITHUB_API_TOKEN=your_token_here' >> ~/.zshrc Try: $ printf \"protocol=https\\nhost=github.com\\n\" | git credential-osxkeychain erase","title":"Scope error"},{"location":"docs/references/troubleshooting/#already-installed","text":"Error Error: aquasecurity/trivy/trivy 64 already installed $ brew upgrade ... Error: aquasecurity/trivy/trivy 64 already installed Try: $ brew unlink trivy && brew uninstall trivy ($ rm -rf /usr/local/Cellar/trivy/64) $ brew install aquasecurity/trivy/trivy","title":"Already installed"},{"location":"docs/references/troubleshooting/#others","text":"","title":"Others"},{"location":"docs/references/troubleshooting/#unknown-error","text":"Try again with --reset option: $ trivy image --reset","title":"Unknown error"},{"location":"docs/references/configuration/config-file/","text":"Config file Trivy can be customized by tweaking a trivy.yaml file. The config path can be overridden by the --config flag. An example is here . Global Options # Same as '--quiet' # Default is false quiet : false # Same as '--debug' # Default is false debug : false # Same as '--insecure' # Default is false insecure : false # Same as '--timeout' # Default is '5m' timeout : 10m # Same as '--cache-dir' # Default is your system cache dir cache : dir : $HOME/.cache/trivy Report Options # Same as '--format' # Default is 'table' format : table # Same as '--report' (available with 'trivy k8s') # Default is all report : all # Same as '--template' # Default is empty template : # Same as '--dependency-tree' # Default is false dependency-tree : false # Same as '--list-all-pkgs' # Default is false list-all-pkgs : false # Same as '--ignorefile' # Default is '.trivyignore' ignorefile : .trivyignore # Same as '--ignore-policy' # Default is empty ignore-policy : # Same as '--exit-code' # Default is 0 exit-code : 0 # Same as '--exit-on-eol' # Default is 0 exit-on-eol : 0 # Same as '--output' # Default is empty (stdout) output : # Same as '--severity' # Default is all severities severity : - UNKNOWN - LOW - MEDIUM - HIGH - CRITICAL Scan Options Available in client/server mode scan : # Same as '--file-patterns' # Default is empty file-patterns : - # Same as '--skip-dirs' # Default is empty skip-dirs : - usr/local/ - etc/ # Same as '--skip-files' # Default is empty skip-files : - package-dev.json # Same as '--offline-scan' # Default is false offline-scan : false # Same as '--scanners' # Default depends on subcommand scanners : - vuln - config - secret Cache Options cache : # Same as '--cache-backend' # Default is 'fs' backend : 'fs' # Same as '--cache-ttl' # Default is 0 (no ttl) ttl : 0 # Redis options redis : # Same as '--redis-ca' # Default is empty ca : # Same as '--redis-cert' # Default is empty cert : # Same as '--redis-key' # Default is empty key : DB Options db : # Same as '--skip-db-update' # Default is false skip-update : false # Same as '--no-progress' # Default is false no-progress : false # Same as '--db-repository' # Default is 'ghcr.io/aquasecurity/trivy-db' repository : ghcr.io/aquasecurity/trivy-db # Same as '--java-db-repository' # Default is 'ghcr.io/aquasecurity/trivy-java-db' java-repository : ghcr.io/aquasecurity/trivy-java-db Registry Options registry : # Same as '--username' # Default is empty username : # Same as '--password' # Default is empty password : # Same as '--registry-token' # Default is empty registry-token : Image Options Available with container image scanning image : # Same as '--input' (available with 'trivy image') # Default is empty input : # Same as '--removed-pkgs' # Default is false removed-pkgs : false # Same as '--platform' # Default is empty platform : docker : # Same as '--docker-host' # Default is empty host : Vulnerability Options Available with vulnerability scanning vulnerability : # Same as '--vuln-type' # Default is 'os,library' type : - os - library # Same as '--ignore-unfixed' # Default is false ignore-unfixed : false Secret Options Available with secret scanning secret : # Same as '--secret-config' # Default is 'trivy-secret.yaml' config : config/trivy/secret.yaml Rego Options rego # Same as '--trace' # Default is false trace : false # Same as '--config-policy' # Default is empty policy : - policy/repository - policy/custom - policy/some-policy.rego # Same as '--config-data' # Default is empty data : - data/ # Same as '--policy-namespaces' # Default is empty namespaces : - opa.examples - users Misconfiguration Options Available with misconfiguration scanning misconfiguration : # Same as '--include-non-failures' # Default is false include-non-failures : false # helm value override configurations # set individual values helm : set : - securityContext.runAsUser=10001 # set values with file helm : values : - overrides.yaml # set specific values from specific files helm : set-file : - image=dev-overrides.yaml # set as string and preserve type helm : set-string : - name=true # terraform tfvars overrrides terraform : vars : - dev-terraform.tfvars - common-terraform.tfvars # Same as '--tf-exclude-downloaded-modules' # Default is false terraform : exclude-downloaded-modules : false Kubernetes Options Available with Kubernetes scanning kubernetes : # Same as '--context' # Default is empty context : # Same as '--namespace' # Default is empty namespace : Repository Options Available with git repository scanning ( trivy repo ) repository : # Same as '--branch' # Default is empty branch : # Same as '--commit' # Default is empty commit : # Same as '--tag' # Default is empty tag : Client/Server Options Available in client/server mode server : # Same as '--server' (available in client mode) # Default is empty addr : http://localhost:4954 # Same as '--token' # Default is empty token : \"something-secret\" # Same as '--token-header' # Default is 'Trivy-Token' token-header : 'My-Token-Header' # Same as '--custom-headers' # Default is empty custom-headers : - scanner : trivy - x-api-token : xxx # Same as '--listen' (available in server mode) # Default is 'localhost:4954' listen : 0.0.0.0:10000 Cloud Options Available for cloud scanning (currently only trivy aws ) cloud : # whether to force a cache update for every scan update-cache : false # how old cached results can be before being invalidated max-cache-age : 24h # aws-specific cloud settings aws : # the aws region to use region : us-east-1 # the aws endpoint to use (not required for general use) endpoint : https://my.custom.aws.endpoint # the aws account to use (this will be determined from your environment when not set) account : 123456789012","title":"Config file"},{"location":"docs/references/configuration/config-file/#config-file","text":"Trivy can be customized by tweaking a trivy.yaml file. The config path can be overridden by the --config flag. An example is here .","title":"Config file"},{"location":"docs/references/configuration/config-file/#global-options","text":"# Same as '--quiet' # Default is false quiet : false # Same as '--debug' # Default is false debug : false # Same as '--insecure' # Default is false insecure : false # Same as '--timeout' # Default is '5m' timeout : 10m # Same as '--cache-dir' # Default is your system cache dir cache : dir : $HOME/.cache/trivy","title":"Global Options"},{"location":"docs/references/configuration/config-file/#report-options","text":"# Same as '--format' # Default is 'table' format : table # Same as '--report' (available with 'trivy k8s') # Default is all report : all # Same as '--template' # Default is empty template : # Same as '--dependency-tree' # Default is false dependency-tree : false # Same as '--list-all-pkgs' # Default is false list-all-pkgs : false # Same as '--ignorefile' # Default is '.trivyignore' ignorefile : .trivyignore # Same as '--ignore-policy' # Default is empty ignore-policy : # Same as '--exit-code' # Default is 0 exit-code : 0 # Same as '--exit-on-eol' # Default is 0 exit-on-eol : 0 # Same as '--output' # Default is empty (stdout) output : # Same as '--severity' # Default is all severities severity : - UNKNOWN - LOW - MEDIUM - HIGH - CRITICAL","title":"Report Options"},{"location":"docs/references/configuration/config-file/#scan-options","text":"Available in client/server mode scan : # Same as '--file-patterns' # Default is empty file-patterns : - # Same as '--skip-dirs' # Default is empty skip-dirs : - usr/local/ - etc/ # Same as '--skip-files' # Default is empty skip-files : - package-dev.json # Same as '--offline-scan' # Default is false offline-scan : false # Same as '--scanners' # Default depends on subcommand scanners : - vuln - config - secret","title":"Scan Options"},{"location":"docs/references/configuration/config-file/#cache-options","text":"cache : # Same as '--cache-backend' # Default is 'fs' backend : 'fs' # Same as '--cache-ttl' # Default is 0 (no ttl) ttl : 0 # Redis options redis : # Same as '--redis-ca' # Default is empty ca : # Same as '--redis-cert' # Default is empty cert : # Same as '--redis-key' # Default is empty key :","title":"Cache Options"},{"location":"docs/references/configuration/config-file/#db-options","text":"db : # Same as '--skip-db-update' # Default is false skip-update : false # Same as '--no-progress' # Default is false no-progress : false # Same as '--db-repository' # Default is 'ghcr.io/aquasecurity/trivy-db' repository : ghcr.io/aquasecurity/trivy-db # Same as '--java-db-repository' # Default is 'ghcr.io/aquasecurity/trivy-java-db' java-repository : ghcr.io/aquasecurity/trivy-java-db","title":"DB Options"},{"location":"docs/references/configuration/config-file/#registry-options","text":"registry : # Same as '--username' # Default is empty username : # Same as '--password' # Default is empty password : # Same as '--registry-token' # Default is empty registry-token :","title":"Registry Options"},{"location":"docs/references/configuration/config-file/#image-options","text":"Available with container image scanning image : # Same as '--input' (available with 'trivy image') # Default is empty input : # Same as '--removed-pkgs' # Default is false removed-pkgs : false # Same as '--platform' # Default is empty platform : docker : # Same as '--docker-host' # Default is empty host :","title":"Image Options"},{"location":"docs/references/configuration/config-file/#vulnerability-options","text":"Available with vulnerability scanning vulnerability : # Same as '--vuln-type' # Default is 'os,library' type : - os - library # Same as '--ignore-unfixed' # Default is false ignore-unfixed : false","title":"Vulnerability Options"},{"location":"docs/references/configuration/config-file/#secret-options","text":"Available with secret scanning secret : # Same as '--secret-config' # Default is 'trivy-secret.yaml' config : config/trivy/secret.yaml","title":"Secret Options"},{"location":"docs/references/configuration/config-file/#rego-options","text":"rego # Same as '--trace' # Default is false trace : false # Same as '--config-policy' # Default is empty policy : - policy/repository - policy/custom - policy/some-policy.rego # Same as '--config-data' # Default is empty data : - data/ # Same as '--policy-namespaces' # Default is empty namespaces : - opa.examples - users","title":"Rego Options"},{"location":"docs/references/configuration/config-file/#misconfiguration-options","text":"Available with misconfiguration scanning misconfiguration : # Same as '--include-non-failures' # Default is false include-non-failures : false # helm value override configurations # set individual values helm : set : - securityContext.runAsUser=10001 # set values with file helm : values : - overrides.yaml # set specific values from specific files helm : set-file : - image=dev-overrides.yaml # set as string and preserve type helm : set-string : - name=true # terraform tfvars overrrides terraform : vars : - dev-terraform.tfvars - common-terraform.tfvars # Same as '--tf-exclude-downloaded-modules' # Default is false terraform : exclude-downloaded-modules : false","title":"Misconfiguration Options"},{"location":"docs/references/configuration/config-file/#kubernetes-options","text":"Available with Kubernetes scanning kubernetes : # Same as '--context' # Default is empty context : # Same as '--namespace' # Default is empty namespace :","title":"Kubernetes Options"},{"location":"docs/references/configuration/config-file/#repository-options","text":"Available with git repository scanning ( trivy repo ) repository : # Same as '--branch' # Default is empty branch : # Same as '--commit' # Default is empty commit : # Same as '--tag' # Default is empty tag :","title":"Repository Options"},{"location":"docs/references/configuration/config-file/#clientserver-options","text":"Available in client/server mode server : # Same as '--server' (available in client mode) # Default is empty addr : http://localhost:4954 # Same as '--token' # Default is empty token : \"something-secret\" # Same as '--token-header' # Default is 'Trivy-Token' token-header : 'My-Token-Header' # Same as '--custom-headers' # Default is empty custom-headers : - scanner : trivy - x-api-token : xxx # Same as '--listen' (available in server mode) # Default is 'localhost:4954' listen : 0.0.0.0:10000","title":"Client/Server Options"},{"location":"docs/references/configuration/config-file/#cloud-options","text":"Available for cloud scanning (currently only trivy aws ) cloud : # whether to force a cache update for every scan update-cache : false # how old cached results can be before being invalidated max-cache-age : 24h # aws-specific cloud settings aws : # the aws region to use region : us-east-1 # the aws endpoint to use (not required for general use) endpoint : https://my.custom.aws.endpoint # the aws account to use (this will be determined from your environment when not set) account : 123456789012","title":"Cloud Options"},{"location":"docs/references/configuration/cli/trivy/","text":"trivy Unified security scanner Synopsis Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues and hard-coded secrets trivy [global flags] command [flags] target Examples # Scan a container image $ trivy image python:3.4-alpine # Scan a container image from a tar archive $ trivy image --input ruby-3.1.tar # Scan local filesystem $ trivy fs . # Run in server mode $ trivy server Options --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode -f, --format string version format (json) --generate-default-config write the default config to trivy-default.yaml -h, --help help for trivy --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy aws - [EXPERIMENTAL] Scan AWS account trivy config - Scan config files for misconfigurations trivy convert - Convert Trivy JSON report into a different format trivy filesystem - Scan local filesystem trivy image - Scan a container image trivy kubernetes - [EXPERIMENTAL] Scan kubernetes cluster trivy module - Manage modules trivy plugin - Manage plugins trivy repository - Scan a repository trivy rootfs - Scan rootfs trivy sbom - Scan SBOM for vulnerabilities trivy server - Server mode trivy version - Print the version trivy vm - [EXPERIMENTAL] Scan a virtual machine image","title":"Overview"},{"location":"docs/references/configuration/cli/trivy/#trivy","text":"Unified security scanner","title":"trivy"},{"location":"docs/references/configuration/cli/trivy/#synopsis","text":"Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues and hard-coded secrets trivy [global flags] command [flags] target","title":"Synopsis"},{"location":"docs/references/configuration/cli/trivy/#examples","text":"# Scan a container image $ trivy image python:3.4-alpine # Scan a container image from a tar archive $ trivy image --input ruby-3.1.tar # Scan local filesystem $ trivy fs . # Run in server mode $ trivy server","title":"Examples"},{"location":"docs/references/configuration/cli/trivy/#options","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode -f, --format string version format (json) --generate-default-config write the default config to trivy-default.yaml -h, --help help for trivy --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options"},{"location":"docs/references/configuration/cli/trivy/#see-also","text":"trivy aws - [EXPERIMENTAL] Scan AWS account trivy config - Scan config files for misconfigurations trivy convert - Convert Trivy JSON report into a different format trivy filesystem - Scan local filesystem trivy image - Scan a container image trivy kubernetes - [EXPERIMENTAL] Scan kubernetes cluster trivy module - Manage modules trivy plugin - Manage plugins trivy repository - Scan a repository trivy rootfs - Scan rootfs trivy sbom - Scan SBOM for vulnerabilities trivy server - Server mode trivy version - Print the version trivy vm - [EXPERIMENTAL] Scan a virtual machine image","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_aws/","text":"trivy aws [EXPERIMENTAL] Scan AWS account Synopsis Scan an AWS account for misconfigurations. Trivy uses the same authentication methods as the AWS CLI. See https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html The following services are supported: - accessanalyzer - api-gateway - athena - cloudfront - cloudtrail - cloudwatch - codebuild - documentdb - dynamodb - ec2 - ecr - ecs - efs - eks - elasticache - elasticsearch - elb - emr - iam - kinesis - kms - lambda - mq - msk - neptune - rds - redshift - s3 - sns - sqs - ssm - workspaces trivy aws [flags] Examples # basic scanning $ trivy aws --region us-east-1 # limit scan to a single service: $ trivy aws --region us-east-1 --service s3 # limit scan to multiple services: $ trivy aws --region us-east-1 --service s3 --service ec2 # force refresh of cache for fresh results $ trivy aws --region us-east-1 --update-cache Options --account string The AWS account to scan. It's useful to specify this when reviewing cached results for multiple accounts. --arn string The AWS ARN to show results for. Useful to filter results once a scan is cached. --compliance string compliance report to generate (aws-cis-1.2,aws-cis-1.4) --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --endpoint string AWS Endpoint override --exit-code int specify exit code when any security issues are found -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for aws --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --list-all-pkgs enabling the option will output all packages regardless of vulnerability --max-cache-age duration The maximum age of the cloud cache. Cached data will be requeried from the cloud provider if it is older than this. (default 24h0m0s) -o, --output string output file name --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --region string AWS Region to scan --report string specify a report format for the output (all,summary) (default \"all\") --reset-policy-bundle remove policy bundle --service strings Only scan AWS Service(s) specified with this flag. Can specify multiple services using --service A --service B etc. -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-policy-update skip fetching rego policy updates --skip-service strings Skip selected AWS Service(s) specified with this flag. Can specify multiple services using --skip-service A --skip-service B etc. -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --trace enable more verbose trace output for custom queries --update-cache Update the cache for the applicable cloud provider instead of using cached results. Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"AWS"},{"location":"docs/references/configuration/cli/trivy_aws/#trivy-aws","text":"[EXPERIMENTAL] Scan AWS account","title":"trivy aws"},{"location":"docs/references/configuration/cli/trivy_aws/#synopsis","text":"Scan an AWS account for misconfigurations. Trivy uses the same authentication methods as the AWS CLI. See https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html The following services are supported: - accessanalyzer - api-gateway - athena - cloudfront - cloudtrail - cloudwatch - codebuild - documentdb - dynamodb - ec2 - ecr - ecs - efs - eks - elasticache - elasticsearch - elb - emr - iam - kinesis - kms - lambda - mq - msk - neptune - rds - redshift - s3 - sns - sqs - ssm - workspaces trivy aws [flags]","title":"Synopsis"},{"location":"docs/references/configuration/cli/trivy_aws/#examples","text":"# basic scanning $ trivy aws --region us-east-1 # limit scan to a single service: $ trivy aws --region us-east-1 --service s3 # limit scan to multiple services: $ trivy aws --region us-east-1 --service s3 --service ec2 # force refresh of cache for fresh results $ trivy aws --region us-east-1 --update-cache","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_aws/#options","text":"--account string The AWS account to scan. It's useful to specify this when reviewing cached results for multiple accounts. --arn string The AWS ARN to show results for. Useful to filter results once a scan is cached. --compliance string compliance report to generate (aws-cis-1.2,aws-cis-1.4) --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --endpoint string AWS Endpoint override --exit-code int specify exit code when any security issues are found -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for aws --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --list-all-pkgs enabling the option will output all packages regardless of vulnerability --max-cache-age duration The maximum age of the cloud cache. Cached data will be requeried from the cloud provider if it is older than this. (default 24h0m0s) -o, --output string output file name --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --region string AWS Region to scan --report string specify a report format for the output (all,summary) (default \"all\") --reset-policy-bundle remove policy bundle --service strings Only scan AWS Service(s) specified with this flag. Can specify multiple services using --service A --service B etc. -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-policy-update skip fetching rego policy updates --skip-service strings Skip selected AWS Service(s) specified with this flag. Can specify multiple services using --skip-service A --skip-service B etc. -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --trace enable more verbose trace output for custom queries --update-cache Update the cache for the applicable cloud provider instead of using cached results.","title":"Options"},{"location":"docs/references/configuration/cli/trivy_aws/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_aws/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_config/","text":"trivy config Scan config files for misconfigurations trivy config [flags] DIR Options --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for config --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --k8s-version string specify k8s version to validate outdated api by it (example: 1.21.0) --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --report string specify a compliance report format for the output (all,summary) (default \"all\") --reset-policy-bundle remove policy bundle -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-policy-update skip fetching rego policy updates -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Config"},{"location":"docs/references/configuration/cli/trivy_config/#trivy-config","text":"Scan config files for misconfigurations trivy config [flags] DIR","title":"trivy config"},{"location":"docs/references/configuration/cli/trivy_config/#options","text":"--cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for config --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --k8s-version string specify k8s version to validate outdated api by it (example: 1.21.0) --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --report string specify a compliance report format for the output (all,summary) (default \"all\") --reset-policy-bundle remove policy bundle -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-policy-update skip fetching rego policy updates -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed.","title":"Options"},{"location":"docs/references/configuration/cli/trivy_config/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_config/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_convert/","text":"trivy convert Convert Trivy JSON report into a different format trivy convert [flags] RESULT_JSON Examples # report conversion $ trivy image --format json --output result.json --list-all-pkgs debian:11 $ trivy convert --format cyclonedx --output result.cdx result.json Options --compliance string compliance report to generate --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") -h, --help help for convert --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignorefile string specify .trivyignore file (default \".trivyignore\") --list-all-pkgs enabling the option will output all packages regardless of vulnerability -o, --output string output file name --report string specify a report format for the output (all,summary) (default \"all\") -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) -t, --template string output template Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Convert"},{"location":"docs/references/configuration/cli/trivy_convert/#trivy-convert","text":"Convert Trivy JSON report into a different format trivy convert [flags] RESULT_JSON","title":"trivy convert"},{"location":"docs/references/configuration/cli/trivy_convert/#examples","text":"# report conversion $ trivy image --format json --output result.json --list-all-pkgs debian:11 $ trivy convert --format cyclonedx --output result.cdx result.json","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_convert/#options","text":"--compliance string compliance report to generate --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") -h, --help help for convert --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignorefile string specify .trivyignore file (default \".trivyignore\") --list-all-pkgs enabling the option will output all packages regardless of vulnerability -o, --output string output file name --report string specify a report format for the output (all,summary) (default \"all\") -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) -t, --template string output template","title":"Options"},{"location":"docs/references/configuration/cli/trivy_convert/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_convert/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_filesystem/","text":"trivy filesystem Scan local filesystem trivy filesystem [flags] PATH Examples # Scan a local project including language-specific files $ trivy fs /path/to/your_project # Scan a single file $ trivy fs ./trivy-ci-test/Pipfile.lock Options --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for filesystem --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-dev-deps include development dependencies in the report (supported: npm, yarn) --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --report string specify a compliance report format for the output (all,summary) (default \"all\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library]) Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Filesystem"},{"location":"docs/references/configuration/cli/trivy_filesystem/#trivy-filesystem","text":"Scan local filesystem trivy filesystem [flags] PATH","title":"trivy filesystem"},{"location":"docs/references/configuration/cli/trivy_filesystem/#examples","text":"# Scan a local project including language-specific files $ trivy fs /path/to/your_project # Scan a single file $ trivy fs ./trivy-ci-test/Pipfile.lock","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_filesystem/#options","text":"--cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for filesystem --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-dev-deps include development dependencies in the report (supported: npm, yarn) --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --report string specify a compliance report format for the output (all,summary) (default \"all\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])","title":"Options"},{"location":"docs/references/configuration/cli/trivy_filesystem/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_filesystem/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_image/","text":"trivy image Scan a container image trivy image [flags] IMAGE_NAME Examples # Scan a container image $ trivy image python:3.4-alpine # Scan a container image from a tar archive $ trivy image --input ruby-3.1.tar # Filter by severities $ trivy image --severity HIGH,CRITICAL alpine:3.15 # Ignore unfixed/unpatched vulnerabilities $ trivy image --ignore-unfixed alpine:3.15 # Scan a container image in client mode $ trivy image --server http://127.0.0.1:4954 alpine:latest # Generate json result $ trivy image --format json --output result.json alpine:3.15 # Generate a report in the CycloneDX format $ trivy image --format cyclonedx --output result.cdx alpine:3.15 Options --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate (docker-cis) --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --docker-host string unix domain socket path to use for docker scanning --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for image --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --image-config-scanners strings comma-separated list of what security issues to detect on container image configurations (config,secret) --image-src strings image source(s) to use, in priority order (docker,containerd,podman,remote) (default [docker,containerd,podman,remote]) --include-non-failures include successes and exceptions, available with '--scanners config' --input string input file path instead of image name --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --platform string set platform in the form os/arch if image is multi-platform capable --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --removed-pkgs detect vulnerabilities of removed packages (only for Alpine) --report string specify a format for the compliance report. (all,summary) (default \"summary\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library]) Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Image"},{"location":"docs/references/configuration/cli/trivy_image/#trivy-image","text":"Scan a container image trivy image [flags] IMAGE_NAME","title":"trivy image"},{"location":"docs/references/configuration/cli/trivy_image/#examples","text":"# Scan a container image $ trivy image python:3.4-alpine # Scan a container image from a tar archive $ trivy image --input ruby-3.1.tar # Filter by severities $ trivy image --severity HIGH,CRITICAL alpine:3.15 # Ignore unfixed/unpatched vulnerabilities $ trivy image --ignore-unfixed alpine:3.15 # Scan a container image in client mode $ trivy image --server http://127.0.0.1:4954 alpine:latest # Generate json result $ trivy image --format json --output result.json alpine:3.15 # Generate a report in the CycloneDX format $ trivy image --format cyclonedx --output result.cdx alpine:3.15","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_image/#options","text":"--cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate (docker-cis) --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --docker-host string unix domain socket path to use for docker scanning --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for image --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --image-config-scanners strings comma-separated list of what security issues to detect on container image configurations (config,secret) --image-src strings image source(s) to use, in priority order (docker,containerd,podman,remote) (default [docker,containerd,podman,remote]) --include-non-failures include successes and exceptions, available with '--scanners config' --input string input file path instead of image name --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --platform string set platform in the form os/arch if image is multi-platform capable --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --removed-pkgs detect vulnerabilities of removed packages (only for Alpine) --report string specify a format for the compliance report. (all,summary) (default \"summary\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])","title":"Options"},{"location":"docs/references/configuration/cli/trivy_image/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_image/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_kubernetes/","text":"trivy kubernetes [EXPERIMENTAL] Scan kubernetes cluster trivy kubernetes [flags] { cluster | all | specific resources like kubectl. eg: pods, pod/NAME } Examples # cluster scanning $ trivy k8s --report summary cluster # namespace scanning: $ trivy k8s -n kube-system --report summary all # resources scanning: $ trivy k8s --report=summary deploy $ trivy k8s --namespace=kube-system --report=summary deploy,configmaps # resource scanning: $ trivy k8s deployment/orion Options -A, --all-namespaces fetch resources from all cluster namespaces --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate (k8s-nsa,k8s-cis,k8s-pss-baseline,k8s-pss-restricted) --components strings specify which components to scan (workload,infra) (default [workload,infra]) --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --context string specify a context to scan --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --exclude-nodes strings indicate the node labels that the node-collector job should exclude from scanning (example: kubernetes.io/arch:arm64,team:dev) --exclude-owned exclude resources that have an owner reference --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,cyclonedx) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for kubernetes --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignorefile string specify .trivyignore file (default \".trivyignore\") --image-src strings image source(s) to use, in priority order (docker,containerd,podman,remote) (default [docker,containerd,podman,remote]) --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --k8s-version string specify k8s version to validate outdated api by it (example: 1.21.0) --kubeconfig string specify the kubeconfig file path to use --list-all-pkgs enabling the option will output all packages regardless of vulnerability -n, --namespace string specify a namespace to scan --no-progress suppress progress bar --node-collector-namespace string specify the namespace in which the node-collector job should be deployed (default \"trivy-temp\") --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --parallel int number (between 1-20) of goroutines enabled for parallel scanning (default 5) --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --report string specify a report format for the output (all,summary) (default \"all\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners string comma-separated list of what security issues to detect (vuln,config,secret,license) (default \"vuln,config,secret,rbac\") --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --tolerations strings specify node-collector job tolerations (example: key1=value1:NoExecute,key2=value2:NoSchedule) --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library]) Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Kubernetes"},{"location":"docs/references/configuration/cli/trivy_kubernetes/#trivy-kubernetes","text":"[EXPERIMENTAL] Scan kubernetes cluster trivy kubernetes [flags] { cluster | all | specific resources like kubectl. eg: pods, pod/NAME }","title":"trivy kubernetes"},{"location":"docs/references/configuration/cli/trivy_kubernetes/#examples","text":"# cluster scanning $ trivy k8s --report summary cluster # namespace scanning: $ trivy k8s -n kube-system --report summary all # resources scanning: $ trivy k8s --report=summary deploy $ trivy k8s --namespace=kube-system --report=summary deploy,configmaps # resource scanning: $ trivy k8s deployment/orion","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_kubernetes/#options","text":"-A, --all-namespaces fetch resources from all cluster namespaces --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate (k8s-nsa,k8s-cis,k8s-pss-baseline,k8s-pss-restricted) --components strings specify which components to scan (workload,infra) (default [workload,infra]) --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --context string specify a context to scan --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --exclude-nodes strings indicate the node labels that the node-collector job should exclude from scanning (example: kubernetes.io/arch:arm64,team:dev) --exclude-owned exclude resources that have an owner reference --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,cyclonedx) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for kubernetes --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignorefile string specify .trivyignore file (default \".trivyignore\") --image-src strings image source(s) to use, in priority order (docker,containerd,podman,remote) (default [docker,containerd,podman,remote]) --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --k8s-version string specify k8s version to validate outdated api by it (example: 1.21.0) --kubeconfig string specify the kubeconfig file path to use --list-all-pkgs enabling the option will output all packages regardless of vulnerability -n, --namespace string specify a namespace to scan --no-progress suppress progress bar --node-collector-namespace string specify the namespace in which the node-collector job should be deployed (default \"trivy-temp\") --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --parallel int number (between 1-20) of goroutines enabled for parallel scanning (default 5) --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --report string specify a report format for the output (all,summary) (default \"all\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners string comma-separated list of what security issues to detect (vuln,config,secret,license) (default \"vuln,config,secret,rbac\") --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --tolerations strings specify node-collector job tolerations (example: key1=value1:NoExecute,key2=value2:NoSchedule) --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])","title":"Options"},{"location":"docs/references/configuration/cli/trivy_kubernetes/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_kubernetes/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_module/","text":"trivy module Manage modules Options --enable-modules strings [EXPERIMENTAL] module names to enable -h, --help help for module --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner trivy module install - Install a module trivy module uninstall - Uninstall a module","title":"Module"},{"location":"docs/references/configuration/cli/trivy_module/#trivy-module","text":"Manage modules","title":"trivy module"},{"location":"docs/references/configuration/cli/trivy_module/#options","text":"--enable-modules strings [EXPERIMENTAL] module names to enable -h, --help help for module --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\")","title":"Options"},{"location":"docs/references/configuration/cli/trivy_module/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_module/#see-also","text":"trivy - Unified security scanner trivy module install - Install a module trivy module uninstall - Uninstall a module","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_module_install/","text":"trivy module install Install a module trivy module install [flags] REPOSITORY Options -h, --help help for install Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --enable-modules strings [EXPERIMENTAL] module names to enable --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy module - Manage modules","title":"Module Install"},{"location":"docs/references/configuration/cli/trivy_module_install/#trivy-module-install","text":"Install a module trivy module install [flags] REPOSITORY","title":"trivy module install"},{"location":"docs/references/configuration/cli/trivy_module_install/#options","text":"-h, --help help for install","title":"Options"},{"location":"docs/references/configuration/cli/trivy_module_install/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --enable-modules strings [EXPERIMENTAL] module names to enable --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_module_install/#see-also","text":"trivy module - Manage modules","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_module_uninstall/","text":"trivy module uninstall Uninstall a module trivy module uninstall [flags] REPOSITORY Options -h, --help help for uninstall Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --enable-modules strings [EXPERIMENTAL] module names to enable --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy module - Manage modules","title":"Module Uninstall"},{"location":"docs/references/configuration/cli/trivy_module_uninstall/#trivy-module-uninstall","text":"Uninstall a module trivy module uninstall [flags] REPOSITORY","title":"trivy module uninstall"},{"location":"docs/references/configuration/cli/trivy_module_uninstall/#options","text":"-h, --help help for uninstall","title":"Options"},{"location":"docs/references/configuration/cli/trivy_module_uninstall/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --enable-modules strings [EXPERIMENTAL] module names to enable --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_module_uninstall/#see-also","text":"trivy module - Manage modules","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_plugin/","text":"trivy plugin Manage plugins Options -h, --help help for plugin Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner trivy plugin info - Show information about the specified plugin trivy plugin install - Install a plugin trivy plugin list - List installed plugin trivy plugin run - Run a plugin on the fly trivy plugin uninstall - Uninstall a plugin trivy plugin update - Update an existing plugin","title":"Plugin"},{"location":"docs/references/configuration/cli/trivy_plugin/#trivy-plugin","text":"Manage plugins","title":"trivy plugin"},{"location":"docs/references/configuration/cli/trivy_plugin/#options","text":"-h, --help help for plugin","title":"Options"},{"location":"docs/references/configuration/cli/trivy_plugin/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_plugin/#see-also","text":"trivy - Unified security scanner trivy plugin info - Show information about the specified plugin trivy plugin install - Install a plugin trivy plugin list - List installed plugin trivy plugin run - Run a plugin on the fly trivy plugin uninstall - Uninstall a plugin trivy plugin update - Update an existing plugin","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_plugin_info/","text":"trivy plugin info Show information about the specified plugin trivy plugin info PLUGIN_NAME Options -h, --help help for info Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy plugin - Manage plugins","title":"Plugin Info"},{"location":"docs/references/configuration/cli/trivy_plugin_info/#trivy-plugin-info","text":"Show information about the specified plugin trivy plugin info PLUGIN_NAME","title":"trivy plugin info"},{"location":"docs/references/configuration/cli/trivy_plugin_info/#options","text":"-h, --help help for info","title":"Options"},{"location":"docs/references/configuration/cli/trivy_plugin_info/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_plugin_info/#see-also","text":"trivy plugin - Manage plugins","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_plugin_install/","text":"trivy plugin install Install a plugin trivy plugin install URL | FILE_PATH Options -h, --help help for install Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy plugin - Manage plugins","title":"Plugin Install"},{"location":"docs/references/configuration/cli/trivy_plugin_install/#trivy-plugin-install","text":"Install a plugin trivy plugin install URL | FILE_PATH","title":"trivy plugin install"},{"location":"docs/references/configuration/cli/trivy_plugin_install/#options","text":"-h, --help help for install","title":"Options"},{"location":"docs/references/configuration/cli/trivy_plugin_install/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_plugin_install/#see-also","text":"trivy plugin - Manage plugins","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_plugin_list/","text":"trivy plugin list List installed plugin trivy plugin list Options -h, --help help for list Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy plugin - Manage plugins","title":"Plugin List"},{"location":"docs/references/configuration/cli/trivy_plugin_list/#trivy-plugin-list","text":"List installed plugin trivy plugin list","title":"trivy plugin list"},{"location":"docs/references/configuration/cli/trivy_plugin_list/#options","text":"-h, --help help for list","title":"Options"},{"location":"docs/references/configuration/cli/trivy_plugin_list/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_plugin_list/#see-also","text":"trivy plugin - Manage plugins","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_plugin_run/","text":"trivy plugin run Run a plugin on the fly trivy plugin run URL | FILE_PATH Options -h, --help help for run Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy plugin - Manage plugins","title":"Plugin Run"},{"location":"docs/references/configuration/cli/trivy_plugin_run/#trivy-plugin-run","text":"Run a plugin on the fly trivy plugin run URL | FILE_PATH","title":"trivy plugin run"},{"location":"docs/references/configuration/cli/trivy_plugin_run/#options","text":"-h, --help help for run","title":"Options"},{"location":"docs/references/configuration/cli/trivy_plugin_run/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_plugin_run/#see-also","text":"trivy plugin - Manage plugins","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_plugin_uninstall/","text":"trivy plugin uninstall Uninstall a plugin trivy plugin uninstall PLUGIN_NAME Options -h, --help help for uninstall Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy plugin - Manage plugins","title":"Plugin Uninstall"},{"location":"docs/references/configuration/cli/trivy_plugin_uninstall/#trivy-plugin-uninstall","text":"Uninstall a plugin trivy plugin uninstall PLUGIN_NAME","title":"trivy plugin uninstall"},{"location":"docs/references/configuration/cli/trivy_plugin_uninstall/#options","text":"-h, --help help for uninstall","title":"Options"},{"location":"docs/references/configuration/cli/trivy_plugin_uninstall/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_plugin_uninstall/#see-also","text":"trivy plugin - Manage plugins","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_plugin_update/","text":"trivy plugin update Update an existing plugin trivy plugin update PLUGIN_NAME Options -h, --help help for update Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy plugin - Manage plugins","title":"Plugin Update"},{"location":"docs/references/configuration/cli/trivy_plugin_update/#trivy-plugin-update","text":"Update an existing plugin trivy plugin update PLUGIN_NAME","title":"trivy plugin update"},{"location":"docs/references/configuration/cli/trivy_plugin_update/#options","text":"-h, --help help for update","title":"Options"},{"location":"docs/references/configuration/cli/trivy_plugin_update/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_plugin_update/#see-also","text":"trivy plugin - Manage plugins","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_repository/","text":"trivy repository Scan a repository trivy repository [flags] (REPO_PATH | REPO_URL) Examples # Scan your remote git repository $ trivy repo https://github.com/knqyf263/trivy-ci-test # Scan your local git repository $ trivy repo /path/to/your/repository Options --branch string pass the branch name to be scanned --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --commit string pass the commit hash to be scanned --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for repository --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-dev-deps include development dependencies in the report (supported: npm, yarn) --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization --tag string pass the tag name to be scanned -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library]) Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Repository"},{"location":"docs/references/configuration/cli/trivy_repository/#trivy-repository","text":"Scan a repository trivy repository [flags] (REPO_PATH | REPO_URL)","title":"trivy repository"},{"location":"docs/references/configuration/cli/trivy_repository/#examples","text":"# Scan your remote git repository $ trivy repo https://github.com/knqyf263/trivy-ci-test # Scan your local git repository $ trivy repo /path/to/your/repository","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_repository/#options","text":"--branch string pass the branch name to be scanned --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --commit string pass the commit hash to be scanned --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for repository --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-dev-deps include development dependencies in the report (supported: npm, yarn) --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization --tag string pass the tag name to be scanned -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])","title":"Options"},{"location":"docs/references/configuration/cli/trivy_repository/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_repository/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_rootfs/","text":"trivy rootfs Scan rootfs trivy rootfs [flags] ROOTDIR Examples # Scan unpacked filesystem $ docker export $(docker create alpine:3.10.2) | tar -C /tmp/rootfs -xvf - $ trivy rootfs /tmp/rootfs # Scan from inside a container $ docker run --rm -it alpine:3.11 / # curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin / # trivy rootfs / Options --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for rootfs --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library]) Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Rootfs"},{"location":"docs/references/configuration/cli/trivy_rootfs/#trivy-rootfs","text":"Scan rootfs trivy rootfs [flags] ROOTDIR","title":"trivy rootfs"},{"location":"docs/references/configuration/cli/trivy_rootfs/#examples","text":"# Scan unpacked filesystem $ docker export $(docker create alpine:3.10.2) | tar -C /tmp/rootfs -xvf - $ trivy rootfs /tmp/rootfs # Scan from inside a container $ docker run --rm -it alpine:3.11 / # curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin / # trivy rootfs /","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_rootfs/#options","text":"--cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for rootfs --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])","title":"Options"},{"location":"docs/references/configuration/cli/trivy_rootfs/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_rootfs/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_sbom/","text":"trivy sbom Scan SBOM for vulnerabilities trivy sbom [flags] SBOM_PATH Examples # Scan CycloneDX and show the result in tables $ trivy sbom /path/to/report.cdx # Scan CycloneDX-type attestation and show the result in tables $ trivy sbom /path/to/report.cdx.intoto.jsonl Options --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") -h, --help help for sbom --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignorefile string specify .trivyignore file (default \".trivyignore\") --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --list-all-pkgs enabling the option will output all packages regardless of vulnerability --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --slow scan over time with lower CPU and memory utilization -t, --template string output template --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --vex string [EXPERIMENTAL] file path to VEX --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library]) Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"SBOM"},{"location":"docs/references/configuration/cli/trivy_sbom/#trivy-sbom","text":"Scan SBOM for vulnerabilities trivy sbom [flags] SBOM_PATH","title":"trivy sbom"},{"location":"docs/references/configuration/cli/trivy_sbom/#examples","text":"# Scan CycloneDX and show the result in tables $ trivy sbom /path/to/report.cdx # Scan CycloneDX-type attestation and show the result in tables $ trivy sbom /path/to/report.cdx.intoto.jsonl","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_sbom/#options","text":"--cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") -h, --help help for sbom --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignorefile string specify .trivyignore file (default \".trivyignore\") --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --list-all-pkgs enabling the option will output all packages regardless of vulnerability --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --slow scan over time with lower CPU and memory utilization -t, --template string output template --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --vex string [EXPERIMENTAL] file path to VEX --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])","title":"Options"},{"location":"docs/references/configuration/cli/trivy_sbom/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_sbom/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_server/","text":"trivy server Server mode trivy server [flags] Examples # Run a server $ trivy server # Listen on 0.0.0.0:10000 $ trivy server --listen 0.0.0.0:10000 Options --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --download-db-only download/update vulnerability database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable -h, --help help for server --listen string listen address in server mode (default \"localhost:4954\") --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --reset remove all caches and database --skip-db-update skip updating vulnerability database --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --username strings username. Comma-separated usernames allowed. Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Server"},{"location":"docs/references/configuration/cli/trivy_server/#trivy-server","text":"Server mode trivy server [flags]","title":"trivy server"},{"location":"docs/references/configuration/cli/trivy_server/#examples","text":"# Run a server $ trivy server # Listen on 0.0.0.0:10000 $ trivy server --listen 0.0.0.0:10000","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_server/#options","text":"--cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --download-db-only download/update vulnerability database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable -h, --help help for server --listen string listen address in server mode (default \"localhost:4954\") --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --reset remove all caches and database --skip-db-update skip updating vulnerability database --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --username strings username. Comma-separated usernames allowed.","title":"Options"},{"location":"docs/references/configuration/cli/trivy_server/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_server/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_version/","text":"trivy version Print the version trivy version [flags] Options -f, --format string version format (json) -h, --help help for version Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Version"},{"location":"docs/references/configuration/cli/trivy_version/#trivy-version","text":"Print the version trivy version [flags]","title":"trivy version"},{"location":"docs/references/configuration/cli/trivy_version/#options","text":"-f, --format string version format (json) -h, --help help for version","title":"Options"},{"location":"docs/references/configuration/cli/trivy_version/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_version/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_vm/","text":"trivy vm [EXPERIMENTAL] Scan a virtual machine image trivy vm [flags] VM_IMAGE Examples # Scan your AWS AMI $ trivy vm --scanners vuln ami:${your_ami_id} # Scan your AWS EBS snapshot $ trivy vm ebs:${your_ebs_snapshot_id} Options --aws-region string AWS region to scan --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for vm --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library]) Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"VM"},{"location":"docs/references/configuration/cli/trivy_vm/#trivy-vm","text":"[EXPERIMENTAL] Scan a virtual machine image trivy vm [flags] VM_IMAGE","title":"trivy vm"},{"location":"docs/references/configuration/cli/trivy_vm/#examples","text":"# Scan your AWS AMI $ trivy vm --scanners vuln ami:${your_ami_id} # Scan your AWS EBS snapshot $ trivy vm ebs:${your_ebs_snapshot_id}","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_vm/#options","text":"--aws-region string AWS region to scan --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for vm --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])","title":"Options"},{"location":"docs/references/configuration/cli/trivy_vm/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_vm/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/modes/client-server/","text":"Client/Server Trivy has client/server mode. Trivy server has vulnerability database and Trivy client doesn't have to download vulnerability database. It is useful if you want to scan images or files at multiple locations and do not want to download the database at every location. Server At first, you need to launch Trivy server. It downloads vulnerability database automatically and continue to fetch the latest DB in the background. $ trivy server --listen localhost:8080 2019-12-12T15:17:06.551+0200 INFO Need to update DB 2019-12-12T15:17:56.706+0200 INFO Reopening DB... 2019-12-12T15:17:56.707+0200 INFO Listening localhost:8080... If you want to accept a connection from outside, you have to specify 0.0.0.0 or your ip address, not localhost . $ trivy server --listen 0.0.0.0:8080 Remote image scan Then, specify the server address for image command. $ trivy image --server http://localhost:8080 alpine:3.10 Note : It's important to specify the protocol (http or https). Result alpine:3.10 (alpine 3.10.2) =========================== Total: 3 (UNKNOWN: 0, LOW: 1, MEDIUM: 2, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | +---------+------------------+----------+-------------------+---------------+ | openssl | CVE-2019-1549 | MEDIUM | 1.1.1c-r0 | 1.1.1d-r0 | + +------------------+ + + + | | CVE-2019-1563 | | | | + +------------------+----------+ + + | | CVE-2019-1547 | LOW | | | +---------+------------------+----------+-------------------+---------------+ Remote scan of local filesystem Also, there is a way to scan local file system: $ trivy fs --server http://localhost:8080 --severity CRITICAL ./integration/testdata/fixtures/fs/pom/ Note : It's important to specify the protocol (http or https). Result pom.xml (pom) ============= Total: 24 (CRITICAL: 24) +---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+ | com.fasterxml.jackson.core:jackson-databind | CVE-2017-17485 | CRITICAL | 2.9.1 | 2.8.11, 2.9.4 | jackson-databind: Unsafe | | | | | | | deserialization due to | | | | | | | incomplete black list (incomplete | | | | | | | fix for CVE-2017-15095)... | | | | | | | -->avd.aquasec.com/nvd/cve-2017-17485 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-11307 | | | 2.7.9.4, 2.8.11.2, 2.9.6 | jackson-databind: Potential | | | | | | | information exfiltration with | | | | | | | default typing, serialization | | | | | | | gadget from MyBatis | | | | | | | -->avd.aquasec.com/nvd/cve-2018-11307 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-14718 | | | 2.6.7.2, 2.9.7 | jackson-databind: arbitrary code | | | | | | | execution in slf4j-ext class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14718 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-14719 | | | | jackson-databind: arbitrary | | | | | | | code execution in blaze-ds-opt | | | | | | | and blaze-ds-core classes | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14719 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-14720 | | | | jackson-databind: exfiltration/XXE | | | | | | | in some JDK classes | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14720 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-14721 | | | | jackson-databind: server-side request | | | | | | | forgery (SSRF) in axis2-jaxws class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14721 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-19360 | | | 2.6.7.3, 2.7.9.5, 2.8.11.3, | jackson-databind: improper | | | | | | 2.9.8 | polymorphic deserialization | | | | | | | in axis2-transport-jms class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-19360 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-19361 | | | | jackson-databind: improper | | | | | | | polymorphic deserialization | | | | | | | in openjpa class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-19361 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-19362 | | | | jackson-databind: improper | | | | | | | polymorphic deserialization | | | | | | | in jboss-common-core class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-19362 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-7489 | | | 2.7.9.3, 2.8.11.1, 2.9.5 | jackson-databind: incomplete fix | | | | | | | for CVE-2017-7525 permits unsafe | | | | | | | serialization via c3p0 libraries | | | | | | | -->avd.aquasec.com/nvd/cve-2018-7489 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14379 | | | 2.7.9.6, 2.8.11.4, 2.9.9.2 | jackson-databind: default | | | | | | | typing mishandling leading | | | | | | | to remote code execution | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14379 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14540 | | | 2.9.10 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | com.zaxxer.hikari.HikariConfig | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14540 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14892 | | | 2.6.7.3, 2.8.11.5, 2.9.10 | jackson-databind: Serialization | | | | | | | gadgets in classes of the | | | | | | | commons-configuration package | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14892 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14893 | | | 2.8.11.5, 2.9.10 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | classes of the xalan package | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14893 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-16335 | | | 2.9.10 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | com.zaxxer.hikari.HikariDataSource | | | | | | | -->avd.aquasec.com/nvd/cve-2019-16335 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-16942 | | | 2.9.10.1 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | org.apache.commons.dbcp.datasources.* | | | | | | | -->avd.aquasec.com/nvd/cve-2019-16942 | + +------------------+ + + +---------------------------------------+ | | CVE-2019-16943 | | | | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | com.p6spy.engine.spy.P6DataSource | | | | | | | -->avd.aquasec.com/nvd/cve-2019-16943 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-17267 | | | 2.9.10 | jackson-databind: Serialization | | | | | | | gadgets in classes of | | | | | | | the ehcache package | | | | | | | -->avd.aquasec.com/nvd/cve-2019-17267 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-17531 | | | 2.9.10.1 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | org.apache.log4j.receivers.db.* | | | | | | | -->avd.aquasec.com/nvd/cve-2019-17531 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-20330 | | | 2.8.11.5, 2.9.10.2 | jackson-databind: lacks | | | | | | | certain net.sf.ehcache blocking | | | | | | | -->avd.aquasec.com/nvd/cve-2019-20330 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2020-8840 | | | 2.7.9.7, 2.8.11.5, 2.9.10.3 | jackson-databind: Lacks certain | | | | | | | xbean-reflect/JNDI blocking | | | | | | | -->avd.aquasec.com/nvd/cve-2020-8840 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2020-9546 | | | 2.7.9.7, 2.8.11.6, 2.9.10.4 | jackson-databind: Serialization | | | | | | | gadgets in shaded-hikari-config | | | | | | | -->avd.aquasec.com/nvd/cve-2020-9546 | + +------------------+ + + +---------------------------------------+ | | CVE-2020-9547 | | | | jackson-databind: Serialization | | | | | | | gadgets in ibatis-sqlmap | | | | | | | -->avd.aquasec.com/nvd/cve-2020-9547 | + +------------------+ + + +---------------------------------------+ | | CVE-2020-9548 | | | | jackson-databind: Serialization | | | | | | | gadgets in anteros-core | | | | | | | -->avd.aquasec.com/nvd/cve-2020-9548 | +---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+ Remote scan of root filesystem Also, there is a way to scan root file system: $ trivy rootfs --server http://localhost:8080 --severity CRITICAL /tmp/rootfs Note : It's important to specify the protocol (http or https). Result /tmp/rootfs (alpine 3.10.2) Total: 1 (CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 apk-tools \u2502 CVE-2021-36159 \u2502 CRITICAL \u2502 2.10.4-r2 \u2502 2.10.7-r0 \u2502 libfetch before 2021-07-26, as used in apk-tools, xbps, and \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 other products, mishandles... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-36159 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Remote scan of git repository Also, there is a way to scan remote git repository: $ trivy repo https://github.com/knqyf263/trivy-ci-test --server http://localhost:8080 Note : It's important to specify the protocol (http or https). Result Cargo.lock (cargo) ================== Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 2, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 ammonia \u2502 CVE-2019-15542 \u2502 HIGH \u2502 1.9.0 \u2502 2.1.0 \u2502 Uncontrolled recursion in ammonia \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-15542 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-38193 \u2502 MEDIUM \u2502 \u2502 2.1.3, 3.1.0 \u2502 An issue was discovered in the ammonia crate before 3.1.0 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for Rust.... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-38193 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 smallvec \u2502 CVE-2019-15551 \u2502 \u2502 0.6.9 \u2502 0.6.10 \u2502 An issue was discovered in the smallvec crate before 0.6.10 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for Rust.... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-15551 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2018-25023 \u2502 HIGH \u2502 \u2502 0.6.13 \u2502 An issue was discovered in the smallvec crate before 0.6.13 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for Rust.... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2018-25023 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 GHSA-66p5-j55p-32r9 \u2502 MEDIUM \u2502 \u2502 \u2502 smallvec creates uninitialized value of any type \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://github.com/advisories/GHSA-66p5-j55p-32r9 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Pipfile.lock (pipenv) ===================== Total: 8 (UNKNOWN: 0, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 celery \u2502 CVE-2021-23727 \u2502 HIGH \u2502 4.3.0 \u2502 5.2.2 \u2502 celery: stored command injection vulnerability may allow \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 privileges escalation \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-23727 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 django \u2502 CVE-2019-6975 \u2502 \u2502 2.0.9 \u2502 1.11.19, 2.0.12, 2.1.7 \u2502 python-django: memory exhaustion in \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 django.utils.numberformat.format() \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-6975 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2019-3498 \u2502 MEDIUM \u2502 \u2502 1.11.18, 2.0.10, 2.1.5 \u2502 python-django: Content spoofing via URL path in default 404 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 page \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-3498 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-33203 \u2502 \u2502 \u2502 2.2.24, 3.1.12, 3.2.4 \u2502 django: Potential directory traversal via ``admindocs`` \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-33203 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 urllib3 \u2502 CVE-2019-11324 \u2502 \u2502 1.24.1 \u2502 1.24.2 \u2502 python-urllib3: Certification mishandle when error should be \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 thrown \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-11324 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-33503 \u2502 \u2502 \u2502 1.26.5 \u2502 python-urllib3: ReDoS in the parsing of authority part of \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 URL \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-33503 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2019-11236 \u2502 MEDIUM \u2502 \u2502 1.24.3 \u2502 python-urllib3: CRLF injection due to not encoding the \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 '\\r\\n' sequence leading to... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-11236 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2020-26137 \u2502 \u2502 \u2502 1.25.9 \u2502 python-urllib3: CRLF injection via HTTP request method \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2020-26137 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Authentication $ trivy server --listen localhost:8080 --token dummy $ trivy image --server http://localhost:8080 --token dummy alpine:3.10 Endpoints Health Checks whether the Trivy server is running. Authentication is not required. Example request: curl -s 0 .0.0.0:8080/healthz ok Returns the 200 OK status if the request was successful. Version Returns the version of the Trivy and all components (db, policy). Authentication is not required. Example request: curl -s 0 .0.0.0:8080/version | jq { \"Version\" : \"dev\" , \"VulnerabilityDB\" : { \"Version\" : 2 , \"NextUpdate\" : \"2023-07-25T14:15:29.876639806Z\" , \"UpdatedAt\" : \"2023-07-25T08:15:29.876640206Z\" , \"DownloadedAt\" : \"2023-07-25T09:36:25.599004Z\" } , \"JavaDB\" : { \"Version\" : 1 , \"NextUpdate\" : \"2023-07-28T01:03:52.169192565Z\" , \"UpdatedAt\" : \"2023-07-25T01:03:52.169192765Z\" , \"DownloadedAt\" : \"2023-07-25T09:37:48.906152Z\" } , \"PolicyBundle\" : { \"Digest\" : \"sha256:829832357626da2677955e3b427191212978ba20012b6eaa03229ca28569ae43\" , \"DownloadedAt\" : \"2023-07-23T11:40:33.122462Z\" } } Returns the 200 OK status if the request was successful. Architecture","title":"Client/Server"},{"location":"docs/references/modes/client-server/#clientserver","text":"Trivy has client/server mode. Trivy server has vulnerability database and Trivy client doesn't have to download vulnerability database. It is useful if you want to scan images or files at multiple locations and do not want to download the database at every location.","title":"Client/Server"},{"location":"docs/references/modes/client-server/#server","text":"At first, you need to launch Trivy server. It downloads vulnerability database automatically and continue to fetch the latest DB in the background. $ trivy server --listen localhost:8080 2019-12-12T15:17:06.551+0200 INFO Need to update DB 2019-12-12T15:17:56.706+0200 INFO Reopening DB... 2019-12-12T15:17:56.707+0200 INFO Listening localhost:8080... If you want to accept a connection from outside, you have to specify 0.0.0.0 or your ip address, not localhost . $ trivy server --listen 0.0.0.0:8080","title":"Server"},{"location":"docs/references/modes/client-server/#remote-image-scan","text":"Then, specify the server address for image command. $ trivy image --server http://localhost:8080 alpine:3.10 Note : It's important to specify the protocol (http or https). Result alpine:3.10 (alpine 3.10.2) =========================== Total: 3 (UNKNOWN: 0, LOW: 1, MEDIUM: 2, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | +---------+------------------+----------+-------------------+---------------+ | openssl | CVE-2019-1549 | MEDIUM | 1.1.1c-r0 | 1.1.1d-r0 | + +------------------+ + + + | | CVE-2019-1563 | | | | + +------------------+----------+ + + | | CVE-2019-1547 | LOW | | | +---------+------------------+----------+-------------------+---------------+","title":"Remote image scan"},{"location":"docs/references/modes/client-server/#remote-scan-of-local-filesystem","text":"Also, there is a way to scan local file system: $ trivy fs --server http://localhost:8080 --severity CRITICAL ./integration/testdata/fixtures/fs/pom/ Note : It's important to specify the protocol (http or https). Result pom.xml (pom) ============= Total: 24 (CRITICAL: 24) +---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+ | com.fasterxml.jackson.core:jackson-databind | CVE-2017-17485 | CRITICAL | 2.9.1 | 2.8.11, 2.9.4 | jackson-databind: Unsafe | | | | | | | deserialization due to | | | | | | | incomplete black list (incomplete | | | | | | | fix for CVE-2017-15095)... | | | | | | | -->avd.aquasec.com/nvd/cve-2017-17485 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-11307 | | | 2.7.9.4, 2.8.11.2, 2.9.6 | jackson-databind: Potential | | | | | | | information exfiltration with | | | | | | | default typing, serialization | | | | | | | gadget from MyBatis | | | | | | | -->avd.aquasec.com/nvd/cve-2018-11307 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-14718 | | | 2.6.7.2, 2.9.7 | jackson-databind: arbitrary code | | | | | | | execution in slf4j-ext class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14718 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-14719 | | | | jackson-databind: arbitrary | | | | | | | code execution in blaze-ds-opt | | | | | | | and blaze-ds-core classes | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14719 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-14720 | | | | jackson-databind: exfiltration/XXE | | | | | | | in some JDK classes | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14720 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-14721 | | | | jackson-databind: server-side request | | | | | | | forgery (SSRF) in axis2-jaxws class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14721 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-19360 | | | 2.6.7.3, 2.7.9.5, 2.8.11.3, | jackson-databind: improper | | | | | | 2.9.8 | polymorphic deserialization | | | | | | | in axis2-transport-jms class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-19360 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-19361 | | | | jackson-databind: improper | | | | | | | polymorphic deserialization | | | | | | | in openjpa class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-19361 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-19362 | | | | jackson-databind: improper | | | | | | | polymorphic deserialization | | | | | | | in jboss-common-core class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-19362 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-7489 | | | 2.7.9.3, 2.8.11.1, 2.9.5 | jackson-databind: incomplete fix | | | | | | | for CVE-2017-7525 permits unsafe | | | | | | | serialization via c3p0 libraries | | | | | | | -->avd.aquasec.com/nvd/cve-2018-7489 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14379 | | | 2.7.9.6, 2.8.11.4, 2.9.9.2 | jackson-databind: default | | | | | | | typing mishandling leading | | | | | | | to remote code execution | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14379 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14540 | | | 2.9.10 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | com.zaxxer.hikari.HikariConfig | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14540 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14892 | | | 2.6.7.3, 2.8.11.5, 2.9.10 | jackson-databind: Serialization | | | | | | | gadgets in classes of the | | | | | | | commons-configuration package | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14892 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14893 | | | 2.8.11.5, 2.9.10 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | classes of the xalan package | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14893 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-16335 | | | 2.9.10 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | com.zaxxer.hikari.HikariDataSource | | | | | | | -->avd.aquasec.com/nvd/cve-2019-16335 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-16942 | | | 2.9.10.1 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | org.apache.commons.dbcp.datasources.* | | | | | | | -->avd.aquasec.com/nvd/cve-2019-16942 | + +------------------+ + + +---------------------------------------+ | | CVE-2019-16943 | | | | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | com.p6spy.engine.spy.P6DataSource | | | | | | | -->avd.aquasec.com/nvd/cve-2019-16943 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-17267 | | | 2.9.10 | jackson-databind: Serialization | | | | | | | gadgets in classes of | | | | | | | the ehcache package | | | | | | | -->avd.aquasec.com/nvd/cve-2019-17267 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-17531 | | | 2.9.10.1 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | org.apache.log4j.receivers.db.* | | | | | | | -->avd.aquasec.com/nvd/cve-2019-17531 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-20330 | | | 2.8.11.5, 2.9.10.2 | jackson-databind: lacks | | | | | | | certain net.sf.ehcache blocking | | | | | | | -->avd.aquasec.com/nvd/cve-2019-20330 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2020-8840 | | | 2.7.9.7, 2.8.11.5, 2.9.10.3 | jackson-databind: Lacks certain | | | | | | | xbean-reflect/JNDI blocking | | | | | | | -->avd.aquasec.com/nvd/cve-2020-8840 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2020-9546 | | | 2.7.9.7, 2.8.11.6, 2.9.10.4 | jackson-databind: Serialization | | | | | | | gadgets in shaded-hikari-config | | | | | | | -->avd.aquasec.com/nvd/cve-2020-9546 | + +------------------+ + + +---------------------------------------+ | | CVE-2020-9547 | | | | jackson-databind: Serialization | | | | | | | gadgets in ibatis-sqlmap | | | | | | | -->avd.aquasec.com/nvd/cve-2020-9547 | + +------------------+ + + +---------------------------------------+ | | CVE-2020-9548 | | | | jackson-databind: Serialization | | | | | | | gadgets in anteros-core | | | | | | | -->avd.aquasec.com/nvd/cve-2020-9548 | +---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+","title":"Remote scan of local filesystem"},{"location":"docs/references/modes/client-server/#remote-scan-of-root-filesystem","text":"Also, there is a way to scan root file system: $ trivy rootfs --server http://localhost:8080 --severity CRITICAL /tmp/rootfs Note : It's important to specify the protocol (http or https). Result /tmp/rootfs (alpine 3.10.2) Total: 1 (CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 apk-tools \u2502 CVE-2021-36159 \u2502 CRITICAL \u2502 2.10.4-r2 \u2502 2.10.7-r0 \u2502 libfetch before 2021-07-26, as used in apk-tools, xbps, and \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 other products, mishandles... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-36159 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"Remote scan of root filesystem"},{"location":"docs/references/modes/client-server/#remote-scan-of-git-repository","text":"Also, there is a way to scan remote git repository: $ trivy repo https://github.com/knqyf263/trivy-ci-test --server http://localhost:8080 Note : It's important to specify the protocol (http or https). Result Cargo.lock (cargo) ================== Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 2, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 ammonia \u2502 CVE-2019-15542 \u2502 HIGH \u2502 1.9.0 \u2502 2.1.0 \u2502 Uncontrolled recursion in ammonia \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-15542 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-38193 \u2502 MEDIUM \u2502 \u2502 2.1.3, 3.1.0 \u2502 An issue was discovered in the ammonia crate before 3.1.0 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for Rust.... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-38193 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 smallvec \u2502 CVE-2019-15551 \u2502 \u2502 0.6.9 \u2502 0.6.10 \u2502 An issue was discovered in the smallvec crate before 0.6.10 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for Rust.... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-15551 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2018-25023 \u2502 HIGH \u2502 \u2502 0.6.13 \u2502 An issue was discovered in the smallvec crate before 0.6.13 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for Rust.... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2018-25023 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 GHSA-66p5-j55p-32r9 \u2502 MEDIUM \u2502 \u2502 \u2502 smallvec creates uninitialized value of any type \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://github.com/advisories/GHSA-66p5-j55p-32r9 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Pipfile.lock (pipenv) ===================== Total: 8 (UNKNOWN: 0, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 celery \u2502 CVE-2021-23727 \u2502 HIGH \u2502 4.3.0 \u2502 5.2.2 \u2502 celery: stored command injection vulnerability may allow \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 privileges escalation \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-23727 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 django \u2502 CVE-2019-6975 \u2502 \u2502 2.0.9 \u2502 1.11.19, 2.0.12, 2.1.7 \u2502 python-django: memory exhaustion in \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 django.utils.numberformat.format() \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-6975 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2019-3498 \u2502 MEDIUM \u2502 \u2502 1.11.18, 2.0.10, 2.1.5 \u2502 python-django: Content spoofing via URL path in default 404 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 page \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-3498 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-33203 \u2502 \u2502 \u2502 2.2.24, 3.1.12, 3.2.4 \u2502 django: Potential directory traversal via ``admindocs`` \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-33203 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 urllib3 \u2502 CVE-2019-11324 \u2502 \u2502 1.24.1 \u2502 1.24.2 \u2502 python-urllib3: Certification mishandle when error should be \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 thrown \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-11324 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-33503 \u2502 \u2502 \u2502 1.26.5 \u2502 python-urllib3: ReDoS in the parsing of authority part of \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 URL \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-33503 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2019-11236 \u2502 MEDIUM \u2502 \u2502 1.24.3 \u2502 python-urllib3: CRLF injection due to not encoding the \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 '\\r\\n' sequence leading to... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-11236 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2020-26137 \u2502 \u2502 \u2502 1.25.9 \u2502 python-urllib3: CRLF injection via HTTP request method \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2020-26137 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"Remote scan of git repository"},{"location":"docs/references/modes/client-server/#authentication","text":"$ trivy server --listen localhost:8080 --token dummy $ trivy image --server http://localhost:8080 --token dummy alpine:3.10","title":"Authentication"},{"location":"docs/references/modes/client-server/#endpoints","text":"","title":"Endpoints"},{"location":"docs/references/modes/client-server/#health","text":"Checks whether the Trivy server is running. Authentication is not required. Example request: curl -s 0 .0.0.0:8080/healthz ok Returns the 200 OK status if the request was successful.","title":"Health"},{"location":"docs/references/modes/client-server/#version","text":"Returns the version of the Trivy and all components (db, policy). Authentication is not required. Example request: curl -s 0 .0.0.0:8080/version | jq { \"Version\" : \"dev\" , \"VulnerabilityDB\" : { \"Version\" : 2 , \"NextUpdate\" : \"2023-07-25T14:15:29.876639806Z\" , \"UpdatedAt\" : \"2023-07-25T08:15:29.876640206Z\" , \"DownloadedAt\" : \"2023-07-25T09:36:25.599004Z\" } , \"JavaDB\" : { \"Version\" : 1 , \"NextUpdate\" : \"2023-07-28T01:03:52.169192565Z\" , \"UpdatedAt\" : \"2023-07-25T01:03:52.169192765Z\" , \"DownloadedAt\" : \"2023-07-25T09:37:48.906152Z\" } , \"PolicyBundle\" : { \"Digest\" : \"sha256:829832357626da2677955e3b427191212978ba20012b6eaa03229ca28569ae43\" , \"DownloadedAt\" : \"2023-07-23T11:40:33.122462Z\" } } Returns the 200 OK status if the request was successful.","title":"Version"},{"location":"docs/references/modes/client-server/#architecture","text":"","title":"Architecture"},{"location":"docs/references/modes/standalone/","text":"Standalone trivy image , trivy filesystem , and trivy repo works as standalone mode. Image Filesystem Git Repository","title":"Standalone"},{"location":"docs/references/modes/standalone/#standalone","text":"trivy image , trivy filesystem , and trivy repo works as standalone mode.","title":"Standalone"},{"location":"docs/references/modes/standalone/#image","text":"","title":"Image"},{"location":"docs/references/modes/standalone/#filesystem","text":"","title":"Filesystem"},{"location":"docs/references/modes/standalone/#git-repository","text":"","title":"Git Repository"},{"location":"docs/scanner/license/","text":"License Scanning Trivy scans any container image for license files and offers an opinionated view on the risk associated with the license. License are classified using the Google License Classification - Forbidden Restricted Reciprocal Notice Permissive Unencumbered Unknown Tip Licenses that Trivy fails to recognize are classified as UNKNOWN. As those licenses may be in violation, it is recommended to check those unknown licenses as well. By default, Trivy scans licenses for packages installed by apk , apt-get , dnf , npm , pip , gem , etc. Check out the coverage document for details. To enable extended license scanning, you can use --license-full . In addition to package licenses, Trivy scans source code files, Markdown documents, text files and LICENSE documents to identify license usage within the image or filesystem. By default, Trivy only classifies licenses that are matched with a confidence level of 0.9 or more by the classifer. To configure the confidence level, you can use --license-confidence-level . This enables us to classify licenses that might be matched with a lower confidence level by the classifer. Note The full license scanning is expensive. It takes a while. Currently, the standard license scanning doesn't support filesystem and repository scanning. License scanning Image Rootfs Filesystem Repository Standard \u2705 \u2705 - - Full (--license-full) \u2705 \u2705 \u2705 \u2705 License checking classifies the identified licenses and map the classification to severity. Classification Severity Forbidden CRITICAL Restricted HIGH Reciprocal MEDIUM Notice LOW Permissive LOW Unencumbered LOW Unknown UNKNOWN Quick start This section shows how to scan license in container image and filesystem. Standard scanning Specify an image name with --scanners license . $ trivy image --scanners license --severity UNKNOWN,HIGH,CRITICAL alpine:3.15 2022 -07-13T17:28:39.526+0300 INFO License scanning is enabled OS Packages ( license ) ===================== Total: 6 ( UNKNOWN: 0 , HIGH: 6 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Package \u2502 License \u2502 Classification \u2502 Severity \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 alpine-baselayout \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 apk-tools \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 busybox \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 scanelf \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 ssl_client \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Full scanning Specify --license-full $ trivy image --scanners license --severity UNKNOWN,HIGH,CRITICAL --license-full grafana/grafana 2022 -07-13T17:48:40.905+0300 INFO Full license scanning is enabled OS Packages ( license ) ===================== Total: 20 ( UNKNOWN: 9 , HIGH: 11 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Package \u2502 License \u2502 Classification \u2502 Severity \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 alpine-baselayout \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 apk-tools \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 bash \u2502 GPL-3.0 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 keyutils-libs \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 LGPL-2.0-or-later \u2502 Non Standard \u2502 UNKNOWN \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 libaio \u2502 LGPL-2.1-or-later \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 libcom_err \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 LGPL-2.0-or-later \u2502 Non Standard \u2502 UNKNOWN \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 tzdata \u2502 Public-Domain \u2502 Non Standard \u2502 UNKNOWN \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Loose File License ( s ) ( license ) =============================== Total: 6 ( UNKNOWN: 4 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Classification \u2502 Severity \u2502 License \u2502 File Location \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 Forbidden \u2502 CRITICAL \u2502 AGPL-3.0 \u2502 /usr/share/grafana/LICENSE \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 Non Standard \u2502 UNKNOWN \u2502 BSD-0-Clause \u2502 /usr/share/grafana/public/build/5069.d6aae9dd11d49c741a80.j- \u2502 \u2502 \u2502 \u2502 \u2502 s.LICENSE.txt \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 /usr/share/grafana/public/build/6444.d6aae9dd11d49c741a80.j- \u2502 \u2502 \u2502 \u2502 \u2502 s.LICENSE.txt \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 /usr/share/grafana/public/build/7889.d6aae9dd11d49c741a80.j- \u2502 \u2502 \u2502 \u2502 \u2502 s.LICENSE.txt \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 /usr/share/grafana/public/build/canvasPanel.d6aae9dd11d49c7- \u2502 \u2502 \u2502 \u2502 \u2502 41a80.js.LICENSE.txt \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Configuration Trivy has number of configuration flags for use with license scanning; Ignored Licenses Trivy license scanning can ignore licenses that are identified to explicitly remove them from the results using the --ignored-licenses flag; $ trivy image --scanners license --ignored-licenses MPL-2.0,MIT --severity HIGH grafana/grafana:latest 2022 -07-13T18:15:28.605Z INFO License scanning is enabled OS Packages ( license ) ===================== Total: 2 ( HIGH: 2 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Package \u2502 License \u2502 Classification \u2502 Severity \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 alpine-baselayout \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 ssl_client \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Configuring Classifier Confidence Level You can use the --license-confidence-level flag to adjust the confidence level between 0.0 to 1.0 (default 0.9). For example, when you run the scanner with the default confidence level on SPDX license list data , it is able to detect only 258 licenses. $ trivy fs --scanners license --license-full <path/to/spdx/list/data> 2023 -04-18T10:05:13.601-0700 INFO Full license scanning is enabled Loose File License ( s ) ( license ) =============================== Total: 258 ( UNKNOWN: 70 , LOW: 90 , MEDIUM: 18 , HIGH: 58 , CRITICAL: 22 ) However, by configuring the confidence level to 0.8, the scanner is now able to detect 282 licenses. $ trivy fs --scanners license --license-full --license-confidence-level 0 .8 <path/to/spdx/list/data> 2023 -04-18T10:21:39.637-0700 INFO Full license scanning is enabled Loose File License ( s ) ( license ) =============================== Total: 282 ( UNKNOWN: 81 , LOW: 97 , MEDIUM: 24 , HIGH: 58 , CRITICAL: 22 ) Custom Classification You can generate the default config by the --generate-default-config flag and customize the license classification. For example, if you want to forbid only AGPL-3.0, you can leave it under forbidden and move other licenses to another classification. $ trivy image --generate-default-config $ vim trivy.yaml license: forbidden: - AGPL-3.0 restricted: - AGPL-1.0 - CC-BY-NC-1.0 - CC-BY-NC-2.0 - CC-BY-NC-2.5 - CC-BY-NC-3.0 - CC-BY-NC-4.0 - CC-BY-NC-ND-1.0 - CC-BY-NC-ND-2.0 - CC-BY-NC-ND-2.5 - CC-BY-NC-ND-3.0 - CC-BY-NC-ND-4.0 - CC-BY-NC-SA-1.0 - CC-BY-NC-SA-2.0 - CC-BY-NC-SA-2.5 - CC-BY-NC-SA-3.0 - CC-BY-NC-SA-4.0 - Commons-Clause - Facebook-2-Clause - Facebook-3-Clause - Facebook-Examples - WTFPL - BCL - CC-BY-ND-1.0 - CC-BY-ND-2.0 - CC-BY-ND-2.5 - CC-BY-ND-3.0 - CC-BY-ND-4.0 - CC-BY-SA-1.0 - CC-BY-SA-2.0 - CC-BY-SA-2.5 - CC-BY-SA-3.0 - CC-BY-SA-4.0 - GPL-1.0 - GPL-2.0 - GPL-2.0-with-autoconf-exception - GPL-2.0-with-bison-exception - GPL-2.0-with-classpath-exception - GPL-2.0-with-font-exception - GPL-2.0-with-GCC-exception - GPL-3.0 - GPL-3.0-with-autoconf-exception - GPL-3.0-with-GCC-exception - LGPL-2.0 - LGPL-2.1 - LGPL-3.0 - NPL-1.0 - NPL-1.1 - OSL-1.0 - OSL-1.1 - OSL-2.0 - OSL-2.1 - OSL-3.0 - QPL-1.0 - Sleepycat reciprocal: - APSL-1.0 - APSL-1.1 - APSL-1.2 - APSL-2.0 - CDDL-1.0 - CDDL-1.1 - CPL-1.0 - EPL-1.0 - EPL-2.0 - FreeImage - IPL-1.0 - MPL-1.0 - MPL-1.1 - MPL-2.0 - Ruby notice: - AFL-1.1 - AFL-1.2 - AFL-2.0 - AFL-2.1 - AFL-3.0 - Apache-1.0 - Apache-1.1 - Apache-2.0 - Artistic-1.0-cl8 - Artistic-1.0-Perl - Artistic-1.0 - Artistic-2.0 - BSL-1.0 - BSD-2-Clause-FreeBSD - BSD-2-Clause-NetBSD - BSD-2-Clause - BSD-3-Clause-Attribution - BSD-3-Clause-Clear - BSD-3-Clause-LBNL - BSD-3-Clause - BSD-4-Clause - BSD-4-Clause-UC - BSD-Protection - CC-BY-1.0 - CC-BY-2.0 - CC-BY-2.5 - CC-BY-3.0 - CC-BY-4.0 - FTL - ISC - ImageMagick - Libpng - Lil-1.0 - Linux-OpenIB - LPL-1.02 - LPL-1.0 - MS-PL - MIT - NCSA - OpenSSL - PHP-3.01 - PHP-3.0 - PIL - Python-2.0 - Python-2.0-complete - PostgreSQL - SGI-B-1.0 - SGI-B-1.1 - SGI-B-2.0 - Unicode-DFS-2015 - Unicode-DFS-2016 - Unicode-TOU - UPL-1.0 - W3C-19980720 - W3C-20150513 - W3C - X11 - Xnet - Zend-2.0 - zlib-acknowledgement - Zlib - ZPL-1.1 - ZPL-2.0 - ZPL-2.1 unencumbered: - CC0-1.0 - Unlicense - 0BSD permissive: []","title":"License"},{"location":"docs/scanner/license/#license-scanning","text":"Trivy scans any container image for license files and offers an opinionated view on the risk associated with the license. License are classified using the Google License Classification - Forbidden Restricted Reciprocal Notice Permissive Unencumbered Unknown Tip Licenses that Trivy fails to recognize are classified as UNKNOWN. As those licenses may be in violation, it is recommended to check those unknown licenses as well. By default, Trivy scans licenses for packages installed by apk , apt-get , dnf , npm , pip , gem , etc. Check out the coverage document for details. To enable extended license scanning, you can use --license-full . In addition to package licenses, Trivy scans source code files, Markdown documents, text files and LICENSE documents to identify license usage within the image or filesystem. By default, Trivy only classifies licenses that are matched with a confidence level of 0.9 or more by the classifer. To configure the confidence level, you can use --license-confidence-level . This enables us to classify licenses that might be matched with a lower confidence level by the classifer. Note The full license scanning is expensive. It takes a while. Currently, the standard license scanning doesn't support filesystem and repository scanning. License scanning Image Rootfs Filesystem Repository Standard \u2705 \u2705 - - Full (--license-full) \u2705 \u2705 \u2705 \u2705 License checking classifies the identified licenses and map the classification to severity. Classification Severity Forbidden CRITICAL Restricted HIGH Reciprocal MEDIUM Notice LOW Permissive LOW Unencumbered LOW Unknown UNKNOWN","title":"License Scanning"},{"location":"docs/scanner/license/#quick-start","text":"This section shows how to scan license in container image and filesystem.","title":"Quick start"},{"location":"docs/scanner/license/#standard-scanning","text":"Specify an image name with --scanners license . $ trivy image --scanners license --severity UNKNOWN,HIGH,CRITICAL alpine:3.15 2022 -07-13T17:28:39.526+0300 INFO License scanning is enabled OS Packages ( license ) ===================== Total: 6 ( UNKNOWN: 0 , HIGH: 6 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Package \u2502 License \u2502 Classification \u2502 Severity \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 alpine-baselayout \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 apk-tools \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 busybox \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 scanelf \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 ssl_client \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"Standard scanning"},{"location":"docs/scanner/license/#full-scanning","text":"Specify --license-full $ trivy image --scanners license --severity UNKNOWN,HIGH,CRITICAL --license-full grafana/grafana 2022 -07-13T17:48:40.905+0300 INFO Full license scanning is enabled OS Packages ( license ) ===================== Total: 20 ( UNKNOWN: 9 , HIGH: 11 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Package \u2502 License \u2502 Classification \u2502 Severity \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 alpine-baselayout \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 apk-tools \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 bash \u2502 GPL-3.0 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 keyutils-libs \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 LGPL-2.0-or-later \u2502 Non Standard \u2502 UNKNOWN \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 libaio \u2502 LGPL-2.1-or-later \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 libcom_err \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 LGPL-2.0-or-later \u2502 Non Standard \u2502 UNKNOWN \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 tzdata \u2502 Public-Domain \u2502 Non Standard \u2502 UNKNOWN \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Loose File License ( s ) ( license ) =============================== Total: 6 ( UNKNOWN: 4 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Classification \u2502 Severity \u2502 License \u2502 File Location \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 Forbidden \u2502 CRITICAL \u2502 AGPL-3.0 \u2502 /usr/share/grafana/LICENSE \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 Non Standard \u2502 UNKNOWN \u2502 BSD-0-Clause \u2502 /usr/share/grafana/public/build/5069.d6aae9dd11d49c741a80.j- \u2502 \u2502 \u2502 \u2502 \u2502 s.LICENSE.txt \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 /usr/share/grafana/public/build/6444.d6aae9dd11d49c741a80.j- \u2502 \u2502 \u2502 \u2502 \u2502 s.LICENSE.txt \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 /usr/share/grafana/public/build/7889.d6aae9dd11d49c741a80.j- \u2502 \u2502 \u2502 \u2502 \u2502 s.LICENSE.txt \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 /usr/share/grafana/public/build/canvasPanel.d6aae9dd11d49c7- \u2502 \u2502 \u2502 \u2502 \u2502 41a80.js.LICENSE.txt \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"Full scanning"},{"location":"docs/scanner/license/#configuration","text":"Trivy has number of configuration flags for use with license scanning;","title":"Configuration"},{"location":"docs/scanner/license/#ignored-licenses","text":"Trivy license scanning can ignore licenses that are identified to explicitly remove them from the results using the --ignored-licenses flag; $ trivy image --scanners license --ignored-licenses MPL-2.0,MIT --severity HIGH grafana/grafana:latest 2022 -07-13T18:15:28.605Z INFO License scanning is enabled OS Packages ( license ) ===================== Total: 2 ( HIGH: 2 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Package \u2502 License \u2502 Classification \u2502 Severity \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 alpine-baselayout \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 ssl_client \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"Ignored Licenses"},{"location":"docs/scanner/license/#configuring-classifier-confidence-level","text":"You can use the --license-confidence-level flag to adjust the confidence level between 0.0 to 1.0 (default 0.9). For example, when you run the scanner with the default confidence level on SPDX license list data , it is able to detect only 258 licenses. $ trivy fs --scanners license --license-full <path/to/spdx/list/data> 2023 -04-18T10:05:13.601-0700 INFO Full license scanning is enabled Loose File License ( s ) ( license ) =============================== Total: 258 ( UNKNOWN: 70 , LOW: 90 , MEDIUM: 18 , HIGH: 58 , CRITICAL: 22 ) However, by configuring the confidence level to 0.8, the scanner is now able to detect 282 licenses. $ trivy fs --scanners license --license-full --license-confidence-level 0 .8 <path/to/spdx/list/data> 2023 -04-18T10:21:39.637-0700 INFO Full license scanning is enabled Loose File License ( s ) ( license ) =============================== Total: 282 ( UNKNOWN: 81 , LOW: 97 , MEDIUM: 24 , HIGH: 58 , CRITICAL: 22 )","title":"Configuring Classifier Confidence Level"},{"location":"docs/scanner/license/#custom-classification","text":"You can generate the default config by the --generate-default-config flag and customize the license classification. For example, if you want to forbid only AGPL-3.0, you can leave it under forbidden and move other licenses to another classification. $ trivy image --generate-default-config $ vim trivy.yaml license: forbidden: - AGPL-3.0 restricted: - AGPL-1.0 - CC-BY-NC-1.0 - CC-BY-NC-2.0 - CC-BY-NC-2.5 - CC-BY-NC-3.0 - CC-BY-NC-4.0 - CC-BY-NC-ND-1.0 - CC-BY-NC-ND-2.0 - CC-BY-NC-ND-2.5 - CC-BY-NC-ND-3.0 - CC-BY-NC-ND-4.0 - CC-BY-NC-SA-1.0 - CC-BY-NC-SA-2.0 - CC-BY-NC-SA-2.5 - CC-BY-NC-SA-3.0 - CC-BY-NC-SA-4.0 - Commons-Clause - Facebook-2-Clause - Facebook-3-Clause - Facebook-Examples - WTFPL - BCL - CC-BY-ND-1.0 - CC-BY-ND-2.0 - CC-BY-ND-2.5 - CC-BY-ND-3.0 - CC-BY-ND-4.0 - CC-BY-SA-1.0 - CC-BY-SA-2.0 - CC-BY-SA-2.5 - CC-BY-SA-3.0 - CC-BY-SA-4.0 - GPL-1.0 - GPL-2.0 - GPL-2.0-with-autoconf-exception - GPL-2.0-with-bison-exception - GPL-2.0-with-classpath-exception - GPL-2.0-with-font-exception - GPL-2.0-with-GCC-exception - GPL-3.0 - GPL-3.0-with-autoconf-exception - GPL-3.0-with-GCC-exception - LGPL-2.0 - LGPL-2.1 - LGPL-3.0 - NPL-1.0 - NPL-1.1 - OSL-1.0 - OSL-1.1 - OSL-2.0 - OSL-2.1 - OSL-3.0 - QPL-1.0 - Sleepycat reciprocal: - APSL-1.0 - APSL-1.1 - APSL-1.2 - APSL-2.0 - CDDL-1.0 - CDDL-1.1 - CPL-1.0 - EPL-1.0 - EPL-2.0 - FreeImage - IPL-1.0 - MPL-1.0 - MPL-1.1 - MPL-2.0 - Ruby notice: - AFL-1.1 - AFL-1.2 - AFL-2.0 - AFL-2.1 - AFL-3.0 - Apache-1.0 - Apache-1.1 - Apache-2.0 - Artistic-1.0-cl8 - Artistic-1.0-Perl - Artistic-1.0 - Artistic-2.0 - BSL-1.0 - BSD-2-Clause-FreeBSD - BSD-2-Clause-NetBSD - BSD-2-Clause - BSD-3-Clause-Attribution - BSD-3-Clause-Clear - BSD-3-Clause-LBNL - BSD-3-Clause - BSD-4-Clause - BSD-4-Clause-UC - BSD-Protection - CC-BY-1.0 - CC-BY-2.0 - CC-BY-2.5 - CC-BY-3.0 - CC-BY-4.0 - FTL - ISC - ImageMagick - Libpng - Lil-1.0 - Linux-OpenIB - LPL-1.02 - LPL-1.0 - MS-PL - MIT - NCSA - OpenSSL - PHP-3.01 - PHP-3.0 - PIL - Python-2.0 - Python-2.0-complete - PostgreSQL - SGI-B-1.0 - SGI-B-1.1 - SGI-B-2.0 - Unicode-DFS-2015 - Unicode-DFS-2016 - Unicode-TOU - UPL-1.0 - W3C-19980720 - W3C-20150513 - W3C - X11 - Xnet - Zend-2.0 - zlib-acknowledgement - Zlib - ZPL-1.1 - ZPL-2.0 - ZPL-2.1 unencumbered: - CC0-1.0 - Unlicense - 0BSD permissive: []","title":"Custom Classification"},{"location":"docs/scanner/secret/","text":"Secret Scanning Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens. Secret scanning is enabled by default. Trivy will scan every plaintext file, according to builtin rules or configuration. There are plenty of builtin rules: AWS access key GCP service account GitHub personal access token GitLab personal access token Slack access token etc. You can see a full list of built-in rules and built-in allow rules . Tip If your secret is not detected properly, please make sure that your file including the secret is not in the allowed paths . You can disable allow rules via disable-allow-rules . Quick start This section shows how to scan secrets in container image and filesystem. Other subcommands should be the same. Container image Specify an image name. $ trivy image myimage:1.0.0 2022 -04-21T18:56:44.099+0300 INFO Detected OS: alpine 2022 -04-21T18:56:44.099+0300 INFO Detecting Alpine vulnerabilities... 2022 -04-21T18:56:44.101+0300 INFO Number of language-specific files: 0 myimage:1.0.0 ( alpine 3 .15.0 ) ============================= Total: 6 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | busybox | CVE-2022-28391 | CRITICAL | 1 .34.1-r3 | 1 .34.1-r5 | CVE-2022-28391 affecting | | | | | | | package busybox 1 .35.0 | | | | | | | -->avd.aquasec.com/nvd/cve-2022-28391 | +--------------+------------------ | | -------------------+---------------+---------------------------------------+ | ssl_client | CVE-2022-28391 | | 1 .34.1-r3 | 1 .34.1-r5 | CVE-2022-28391 affecting | | | | | | | package busybox 1 .35.0 | | | | | | | -->avd.aquasec.com/nvd/cve-2022-28391 | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ app/secret.sh ( secrets ) ======================= Total: 1 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 1 ) +----------+-------------------+----------+---------+--------------------------------+ | CATEGORY | DESCRIPTION | SEVERITY | LINE NO | MATCH | +----------+-------------------+----------+---------+--------------------------------+ | AWS | AWS Access Key ID | CRITICAL | 10 | export AWS_ACCESS_KEY_ID = ***** | +----------+-------------------+----------+---------+--------------------------------+ Tip Trivy tries to detect a base image and skip those layers for secret scanning. A base image usually contains a lot of files and makes secret scanning much slower. If a secret is not detected properly, you can see base layers with the --debug flag. Filesystem $ trivy fs /path/to/your_project ... ( snip ) ... certs/key.pem ( secrets ) ======================== Total: 1 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 1 , CRITICAL: 0 ) +----------------------+------------------------+----------+---------+---------------------------------+ | CATEGORY | DESCRIPTION | SEVERITY | LINE NO | MATCH | +----------------------+------------------------+----------+---------+---------------------------------+ | AsymmetricPrivateKey | Asymmetric Private Key | HIGH | 1 | -----BEGIN RSA PRIVATE KEY----- | +----------------------+------------------------+----------+---------+---------------------------------+ Tip Your project may have some secrets for testing. You can skip them with --skip-dirs or --skip-files . We would recommend specifying these options so that the secret scanning can be faster if those files don't need to be scanned. Also, you can specify paths to be allowed in a configuration file. See the detail here . Configuration This section describes secret-specific configuration. Other common options are documented here . Trivy has a set of builtin rules for secret scanning, which can be extended or modified by a configuration file. Trivy tries to load trivy-secret.yaml in the current directory by default. If the file doesn't exist, only built-in rules are used. You can customize the config file path via the --secret-config flag. Warning Trivy uses Golang regexp package . To use ^ and $ as symbols of begin and end of line use multi-line mode - (?m) . Custom Rules Trivy allows defining custom rules. rules : - id : rule1 category : general title : Generic Rule severity : HIGH path : .*\\.sh keywords : - secret regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] secret-group-name : secret allow-rules : - id : skip-text description : skip text files path : .*\\.txt id (required) Unique identifier for this rule. category (required) String used for metadata and reporting purposes. title (required) Short human-readable title of the rule. severity (required) How critical this rule is. Allowed values: CRITICAL HIGH MEDIUM LOW regex (required) Golang regular expression used to detect secrets. path (optional) Golang regular expression used to match paths. keywords (optional, recommended) Keywords are used for pre-regex check filtering. Rules that contain keywords will perform a quick string compare check to make sure the keyword(s) are in the content being scanned. Ideally these values should either be part of the identifier or unique strings specific to the rule's regex. It is recommended to define for better performance. allow-rules (optional) Allow rules for a single rule to reduce false positives with known secrets. The details are below. Allow Rules If the detected secret is matched with the specified regex , then that secret will be skipped and not detected. The same logic applies for path . allow-rules can be defined globally and per each rule. The fields are the same. rules : - id : rule1 category : general title : Generic Rule severity : HIGH regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] allow-rules : - id : skip-text description : skip text files path : .*\\.txt allow-rules : - id : social-security-number description : skip social security number regex : 219-09-9999 id (required) Unique identifier for this allow rule. description (optional) Short human-readable description of this allow rule. regex (optional) Golang regular expression used to allow detected secrets. regex or path must be specified. path (optional) Golang regular expression used to allow matched paths. regex or path must be specified. Enable Rules Trivy provides plenty of out-of-box rules and allow rules, but you may not need all of them. In that case, enable-builtin-rules will be helpful. If you just need AWS secret detection, you can enable only relevant rules as shown below. It specifies AWS-related rule IDs in enable-builtin-rules . All other rules are disabled, so the scanning will be much faster. We would strongly recommend using this option if you don't need all rules. You can see a full list of built-in rule IDs and built-in allow rule IDs . enable-builtin-rules : - aws-access-key-id - aws-account-id - aws-secret-access-key Disable Rules Trivy offers built-in rules and allow rules, but you may want to disable some of them. For example, you don't use Slack, so Slack doesn't have to be scanned. You can specify the Slack rule IDs, slack-access-token and slack-web-hook in disable-rules so that those rules will be disabled for less false positives. You should specify either enable-builtin-rules or disable-rules . If they both are specified, disable-rules takes precedence. In case github-pat is specified in enable-builtin-rules and disable-rules , it will be disabled. In addition, there are some allow rules. Markdown files are ignored by default, but you may want to scan markdown files as well. You can disable the allow rule by adding markdown to disable-allow-rules . You can see a full list of built-in rule IDs and built-in allow rule IDs . disable-rules : - slack-access-token - slack-web-hook disable-allow-rules : - markdown Recommendation We would recommend specifying --skip-dirs for faster secret scanning. In container image scanning, Trivy walks the file tree rooted / and scans all the files other than built-in allowed paths . It will take a while if your image contains a lot of files even though Trivy tries to avoid scanning layers from a base image. If you want to make scanning faster, --skip-dirs and --skip-files helps so that Trivy will skip scanning those files and directories. You can see more options here . allow-rules is also helpful. See the allow-rules section. In addition, all the built-in rules are enabled by default, so it takes some time to scan all of them. If you don't need all those rules, you can use enable-builtin-rules or disable-rules in the configuration file. You should use enable-builtin-rules if you need only AWS secret detection, for example. All rules are disabled except for the ones you specify, so it runs very fast. On the other hand, you should use disable-rules if you just want to disable some built-in rules. See the enable-rules and disable-rules sections for the detail. If you don't need secret scanning, you can disable it via the --scanners flag. $ trivy image --scanners vuln alpine:3.15 Example trivy-secret.yaml in the working directory is loaded by default. $ cat trivy-secret.yaml rules : - id : rule1 category : general title : Generic Rule severity : HIGH regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] allow-rules : - id : social-security-number description : skip social security number regex : 219-09-9999 - id : log-dir description : skip log directory path : ^\\/var\\/log\\/ disable-rules : - slack-access-token - slack-web-hook disable-allow-rules : - markdown # The following command automatically loads the above configuration. $ trivy image YOUR_IMAGE Also, you can customize the config file path via --secret-config . $ cat ./secret-config/trivy.yaml rules : - id : rule1 category : general title : Generic Rule severity : HIGH regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] allow-rules : - id : skip-text description : skip text files path : .*\\.txt enable-builtin-rules : - aws-access-key-id - aws-account-id - aws-secret-access-key disable-allow-rules : - usr-dirs # Pass the above config with `--secret-config`. $ trivy fs --secret-config ./secret-config/trivy.yaml /path/to/your_project Credit This feature is inspired by gitleaks .","title":"Secret"},{"location":"docs/scanner/secret/#secret-scanning","text":"Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens. Secret scanning is enabled by default. Trivy will scan every plaintext file, according to builtin rules or configuration. There are plenty of builtin rules: AWS access key GCP service account GitHub personal access token GitLab personal access token Slack access token etc. You can see a full list of built-in rules and built-in allow rules . Tip If your secret is not detected properly, please make sure that your file including the secret is not in the allowed paths . You can disable allow rules via disable-allow-rules .","title":"Secret Scanning"},{"location":"docs/scanner/secret/#quick-start","text":"This section shows how to scan secrets in container image and filesystem. Other subcommands should be the same.","title":"Quick start"},{"location":"docs/scanner/secret/#container-image","text":"Specify an image name. $ trivy image myimage:1.0.0 2022 -04-21T18:56:44.099+0300 INFO Detected OS: alpine 2022 -04-21T18:56:44.099+0300 INFO Detecting Alpine vulnerabilities... 2022 -04-21T18:56:44.101+0300 INFO Number of language-specific files: 0 myimage:1.0.0 ( alpine 3 .15.0 ) ============================= Total: 6 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | busybox | CVE-2022-28391 | CRITICAL | 1 .34.1-r3 | 1 .34.1-r5 | CVE-2022-28391 affecting | | | | | | | package busybox 1 .35.0 | | | | | | | -->avd.aquasec.com/nvd/cve-2022-28391 | +--------------+------------------ | | -------------------+---------------+---------------------------------------+ | ssl_client | CVE-2022-28391 | | 1 .34.1-r3 | 1 .34.1-r5 | CVE-2022-28391 affecting | | | | | | | package busybox 1 .35.0 | | | | | | | -->avd.aquasec.com/nvd/cve-2022-28391 | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ app/secret.sh ( secrets ) ======================= Total: 1 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 1 ) +----------+-------------------+----------+---------+--------------------------------+ | CATEGORY | DESCRIPTION | SEVERITY | LINE NO | MATCH | +----------+-------------------+----------+---------+--------------------------------+ | AWS | AWS Access Key ID | CRITICAL | 10 | export AWS_ACCESS_KEY_ID = ***** | +----------+-------------------+----------+---------+--------------------------------+ Tip Trivy tries to detect a base image and skip those layers for secret scanning. A base image usually contains a lot of files and makes secret scanning much slower. If a secret is not detected properly, you can see base layers with the --debug flag.","title":"Container image"},{"location":"docs/scanner/secret/#filesystem","text":"$ trivy fs /path/to/your_project ... ( snip ) ... certs/key.pem ( secrets ) ======================== Total: 1 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 1 , CRITICAL: 0 ) +----------------------+------------------------+----------+---------+---------------------------------+ | CATEGORY | DESCRIPTION | SEVERITY | LINE NO | MATCH | +----------------------+------------------------+----------+---------+---------------------------------+ | AsymmetricPrivateKey | Asymmetric Private Key | HIGH | 1 | -----BEGIN RSA PRIVATE KEY----- | +----------------------+------------------------+----------+---------+---------------------------------+ Tip Your project may have some secrets for testing. You can skip them with --skip-dirs or --skip-files . We would recommend specifying these options so that the secret scanning can be faster if those files don't need to be scanned. Also, you can specify paths to be allowed in a configuration file. See the detail here .","title":"Filesystem"},{"location":"docs/scanner/secret/#configuration","text":"This section describes secret-specific configuration. Other common options are documented here . Trivy has a set of builtin rules for secret scanning, which can be extended or modified by a configuration file. Trivy tries to load trivy-secret.yaml in the current directory by default. If the file doesn't exist, only built-in rules are used. You can customize the config file path via the --secret-config flag. Warning Trivy uses Golang regexp package . To use ^ and $ as symbols of begin and end of line use multi-line mode - (?m) .","title":"Configuration"},{"location":"docs/scanner/secret/#custom-rules","text":"Trivy allows defining custom rules. rules : - id : rule1 category : general title : Generic Rule severity : HIGH path : .*\\.sh keywords : - secret regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] secret-group-name : secret allow-rules : - id : skip-text description : skip text files path : .*\\.txt id (required) Unique identifier for this rule. category (required) String used for metadata and reporting purposes. title (required) Short human-readable title of the rule. severity (required) How critical this rule is. Allowed values: CRITICAL HIGH MEDIUM LOW regex (required) Golang regular expression used to detect secrets. path (optional) Golang regular expression used to match paths. keywords (optional, recommended) Keywords are used for pre-regex check filtering. Rules that contain keywords will perform a quick string compare check to make sure the keyword(s) are in the content being scanned. Ideally these values should either be part of the identifier or unique strings specific to the rule's regex. It is recommended to define for better performance. allow-rules (optional) Allow rules for a single rule to reduce false positives with known secrets. The details are below.","title":"Custom Rules"},{"location":"docs/scanner/secret/#allow-rules","text":"If the detected secret is matched with the specified regex , then that secret will be skipped and not detected. The same logic applies for path . allow-rules can be defined globally and per each rule. The fields are the same. rules : - id : rule1 category : general title : Generic Rule severity : HIGH regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] allow-rules : - id : skip-text description : skip text files path : .*\\.txt allow-rules : - id : social-security-number description : skip social security number regex : 219-09-9999 id (required) Unique identifier for this allow rule. description (optional) Short human-readable description of this allow rule. regex (optional) Golang regular expression used to allow detected secrets. regex or path must be specified. path (optional) Golang regular expression used to allow matched paths. regex or path must be specified.","title":"Allow Rules"},{"location":"docs/scanner/secret/#enable-rules","text":"Trivy provides plenty of out-of-box rules and allow rules, but you may not need all of them. In that case, enable-builtin-rules will be helpful. If you just need AWS secret detection, you can enable only relevant rules as shown below. It specifies AWS-related rule IDs in enable-builtin-rules . All other rules are disabled, so the scanning will be much faster. We would strongly recommend using this option if you don't need all rules. You can see a full list of built-in rule IDs and built-in allow rule IDs . enable-builtin-rules : - aws-access-key-id - aws-account-id - aws-secret-access-key","title":"Enable Rules"},{"location":"docs/scanner/secret/#disable-rules","text":"Trivy offers built-in rules and allow rules, but you may want to disable some of them. For example, you don't use Slack, so Slack doesn't have to be scanned. You can specify the Slack rule IDs, slack-access-token and slack-web-hook in disable-rules so that those rules will be disabled for less false positives. You should specify either enable-builtin-rules or disable-rules . If they both are specified, disable-rules takes precedence. In case github-pat is specified in enable-builtin-rules and disable-rules , it will be disabled. In addition, there are some allow rules. Markdown files are ignored by default, but you may want to scan markdown files as well. You can disable the allow rule by adding markdown to disable-allow-rules . You can see a full list of built-in rule IDs and built-in allow rule IDs . disable-rules : - slack-access-token - slack-web-hook disable-allow-rules : - markdown","title":"Disable Rules"},{"location":"docs/scanner/secret/#recommendation","text":"We would recommend specifying --skip-dirs for faster secret scanning. In container image scanning, Trivy walks the file tree rooted / and scans all the files other than built-in allowed paths . It will take a while if your image contains a lot of files even though Trivy tries to avoid scanning layers from a base image. If you want to make scanning faster, --skip-dirs and --skip-files helps so that Trivy will skip scanning those files and directories. You can see more options here . allow-rules is also helpful. See the allow-rules section. In addition, all the built-in rules are enabled by default, so it takes some time to scan all of them. If you don't need all those rules, you can use enable-builtin-rules or disable-rules in the configuration file. You should use enable-builtin-rules if you need only AWS secret detection, for example. All rules are disabled except for the ones you specify, so it runs very fast. On the other hand, you should use disable-rules if you just want to disable some built-in rules. See the enable-rules and disable-rules sections for the detail. If you don't need secret scanning, you can disable it via the --scanners flag. $ trivy image --scanners vuln alpine:3.15","title":"Recommendation"},{"location":"docs/scanner/secret/#example","text":"trivy-secret.yaml in the working directory is loaded by default. $ cat trivy-secret.yaml rules : - id : rule1 category : general title : Generic Rule severity : HIGH regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] allow-rules : - id : social-security-number description : skip social security number regex : 219-09-9999 - id : log-dir description : skip log directory path : ^\\/var\\/log\\/ disable-rules : - slack-access-token - slack-web-hook disable-allow-rules : - markdown # The following command automatically loads the above configuration. $ trivy image YOUR_IMAGE Also, you can customize the config file path via --secret-config . $ cat ./secret-config/trivy.yaml rules : - id : rule1 category : general title : Generic Rule severity : HIGH regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] allow-rules : - id : skip-text description : skip text files path : .*\\.txt enable-builtin-rules : - aws-access-key-id - aws-account-id - aws-secret-access-key disable-allow-rules : - usr-dirs # Pass the above config with `--secret-config`. $ trivy fs --secret-config ./secret-config/trivy.yaml /path/to/your_project","title":"Example"},{"location":"docs/scanner/secret/#credit","text":"This feature is inspired by gitleaks .","title":"Credit"},{"location":"docs/scanner/vulnerability/","text":"Vulnerability Scanning Trivy detects known vulnerabilities according to the versions of installed packages. The following packages are supported. OS packages Language-specific packages Trivy also detects known vulnerabilities in Kubernetes components using KBOM (Kubernetes bill of Material) scanning. To learn more, see the documentation for Kubernetes scanning . OS Packages Trivy is capable of automatically detecting installed OS packages when scanning container images, VM images and running hosts. Note Trivy doesn't support third-party/self-compiled packages/binaries, but official packages provided by vendors such as Red Hat and Debian. Supported OS See here for the supported OSes. Data Sources OS Source Arch Linux Vulnerable Issues Alpine Linux secdb Wolfi Linux secdb Chainguard secdb Amazon Linux Amazon Linux Security Center Debian Security Bug Tracker / OVAL Ubuntu Ubuntu CVE Tracker RHEL/CentOS OVAL / Security Data AlmaLinux AlmaLinux Product Errata Rocky Linux Rocky Linux UpdateInfo Oracle Linux OVAL CBL-Mariner OVAL OpenSUSE/SLES CVRF Photon OS Photon Security Advisory Data Source Selection Trivy only consumes security advisories from the sources listed in the above table. As for packages installed from OS package managers ( dpkg , yum , apk , etc.), Trivy uses the advisory database from the appropriate OS vendor . For example: for a python package installed from yum (Amazon linux), Trivy will only get advisories from ALAS . But for a python package installed from another source (e.g. pip ), Trivy will get advisories from the GitLab and GitHub databases. This advisory selection is essential to avoid getting false positives because OS vendors usually backport upstream fixes, and the fixed version can be different from the upstream fixed version. Severity Selection The severity is taken from the selected data source since the severity from vendors is more accurate. Using CVE-2023-0464 as an example, while it is rated as \"HIGH\" in NVD , Red Hat has marked its 'Impact' as \"Low\" . As a result, Trivy will display it as \"Low\". The severity depends on the compile option, the default configuration, etc. NVD doesn't know how the vendor distributes the software. Red Hat evaluates the severity more accurately. That's why Trivy prefers vendor scores over NVD. If the data source does not provide a severity, the severity is determined based on the CVSS score as follows: Base Score Range Severity 0.1-3.9 Low 4.0-6.9 Medium 7.0-8.9 High 9.0-10.0 Critical If the CVSS score is also not provided, it falls back to NVD , and if NVD does not have severity, it will be UNKNOWN. Unfixed Vulnerabilities The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution. To hide unfixed/unfixable vulnerabilities, you can use the --ignore-unfixed flag. Language-specific Packages Supported Languages See here for the supported languages. Data Sources Language Source Commercial Use Delay 1 PHP PHP Security Advisories Database \u2705 - GitHub Advisory Database (Composer) \u2705 - Python GitHub Advisory Database (pip) \u2705 - Open Source Vulnerabilities (PyPI) \u2705 - Ruby Ruby Advisory Database \u2705 - GitHub Advisory Database (RubyGems) \u2705 - Node.js Ecosystem Security Working Group \u2705 - GitHub Advisory Database (npm) \u2705 - Java GitLab Advisories Community \u2705 1 month GitHub Advisory Database (Maven) \u2705 - Go GitHub Advisory Database (Go) \u2705 - Rust Open Source Vulnerabilities (crates.io) \u2705 - .NET GitHub Advisory Database (NuGet) \u2705 - C/C++ GitLab Advisories Community \u2705 1 month Dart GitHub Advisory Database (Pub) \u2705 - Elixir GitHub Advisory Database (Erlang) \u2705 - Swift GitHub Advisory Database (Swift) \u2705 - Kubernetes Trivy can detect vulnerabilities in Kubernetes clusters and components. Data Sources Vendor Source Kubernetes Kubernetes Official CVE feed 1 Database Trivy downloads the vulnerability database every 6 hours. Trivy uses two types of databases for vulnerability detection: Vulnerability Database Java Index Database This page provides detailed information about these databases. Vulnerability Database Trivy utilizes a database containing vulnerability information. This database is built every six hours on GitHub and is distributed via GitHub Container registry (GHCR) . The database is cached and updated as needed. As Trivy updates the database automatically during execution, users don't need to be concerned about it. For CLI flags related to the database, please refer to this page . Private Hosting If you host the database on your own OCI registry, you can specify a different repository with the --db-repository flag. The default is ghcr.io/aquasecurity/trivy-db . $ trivy image --db-repository YOUR_REPO YOUR_IMAGE If authentication is required, it can be configured in the same way as for private images. Please refer to the documentation for more details. Java Index Database This database is only downloaded when scanning JAR files so that Trivy can identify the groupId, artifactId, and version of JAR files. It is built once a day on GitHub and distributed via GitHub Container registry (GHCR) . Like the vulnerability database, it is automatically downloaded and updated when needed, so users don't need to worry about it. Private Hosting If you host the database on your own OCI registry, you can specify a different repository with the --java-db-repository flag. The default is ghcr.io/aquasecurity/trivy-java-db . If authentication is required, you need to run docker login YOUR_REGISTRY . Currently, specifying a username and password is not supported. https://github.com/GoogleContainerTools/distroless \u21a9 \u21a9","title":"Vulnerability"},{"location":"docs/scanner/vulnerability/#vulnerability-scanning","text":"Trivy detects known vulnerabilities according to the versions of installed packages. The following packages are supported. OS packages Language-specific packages Trivy also detects known vulnerabilities in Kubernetes components using KBOM (Kubernetes bill of Material) scanning. To learn more, see the documentation for Kubernetes scanning .","title":"Vulnerability Scanning"},{"location":"docs/scanner/vulnerability/#os-packages","text":"Trivy is capable of automatically detecting installed OS packages when scanning container images, VM images and running hosts. Note Trivy doesn't support third-party/self-compiled packages/binaries, but official packages provided by vendors such as Red Hat and Debian.","title":"OS Packages"},{"location":"docs/scanner/vulnerability/#supported-os","text":"See here for the supported OSes.","title":"Supported OS"},{"location":"docs/scanner/vulnerability/#data-sources","text":"OS Source Arch Linux Vulnerable Issues Alpine Linux secdb Wolfi Linux secdb Chainguard secdb Amazon Linux Amazon Linux Security Center Debian Security Bug Tracker / OVAL Ubuntu Ubuntu CVE Tracker RHEL/CentOS OVAL / Security Data AlmaLinux AlmaLinux Product Errata Rocky Linux Rocky Linux UpdateInfo Oracle Linux OVAL CBL-Mariner OVAL OpenSUSE/SLES CVRF Photon OS Photon Security Advisory","title":"Data Sources"},{"location":"docs/scanner/vulnerability/#data-source-selection","text":"Trivy only consumes security advisories from the sources listed in the above table. As for packages installed from OS package managers ( dpkg , yum , apk , etc.), Trivy uses the advisory database from the appropriate OS vendor . For example: for a python package installed from yum (Amazon linux), Trivy will only get advisories from ALAS . But for a python package installed from another source (e.g. pip ), Trivy will get advisories from the GitLab and GitHub databases. This advisory selection is essential to avoid getting false positives because OS vendors usually backport upstream fixes, and the fixed version can be different from the upstream fixed version.","title":"Data Source Selection"},{"location":"docs/scanner/vulnerability/#severity-selection","text":"The severity is taken from the selected data source since the severity from vendors is more accurate. Using CVE-2023-0464 as an example, while it is rated as \"HIGH\" in NVD , Red Hat has marked its 'Impact' as \"Low\" . As a result, Trivy will display it as \"Low\". The severity depends on the compile option, the default configuration, etc. NVD doesn't know how the vendor distributes the software. Red Hat evaluates the severity more accurately. That's why Trivy prefers vendor scores over NVD. If the data source does not provide a severity, the severity is determined based on the CVSS score as follows: Base Score Range Severity 0.1-3.9 Low 4.0-6.9 Medium 7.0-8.9 High 9.0-10.0 Critical If the CVSS score is also not provided, it falls back to NVD , and if NVD does not have severity, it will be UNKNOWN.","title":"Severity Selection"},{"location":"docs/scanner/vulnerability/#unfixed-vulnerabilities","text":"The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution. To hide unfixed/unfixable vulnerabilities, you can use the --ignore-unfixed flag.","title":"Unfixed Vulnerabilities"},{"location":"docs/scanner/vulnerability/#language-specific-packages","text":"","title":"Language-specific Packages"},{"location":"docs/scanner/vulnerability/#supported-languages","text":"See here for the supported languages.","title":"Supported Languages"},{"location":"docs/scanner/vulnerability/#data-sources_1","text":"Language Source Commercial Use Delay 1 PHP PHP Security Advisories Database \u2705 - GitHub Advisory Database (Composer) \u2705 - Python GitHub Advisory Database (pip) \u2705 - Open Source Vulnerabilities (PyPI) \u2705 - Ruby Ruby Advisory Database \u2705 - GitHub Advisory Database (RubyGems) \u2705 - Node.js Ecosystem Security Working Group \u2705 - GitHub Advisory Database (npm) \u2705 - Java GitLab Advisories Community \u2705 1 month GitHub Advisory Database (Maven) \u2705 - Go GitHub Advisory Database (Go) \u2705 - Rust Open Source Vulnerabilities (crates.io) \u2705 - .NET GitHub Advisory Database (NuGet) \u2705 - C/C++ GitLab Advisories Community \u2705 1 month Dart GitHub Advisory Database (Pub) \u2705 - Elixir GitHub Advisory Database (Erlang) \u2705 - Swift GitHub Advisory Database (Swift) \u2705 -","title":"Data Sources"},{"location":"docs/scanner/vulnerability/#kubernetes","text":"Trivy can detect vulnerabilities in Kubernetes clusters and components.","title":"Kubernetes"},{"location":"docs/scanner/vulnerability/#data-sources_2","text":"Vendor Source Kubernetes Kubernetes Official CVE feed 1","title":"Data Sources"},{"location":"docs/scanner/vulnerability/#database","text":"Trivy downloads the vulnerability database every 6 hours. Trivy uses two types of databases for vulnerability detection: Vulnerability Database Java Index Database This page provides detailed information about these databases.","title":"Database"},{"location":"docs/scanner/vulnerability/#vulnerability-database","text":"Trivy utilizes a database containing vulnerability information. This database is built every six hours on GitHub and is distributed via GitHub Container registry (GHCR) . The database is cached and updated as needed. As Trivy updates the database automatically during execution, users don't need to be concerned about it. For CLI flags related to the database, please refer to this page .","title":"Vulnerability Database"},{"location":"docs/scanner/vulnerability/#private-hosting","text":"If you host the database on your own OCI registry, you can specify a different repository with the --db-repository flag. The default is ghcr.io/aquasecurity/trivy-db . $ trivy image --db-repository YOUR_REPO YOUR_IMAGE If authentication is required, it can be configured in the same way as for private images. Please refer to the documentation for more details.","title":"Private Hosting"},{"location":"docs/scanner/vulnerability/#java-index-database","text":"This database is only downloaded when scanning JAR files so that Trivy can identify the groupId, artifactId, and version of JAR files. It is built once a day on GitHub and distributed via GitHub Container registry (GHCR) . Like the vulnerability database, it is automatically downloaded and updated when needed, so users don't need to worry about it.","title":"Java Index Database"},{"location":"docs/scanner/vulnerability/#private-hosting_1","text":"If you host the database on your own OCI registry, you can specify a different repository with the --java-db-repository flag. The default is ghcr.io/aquasecurity/trivy-java-db . If authentication is required, you need to run docker login YOUR_REGISTRY . Currently, specifying a username and password is not supported. https://github.com/GoogleContainerTools/distroless \u21a9 \u21a9","title":"Private Hosting"},{"location":"docs/scanner/misconfiguration/","text":"Misconfiguration Scanning Trivy provides built-in policies to detect configuration issues in popular Infrastructure as Code files, such as: Docker, Kubernetes, Terraform, CloudFormation, and more. In addition to built-in policies, you can write your own custom policies, as you can see here . Quick start Simply specify a directory containing IaC files such as Terraform, CloudFormation, Azure ARM templates, Helm Charts and Dockerfile. $ trivy config [ YOUR_IaC_DIRECTORY ] Example $ ls build/ Dockerfile $ trivy config ./build 2022-05-16T13:29:29.952+0100 INFO Detected config files: 1 Dockerfile (dockerfile) ======================= Tests: 23 (SUCCESSES: 22, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) MEDIUM: Specify a tag in the 'FROM' statement for image 'alpine' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated. See https://avd.aquasec.com/misconfig/ds001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:1 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 [ FROM alpine:latest \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 You can also enable misconfiguration detection in container image, filesystem and git repository scanning via --scanners config . $ trivy image --scanners config IMAGE_NAME $ trivy fs --scanners config /path/to/dir Note Misconfiguration detection is not enabled by default in image , fs and repo subcommands. Unlike the config subcommand, image , fs and repo subcommands can also scan for vulnerabilities and secrets at the same time. You can specify --scanners vuln,config,secret to enable vulnerability and secret detection as well as misconfiguration detection. Example $ ls myapp/ Dockerfile Pipfile.lock $ trivy fs --scanners vuln,config,secret --severity HIGH,CRITICAL myapp/ 2022 -05-16T13:42:21.440+0100 INFO Number of language-specific files: 1 2022 -05-16T13:42:21.440+0100 INFO Detecting pipenv vulnerabilities... 2022 -05-16T13:42:21.440+0100 INFO Detected config files: 1 Pipfile.lock ( pipenv ) ===================== Total: 1 ( HIGH: 1 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 httplib2 \u2502 CVE-2021-21240 \u2502 HIGH \u2502 0 .12.1 \u2502 0 .19.0 \u2502 python-httplib2: Regular expression denial of service via \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 malicious header \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-21240 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Dockerfile ( dockerfile ) ======================= Tests: 17 ( SUCCESSES: 16 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 1 , CRITICAL: 0 ) HIGH: Last USER command in Dockerfile should not be 'root' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:3 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 3 [ USER root \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 In the above example, Trivy detected vulnerabilities of Python dependencies and misconfigurations in Dockerfile. Type detection The specified directory can contain mixed types of IaC files. Trivy automatically detects config types and applies relevant policies. For example, the following example holds IaC files for Terraform, CloudFormation, Kubernetes, Helm Charts, and Dockerfile in the same directory. $ ls iac/ Dockerfile deployment.yaml main.tf mysql-8.8.26.tar $ trivy conf --severity HIGH,CRITICAL ./iac Result 2022-06-06T11:01:21.142+0100 INFO Detected config files: 8 Dockerfile (dockerfile) Tests: 21 (SUCCESSES: 20, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (MEDIUM: 0, HIGH: 1, CRITICAL: 0) HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml (kubernetes) Tests: 20 (SUCCESSES: 15, FAILURES: 5, EXCEPTIONS: 0) Failures: 5 (MEDIUM: 4, HIGH: 1, CRITICAL: 0) MEDIUM: Container 'hello-kubernetes' of Deployment 'hello-kubernetes' should set 'securityContext.allowPrivilegeEscalation' to false \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node. See https://avd.aquasec.com/misconfig/ksv001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:16-19 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 16 \u250c - name: hello-kubernetes 17 \u2502 image: hello-kubernetes:1.5 18 \u2502 ports: 19 \u2514 - containerPort: 8080 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 HIGH: Deployment 'hello-kubernetes' should not specify '/var/run/docker.socker' in 'spec.template.volumes.hostPath.path' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Mounting docker.sock from the host can give the container full root access to the host. See https://avd.aquasec.com/misconfig/ksv006 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:6-29 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 6 \u250c replicas: 3 7 \u2502 selector: 8 \u2502 matchLabels: 9 \u2502 app: hello-kubernetes 10 \u2502 template: 11 \u2502 metadata: 12 \u2502 labels: 13 \u2502 app: hello-kubernetes 14 \u2514 spec: .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Container 'hello-kubernetes' of Deployment 'hello-kubernetes' should set 'securityContext.runAsNonRoot' to true \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges. See https://avd.aquasec.com/misconfig/ksv012 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:16-19 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 16 \u250c - name: hello-kubernetes 17 \u2502 image: hello-kubernetes:1.5 18 \u2502 ports: 19 \u2514 - containerPort: 8080 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Deployment 'hello-kubernetes' should not set 'spec.template.volumes.hostPath' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 HostPath volumes must be forbidden. See https://avd.aquasec.com/misconfig/ksv023 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:6-29 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 6 \u250c replicas: 3 7 \u2502 selector: 8 \u2502 matchLabels: 9 \u2502 app: hello-kubernetes 10 \u2502 template: 11 \u2502 metadata: 12 \u2502 labels: 13 \u2502 app: hello-kubernetes 14 \u2514 spec: .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Deployment 'hello-kubernetes' should set 'securityContext.sysctl' to the allowed values \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed 'safe' subset. A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated from other Pods or processes on the same Node. See https://avd.aquasec.com/misconfig/ksv026 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:6-29 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 6 \u250c replicas: 3 7 \u2502 selector: 8 \u2502 matchLabels: 9 \u2502 app: hello-kubernetes 10 \u2502 template: 11 \u2502 metadata: 12 \u2502 labels: 13 \u2502 app: hello-kubernetes 14 \u2514 spec: .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 mysql-8.8.26.tar:templates/primary/statefulset.yaml (helm) Tests: 20 (SUCCESSES: 18, FAILURES: 2, EXCEPTIONS: 0) Failures: 2 (MEDIUM: 2, HIGH: 0, CRITICAL: 0) MEDIUM: Container 'mysql' of StatefulSet 'mysql' should set 'securityContext.allowPrivilegeEscalation' to false \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node. See https://avd.aquasec.com/misconfig/ksv001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 mysql-8.8.26.tar:templates/primary/statefulset.yaml:56-130 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 56 \u250c - name: mysql 57 \u2502 image: docker.io/bitnami/mysql:8.0.28-debian-10-r23 58 \u2502 imagePullPolicy: \"IfNotPresent\" 59 \u2502 securityContext: 60 \u2502 runAsUser: 1001 61 \u2502 env: 62 \u2502 - name: BITNAMI_DEBUG 63 \u2502 value: \"false\" 64 \u2514 - name: MYSQL_ROOT_PASSWORD .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Container 'mysql' of StatefulSet 'mysql' should set 'securityContext.runAsNonRoot' to true \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges. See https://avd.aquasec.com/misconfig/ksv012 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 mysql-8.8.26.tar:templates/primary/statefulset.yaml:56-130 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 56 \u250c - name: mysql 57 \u2502 image: docker.io/bitnami/mysql:8.0.28-debian-10-r23 58 \u2502 imagePullPolicy: \"IfNotPresent\" 59 \u2502 securityContext: 60 \u2502 runAsUser: 1001 61 \u2502 env: 62 \u2502 - name: BITNAMI_DEBUG 63 \u2502 value: \"false\" 64 \u2514 - name: MYSQL_ROOT_PASSWORD .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 You can see the config type next to each file name. Example Dockerfile ( dockerfile ) ======================= Tests: 23 ( SUCCESSES: 22 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 1 , CRITICAL: 0 ) ... deployment.yaml ( kubernetes ) ============================ Tests: 28 ( SUCCESSES: 15 , FAILURES: 13 , EXCEPTIONS: 0 ) Failures: 13 ( MEDIUM: 4 , HIGH: 1 , CRITICAL: 0 ) ... main.tf ( terraform ) =================== Tests: 23 ( SUCCESSES: 14 , FAILURES: 9 , EXCEPTIONS: 0 ) Failures: 9 ( HIGH: 6 , CRITICAL: 1 ) ... bucket.yaml ( cloudformation ) ============================ Tests: 9 ( SUCCESSES: 3 , FAILURES: 6 , EXCEPTIONS: 0 ) Failures: 6 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 2 , HIGH: 4 , CRITICAL: 0 ) ... mysql-8.8.26.tar:templates/primary/statefulset.yaml ( helm ) ========================================================== Tests: 20 ( SUCCESSES: 18 , FAILURES: 2 , EXCEPTIONS: 0 ) Failures: 2 ( MEDIUM: 2 , HIGH: 0 , CRITICAL: 0 ) Configuration This section describes misconfiguration-specific configuration. Other common options are documented here . Pass custom policies You can pass policy files or directories including your custom policies through --policy option. This can be repeated for specifying multiple files or directories. cd examplex/misconf/ trivy conf --policy custom-policy/policy --policy combine/policy --policy policy.rego --namespaces user misconf/mixed For more details, see Custom Policies . Tip You also need to specify --namespaces option. Pass custom data You can pass directories including your custom data through --data option. This can be repeated for specifying multiple directories. cd examples/misconf/custom-data trivy conf --policy ./policy --data ./data --namespaces user ./configs For more details, see Custom Data . Pass namespaces By default, Trivy evaluates policies defined in builtin.* . If you want to evaluate custom policies in other packages, you have to specify package prefixes through --namespaces option. This can be repeated for specifying multiple packages. trivy conf --policy ./policy --namespaces main --namespaces user ./configs","title":"Overview"},{"location":"docs/scanner/misconfiguration/#misconfiguration-scanning","text":"Trivy provides built-in policies to detect configuration issues in popular Infrastructure as Code files, such as: Docker, Kubernetes, Terraform, CloudFormation, and more. In addition to built-in policies, you can write your own custom policies, as you can see here .","title":"Misconfiguration Scanning"},{"location":"docs/scanner/misconfiguration/#quick-start","text":"Simply specify a directory containing IaC files such as Terraform, CloudFormation, Azure ARM templates, Helm Charts and Dockerfile. $ trivy config [ YOUR_IaC_DIRECTORY ] Example $ ls build/ Dockerfile $ trivy config ./build 2022-05-16T13:29:29.952+0100 INFO Detected config files: 1 Dockerfile (dockerfile) ======================= Tests: 23 (SUCCESSES: 22, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) MEDIUM: Specify a tag in the 'FROM' statement for image 'alpine' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated. See https://avd.aquasec.com/misconfig/ds001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:1 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 [ FROM alpine:latest \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 You can also enable misconfiguration detection in container image, filesystem and git repository scanning via --scanners config . $ trivy image --scanners config IMAGE_NAME $ trivy fs --scanners config /path/to/dir Note Misconfiguration detection is not enabled by default in image , fs and repo subcommands. Unlike the config subcommand, image , fs and repo subcommands can also scan for vulnerabilities and secrets at the same time. You can specify --scanners vuln,config,secret to enable vulnerability and secret detection as well as misconfiguration detection. Example $ ls myapp/ Dockerfile Pipfile.lock $ trivy fs --scanners vuln,config,secret --severity HIGH,CRITICAL myapp/ 2022 -05-16T13:42:21.440+0100 INFO Number of language-specific files: 1 2022 -05-16T13:42:21.440+0100 INFO Detecting pipenv vulnerabilities... 2022 -05-16T13:42:21.440+0100 INFO Detected config files: 1 Pipfile.lock ( pipenv ) ===================== Total: 1 ( HIGH: 1 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 httplib2 \u2502 CVE-2021-21240 \u2502 HIGH \u2502 0 .12.1 \u2502 0 .19.0 \u2502 python-httplib2: Regular expression denial of service via \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 malicious header \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-21240 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Dockerfile ( dockerfile ) ======================= Tests: 17 ( SUCCESSES: 16 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 1 , CRITICAL: 0 ) HIGH: Last USER command in Dockerfile should not be 'root' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:3 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 3 [ USER root \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 In the above example, Trivy detected vulnerabilities of Python dependencies and misconfigurations in Dockerfile.","title":"Quick start"},{"location":"docs/scanner/misconfiguration/#type-detection","text":"The specified directory can contain mixed types of IaC files. Trivy automatically detects config types and applies relevant policies. For example, the following example holds IaC files for Terraform, CloudFormation, Kubernetes, Helm Charts, and Dockerfile in the same directory. $ ls iac/ Dockerfile deployment.yaml main.tf mysql-8.8.26.tar $ trivy conf --severity HIGH,CRITICAL ./iac Result 2022-06-06T11:01:21.142+0100 INFO Detected config files: 8 Dockerfile (dockerfile) Tests: 21 (SUCCESSES: 20, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (MEDIUM: 0, HIGH: 1, CRITICAL: 0) HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml (kubernetes) Tests: 20 (SUCCESSES: 15, FAILURES: 5, EXCEPTIONS: 0) Failures: 5 (MEDIUM: 4, HIGH: 1, CRITICAL: 0) MEDIUM: Container 'hello-kubernetes' of Deployment 'hello-kubernetes' should set 'securityContext.allowPrivilegeEscalation' to false \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node. See https://avd.aquasec.com/misconfig/ksv001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:16-19 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 16 \u250c - name: hello-kubernetes 17 \u2502 image: hello-kubernetes:1.5 18 \u2502 ports: 19 \u2514 - containerPort: 8080 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 HIGH: Deployment 'hello-kubernetes' should not specify '/var/run/docker.socker' in 'spec.template.volumes.hostPath.path' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Mounting docker.sock from the host can give the container full root access to the host. See https://avd.aquasec.com/misconfig/ksv006 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:6-29 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 6 \u250c replicas: 3 7 \u2502 selector: 8 \u2502 matchLabels: 9 \u2502 app: hello-kubernetes 10 \u2502 template: 11 \u2502 metadata: 12 \u2502 labels: 13 \u2502 app: hello-kubernetes 14 \u2514 spec: .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Container 'hello-kubernetes' of Deployment 'hello-kubernetes' should set 'securityContext.runAsNonRoot' to true \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges. See https://avd.aquasec.com/misconfig/ksv012 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:16-19 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 16 \u250c - name: hello-kubernetes 17 \u2502 image: hello-kubernetes:1.5 18 \u2502 ports: 19 \u2514 - containerPort: 8080 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Deployment 'hello-kubernetes' should not set 'spec.template.volumes.hostPath' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 HostPath volumes must be forbidden. See https://avd.aquasec.com/misconfig/ksv023 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:6-29 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 6 \u250c replicas: 3 7 \u2502 selector: 8 \u2502 matchLabels: 9 \u2502 app: hello-kubernetes 10 \u2502 template: 11 \u2502 metadata: 12 \u2502 labels: 13 \u2502 app: hello-kubernetes 14 \u2514 spec: .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Deployment 'hello-kubernetes' should set 'securityContext.sysctl' to the allowed values \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed 'safe' subset. A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated from other Pods or processes on the same Node. See https://avd.aquasec.com/misconfig/ksv026 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:6-29 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 6 \u250c replicas: 3 7 \u2502 selector: 8 \u2502 matchLabels: 9 \u2502 app: hello-kubernetes 10 \u2502 template: 11 \u2502 metadata: 12 \u2502 labels: 13 \u2502 app: hello-kubernetes 14 \u2514 spec: .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 mysql-8.8.26.tar:templates/primary/statefulset.yaml (helm) Tests: 20 (SUCCESSES: 18, FAILURES: 2, EXCEPTIONS: 0) Failures: 2 (MEDIUM: 2, HIGH: 0, CRITICAL: 0) MEDIUM: Container 'mysql' of StatefulSet 'mysql' should set 'securityContext.allowPrivilegeEscalation' to false \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node. See https://avd.aquasec.com/misconfig/ksv001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 mysql-8.8.26.tar:templates/primary/statefulset.yaml:56-130 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 56 \u250c - name: mysql 57 \u2502 image: docker.io/bitnami/mysql:8.0.28-debian-10-r23 58 \u2502 imagePullPolicy: \"IfNotPresent\" 59 \u2502 securityContext: 60 \u2502 runAsUser: 1001 61 \u2502 env: 62 \u2502 - name: BITNAMI_DEBUG 63 \u2502 value: \"false\" 64 \u2514 - name: MYSQL_ROOT_PASSWORD .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Container 'mysql' of StatefulSet 'mysql' should set 'securityContext.runAsNonRoot' to true \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges. See https://avd.aquasec.com/misconfig/ksv012 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 mysql-8.8.26.tar:templates/primary/statefulset.yaml:56-130 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 56 \u250c - name: mysql 57 \u2502 image: docker.io/bitnami/mysql:8.0.28-debian-10-r23 58 \u2502 imagePullPolicy: \"IfNotPresent\" 59 \u2502 securityContext: 60 \u2502 runAsUser: 1001 61 \u2502 env: 62 \u2502 - name: BITNAMI_DEBUG 63 \u2502 value: \"false\" 64 \u2514 - name: MYSQL_ROOT_PASSWORD .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 You can see the config type next to each file name. Example Dockerfile ( dockerfile ) ======================= Tests: 23 ( SUCCESSES: 22 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 1 , CRITICAL: 0 ) ... deployment.yaml ( kubernetes ) ============================ Tests: 28 ( SUCCESSES: 15 , FAILURES: 13 , EXCEPTIONS: 0 ) Failures: 13 ( MEDIUM: 4 , HIGH: 1 , CRITICAL: 0 ) ... main.tf ( terraform ) =================== Tests: 23 ( SUCCESSES: 14 , FAILURES: 9 , EXCEPTIONS: 0 ) Failures: 9 ( HIGH: 6 , CRITICAL: 1 ) ... bucket.yaml ( cloudformation ) ============================ Tests: 9 ( SUCCESSES: 3 , FAILURES: 6 , EXCEPTIONS: 0 ) Failures: 6 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 2 , HIGH: 4 , CRITICAL: 0 ) ... mysql-8.8.26.tar:templates/primary/statefulset.yaml ( helm ) ========================================================== Tests: 20 ( SUCCESSES: 18 , FAILURES: 2 , EXCEPTIONS: 0 ) Failures: 2 ( MEDIUM: 2 , HIGH: 0 , CRITICAL: 0 )","title":"Type detection"},{"location":"docs/scanner/misconfiguration/#configuration","text":"This section describes misconfiguration-specific configuration. Other common options are documented here .","title":"Configuration"},{"location":"docs/scanner/misconfiguration/#pass-custom-policies","text":"You can pass policy files or directories including your custom policies through --policy option. This can be repeated for specifying multiple files or directories. cd examplex/misconf/ trivy conf --policy custom-policy/policy --policy combine/policy --policy policy.rego --namespaces user misconf/mixed For more details, see Custom Policies . Tip You also need to specify --namespaces option.","title":"Pass custom policies"},{"location":"docs/scanner/misconfiguration/#pass-custom-data","text":"You can pass directories including your custom data through --data option. This can be repeated for specifying multiple directories. cd examples/misconf/custom-data trivy conf --policy ./policy --data ./data --namespaces user ./configs For more details, see Custom Data .","title":"Pass custom data"},{"location":"docs/scanner/misconfiguration/#pass-namespaces","text":"By default, Trivy evaluates policies defined in builtin.* . If you want to evaluate custom policies in other packages, you have to specify package prefixes through --namespaces option. This can be repeated for specifying multiple packages. trivy conf --policy ./policy --namespaces main --namespaces user ./configs","title":"Pass namespaces"},{"location":"docs/scanner/misconfiguration/custom/","text":"Custom Policies Overview You can write custom policies in Rego . Once you finish writing custom policies, you can pass the policy files or the directory where those policies are stored with --policy option. trivy conf --policy /path/to/policy.rego --policy /path/to/custom_policies --namespaces user /path/to/config_dir As for --namespaces option, the detail is described as below. File formats If a file name matches the following file patterns, Trivy will parse the file and pass it as input to your Rego policy. File format File pattern JSON *.json YAML *.yaml and *.yml Dockerfile Dockerfile , Dockerfile.* , and *.Dockerfile Containerfile Containerfile , Containerfile.* , and *.Containerfile Terraform *.tf and *.tf.json Configuration languages In the above general file formats, Trivy automatically identifies the following types of configuration files: CloudFormation (JSON/YAML) Kubernetes (JSON/YAML) Helm (YAML) Terraform Plan (JSON) This is useful for filtering inputs, as described below. Rego format A single package must contain only one policy. Example # METADATA # title: Deployment not allowed # description: Deployments are not allowed because of some reasons. # schemas: # - input: schema[\"kubernetes\"] # custom: # id: ID001 # severity: LOW # input: # selector: # - type: kubernetes package user.kubernetes.ID001 deny[res] { input.kind == \"Deployment\" msg := sprintf(\"Found deployment '%s' but deployments are not allowed\", [input.metadata.name]) res := result.new(msg, input.kind) } In this example, ID001 \"Deployment not allowed\" is defined under user.kubernetes.ID001 . If you add a new custom policy, it must be defined under a new package like user.kubernetes.ID002 . Policy structure # METADATA (optional) SHOULD be defined for clarity since these values will be displayed in the scan results custom.input SHOULD be set to indicate the input type the policy should be applied to. See list of available types package (required) MUST follow the Rego's specification MUST be unique per policy SHOULD include policy id for uniqueness MAY include the group name such as kubernetes for clarity Group name has no effect on policy evaluation deny (required) SHOULD be deny or start with deny_ Although warn , warn_* , violation , violation_ also work for compatibility, deny is recommended as severity can be defined in __rego_metadata__ . SHOULD return ONE OF: The result of a call to result.new(msg, cause) . The msg is a string describing the issue occurrence, and the cause is the property/object where the issue occurred. Providing this allows Trivy to ascertain line numbers and highlight code in the output. A string denoting the detected issue Although object with msg field is accepted, other fields are dropped and string is recommended if result.new() is not utilised. e.g. {\"msg\": \"deny message\", \"details\": \"something\"} Package A package name must be unique per policy. Example package user.kubernetes.ID001 By default, only builtin.* packages will be evaluated. If you define custom packages, you have to specify the package prefix via --namespaces option. trivy conf --policy /path/to/custom_policies --namespaces user /path/to/config_dir In this case, user.* will be evaluated. Any package prefixes such as main and user are allowed. Metadata Metadata helps enrich Trivy's scan results with useful information. The annotation format is described in the OPA documentation . Trivy supports extra fields in the custom section as described below. Example # METADATA # title: Deployment not allowed # description: Deployments are not allowed because of some reasons. # custom: # id: ID001 # severity: LOW # input: # selector: # - type: kubernetes All fields are optional. The schemas field should be used to enable policy validation using a built-in schema. The schema that will be used is based on the input document type. It is recommended to use this to ensure your policies are correct and do not reference incorrect properties/values. Field name Allowed values Default value In table In JSON title Any characters N/A description Any characters schemas.input schema[\"kubernetes\"] , schema[\"dockerfile\"] , schema[\"cloud\"] (applied to all input types) custom.id Any characters N/A custom.severity LOW , MEDIUM , HIGH , CRITICAL UNKNOWN custom.recommended_actions Any characters custom.input.selector.type Any item(s) in this list url Any characters Some fields are displayed in scan results. k.yaml ( kubernetes ) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Tests: 32 ( SUCCESSES: 31 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( UNKNOWN: 0 , LOW: 1 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 ) LOW: Found deployment 'my-deployment' but deployments are not allowed \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Deployments are not allowed because of some reasons. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 k.yaml:1-2 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 \u250c apiVersion: v1 2 \u2514 kind: Deployment \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Input You can specify input format via the custom.input annotation. Example # METADATA # custom: # input: # combine: false # selector: # - type: kubernetes combine (boolean) The details are here . selector (array) This option filters the input by file format or configuration language. In the above example, Trivy passes only Kubernetes files to this policy. Even if a Dockerfile exists in the specified directory, it will not be passed to the policy as input. Possible values for input types are: dockerfile (Dockerfile) kubernetes (Kubernetes YAML/JSON) rbac (Kubernetes RBAC YAML/JSON) cloud (Cloud format, as defined by defsec - this is used for Terraform, CloudFormation, and Cloud/AWS scanning) yaml (Generic YAML) json (Generic JSON) toml (Generic TOML) When configuration languages such as Kubernetes are not identified, file formats such as JSON will be used as type . When a configuration language is identified, it will overwrite type . Example pod.yaml including Kubernetes Pod will be handled as kubernetes , not yaml . type is overwritten by kubernetes from yaml . type accepts kubernetes , dockerfile , cloudformation , terraform , terraformplan , json , or yaml . Schemas See here for the detail.","title":"Overview"},{"location":"docs/scanner/misconfiguration/custom/#custom-policies","text":"","title":"Custom Policies"},{"location":"docs/scanner/misconfiguration/custom/#overview","text":"You can write custom policies in Rego . Once you finish writing custom policies, you can pass the policy files or the directory where those policies are stored with --policy option. trivy conf --policy /path/to/policy.rego --policy /path/to/custom_policies --namespaces user /path/to/config_dir As for --namespaces option, the detail is described as below.","title":"Overview"},{"location":"docs/scanner/misconfiguration/custom/#file-formats","text":"If a file name matches the following file patterns, Trivy will parse the file and pass it as input to your Rego policy. File format File pattern JSON *.json YAML *.yaml and *.yml Dockerfile Dockerfile , Dockerfile.* , and *.Dockerfile Containerfile Containerfile , Containerfile.* , and *.Containerfile Terraform *.tf and *.tf.json","title":"File formats"},{"location":"docs/scanner/misconfiguration/custom/#configuration-languages","text":"In the above general file formats, Trivy automatically identifies the following types of configuration files: CloudFormation (JSON/YAML) Kubernetes (JSON/YAML) Helm (YAML) Terraform Plan (JSON) This is useful for filtering inputs, as described below.","title":"Configuration languages"},{"location":"docs/scanner/misconfiguration/custom/#rego-format","text":"A single package must contain only one policy. Example # METADATA # title: Deployment not allowed # description: Deployments are not allowed because of some reasons. # schemas: # - input: schema[\"kubernetes\"] # custom: # id: ID001 # severity: LOW # input: # selector: # - type: kubernetes package user.kubernetes.ID001 deny[res] { input.kind == \"Deployment\" msg := sprintf(\"Found deployment '%s' but deployments are not allowed\", [input.metadata.name]) res := result.new(msg, input.kind) } In this example, ID001 \"Deployment not allowed\" is defined under user.kubernetes.ID001 . If you add a new custom policy, it must be defined under a new package like user.kubernetes.ID002 .","title":"Rego format"},{"location":"docs/scanner/misconfiguration/custom/#policy-structure","text":"# METADATA (optional) SHOULD be defined for clarity since these values will be displayed in the scan results custom.input SHOULD be set to indicate the input type the policy should be applied to. See list of available types package (required) MUST follow the Rego's specification MUST be unique per policy SHOULD include policy id for uniqueness MAY include the group name such as kubernetes for clarity Group name has no effect on policy evaluation deny (required) SHOULD be deny or start with deny_ Although warn , warn_* , violation , violation_ also work for compatibility, deny is recommended as severity can be defined in __rego_metadata__ . SHOULD return ONE OF: The result of a call to result.new(msg, cause) . The msg is a string describing the issue occurrence, and the cause is the property/object where the issue occurred. Providing this allows Trivy to ascertain line numbers and highlight code in the output. A string denoting the detected issue Although object with msg field is accepted, other fields are dropped and string is recommended if result.new() is not utilised. e.g. {\"msg\": \"deny message\", \"details\": \"something\"}","title":"Policy structure"},{"location":"docs/scanner/misconfiguration/custom/#package","text":"A package name must be unique per policy. Example package user.kubernetes.ID001 By default, only builtin.* packages will be evaluated. If you define custom packages, you have to specify the package prefix via --namespaces option. trivy conf --policy /path/to/custom_policies --namespaces user /path/to/config_dir In this case, user.* will be evaluated. Any package prefixes such as main and user are allowed.","title":"Package"},{"location":"docs/scanner/misconfiguration/custom/#metadata","text":"Metadata helps enrich Trivy's scan results with useful information. The annotation format is described in the OPA documentation . Trivy supports extra fields in the custom section as described below. Example # METADATA # title: Deployment not allowed # description: Deployments are not allowed because of some reasons. # custom: # id: ID001 # severity: LOW # input: # selector: # - type: kubernetes All fields are optional. The schemas field should be used to enable policy validation using a built-in schema. The schema that will be used is based on the input document type. It is recommended to use this to ensure your policies are correct and do not reference incorrect properties/values. Field name Allowed values Default value In table In JSON title Any characters N/A description Any characters schemas.input schema[\"kubernetes\"] , schema[\"dockerfile\"] , schema[\"cloud\"] (applied to all input types) custom.id Any characters N/A custom.severity LOW , MEDIUM , HIGH , CRITICAL UNKNOWN custom.recommended_actions Any characters custom.input.selector.type Any item(s) in this list url Any characters Some fields are displayed in scan results. k.yaml ( kubernetes ) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Tests: 32 ( SUCCESSES: 31 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( UNKNOWN: 0 , LOW: 1 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 ) LOW: Found deployment 'my-deployment' but deployments are not allowed \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Deployments are not allowed because of some reasons. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 k.yaml:1-2 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 \u250c apiVersion: v1 2 \u2514 kind: Deployment \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500","title":"Metadata"},{"location":"docs/scanner/misconfiguration/custom/#input","text":"You can specify input format via the custom.input annotation. Example # METADATA # custom: # input: # combine: false # selector: # - type: kubernetes combine (boolean) The details are here . selector (array) This option filters the input by file format or configuration language. In the above example, Trivy passes only Kubernetes files to this policy. Even if a Dockerfile exists in the specified directory, it will not be passed to the policy as input. Possible values for input types are: dockerfile (Dockerfile) kubernetes (Kubernetes YAML/JSON) rbac (Kubernetes RBAC YAML/JSON) cloud (Cloud format, as defined by defsec - this is used for Terraform, CloudFormation, and Cloud/AWS scanning) yaml (Generic YAML) json (Generic JSON) toml (Generic TOML) When configuration languages such as Kubernetes are not identified, file formats such as JSON will be used as type . When a configuration language is identified, it will overwrite type . Example pod.yaml including Kubernetes Pod will be handled as kubernetes , not yaml . type is overwritten by kubernetes from yaml . type accepts kubernetes , dockerfile , cloudformation , terraform , terraformplan , json , or yaml .","title":"Input"},{"location":"docs/scanner/misconfiguration/custom/#schemas","text":"See here for the detail.","title":"Schemas"},{"location":"docs/scanner/misconfiguration/custom/combine/","text":"Combined input Overview Trivy usually scans each configuration file individually. Sometimes it might be useful to compare values from different configuration files simultaneously. When combine is set to true, all config files under the specified directory are combined into one input data structure. Example __rego_input__ := { \"combine\": false, } In \"combine\" mode, the input document becomes an array, where each element is an object with two fields: \"path\": \"path/to/file\" : the relative file path of the respective file \"contents\": ... : the parsed content of the respective file Now you can ensure that duplicate values match across the entirety of your configuration files. Return value In \"combine\" mode, the deny entrypoint must return an object with two keys filepath (required) the relative file path of the file being evaluated msg (required) the message describing an issue Example deny[res] { resource := input[i].contents ... some logic ... res := { \"filepath\": input[i].path, \"msg\": \"something bad\", } }","title":"Combine"},{"location":"docs/scanner/misconfiguration/custom/combine/#combined-input","text":"","title":"Combined input"},{"location":"docs/scanner/misconfiguration/custom/combine/#overview","text":"Trivy usually scans each configuration file individually. Sometimes it might be useful to compare values from different configuration files simultaneously. When combine is set to true, all config files under the specified directory are combined into one input data structure. Example __rego_input__ := { \"combine\": false, } In \"combine\" mode, the input document becomes an array, where each element is an object with two fields: \"path\": \"path/to/file\" : the relative file path of the respective file \"contents\": ... : the parsed content of the respective file Now you can ensure that duplicate values match across the entirety of your configuration files.","title":"Overview"},{"location":"docs/scanner/misconfiguration/custom/combine/#return-value","text":"In \"combine\" mode, the deny entrypoint must return an object with two keys filepath (required) the relative file path of the file being evaluated msg (required) the message describing an issue Example deny[res] { resource := input[i].contents ... some logic ... res := { \"filepath\": input[i].path, \"msg\": \"something bad\", } }","title":"Return value"},{"location":"docs/scanner/misconfiguration/custom/data/","text":"Custom Data Custom policies may require additional data in order to determine an answer. For example, an allowed list of resources that can be created. Instead of hardcoding this information inside your policy, Trivy allows passing paths to data files with the --data flag. Given the following yaml file: $ cd examples/misconf/custom-data $ cat data/ports.yaml [ ~/src/github.com/aquasecurity/trivy/examples/misconf/custom-data ] services: ports: - \"20\" - \"20/tcp\" - \"20/udp\" - \"23\" - \"23/tcp\" This can be imported into your policy: import data.services ports := services.ports Then, you need to pass data paths through --data option. Trivy recursively searches the specified paths for JSON ( *.json ) and YAML ( *.yaml ) files. $ trivy conf --policy ./policy --data data --namespaces user ./configs","title":"Data"},{"location":"docs/scanner/misconfiguration/custom/data/#custom-data","text":"Custom policies may require additional data in order to determine an answer. For example, an allowed list of resources that can be created. Instead of hardcoding this information inside your policy, Trivy allows passing paths to data files with the --data flag. Given the following yaml file: $ cd examples/misconf/custom-data $ cat data/ports.yaml [ ~/src/github.com/aquasecurity/trivy/examples/misconf/custom-data ] services: ports: - \"20\" - \"20/tcp\" - \"20/udp\" - \"23\" - \"23/tcp\" This can be imported into your policy: import data.services ports := services.ports Then, you need to pass data paths through --data option. Trivy recursively searches the specified paths for JSON ( *.json ) and YAML ( *.yaml ) files. $ trivy conf --policy ./policy --data data --namespaces user ./configs","title":"Custom Data"},{"location":"docs/scanner/misconfiguration/custom/debug/","text":"Debugging policies When working on more complex queries (or when learning Rego), it's useful to see exactly how the policy is applied. For this purpose you can use the --trace flag. This will output a large trace from Open Policy Agent like the following: Tip Only failed policies show traces. If you want to debug a passed policy, you need to make it fail on purpose. $ trivy conf --trace configs/ 2022 -05-16T13:47:58.853+0100 INFO Detected config files: 1 Dockerfile ( dockerfile ) ======================= Tests: 23 ( SUCCESSES: 21 , FAILURES: 2 , EXCEPTIONS: 0 ) Failures: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 1 , HIGH: 1 , CRITICAL: 0 ) MEDIUM: Specify a tag in the 'FROM' statement for image 'alpine' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated. See https://avd.aquasec.com/misconfig/ds001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:1 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 [ FROM alpine:latest \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 HIGH: Last USER command in Dockerfile should not be 'root' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:3 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 3 [ USER root \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 ID: DS001 File: Dockerfile Namespace: builtin.dockerfile.DS001 Query: data.builtin.dockerfile.DS001.deny Message: Specify a tag in the 'FROM' statement for image 'alpine' TRACE Enter data.builtin.dockerfile.DS001.deny = _ TRACE | Eval data.builtin.dockerfile.DS001.deny = _ TRACE | Index data.builtin.dockerfile.DS001.deny ( matched 1 rule ) TRACE | Enter data.builtin.dockerfile.DS001.deny TRACE | | Eval output = data.builtin.dockerfile.DS001.fail_latest [ _ ] TRACE | | Index data.builtin.dockerfile.DS001.fail_latest ( matched 1 rule ) TRACE | | Enter data.builtin.dockerfile.DS001.fail_latest TRACE | | | Eval output = data.builtin.dockerfile.DS001.image_tags [ _ ] TRACE | | | Index data.builtin.dockerfile.DS001.image_tags ( matched 2 rules ) TRACE | | | Enter data.builtin.dockerfile.DS001.image_tags TRACE | | | | Eval from = data.lib.docker.from [ _ ] TRACE | | | | Index data.lib.docker.from ( matched 1 rule ) TRACE | | | | Enter data.lib.docker.from TRACE | | | | | Eval instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"from\" TRACE | | | | | Exit data.lib.docker.from TRACE | | | | Redo data.lib.docker.from TRACE | | | | | Redo instruction.Cmd = \"from\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"from\" TRACE | | | | | Fail instruction.Cmd = \"from\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"from\" TRACE | | | | | Fail instruction.Cmd = \"from\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | Eval name = from.Value [ 0 ] TRACE | | | | Eval not startswith ( name, \" $ \" ) TRACE | | | | Enter startswith ( name, \" $ \" ) TRACE | | | | | Eval startswith ( name, \" $ \" ) TRACE | | | | | Fail startswith ( name, \" $ \" ) TRACE | | | | Eval data.builtin.dockerfile.DS001.parse_tag ( name, __local505__ ) TRACE | | | | Index data.builtin.dockerfile.DS001.parse_tag ( matched 2 rules ) TRACE | | | | Enter data.builtin.dockerfile.DS001.parse_tag TRACE | | | | | Eval split ( name, \":\" , __local504__ ) TRACE | | | | | Eval [ img, tag ] = __local504__ TRACE | | | | | Exit data.builtin.dockerfile.DS001.parse_tag TRACE | | | | Eval [ img, tag ] = __local505__ TRACE | | | | Eval output = { \"cmd\" : from, \"img\" : img, \"tag\" : tag } TRACE | | | | Exit data.builtin.dockerfile.DS001.image_tags TRACE | | | Redo data.builtin.dockerfile.DS001.image_tags TRACE | | | | Redo output = { \"cmd\" : from, \"img\" : img, \"tag\" : tag } TRACE | | | | Redo [ img, tag ] = __local505__ TRACE | | | | Redo data.builtin.dockerfile.DS001.parse_tag ( name, __local505__ ) TRACE | | | | Redo data.builtin.dockerfile.DS001.parse_tag TRACE | | | | | Redo [ img, tag ] = __local504__ TRACE | | | | | Redo split ( name, \":\" , __local504__ ) TRACE | | | | Enter data.builtin.dockerfile.DS001.parse_tag TRACE | | | | | Eval tag = \"latest\" TRACE | | | | | Eval not contains ( img, \":\" ) TRACE | | | | | Enter contains ( img, \":\" ) TRACE | | | | | | Eval contains ( img, \":\" ) TRACE | | | | | | Exit contains ( img, \":\" ) TRACE | | | | | Redo contains ( img, \":\" ) TRACE | | | | | | Redo contains ( img, \":\" ) TRACE | | | | | Fail not contains ( img, \":\" ) TRACE | | | | | Redo tag = \"latest\" TRACE | | | | Redo name = from.Value [ 0 ] TRACE | | | | Redo from = data.lib.docker.from [ _ ] TRACE | | | Enter data.builtin.dockerfile.DS001.image_tags TRACE | | | | Eval from = data.lib.docker.from [ i ] TRACE | | | | Index data.lib.docker.from ( matched 1 rule ) TRACE | | | | Eval name = from.Value [ 0 ] TRACE | | | | Eval cmd_obj = input.stages [ j ][ k ] TRACE | | | | Eval possibilities = { \"arg\" , \"env\" } TRACE | | | | Eval cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Fail cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Redo possibilities = { \"arg\" , \"env\" } TRACE | | | | Redo cmd_obj = input.stages [ j ][ k ] TRACE | | | | Eval possibilities = { \"arg\" , \"env\" } TRACE | | | | Eval cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Fail cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Redo possibilities = { \"arg\" , \"env\" } TRACE | | | | Redo cmd_obj = input.stages [ j ][ k ] TRACE | | | | Eval possibilities = { \"arg\" , \"env\" } TRACE | | | | Eval cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Fail cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Redo possibilities = { \"arg\" , \"env\" } TRACE | | | | Redo cmd_obj = input.stages [ j ][ k ] TRACE | | | | Redo name = from.Value [ 0 ] TRACE | | | | Redo from = data.lib.docker.from [ i ] TRACE | | | Eval __local752__ = output.img TRACE | | | Eval neq ( __local752__, \"scratch\" ) TRACE | | | Eval __local753__ = output.img TRACE | | | Eval not data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | Enter data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | | Eval data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | | Index data.builtin.dockerfile.DS001.is_alias ( matched 1 rule, early exit ) TRACE | | | | Enter data.builtin.dockerfile.DS001.is_alias TRACE | | | | | Eval img = data.builtin.dockerfile.DS001.get_aliases [ _ ] TRACE | | | | | Index data.builtin.dockerfile.DS001.get_aliases ( matched 1 rule ) TRACE | | | | | Enter data.builtin.dockerfile.DS001.get_aliases TRACE | | | | | | Eval from_cmd = data.lib.docker.from [ _ ] TRACE | | | | | | Index data.lib.docker.from ( matched 1 rule ) TRACE | | | | | | Eval __local749__ = from_cmd.Value TRACE | | | | | | Eval data.builtin.dockerfile.DS001.get_alias ( __local749__, __local503__ ) TRACE | | | | | | Index data.builtin.dockerfile.DS001.get_alias ( matched 1 rule ) TRACE | | | | | | Enter data.builtin.dockerfile.DS001.get_alias TRACE | | | | | | | Eval __local748__ = values [ i ] TRACE | | | | | | | Eval lower ( __local748__, __local501__ ) TRACE | | | | | | | Eval \"as\" = __local501__ TRACE | | | | | | | Fail \"as\" = __local501__ TRACE | | | | | | | Redo lower ( __local748__, __local501__ ) TRACE | | | | | | | Redo __local748__ = values [ i ] TRACE | | | | | | Fail data.builtin.dockerfile.DS001.get_alias ( __local749__, __local503__ ) TRACE | | | | | | Redo __local749__ = from_cmd.Value TRACE | | | | | | Redo from_cmd = data.lib.docker.from [ _ ] TRACE | | | | | Fail img = data.builtin.dockerfile.DS001.get_aliases [ _ ] TRACE | | | | Fail data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | Eval output.tag = \"latest\" TRACE | | | Exit data.builtin.dockerfile.DS001.fail_latest TRACE | | Redo data.builtin.dockerfile.DS001.fail_latest TRACE | | | Redo output.tag = \"latest\" TRACE | | | Redo __local753__ = output.img TRACE | | | Redo neq ( __local752__, \"scratch\" ) TRACE | | | Redo __local752__ = output.img TRACE | | | Redo output = data.builtin.dockerfile.DS001.image_tags [ _ ] TRACE | | Eval __local754__ = output.img TRACE | | Eval sprintf ( \"Specify a tag in the 'FROM' statement for image '%s'\" , [ __local754__ ] , __local509__ ) TRACE | | Eval msg = __local509__ TRACE | | Eval __local755__ = output.cmd TRACE | | Eval data.lib.docker.result ( msg, __local755__, __local510__ ) TRACE | | Index data.lib.docker.result ( matched 1 rule ) TRACE | | Enter data.lib.docker.result TRACE | | | Eval object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | | Eval object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Eval object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Eval result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Exit data.lib.docker.result TRACE | | Eval res = __local510__ TRACE | | Exit data.builtin.dockerfile.DS001.deny TRACE | Redo data.builtin.dockerfile.DS001.deny TRACE | | Redo res = __local510__ TRACE | | Redo data.lib.docker.result ( msg, __local755__, __local510__ ) TRACE | | Redo data.lib.docker.result TRACE | | | Redo result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Redo object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Redo object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Redo object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | Redo __local755__ = output.cmd TRACE | | Redo msg = __local509__ TRACE | | Redo sprintf ( \"Specify a tag in the 'FROM' statement for image '%s'\" , [ __local754__ ] , __local509__ ) TRACE | | Redo __local754__ = output.img TRACE | | Redo output = data.builtin.dockerfile.DS001.fail_latest [ _ ] TRACE | Exit data.builtin.dockerfile.DS001.deny = _ TRACE Redo data.builtin.dockerfile.DS001.deny = _ TRACE | Redo data.builtin.dockerfile.DS001.deny = _ TRACE ID: DS002 File: Dockerfile Namespace: builtin.dockerfile.DS002 Query: data.builtin.dockerfile.DS002.deny Message: Last USER command in Dockerfile should not be 'root' TRACE Enter data.builtin.dockerfile.DS002.deny = _ TRACE | Eval data.builtin.dockerfile.DS002.deny = _ TRACE | Index data.builtin.dockerfile.DS002.deny ( matched 2 rules ) TRACE | Enter data.builtin.dockerfile.DS002.deny TRACE | | Eval data.builtin.dockerfile.DS002.fail_user_count TRACE | | Index data.builtin.dockerfile.DS002.fail_user_count ( matched 1 rule, early exit ) TRACE | | Enter data.builtin.dockerfile.DS002.fail_user_count TRACE | | | Eval __local771__ = data.builtin.dockerfile.DS002.get_user TRACE | | | Index data.builtin.dockerfile.DS002.get_user ( matched 1 rule ) TRACE | | | Enter data.builtin.dockerfile.DS002.get_user TRACE | | | | Eval user = data.lib.docker.user [ _ ] TRACE | | | | Index data.lib.docker.user ( matched 1 rule ) TRACE | | | | Enter data.lib.docker.user TRACE | | | | | Eval instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"user\" TRACE | | | | | Fail instruction.Cmd = \"user\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"user\" TRACE | | | | | Exit data.lib.docker.user TRACE | | | | Redo data.lib.docker.user TRACE | | | | | Redo instruction.Cmd = \"user\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"user\" TRACE | | | | | Fail instruction.Cmd = \"user\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | Eval username = user.Value [ _ ] TRACE | | | | Exit data.builtin.dockerfile.DS002.get_user TRACE | | | Redo data.builtin.dockerfile.DS002.get_user TRACE | | | | Redo username = user.Value [ _ ] TRACE | | | | Redo user = data.lib.docker.user [ _ ] TRACE | | | Eval count ( __local771__, __local536__ ) TRACE | | | Eval lt ( __local536__, 1 ) TRACE | | | Fail lt ( __local536__, 1 ) TRACE | | | Redo count ( __local771__, __local536__ ) TRACE | | | Redo __local771__ = data.builtin.dockerfile.DS002.get_user TRACE | | Fail data.builtin.dockerfile.DS002.fail_user_count TRACE | Enter data.builtin.dockerfile.DS002.deny TRACE | | Eval cmd = data.builtin.dockerfile.DS002.fail_last_user_root [ _ ] TRACE | | Index data.builtin.dockerfile.DS002.fail_last_user_root ( matched 1 rule ) TRACE | | Enter data.builtin.dockerfile.DS002.fail_last_user_root TRACE | | | Eval stage_users = data.lib.docker.stage_user [ _ ] TRACE | | | Index data.lib.docker.stage_user ( matched 1 rule ) TRACE | | | Enter data.lib.docker.stage_user TRACE | | | | Eval stage = input.stages [ stage_name ] TRACE | | | | Eval users = [ cmd | cmd = stage [ _ ] ; cmd.Cmd = \"user\" ] TRACE | | | | Enter cmd = stage [ _ ] ; cmd.Cmd = \"user\" TRACE | | | | | Eval cmd = stage [ _ ] TRACE | | | | | Eval cmd.Cmd = \"user\" TRACE | | | | | Fail cmd.Cmd = \"user\" TRACE | | | | | Redo cmd = stage [ _ ] TRACE | | | | | Eval cmd.Cmd = \"user\" TRACE | | | | | Exit cmd = stage [ _ ] ; cmd.Cmd = \"user\" TRACE | | | | Redo cmd = stage [ _ ] ; cmd.Cmd = \"user\" TRACE | | | | | Redo cmd.Cmd = \"user\" TRACE | | | | | Redo cmd = stage [ _ ] TRACE | | | | | Eval cmd.Cmd = \"user\" TRACE | | | | | Fail cmd.Cmd = \"user\" TRACE | | | | | Redo cmd = stage [ _ ] TRACE | | | | Exit data.lib.docker.stage_user TRACE | | | Redo data.lib.docker.stage_user TRACE | | | | Redo users = [ cmd | cmd = stage [ _ ] ; cmd.Cmd = \"user\" ] TRACE | | | | Redo stage = input.stages [ stage_name ] TRACE | | | Eval count ( stage_users, __local537__ ) TRACE | | | Eval len = __local537__ TRACE | | | Eval minus ( len, 1 , __local538__ ) TRACE | | | Eval last = stage_users [ __local538__ ] TRACE | | | Eval user = last.Value [ 0 ] TRACE | | | Eval user = \"root\" TRACE | | | Exit data.builtin.dockerfile.DS002.fail_last_user_root TRACE | | Redo data.builtin.dockerfile.DS002.fail_last_user_root TRACE | | | Redo user = \"root\" TRACE | | | Redo user = last.Value [ 0 ] TRACE | | | Redo last = stage_users [ __local538__ ] TRACE | | | Redo minus ( len, 1 , __local538__ ) TRACE | | | Redo len = __local537__ TRACE | | | Redo count ( stage_users, __local537__ ) TRACE | | | Redo stage_users = data.lib.docker.stage_user [ _ ] TRACE | | Eval msg = \"Last USER command in Dockerfile should not be 'root'\" TRACE | | Eval data.lib.docker.result ( msg, cmd, __local540__ ) TRACE | | Index data.lib.docker.result ( matched 1 rule ) TRACE | | Enter data.lib.docker.result TRACE | | | Eval object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | | Eval object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Eval object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Eval result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Exit data.lib.docker.result TRACE | | Eval res = __local540__ TRACE | | Exit data.builtin.dockerfile.DS002.deny TRACE | Redo data.builtin.dockerfile.DS002.deny TRACE | | Redo res = __local540__ TRACE | | Redo data.lib.docker.result ( msg, cmd, __local540__ ) TRACE | | Redo data.lib.docker.result TRACE | | | Redo result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Redo object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Redo object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Redo object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | Redo msg = \"Last USER command in Dockerfile should not be 'root'\" TRACE | | Redo cmd = data.builtin.dockerfile.DS002.fail_last_user_root [ _ ] TRACE | Exit data.builtin.dockerfile.DS002.deny = _ TRACE Redo data.builtin.dockerfile.DS002.deny = _ TRACE | Redo data.builtin.dockerfile.DS002.deny = _ TRACE","title":"Debugging Policies"},{"location":"docs/scanner/misconfiguration/custom/debug/#debugging-policies","text":"When working on more complex queries (or when learning Rego), it's useful to see exactly how the policy is applied. For this purpose you can use the --trace flag. This will output a large trace from Open Policy Agent like the following: Tip Only failed policies show traces. If you want to debug a passed policy, you need to make it fail on purpose. $ trivy conf --trace configs/ 2022 -05-16T13:47:58.853+0100 INFO Detected config files: 1 Dockerfile ( dockerfile ) ======================= Tests: 23 ( SUCCESSES: 21 , FAILURES: 2 , EXCEPTIONS: 0 ) Failures: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 1 , HIGH: 1 , CRITICAL: 0 ) MEDIUM: Specify a tag in the 'FROM' statement for image 'alpine' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated. See https://avd.aquasec.com/misconfig/ds001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:1 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 [ FROM alpine:latest \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 HIGH: Last USER command in Dockerfile should not be 'root' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:3 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 3 [ USER root \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 ID: DS001 File: Dockerfile Namespace: builtin.dockerfile.DS001 Query: data.builtin.dockerfile.DS001.deny Message: Specify a tag in the 'FROM' statement for image 'alpine' TRACE Enter data.builtin.dockerfile.DS001.deny = _ TRACE | Eval data.builtin.dockerfile.DS001.deny = _ TRACE | Index data.builtin.dockerfile.DS001.deny ( matched 1 rule ) TRACE | Enter data.builtin.dockerfile.DS001.deny TRACE | | Eval output = data.builtin.dockerfile.DS001.fail_latest [ _ ] TRACE | | Index data.builtin.dockerfile.DS001.fail_latest ( matched 1 rule ) TRACE | | Enter data.builtin.dockerfile.DS001.fail_latest TRACE | | | Eval output = data.builtin.dockerfile.DS001.image_tags [ _ ] TRACE | | | Index data.builtin.dockerfile.DS001.image_tags ( matched 2 rules ) TRACE | | | Enter data.builtin.dockerfile.DS001.image_tags TRACE | | | | Eval from = data.lib.docker.from [ _ ] TRACE | | | | Index data.lib.docker.from ( matched 1 rule ) TRACE | | | | Enter data.lib.docker.from TRACE | | | | | Eval instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"from\" TRACE | | | | | Exit data.lib.docker.from TRACE | | | | Redo data.lib.docker.from TRACE | | | | | Redo instruction.Cmd = \"from\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"from\" TRACE | | | | | Fail instruction.Cmd = \"from\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"from\" TRACE | | | | | Fail instruction.Cmd = \"from\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | Eval name = from.Value [ 0 ] TRACE | | | | Eval not startswith ( name, \" $ \" ) TRACE | | | | Enter startswith ( name, \" $ \" ) TRACE | | | | | Eval startswith ( name, \" $ \" ) TRACE | | | | | Fail startswith ( name, \" $ \" ) TRACE | | | | Eval data.builtin.dockerfile.DS001.parse_tag ( name, __local505__ ) TRACE | | | | Index data.builtin.dockerfile.DS001.parse_tag ( matched 2 rules ) TRACE | | | | Enter data.builtin.dockerfile.DS001.parse_tag TRACE | | | | | Eval split ( name, \":\" , __local504__ ) TRACE | | | | | Eval [ img, tag ] = __local504__ TRACE | | | | | Exit data.builtin.dockerfile.DS001.parse_tag TRACE | | | | Eval [ img, tag ] = __local505__ TRACE | | | | Eval output = { \"cmd\" : from, \"img\" : img, \"tag\" : tag } TRACE | | | | Exit data.builtin.dockerfile.DS001.image_tags TRACE | | | Redo data.builtin.dockerfile.DS001.image_tags TRACE | | | | Redo output = { \"cmd\" : from, \"img\" : img, \"tag\" : tag } TRACE | | | | Redo [ img, tag ] = __local505__ TRACE | | | | Redo data.builtin.dockerfile.DS001.parse_tag ( name, __local505__ ) TRACE | | | | Redo data.builtin.dockerfile.DS001.parse_tag TRACE | | | | | Redo [ img, tag ] = __local504__ TRACE | | | | | Redo split ( name, \":\" , __local504__ ) TRACE | | | | Enter data.builtin.dockerfile.DS001.parse_tag TRACE | | | | | Eval tag = \"latest\" TRACE | | | | | Eval not contains ( img, \":\" ) TRACE | | | | | Enter contains ( img, \":\" ) TRACE | | | | | | Eval contains ( img, \":\" ) TRACE | | | | | | Exit contains ( img, \":\" ) TRACE | | | | | Redo contains ( img, \":\" ) TRACE | | | | | | Redo contains ( img, \":\" ) TRACE | | | | | Fail not contains ( img, \":\" ) TRACE | | | | | Redo tag = \"latest\" TRACE | | | | Redo name = from.Value [ 0 ] TRACE | | | | Redo from = data.lib.docker.from [ _ ] TRACE | | | Enter data.builtin.dockerfile.DS001.image_tags TRACE | | | | Eval from = data.lib.docker.from [ i ] TRACE | | | | Index data.lib.docker.from ( matched 1 rule ) TRACE | | | | Eval name = from.Value [ 0 ] TRACE | | | | Eval cmd_obj = input.stages [ j ][ k ] TRACE | | | | Eval possibilities = { \"arg\" , \"env\" } TRACE | | | | Eval cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Fail cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Redo possibilities = { \"arg\" , \"env\" } TRACE | | | | Redo cmd_obj = input.stages [ j ][ k ] TRACE | | | | Eval possibilities = { \"arg\" , \"env\" } TRACE | | | | Eval cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Fail cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Redo possibilities = { \"arg\" , \"env\" } TRACE | | | | Redo cmd_obj = input.stages [ j ][ k ] TRACE | | | | Eval possibilities = { \"arg\" , \"env\" } TRACE | | | | Eval cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Fail cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Redo possibilities = { \"arg\" , \"env\" } TRACE | | | | Redo cmd_obj = input.stages [ j ][ k ] TRACE | | | | Redo name = from.Value [ 0 ] TRACE | | | | Redo from = data.lib.docker.from [ i ] TRACE | | | Eval __local752__ = output.img TRACE | | | Eval neq ( __local752__, \"scratch\" ) TRACE | | | Eval __local753__ = output.img TRACE | | | Eval not data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | Enter data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | | Eval data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | | Index data.builtin.dockerfile.DS001.is_alias ( matched 1 rule, early exit ) TRACE | | | | Enter data.builtin.dockerfile.DS001.is_alias TRACE | | | | | Eval img = data.builtin.dockerfile.DS001.get_aliases [ _ ] TRACE | | | | | Index data.builtin.dockerfile.DS001.get_aliases ( matched 1 rule ) TRACE | | | | | Enter data.builtin.dockerfile.DS001.get_aliases TRACE | | | | | | Eval from_cmd = data.lib.docker.from [ _ ] TRACE | | | | | | Index data.lib.docker.from ( matched 1 rule ) TRACE | | | | | | Eval __local749__ = from_cmd.Value TRACE | | | | | | Eval data.builtin.dockerfile.DS001.get_alias ( __local749__, __local503__ ) TRACE | | | | | | Index data.builtin.dockerfile.DS001.get_alias ( matched 1 rule ) TRACE | | | | | | Enter data.builtin.dockerfile.DS001.get_alias TRACE | | | | | | | Eval __local748__ = values [ i ] TRACE | | | | | | | Eval lower ( __local748__, __local501__ ) TRACE | | | | | | | Eval \"as\" = __local501__ TRACE | | | | | | | Fail \"as\" = __local501__ TRACE | | | | | | | Redo lower ( __local748__, __local501__ ) TRACE | | | | | | | Redo __local748__ = values [ i ] TRACE | | | | | | Fail data.builtin.dockerfile.DS001.get_alias ( __local749__, __local503__ ) TRACE | | | | | | Redo __local749__ = from_cmd.Value TRACE | | | | | | Redo from_cmd = data.lib.docker.from [ _ ] TRACE | | | | | Fail img = data.builtin.dockerfile.DS001.get_aliases [ _ ] TRACE | | | | Fail data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | Eval output.tag = \"latest\" TRACE | | | Exit data.builtin.dockerfile.DS001.fail_latest TRACE | | Redo data.builtin.dockerfile.DS001.fail_latest TRACE | | | Redo output.tag = \"latest\" TRACE | | | Redo __local753__ = output.img TRACE | | | Redo neq ( __local752__, \"scratch\" ) TRACE | | | Redo __local752__ = output.img TRACE | | | Redo output = data.builtin.dockerfile.DS001.image_tags [ _ ] TRACE | | Eval __local754__ = output.img TRACE | | Eval sprintf ( \"Specify a tag in the 'FROM' statement for image '%s'\" , [ __local754__ ] , __local509__ ) TRACE | | Eval msg = __local509__ TRACE | | Eval __local755__ = output.cmd TRACE | | Eval data.lib.docker.result ( msg, __local755__, __local510__ ) TRACE | | Index data.lib.docker.result ( matched 1 rule ) TRACE | | Enter data.lib.docker.result TRACE | | | Eval object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | | Eval object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Eval object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Eval result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Exit data.lib.docker.result TRACE | | Eval res = __local510__ TRACE | | Exit data.builtin.dockerfile.DS001.deny TRACE | Redo data.builtin.dockerfile.DS001.deny TRACE | | Redo res = __local510__ TRACE | | Redo data.lib.docker.result ( msg, __local755__, __local510__ ) TRACE | | Redo data.lib.docker.result TRACE | | | Redo result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Redo object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Redo object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Redo object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | Redo __local755__ = output.cmd TRACE | | Redo msg = __local509__ TRACE | | Redo sprintf ( \"Specify a tag in the 'FROM' statement for image '%s'\" , [ __local754__ ] , __local509__ ) TRACE | | Redo __local754__ = output.img TRACE | | Redo output = data.builtin.dockerfile.DS001.fail_latest [ _ ] TRACE | Exit data.builtin.dockerfile.DS001.deny = _ TRACE Redo data.builtin.dockerfile.DS001.deny = _ TRACE | Redo data.builtin.dockerfile.DS001.deny = _ TRACE ID: DS002 File: Dockerfile Namespace: builtin.dockerfile.DS002 Query: data.builtin.dockerfile.DS002.deny Message: Last USER command in Dockerfile should not be 'root' TRACE Enter data.builtin.dockerfile.DS002.deny = _ TRACE | Eval data.builtin.dockerfile.DS002.deny = _ TRACE | Index data.builtin.dockerfile.DS002.deny ( matched 2 rules ) TRACE | Enter data.builtin.dockerfile.DS002.deny TRACE | | Eval data.builtin.dockerfile.DS002.fail_user_count TRACE | | Index data.builtin.dockerfile.DS002.fail_user_count ( matched 1 rule, early exit ) TRACE | | Enter data.builtin.dockerfile.DS002.fail_user_count TRACE | | | Eval __local771__ = data.builtin.dockerfile.DS002.get_user TRACE | | | Index data.builtin.dockerfile.DS002.get_user ( matched 1 rule ) TRACE | | | Enter data.builtin.dockerfile.DS002.get_user TRACE | | | | Eval user = data.lib.docker.user [ _ ] TRACE | | | | Index data.lib.docker.user ( matched 1 rule ) TRACE | | | | Enter data.lib.docker.user TRACE | | | | | Eval instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"user\" TRACE | | | | | Fail instruction.Cmd = \"user\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"user\" TRACE | | | | | Exit data.lib.docker.user TRACE | | | | Redo data.lib.docker.user TRACE | | | | | Redo instruction.Cmd = \"user\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"user\" TRACE | | | | | Fail instruction.Cmd = \"user\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | Eval username = user.Value [ _ ] TRACE | | | | Exit data.builtin.dockerfile.DS002.get_user TRACE | | | Redo data.builtin.dockerfile.DS002.get_user TRACE | | | | Redo username = user.Value [ _ ] TRACE | | | | Redo user = data.lib.docker.user [ _ ] TRACE | | | Eval count ( __local771__, __local536__ ) TRACE | | | Eval lt ( __local536__, 1 ) TRACE | | | Fail lt ( __local536__, 1 ) TRACE | | | Redo count ( __local771__, __local536__ ) TRACE | | | Redo __local771__ = data.builtin.dockerfile.DS002.get_user TRACE | | Fail data.builtin.dockerfile.DS002.fail_user_count TRACE | Enter data.builtin.dockerfile.DS002.deny TRACE | | Eval cmd = data.builtin.dockerfile.DS002.fail_last_user_root [ _ ] TRACE | | Index data.builtin.dockerfile.DS002.fail_last_user_root ( matched 1 rule ) TRACE | | Enter data.builtin.dockerfile.DS002.fail_last_user_root TRACE | | | Eval stage_users = data.lib.docker.stage_user [ _ ] TRACE | | | Index data.lib.docker.stage_user ( matched 1 rule ) TRACE | | | Enter data.lib.docker.stage_user TRACE | | | | Eval stage = input.stages [ stage_name ] TRACE | | | | Eval users = [ cmd | cmd = stage [ _ ] ; cmd.Cmd = \"user\" ] TRACE | | | | Enter cmd = stage [ _ ] ; cmd.Cmd = \"user\" TRACE | | | | | Eval cmd = stage [ _ ] TRACE | | | | | Eval cmd.Cmd = \"user\" TRACE | | | | | Fail cmd.Cmd = \"user\" TRACE | | | | | Redo cmd = stage [ _ ] TRACE | | | | | Eval cmd.Cmd = \"user\" TRACE | | | | | Exit cmd = stage [ _ ] ; cmd.Cmd = \"user\" TRACE | | | | Redo cmd = stage [ _ ] ; cmd.Cmd = \"user\" TRACE | | | | | Redo cmd.Cmd = \"user\" TRACE | | | | | Redo cmd = stage [ _ ] TRACE | | | | | Eval cmd.Cmd = \"user\" TRACE | | | | | Fail cmd.Cmd = \"user\" TRACE | | | | | Redo cmd = stage [ _ ] TRACE | | | | Exit data.lib.docker.stage_user TRACE | | | Redo data.lib.docker.stage_user TRACE | | | | Redo users = [ cmd | cmd = stage [ _ ] ; cmd.Cmd = \"user\" ] TRACE | | | | Redo stage = input.stages [ stage_name ] TRACE | | | Eval count ( stage_users, __local537__ ) TRACE | | | Eval len = __local537__ TRACE | | | Eval minus ( len, 1 , __local538__ ) TRACE | | | Eval last = stage_users [ __local538__ ] TRACE | | | Eval user = last.Value [ 0 ] TRACE | | | Eval user = \"root\" TRACE | | | Exit data.builtin.dockerfile.DS002.fail_last_user_root TRACE | | Redo data.builtin.dockerfile.DS002.fail_last_user_root TRACE | | | Redo user = \"root\" TRACE | | | Redo user = last.Value [ 0 ] TRACE | | | Redo last = stage_users [ __local538__ ] TRACE | | | Redo minus ( len, 1 , __local538__ ) TRACE | | | Redo len = __local537__ TRACE | | | Redo count ( stage_users, __local537__ ) TRACE | | | Redo stage_users = data.lib.docker.stage_user [ _ ] TRACE | | Eval msg = \"Last USER command in Dockerfile should not be 'root'\" TRACE | | Eval data.lib.docker.result ( msg, cmd, __local540__ ) TRACE | | Index data.lib.docker.result ( matched 1 rule ) TRACE | | Enter data.lib.docker.result TRACE | | | Eval object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | | Eval object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Eval object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Eval result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Exit data.lib.docker.result TRACE | | Eval res = __local540__ TRACE | | Exit data.builtin.dockerfile.DS002.deny TRACE | Redo data.builtin.dockerfile.DS002.deny TRACE | | Redo res = __local540__ TRACE | | Redo data.lib.docker.result ( msg, cmd, __local540__ ) TRACE | | Redo data.lib.docker.result TRACE | | | Redo result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Redo object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Redo object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Redo object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | Redo msg = \"Last USER command in Dockerfile should not be 'root'\" TRACE | | Redo cmd = data.builtin.dockerfile.DS002.fail_last_user_root [ _ ] TRACE | Exit data.builtin.dockerfile.DS002.deny = _ TRACE Redo data.builtin.dockerfile.DS002.deny = _ TRACE | Redo data.builtin.dockerfile.DS002.deny = _ TRACE","title":"Debugging policies"},{"location":"docs/scanner/misconfiguration/custom/schema/","text":"Input Schema Overview Policies can be defined with custom schemas that allow inputs to be verified against them. Adding a policy schema enables Trivy to show more detailed error messages when an invalid input is encountered. In Trivy we have been able to define a schema for a Dockerfile . Without input schemas, a policy would be as follows: Example # METADATA package mypackage deny { input.evil == \"foo bar\" } If this policy is run against offending Dockerfile(s), there will not be any issues as the policy will fail to evaluate. Although the policy's failure to evaluate is legitimate, this should not result in a positive result for the scan. For instance if we have a policy that checks for misconfigurations in a Dockerfile , we could define the schema as such Example # METADATA # schemas: # - input: schema[\"dockerfile\"] package mypackage deny { input.evil == \"foo bar\" } Here input: schema[\"dockerfile\"] points to a schema that expects a valid Dockerfile as input. An example of this can be found here Now if this policy is evaluated against, a more descriptive error will be available to help fix the problem. 1 error occurred: testpolicy.rego:8: rego_type_error: undefined ref: input.evil input.evil ^ have: \"evil\" want ( one of ) : [ \"Stages\" ] Currently, out of the box the following schemas are supported natively: Docker Kubernetes Cloud Custom Policies with Custom Schemas You can also bring a custom policy that defines one or more custom schema. Example # METADATA # schemas: # - input: schema[\"fooschema\"] # - input: schema[\"barschema\"] package mypackage deny { input.evil == \"foo bar\" } The policies can be placed in a structure as follows Example /Users/user/my-custom-policies \u251c\u2500\u2500 my_policy.rego \u2514\u2500\u2500 schemas \u2514\u2500\u2500 fooschema.json \u2514\u2500\u2500 barschema.json To use such a policy with Trivy, use the --config-policy flag that points to the policy file or to the directory where the schemas and policies are contained. $ trivy --config-policy = /Users/user/my-custom-policies <path/to/iac> For more details on how to define schemas within Rego policies, please see the OPA guide that describes it in more detail.","title":"Schemas"},{"location":"docs/scanner/misconfiguration/custom/schema/#input-schema","text":"","title":"Input Schema"},{"location":"docs/scanner/misconfiguration/custom/schema/#overview","text":"Policies can be defined with custom schemas that allow inputs to be verified against them. Adding a policy schema enables Trivy to show more detailed error messages when an invalid input is encountered. In Trivy we have been able to define a schema for a Dockerfile . Without input schemas, a policy would be as follows: Example # METADATA package mypackage deny { input.evil == \"foo bar\" } If this policy is run against offending Dockerfile(s), there will not be any issues as the policy will fail to evaluate. Although the policy's failure to evaluate is legitimate, this should not result in a positive result for the scan. For instance if we have a policy that checks for misconfigurations in a Dockerfile , we could define the schema as such Example # METADATA # schemas: # - input: schema[\"dockerfile\"] package mypackage deny { input.evil == \"foo bar\" } Here input: schema[\"dockerfile\"] points to a schema that expects a valid Dockerfile as input. An example of this can be found here Now if this policy is evaluated against, a more descriptive error will be available to help fix the problem. 1 error occurred: testpolicy.rego:8: rego_type_error: undefined ref: input.evil input.evil ^ have: \"evil\" want ( one of ) : [ \"Stages\" ] Currently, out of the box the following schemas are supported natively: Docker Kubernetes Cloud","title":"Overview"},{"location":"docs/scanner/misconfiguration/custom/schema/#custom-policies-with-custom-schemas","text":"You can also bring a custom policy that defines one or more custom schema. Example # METADATA # schemas: # - input: schema[\"fooschema\"] # - input: schema[\"barschema\"] package mypackage deny { input.evil == \"foo bar\" } The policies can be placed in a structure as follows Example /Users/user/my-custom-policies \u251c\u2500\u2500 my_policy.rego \u2514\u2500\u2500 schemas \u2514\u2500\u2500 fooschema.json \u2514\u2500\u2500 barschema.json To use such a policy with Trivy, use the --config-policy flag that points to the policy file or to the directory where the schemas and policies are contained. $ trivy --config-policy = /Users/user/my-custom-policies <path/to/iac> For more details on how to define schemas within Rego policies, please see the OPA guide that describes it in more detail.","title":"Custom Policies with Custom Schemas"},{"location":"docs/scanner/misconfiguration/custom/selectors/","text":"Input Selectors Overview Sometimes you might want to limit a certain policy to only be run on certain resources. This can be achieved with input selectors. Use case For instance, if you have a custom policy that you only want to be evaluated if a certain resource type is being scanned. In such a case you could utilize input selectors to limit its evaluation on only those resources. Example # METADATA # title: \"RDS Publicly Accessible\" # description: \"Ensures RDS instances are not launched into the public cloud.\" # custom: # input: # selector: # - type: cloud # subtypes: # - provider: aws # service: rds package builtin.aws.rds.aws0999 deny[res] { instance := input.aws.rds.instances[_] instance.publicaccess.value res := result.new(\"Instance has Public Access enabled\", instance.publicaccess) Observe the following subtypes defined: # subtypes: # - provider: aws # service: rds They will ensure that the policy is only run when the input to such a policy contains an RDS instance. Enabling selectors and subtypes Currently, the following are supported: Selector Subtype fields required Example Cloud (AWS, Azure, etc.) provider , service provider: aws , service: rds Kubernetes type: kubernetes Dockerfile type: dockerfile Default behaviour If no subtypes or selectors are specified, the policy will be evaluated regardless of input.","title":"Selectors"},{"location":"docs/scanner/misconfiguration/custom/selectors/#input-selectors","text":"","title":"Input Selectors"},{"location":"docs/scanner/misconfiguration/custom/selectors/#overview","text":"Sometimes you might want to limit a certain policy to only be run on certain resources. This can be achieved with input selectors.","title":"Overview"},{"location":"docs/scanner/misconfiguration/custom/selectors/#use-case","text":"For instance, if you have a custom policy that you only want to be evaluated if a certain resource type is being scanned. In such a case you could utilize input selectors to limit its evaluation on only those resources. Example # METADATA # title: \"RDS Publicly Accessible\" # description: \"Ensures RDS instances are not launched into the public cloud.\" # custom: # input: # selector: # - type: cloud # subtypes: # - provider: aws # service: rds package builtin.aws.rds.aws0999 deny[res] { instance := input.aws.rds.instances[_] instance.publicaccess.value res := result.new(\"Instance has Public Access enabled\", instance.publicaccess) Observe the following subtypes defined: # subtypes: # - provider: aws # service: rds They will ensure that the policy is only run when the input to such a policy contains an RDS instance.","title":"Use case"},{"location":"docs/scanner/misconfiguration/custom/selectors/#enabling-selectors-and-subtypes","text":"Currently, the following are supported: Selector Subtype fields required Example Cloud (AWS, Azure, etc.) provider , service provider: aws , service: rds Kubernetes type: kubernetes Dockerfile type: dockerfile","title":"Enabling selectors and subtypes"},{"location":"docs/scanner/misconfiguration/custom/selectors/#default-behaviour","text":"If no subtypes or selectors are specified, the policy will be evaluated regardless of input.","title":"Default behaviour"},{"location":"docs/scanner/misconfiguration/custom/testing/","text":"Testing It is highly recommended to write tests for your custom policies. Rego testing To help you verify the correctness of your custom policies, OPA gives you a framework that you can use to write tests for your policies. By writing tests for your custom policies you can speed up the development process of new rules and reduce the amount of time it takes to modify rules as requirements evolve. For more details, see Policy Testing . Example package user.dockerfile.ID002 test_add_denied { r := deny with input as {\"stages\": {\"alpine:3.13\": [ {\"Cmd\": \"add\", \"Value\": [\"/target/resources.tar.gz\", \"resources.jar\"]}, {\"Cmd\": \"add\", \"Value\": [\"/target/app.jar\", \"app.jar\"]}, ]}} count(r) == 1 r[_] == \"Consider using 'COPY /target/app.jar app.jar' command instead of 'ADD /target/app.jar app.jar'\" } To write tests for custom policies, you can refer to existing tests under defsec . Go testing Fanal which is a core library of Trivy can be imported as a Go library. You can scan config files in Go and test your custom policies using Go's testing methods, such as table-driven tests . This allows you to use the actual configuration file as input, making it easy to prepare test data and ensure that your custom policies work in practice. In particular, Dockerfile and HCL need to be converted to structural data as input, which may be different from the expected input format. Tip We recommend writing OPA and Go tests both since they have different roles, like unit tests and integration tests. The following example stores allowed and denied configuration files in a directory. Successes contains the result of successes, and Failures contains the result of failures. { name : \"disallowed ports\" , input : \"configs/\" , fields : fields { policyPaths : [] string { \"policy\" }, dataPaths : [] string { \"data\" }, namespaces : [] string { \"user\" }, }, want : [] types . Misconfiguration { { FileType : types . Dockerfile , FilePath : \"Dockerfile.allowed\" , Successes : types . MisconfResults { { Namespace : \"user.dockerfile.ID002\" , PolicyMetadata : types . PolicyMetadata { ID : \"ID002\" , Type : \"Docker Custom Check\" , Title : \"Disallowed ports exposed\" , Severity : \"HIGH\" , }, }, }, }, { FileType : types . Dockerfile , FilePath : \"Dockerfile.denied\" , Failures : types . MisconfResults { { Namespace : \"user.dockerfile.ID002\" , Message : \"Port 23 should not be exposed\" , PolicyMetadata : types . PolicyMetadata { ID : \"ID002\" , Type : \"Docker Custom Check\" , Title : \"Disallowed ports exposed\" , Severity : \"HIGH\" , }, }, }, }, }, }, Dockerfile.allowed has one successful result in Successes , while Dockerfile.denied has one failure result in Failures .","title":"Testing"},{"location":"docs/scanner/misconfiguration/custom/testing/#testing","text":"It is highly recommended to write tests for your custom policies.","title":"Testing"},{"location":"docs/scanner/misconfiguration/custom/testing/#rego-testing","text":"To help you verify the correctness of your custom policies, OPA gives you a framework that you can use to write tests for your policies. By writing tests for your custom policies you can speed up the development process of new rules and reduce the amount of time it takes to modify rules as requirements evolve. For more details, see Policy Testing . Example package user.dockerfile.ID002 test_add_denied { r := deny with input as {\"stages\": {\"alpine:3.13\": [ {\"Cmd\": \"add\", \"Value\": [\"/target/resources.tar.gz\", \"resources.jar\"]}, {\"Cmd\": \"add\", \"Value\": [\"/target/app.jar\", \"app.jar\"]}, ]}} count(r) == 1 r[_] == \"Consider using 'COPY /target/app.jar app.jar' command instead of 'ADD /target/app.jar app.jar'\" } To write tests for custom policies, you can refer to existing tests under defsec .","title":"Rego testing"},{"location":"docs/scanner/misconfiguration/custom/testing/#go-testing","text":"Fanal which is a core library of Trivy can be imported as a Go library. You can scan config files in Go and test your custom policies using Go's testing methods, such as table-driven tests . This allows you to use the actual configuration file as input, making it easy to prepare test data and ensure that your custom policies work in practice. In particular, Dockerfile and HCL need to be converted to structural data as input, which may be different from the expected input format. Tip We recommend writing OPA and Go tests both since they have different roles, like unit tests and integration tests. The following example stores allowed and denied configuration files in a directory. Successes contains the result of successes, and Failures contains the result of failures. { name : \"disallowed ports\" , input : \"configs/\" , fields : fields { policyPaths : [] string { \"policy\" }, dataPaths : [] string { \"data\" }, namespaces : [] string { \"user\" }, }, want : [] types . Misconfiguration { { FileType : types . Dockerfile , FilePath : \"Dockerfile.allowed\" , Successes : types . MisconfResults { { Namespace : \"user.dockerfile.ID002\" , PolicyMetadata : types . PolicyMetadata { ID : \"ID002\" , Type : \"Docker Custom Check\" , Title : \"Disallowed ports exposed\" , Severity : \"HIGH\" , }, }, }, }, { FileType : types . Dockerfile , FilePath : \"Dockerfile.denied\" , Failures : types . MisconfResults { { Namespace : \"user.dockerfile.ID002\" , Message : \"Port 23 should not be exposed\" , PolicyMetadata : types . PolicyMetadata { ID : \"ID002\" , Type : \"Docker Custom Check\" , Title : \"Disallowed ports exposed\" , Severity : \"HIGH\" , }, }, }, }, }, }, Dockerfile.allowed has one successful result in Successes , while Dockerfile.denied has one failure result in Failures .","title":"Go testing"},{"location":"docs/scanner/misconfiguration/policy/builtin/","text":"Built-in Policies Policy Sources Built-in policies are mainly written in Rego and Go. Those policies are managed under defsec repository . See here for the list of supported config types. For suggestions or issues regarding policy content, please open an issue under the defsec repository. Policy Distribution defsec policies are distributed as an OPA bundle on GitHub Container Registry (GHCR). When misconfiguration detection is enabled, Trivy pulls the OPA bundle from GHCR as an OCI artifact and stores it in the cache. Those policies are then loaded into Trivy OPA engine and used for detecting misconfigurations. If Trivy is unable to pull down newer policies, it will use the embedded set of policies as a fallback. This is also the case in air-gap environments where --skip-policy-update might be passed. Update Interval Trivy checks for updates to OPA bundle on GHCR every 24 hours and pulls it if there are any updates.","title":"Built-in Policies"},{"location":"docs/scanner/misconfiguration/policy/builtin/#built-in-policies","text":"","title":"Built-in Policies"},{"location":"docs/scanner/misconfiguration/policy/builtin/#policy-sources","text":"Built-in policies are mainly written in Rego and Go. Those policies are managed under defsec repository . See here for the list of supported config types. For suggestions or issues regarding policy content, please open an issue under the defsec repository.","title":"Policy Sources"},{"location":"docs/scanner/misconfiguration/policy/builtin/#policy-distribution","text":"defsec policies are distributed as an OPA bundle on GitHub Container Registry (GHCR). When misconfiguration detection is enabled, Trivy pulls the OPA bundle from GHCR as an OCI artifact and stores it in the cache. Those policies are then loaded into Trivy OPA engine and used for detecting misconfigurations. If Trivy is unable to pull down newer policies, it will use the embedded set of policies as a fallback. This is also the case in air-gap environments where --skip-policy-update might be passed.","title":"Policy Distribution"},{"location":"docs/scanner/misconfiguration/policy/builtin/#update-interval","text":"Trivy checks for updates to OPA bundle on GHCR every 24 hours and pulls it if there are any updates.","title":"Update Interval"},{"location":"docs/scanner/misconfiguration/policy/exceptions/","text":"Exceptions Exceptions let you specify cases where you allow policy violations. Trivy supports two types of exceptions. Info Exceptions can be applied to built-in policies as well as custom policies. Namespace-based exceptions There are some cases where you need to disable built-in policies partially or fully. Namespace-based exceptions lets you rough choose which individual packages to exempt. To use namespace-based exceptions, create a Rego rule with the name exception that returns the package names to exempt. The exception rule must be defined under namespace.exceptions . data.namespaces includes all package names. Example package namespace.exceptions import data.namespaces exception[ns] { ns := data.namespaces[_] startswith(ns, \"builtin.kubernetes\") } This example exempts all built-in policies for Kubernetes. For more details, see an example . Rule-based exceptions There are some cases where you need more flexibility and granularity in defining which cases to exempt. Rule-based exceptions lets you granularly choose which individual rules to exempt, while also declaring under which conditions to exempt them. To use rule-based exceptions, create a Rego rule with the name exception that returns the rule name suffixes to exempt, prefixed by deny_ (for example, returning foo will exempt deny_foo ). The rule can make any other assertion, for example, on the input or data documents. This is useful to specify the exemption for a specific case. Note that if you specify the empty string, the exception will match all rules named deny . exception[rules] { # Logic rules = [\"foo\",\"bar\"] } The above would provide an exception from deny_foo and deny_bar . Example package user.kubernetes.ID100 __rego_metadata := { \"id\": \"ID100\", \"title\": \"Deployment not allowed\", \"severity\": \"HIGH\", \"type\": \"Kubernetes Custom Check\", } deny_deployment[msg] { input.kind == \"Deployment\" msg = sprintf(\"Found deployment '%s' but deployments are not allowed\", [name]) } exception[rules] { input.kind == \"Deployment\" input.metadata.name == \"allow-deployment\" rules := [\"deployment\"] } If you want to apply rule-based exceptions to built-in policies, you have to define the exception under the same package. Example package builtin.kubernetes.KSV012 exception[rules] { input.metadata.name == \"can-run-as-root\" rules := [\"\"] } This exception is applied to KSV012 in defsec. You can get the package names in the defsec repository or the JSON output from Trivy. For more details, see an example .","title":"Exceptions"},{"location":"docs/scanner/misconfiguration/policy/exceptions/#exceptions","text":"Exceptions let you specify cases where you allow policy violations. Trivy supports two types of exceptions. Info Exceptions can be applied to built-in policies as well as custom policies.","title":"Exceptions"},{"location":"docs/scanner/misconfiguration/policy/exceptions/#namespace-based-exceptions","text":"There are some cases where you need to disable built-in policies partially or fully. Namespace-based exceptions lets you rough choose which individual packages to exempt. To use namespace-based exceptions, create a Rego rule with the name exception that returns the package names to exempt. The exception rule must be defined under namespace.exceptions . data.namespaces includes all package names. Example package namespace.exceptions import data.namespaces exception[ns] { ns := data.namespaces[_] startswith(ns, \"builtin.kubernetes\") } This example exempts all built-in policies for Kubernetes. For more details, see an example .","title":"Namespace-based exceptions"},{"location":"docs/scanner/misconfiguration/policy/exceptions/#rule-based-exceptions","text":"There are some cases where you need more flexibility and granularity in defining which cases to exempt. Rule-based exceptions lets you granularly choose which individual rules to exempt, while also declaring under which conditions to exempt them. To use rule-based exceptions, create a Rego rule with the name exception that returns the rule name suffixes to exempt, prefixed by deny_ (for example, returning foo will exempt deny_foo ). The rule can make any other assertion, for example, on the input or data documents. This is useful to specify the exemption for a specific case. Note that if you specify the empty string, the exception will match all rules named deny . exception[rules] { # Logic rules = [\"foo\",\"bar\"] } The above would provide an exception from deny_foo and deny_bar . Example package user.kubernetes.ID100 __rego_metadata := { \"id\": \"ID100\", \"title\": \"Deployment not allowed\", \"severity\": \"HIGH\", \"type\": \"Kubernetes Custom Check\", } deny_deployment[msg] { input.kind == \"Deployment\" msg = sprintf(\"Found deployment '%s' but deployments are not allowed\", [name]) } exception[rules] { input.kind == \"Deployment\" input.metadata.name == \"allow-deployment\" rules := [\"deployment\"] } If you want to apply rule-based exceptions to built-in policies, you have to define the exception under the same package. Example package builtin.kubernetes.KSV012 exception[rules] { input.metadata.name == \"can-run-as-root\" rules := [\"\"] } This exception is applied to KSV012 in defsec. You can get the package names in the defsec repository or the JSON output from Trivy. For more details, see an example .","title":"Rule-based exceptions"},{"location":"docs/supply-chain/sbom/","text":"SBOM Generating Trivy can generate the following SBOM formats. CycloneDX SPDX CLI commands To generate SBOM, you can use the --format option for each subcommand such as image , fs and vm . $ trivy image --format spdx-json --output result.json alpine:3.15 $ trivy fs --format cyclonedx --output result.json /app/myproject Result { \"bomFormat\": \"CycloneDX\", \"specVersion\": \"1.3\", \"serialNumber\": \"urn:uuid:2be5773d-7cd3-4b4b-90a5-e165474ddace\", \"version\": 1, \"metadata\": { \"timestamp\": \"2022-02-22T15:11:40.270597Z\", \"tools\": [ { \"vendor\": \"aquasecurity\", \"name\": \"trivy\", \"version\": \"dev\" } ], \"component\": { \"bom-ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"type\": \"container\", \"name\": \"alpine:3.15\", \"version\": \"\", \"purl\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SchemaVersion\", \"value\": \"2\" }, { \"name\": \"aquasecurity:trivy:ImageID\", \"value\": \"sha256:c059bfaa849c4d8e4aecaeb3a10c2d9b3d85f5165c66ad3a4d937758128c4d18\" }, { \"name\": \"aquasecurity:trivy:RepoDigest\", \"value\": \"alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300\" }, { \"name\": \"aquasecurity:trivy:DiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" }, { \"name\": \"aquasecurity:trivy:RepoTag\", \"value\": \"alpine:3.15\" } ] } }, \"components\": [ { \"bom-ref\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"type\": \"library\", \"name\": \"alpine-baselayout\", \"version\": \"3.2.0-r18\", \"licenses\": [ { \"expression\": \"GPL-2.0-only\" } ], \"purl\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"alpine-baselayout\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"3.2.0-r18\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, ...(snip)... { \"bom-ref\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"type\": \"library\", \"name\": \"zlib\", \"version\": \"1.2.11-r3\", \"licenses\": [ { \"expression\": \"Zlib\" } ], \"purl\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"zlib\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"1.2.11-r3\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, { \"bom-ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"type\": \"operating-system\", \"name\": \"alpine\", \"version\": \"3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:Type\", \"value\": \"alpine\" }, { \"name\": \"aquasecurity:trivy:Class\", \"value\": \"os-pkgs\" } ] } ], \"dependencies\": [ { \"ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"dependsOn\": [ \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"pkg:apk/alpine/alpine-keys@2.4-r1?distro=3.15.0\", \"pkg:apk/alpine/apk-tools@2.12.7-r3?distro=3.15.0\", \"pkg:apk/alpine/busybox@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/ca-certificates-bundle@20191127-r7?distro=3.15.0\", \"pkg:apk/alpine/libc-utils@0.7.2-r3?distro=3.15.0\", \"pkg:apk/alpine/libcrypto1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/libretls@3.3.4-r2?distro=3.15.0\", \"pkg:apk/alpine/libssl1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/musl@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/musl-utils@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/scanelf@1.3.3-r0?distro=3.15.0\", \"pkg:apk/alpine/ssl_client@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\" ] }, { \"ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"dependsOn\": [ \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\" ] } ] } Supported packages Trivy supports the following packages. OS packages Language-specific packages Formats CycloneDX Trivy can generate SBOM in the CycloneDX format. Note that XML format is not supported at the moment. You can use the regular subcommands (like image , fs and rootfs ) and specify cyclonedx with the --format option. CycloneDX can represent either or both SBOM or BOV. Software Bill of Materials (SBOM) Bill of Vulnerabilities (BOV) By default, --format cyclonedx represents SBOM and doesn't include vulnerabilities in the CycloneDX output. $ trivy image --format cyclonedx --output result.json alpine:3.15 2022-07-19T07:47:27.624Z INFO \"--format cyclonedx\" disables security scanning. Specify \"--scanners vuln\" explicitly if you want to include vulnerabilities in the CycloneDX report. Result $ cat result.json | jq . { \"bomFormat\": \"CycloneDX\", \"specVersion\": \"1.5\", \"serialNumber\": \"urn:uuid:2be5773d-7cd3-4b4b-90a5-e165474ddace\", \"version\": 1, \"metadata\": { \"timestamp\": \"2022-02-22T15:11:40.270597Z\", \"tools\": [ { \"vendor\": \"aquasecurity\", \"name\": \"trivy\", \"version\": \"dev\" } ], \"component\": { \"bom-ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"type\": \"container\", \"name\": \"alpine:3.15\", \"version\": \"\", \"purl\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SchemaVersion\", \"value\": \"2\" }, { \"name\": \"aquasecurity:trivy:ImageID\", \"value\": \"sha256:c059bfaa849c4d8e4aecaeb3a10c2d9b3d85f5165c66ad3a4d937758128c4d18\" }, { \"name\": \"aquasecurity:trivy:RepoDigest\", \"value\": \"alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300\" }, { \"name\": \"aquasecurity:trivy:DiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" }, { \"name\": \"aquasecurity:trivy:RepoTag\", \"value\": \"alpine:3.15\" } ] } }, \"components\": [ { \"bom-ref\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"type\": \"library\", \"name\": \"alpine-baselayout\", \"version\": \"3.2.0-r18\", \"licenses\": [ { \"expression\": \"GPL-2.0-only\" } ], \"purl\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"alpine-baselayout\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"3.2.0-r18\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, ...(snip)... { \"bom-ref\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"type\": \"library\", \"name\": \"zlib\", \"version\": \"1.2.11-r3\", \"licenses\": [ { \"expression\": \"Zlib\" } ], \"purl\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"zlib\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"1.2.11-r3\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, { \"bom-ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"type\": \"operating-system\", \"name\": \"alpine\", \"version\": \"3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:Type\", \"value\": \"alpine\" }, { \"name\": \"aquasecurity:trivy:Class\", \"value\": \"os-pkgs\" } ] } ], \"dependencies\": [ { \"ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"dependsOn\": [ \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"pkg:apk/alpine/alpine-keys@2.4-r1?distro=3.15.0\", \"pkg:apk/alpine/apk-tools@2.12.7-r3?distro=3.15.0\", \"pkg:apk/alpine/busybox@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/ca-certificates-bundle@20191127-r7?distro=3.15.0\", \"pkg:apk/alpine/libc-utils@0.7.2-r3?distro=3.15.0\", \"pkg:apk/alpine/libcrypto1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/libretls@3.3.4-r2?distro=3.15.0\", \"pkg:apk/alpine/libssl1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/musl@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/musl-utils@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/scanelf@1.3.3-r0?distro=3.15.0\", \"pkg:apk/alpine/ssl_client@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\" ] }, { \"ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"dependsOn\": [ \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\" ] } ], \"vulnerabilities\": [ { \"id\": \"CVE-2021-42386\", \"source\": { \"name\": \"alpine\", \"url\": \"https://secdb.alpinelinux.org/\" }, \"ratings\": [ { \"source\": { \"name\": \"nvd\" }, \"score\": 7.2, \"severity\": \"high\", \"method\": \"CVSSv31\", \"vector\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\" }, { \"source\": { \"name\": \"nvd\" }, \"score\": 6.5, \"severity\": \"medium\", \"method\": \"CVSSv2\", \"vector\": \"AV:N/AC:L/Au:S/C:P/I:P/A:P\" }, { \"source\": { \"name\": \"redhat\" }, \"score\": 6.6, \"severity\": \"medium\", \"method\": \"CVSSv31\", \"vector\": \"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\" } ], \"cwes\": [ 416 ], \"description\": \"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function\", \"advisories\": [ { \"url\": \"https://access.redhat.com/security/cve/CVE-2021-42386\" }, { \"url\": \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42386\" } ], \"published\": \"2021-11-15 21:15:00 +0000 UTC\", \"updated\": \"2022-01-04 17:14:00 +0000 UTC\", \"affects\": [ { \"ref\": \"pkg:apk/alpine/busybox@1.33.1-r3?distro=3.14.2\" }, { \"ref\": \"pkg:apk/alpine/ssl_client@1.33.1-r3?distro=3.14.2\" } ] } ] } If you want to include vulnerabilities, you can enable vulnerability scanning via --scanners vuln . $ trivy image --scanners vuln --format cyclonedx --output result.json alpine:3.15 SPDX Trivy can generate SBOM in the SPDX format. You can use the regular subcommands (like image , fs and rootfs ) and specify spdx with the --format option. $ trivy image --format spdx --output result.spdx alpine:3.15 Result $ cat result.spdx SPDXVersion: SPDX-2.2 DataLicense: CC0-1.0 SPDXID: SPDXRef-DOCUMENT DocumentName: alpine:3.15 DocumentNamespace: https://aquasecurity.github.io/trivy/container_image/alpine:3.15-bebf6b19-a94c-4e2c-af44-065f63923f48 Creator: Organization: aquasecurity Creator: Tool: trivy-0.38.1 Created: 2022-04-28T07:32:57.142806Z ##### Package: zlib PackageName: zlib SPDXID: SPDXRef-12bc938ac028a5e1 PackageVersion: 1.2.12-r0 FilesAnalyzed: false PackageLicenseConcluded: Zlib PackageLicenseDeclared: Zlib ##### Package: apk-tools PackageName: apk-tools SPDXID: SPDXRef-26c274652190d87f PackageVersion: 2.12.7-r3 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: libretls PackageName: libretls SPDXID: SPDXRef-2b021966d19a8211 PackageVersion: 3.3.4-r3 FilesAnalyzed: false PackageLicenseConcluded: ISC AND (BSD-3-Clause OR MIT) PackageLicenseDeclared: ISC AND (BSD-3-Clause OR MIT) ##### Package: busybox PackageName: busybox SPDXID: SPDXRef-317ce3476703f20d PackageVersion: 1.34.1-r5 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: libcrypto1.1 PackageName: libcrypto1.1 SPDXID: SPDXRef-34f407fb4dbd67f4 PackageVersion: 1.1.1n-r0 FilesAnalyzed: false PackageLicenseConcluded: OpenSSL PackageLicenseDeclared: OpenSSL ##### Package: libc-utils PackageName: libc-utils SPDXID: SPDXRef-4bbc1cb449d54083 PackageVersion: 0.7.2-r3 FilesAnalyzed: false PackageLicenseConcluded: BSD-2-Clause AND BSD-3-Clause PackageLicenseDeclared: BSD-2-Clause AND BSD-3-Clause ##### Package: alpine-keys PackageName: alpine-keys SPDXID: SPDXRef-a3bdd174be1456b6 PackageVersion: 2.4-r1 FilesAnalyzed: false PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT ##### Package: ca-certificates-bundle PackageName: ca-certificates-bundle SPDXID: SPDXRef-ac6472ba26fb991c PackageVersion: 20211220-r0 FilesAnalyzed: false PackageLicenseConcluded: MPL-2.0 AND MIT PackageLicenseDeclared: MPL-2.0 AND MIT ##### Package: libssl1.1 PackageName: libssl1.1 SPDXID: SPDXRef-b2d1b1d70fe90f7d PackageVersion: 1.1.1n-r0 FilesAnalyzed: false PackageLicenseConcluded: OpenSSL PackageLicenseDeclared: OpenSSL ##### Package: scanelf PackageName: scanelf SPDXID: SPDXRef-c617077ba6649520 PackageVersion: 1.3.3-r0 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: musl PackageName: musl SPDXID: SPDXRef-ca80b810029cde0e PackageVersion: 1.2.2-r7 FilesAnalyzed: false PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT ##### Package: alpine-baselayout PackageName: alpine-baselayout SPDXID: SPDXRef-d782e64751ba9faa PackageVersion: 3.2.0-r18 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: musl-utils PackageName: musl-utils SPDXID: SPDXRef-e5e8a237f6162e22 PackageVersion: 1.2.2-r7 FilesAnalyzed: false PackageLicenseConcluded: MIT BSD GPL2+ PackageLicenseDeclared: MIT BSD GPL2+ ##### Package: ssl_client PackageName: ssl_client SPDXID: SPDXRef-fdf0ce84f6337be4 PackageVersion: 1.34.1-r5 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only SPDX-JSON format is also supported by using spdx-json with the --format option. $ trivy image --format spdx-json --output result.spdx.json alpine:3.15 Result $ cat result.spdx.json | jq . { \"SPDXID\": \"SPDXRef-DOCUMENT\", \"creationInfo\": { \"created\": \"2022-04-28T08:16:55.328255Z\", \"creators\": [ \"Tool: trivy-0.38.1\", \"Organization: aquasecurity\" ] }, \"dataLicense\": \"CC0-1.0\", \"documentNamespace\": \"http://aquasecurity.github.io/trivy/container_image/alpine:3.15-d9549e3a-a4c5-4ee3-8bde-8c78d451fbe7\", \"name\": \"alpine:3.15\", \"packages\": [ { \"SPDXID\": \"SPDXRef-12bc938ac028a5e1\", \"filesAnalyzed\": false, \"licenseConcluded\": \"Zlib\", \"licenseDeclared\": \"Zlib\", \"name\": \"zlib\", \"versionInfo\": \"1.2.12-r0\" }, { \"SPDXID\": \"SPDXRef-26c274652190d87f\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"apk-tools\", \"versionInfo\": \"2.12.7-r3\" }, { \"SPDXID\": \"SPDXRef-2b021966d19a8211\", \"filesAnalyzed\": false, \"licenseConcluded\": \"ISC AND (BSD-3-Clause OR MIT)\", \"licenseDeclared\": \"ISC AND (BSD-3-Clause OR MIT)\", \"name\": \"libretls\", \"versionInfo\": \"3.3.4-r3\" }, { \"SPDXID\": \"SPDXRef-317ce3476703f20d\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"busybox\", \"versionInfo\": \"1.34.1-r5\" }, { \"SPDXID\": \"SPDXRef-34f407fb4dbd67f4\", \"filesAnalyzed\": false, \"licenseConcluded\": \"OpenSSL\", \"licenseDeclared\": \"OpenSSL\", \"name\": \"libcrypto1.1\", \"versionInfo\": \"1.1.1n-r0\" }, { \"SPDXID\": \"SPDXRef-4bbc1cb449d54083\", \"filesAnalyzed\": false, \"licenseConcluded\": \"BSD-2-Clause AND BSD-3-Clause\", \"licenseDeclared\": \"BSD-2-Clause AND BSD-3-Clause\", \"name\": \"libc-utils\", \"versionInfo\": \"0.7.2-r3\" }, { \"SPDXID\": \"SPDXRef-a3bdd174be1456b6\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MIT\", \"licenseDeclared\": \"MIT\", \"name\": \"alpine-keys\", \"versionInfo\": \"2.4-r1\" }, { \"SPDXID\": \"SPDXRef-ac6472ba26fb991c\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MPL-2.0 AND MIT\", \"licenseDeclared\": \"MPL-2.0 AND MIT\", \"name\": \"ca-certificates-bundle\", \"versionInfo\": \"20211220-r0\" }, { \"SPDXID\": \"SPDXRef-b2d1b1d70fe90f7d\", \"filesAnalyzed\": false, \"licenseConcluded\": \"OpenSSL\", \"licenseDeclared\": \"OpenSSL\", \"name\": \"libssl1.1\", \"versionInfo\": \"1.1.1n-r0\" }, { \"SPDXID\": \"SPDXRef-c617077ba6649520\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"scanelf\", \"versionInfo\": \"1.3.3-r0\" }, { \"SPDXID\": \"SPDXRef-ca80b810029cde0e\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MIT\", \"licenseDeclared\": \"MIT\", \"name\": \"musl\", \"versionInfo\": \"1.2.2-r7\" }, { \"SPDXID\": \"SPDXRef-d782e64751ba9faa\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"alpine-baselayout\", \"versionInfo\": \"3.2.0-r18\" }, { \"SPDXID\": \"SPDXRef-e5e8a237f6162e22\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MIT BSD GPL2+\", \"licenseDeclared\": \"MIT BSD GPL2+\", \"name\": \"musl-utils\", \"versionInfo\": \"1.2.2-r7\" }, { \"SPDXID\": \"SPDXRef-fdf0ce84f6337be4\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"ssl_client\", \"versionInfo\": \"1.34.1-r5\" } ], \"spdxVersion\": \"SPDX-2.2\" } Scanning Trivy can take SBOM documents as input for scanning. See here for more details. Also, Trivy searches for SBOM files in container images. $ trivy image bitnami/elasticsearch:8.7.1 For example, Bitnami images contain SBOM files in /opt/bitnami directory. Trivy automatically detects the SBOM files and uses them for scanning. It is enabled in the following targets. Target Enabled Container Image \u2713 Filesystem Rootfs \u2713 Git Repository VM Image \u2713 Kubernetes AWS SBOM","title":"SBOM"},{"location":"docs/supply-chain/sbom/#sbom","text":"","title":"SBOM"},{"location":"docs/supply-chain/sbom/#generating","text":"Trivy can generate the following SBOM formats. CycloneDX SPDX","title":"Generating"},{"location":"docs/supply-chain/sbom/#cli-commands","text":"To generate SBOM, you can use the --format option for each subcommand such as image , fs and vm . $ trivy image --format spdx-json --output result.json alpine:3.15 $ trivy fs --format cyclonedx --output result.json /app/myproject Result { \"bomFormat\": \"CycloneDX\", \"specVersion\": \"1.3\", \"serialNumber\": \"urn:uuid:2be5773d-7cd3-4b4b-90a5-e165474ddace\", \"version\": 1, \"metadata\": { \"timestamp\": \"2022-02-22T15:11:40.270597Z\", \"tools\": [ { \"vendor\": \"aquasecurity\", \"name\": \"trivy\", \"version\": \"dev\" } ], \"component\": { \"bom-ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"type\": \"container\", \"name\": \"alpine:3.15\", \"version\": \"\", \"purl\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SchemaVersion\", \"value\": \"2\" }, { \"name\": \"aquasecurity:trivy:ImageID\", \"value\": \"sha256:c059bfaa849c4d8e4aecaeb3a10c2d9b3d85f5165c66ad3a4d937758128c4d18\" }, { \"name\": \"aquasecurity:trivy:RepoDigest\", \"value\": \"alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300\" }, { \"name\": \"aquasecurity:trivy:DiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" }, { \"name\": \"aquasecurity:trivy:RepoTag\", \"value\": \"alpine:3.15\" } ] } }, \"components\": [ { \"bom-ref\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"type\": \"library\", \"name\": \"alpine-baselayout\", \"version\": \"3.2.0-r18\", \"licenses\": [ { \"expression\": \"GPL-2.0-only\" } ], \"purl\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"alpine-baselayout\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"3.2.0-r18\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, ...(snip)... { \"bom-ref\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"type\": \"library\", \"name\": \"zlib\", \"version\": \"1.2.11-r3\", \"licenses\": [ { \"expression\": \"Zlib\" } ], \"purl\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"zlib\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"1.2.11-r3\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, { \"bom-ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"type\": \"operating-system\", \"name\": \"alpine\", \"version\": \"3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:Type\", \"value\": \"alpine\" }, { \"name\": \"aquasecurity:trivy:Class\", \"value\": \"os-pkgs\" } ] } ], \"dependencies\": [ { \"ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"dependsOn\": [ \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"pkg:apk/alpine/alpine-keys@2.4-r1?distro=3.15.0\", \"pkg:apk/alpine/apk-tools@2.12.7-r3?distro=3.15.0\", \"pkg:apk/alpine/busybox@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/ca-certificates-bundle@20191127-r7?distro=3.15.0\", \"pkg:apk/alpine/libc-utils@0.7.2-r3?distro=3.15.0\", \"pkg:apk/alpine/libcrypto1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/libretls@3.3.4-r2?distro=3.15.0\", \"pkg:apk/alpine/libssl1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/musl@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/musl-utils@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/scanelf@1.3.3-r0?distro=3.15.0\", \"pkg:apk/alpine/ssl_client@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\" ] }, { \"ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"dependsOn\": [ \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\" ] } ] }","title":"CLI commands"},{"location":"docs/supply-chain/sbom/#supported-packages","text":"Trivy supports the following packages. OS packages Language-specific packages","title":"Supported packages"},{"location":"docs/supply-chain/sbom/#formats","text":"","title":"Formats"},{"location":"docs/supply-chain/sbom/#cyclonedx","text":"Trivy can generate SBOM in the CycloneDX format. Note that XML format is not supported at the moment. You can use the regular subcommands (like image , fs and rootfs ) and specify cyclonedx with the --format option. CycloneDX can represent either or both SBOM or BOV. Software Bill of Materials (SBOM) Bill of Vulnerabilities (BOV) By default, --format cyclonedx represents SBOM and doesn't include vulnerabilities in the CycloneDX output. $ trivy image --format cyclonedx --output result.json alpine:3.15 2022-07-19T07:47:27.624Z INFO \"--format cyclonedx\" disables security scanning. Specify \"--scanners vuln\" explicitly if you want to include vulnerabilities in the CycloneDX report. Result $ cat result.json | jq . { \"bomFormat\": \"CycloneDX\", \"specVersion\": \"1.5\", \"serialNumber\": \"urn:uuid:2be5773d-7cd3-4b4b-90a5-e165474ddace\", \"version\": 1, \"metadata\": { \"timestamp\": \"2022-02-22T15:11:40.270597Z\", \"tools\": [ { \"vendor\": \"aquasecurity\", \"name\": \"trivy\", \"version\": \"dev\" } ], \"component\": { \"bom-ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"type\": \"container\", \"name\": \"alpine:3.15\", \"version\": \"\", \"purl\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SchemaVersion\", \"value\": \"2\" }, { \"name\": \"aquasecurity:trivy:ImageID\", \"value\": \"sha256:c059bfaa849c4d8e4aecaeb3a10c2d9b3d85f5165c66ad3a4d937758128c4d18\" }, { \"name\": \"aquasecurity:trivy:RepoDigest\", \"value\": \"alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300\" }, { \"name\": \"aquasecurity:trivy:DiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" }, { \"name\": \"aquasecurity:trivy:RepoTag\", \"value\": \"alpine:3.15\" } ] } }, \"components\": [ { \"bom-ref\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"type\": \"library\", \"name\": \"alpine-baselayout\", \"version\": \"3.2.0-r18\", \"licenses\": [ { \"expression\": \"GPL-2.0-only\" } ], \"purl\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"alpine-baselayout\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"3.2.0-r18\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, ...(snip)... { \"bom-ref\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"type\": \"library\", \"name\": \"zlib\", \"version\": \"1.2.11-r3\", \"licenses\": [ { \"expression\": \"Zlib\" } ], \"purl\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"zlib\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"1.2.11-r3\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, { \"bom-ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"type\": \"operating-system\", \"name\": \"alpine\", \"version\": \"3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:Type\", \"value\": \"alpine\" }, { \"name\": \"aquasecurity:trivy:Class\", \"value\": \"os-pkgs\" } ] } ], \"dependencies\": [ { \"ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"dependsOn\": [ \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"pkg:apk/alpine/alpine-keys@2.4-r1?distro=3.15.0\", \"pkg:apk/alpine/apk-tools@2.12.7-r3?distro=3.15.0\", \"pkg:apk/alpine/busybox@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/ca-certificates-bundle@20191127-r7?distro=3.15.0\", \"pkg:apk/alpine/libc-utils@0.7.2-r3?distro=3.15.0\", \"pkg:apk/alpine/libcrypto1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/libretls@3.3.4-r2?distro=3.15.0\", \"pkg:apk/alpine/libssl1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/musl@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/musl-utils@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/scanelf@1.3.3-r0?distro=3.15.0\", \"pkg:apk/alpine/ssl_client@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\" ] }, { \"ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"dependsOn\": [ \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\" ] } ], \"vulnerabilities\": [ { \"id\": \"CVE-2021-42386\", \"source\": { \"name\": \"alpine\", \"url\": \"https://secdb.alpinelinux.org/\" }, \"ratings\": [ { \"source\": { \"name\": \"nvd\" }, \"score\": 7.2, \"severity\": \"high\", \"method\": \"CVSSv31\", \"vector\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\" }, { \"source\": { \"name\": \"nvd\" }, \"score\": 6.5, \"severity\": \"medium\", \"method\": \"CVSSv2\", \"vector\": \"AV:N/AC:L/Au:S/C:P/I:P/A:P\" }, { \"source\": { \"name\": \"redhat\" }, \"score\": 6.6, \"severity\": \"medium\", \"method\": \"CVSSv31\", \"vector\": \"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\" } ], \"cwes\": [ 416 ], \"description\": \"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function\", \"advisories\": [ { \"url\": \"https://access.redhat.com/security/cve/CVE-2021-42386\" }, { \"url\": \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42386\" } ], \"published\": \"2021-11-15 21:15:00 +0000 UTC\", \"updated\": \"2022-01-04 17:14:00 +0000 UTC\", \"affects\": [ { \"ref\": \"pkg:apk/alpine/busybox@1.33.1-r3?distro=3.14.2\" }, { \"ref\": \"pkg:apk/alpine/ssl_client@1.33.1-r3?distro=3.14.2\" } ] } ] } If you want to include vulnerabilities, you can enable vulnerability scanning via --scanners vuln . $ trivy image --scanners vuln --format cyclonedx --output result.json alpine:3.15","title":"CycloneDX"},{"location":"docs/supply-chain/sbom/#spdx","text":"Trivy can generate SBOM in the SPDX format. You can use the regular subcommands (like image , fs and rootfs ) and specify spdx with the --format option. $ trivy image --format spdx --output result.spdx alpine:3.15 Result $ cat result.spdx SPDXVersion: SPDX-2.2 DataLicense: CC0-1.0 SPDXID: SPDXRef-DOCUMENT DocumentName: alpine:3.15 DocumentNamespace: https://aquasecurity.github.io/trivy/container_image/alpine:3.15-bebf6b19-a94c-4e2c-af44-065f63923f48 Creator: Organization: aquasecurity Creator: Tool: trivy-0.38.1 Created: 2022-04-28T07:32:57.142806Z ##### Package: zlib PackageName: zlib SPDXID: SPDXRef-12bc938ac028a5e1 PackageVersion: 1.2.12-r0 FilesAnalyzed: false PackageLicenseConcluded: Zlib PackageLicenseDeclared: Zlib ##### Package: apk-tools PackageName: apk-tools SPDXID: SPDXRef-26c274652190d87f PackageVersion: 2.12.7-r3 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: libretls PackageName: libretls SPDXID: SPDXRef-2b021966d19a8211 PackageVersion: 3.3.4-r3 FilesAnalyzed: false PackageLicenseConcluded: ISC AND (BSD-3-Clause OR MIT) PackageLicenseDeclared: ISC AND (BSD-3-Clause OR MIT) ##### Package: busybox PackageName: busybox SPDXID: SPDXRef-317ce3476703f20d PackageVersion: 1.34.1-r5 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: libcrypto1.1 PackageName: libcrypto1.1 SPDXID: SPDXRef-34f407fb4dbd67f4 PackageVersion: 1.1.1n-r0 FilesAnalyzed: false PackageLicenseConcluded: OpenSSL PackageLicenseDeclared: OpenSSL ##### Package: libc-utils PackageName: libc-utils SPDXID: SPDXRef-4bbc1cb449d54083 PackageVersion: 0.7.2-r3 FilesAnalyzed: false PackageLicenseConcluded: BSD-2-Clause AND BSD-3-Clause PackageLicenseDeclared: BSD-2-Clause AND BSD-3-Clause ##### Package: alpine-keys PackageName: alpine-keys SPDXID: SPDXRef-a3bdd174be1456b6 PackageVersion: 2.4-r1 FilesAnalyzed: false PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT ##### Package: ca-certificates-bundle PackageName: ca-certificates-bundle SPDXID: SPDXRef-ac6472ba26fb991c PackageVersion: 20211220-r0 FilesAnalyzed: false PackageLicenseConcluded: MPL-2.0 AND MIT PackageLicenseDeclared: MPL-2.0 AND MIT ##### Package: libssl1.1 PackageName: libssl1.1 SPDXID: SPDXRef-b2d1b1d70fe90f7d PackageVersion: 1.1.1n-r0 FilesAnalyzed: false PackageLicenseConcluded: OpenSSL PackageLicenseDeclared: OpenSSL ##### Package: scanelf PackageName: scanelf SPDXID: SPDXRef-c617077ba6649520 PackageVersion: 1.3.3-r0 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: musl PackageName: musl SPDXID: SPDXRef-ca80b810029cde0e PackageVersion: 1.2.2-r7 FilesAnalyzed: false PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT ##### Package: alpine-baselayout PackageName: alpine-baselayout SPDXID: SPDXRef-d782e64751ba9faa PackageVersion: 3.2.0-r18 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: musl-utils PackageName: musl-utils SPDXID: SPDXRef-e5e8a237f6162e22 PackageVersion: 1.2.2-r7 FilesAnalyzed: false PackageLicenseConcluded: MIT BSD GPL2+ PackageLicenseDeclared: MIT BSD GPL2+ ##### Package: ssl_client PackageName: ssl_client SPDXID: SPDXRef-fdf0ce84f6337be4 PackageVersion: 1.34.1-r5 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only SPDX-JSON format is also supported by using spdx-json with the --format option. $ trivy image --format spdx-json --output result.spdx.json alpine:3.15 Result $ cat result.spdx.json | jq . { \"SPDXID\": \"SPDXRef-DOCUMENT\", \"creationInfo\": { \"created\": \"2022-04-28T08:16:55.328255Z\", \"creators\": [ \"Tool: trivy-0.38.1\", \"Organization: aquasecurity\" ] }, \"dataLicense\": \"CC0-1.0\", \"documentNamespace\": \"http://aquasecurity.github.io/trivy/container_image/alpine:3.15-d9549e3a-a4c5-4ee3-8bde-8c78d451fbe7\", \"name\": \"alpine:3.15\", \"packages\": [ { \"SPDXID\": \"SPDXRef-12bc938ac028a5e1\", \"filesAnalyzed\": false, \"licenseConcluded\": \"Zlib\", \"licenseDeclared\": \"Zlib\", \"name\": \"zlib\", \"versionInfo\": \"1.2.12-r0\" }, { \"SPDXID\": \"SPDXRef-26c274652190d87f\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"apk-tools\", \"versionInfo\": \"2.12.7-r3\" }, { \"SPDXID\": \"SPDXRef-2b021966d19a8211\", \"filesAnalyzed\": false, \"licenseConcluded\": \"ISC AND (BSD-3-Clause OR MIT)\", \"licenseDeclared\": \"ISC AND (BSD-3-Clause OR MIT)\", \"name\": \"libretls\", \"versionInfo\": \"3.3.4-r3\" }, { \"SPDXID\": \"SPDXRef-317ce3476703f20d\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"busybox\", \"versionInfo\": \"1.34.1-r5\" }, { \"SPDXID\": \"SPDXRef-34f407fb4dbd67f4\", \"filesAnalyzed\": false, \"licenseConcluded\": \"OpenSSL\", \"licenseDeclared\": \"OpenSSL\", \"name\": \"libcrypto1.1\", \"versionInfo\": \"1.1.1n-r0\" }, { \"SPDXID\": \"SPDXRef-4bbc1cb449d54083\", \"filesAnalyzed\": false, \"licenseConcluded\": \"BSD-2-Clause AND BSD-3-Clause\", \"licenseDeclared\": \"BSD-2-Clause AND BSD-3-Clause\", \"name\": \"libc-utils\", \"versionInfo\": \"0.7.2-r3\" }, { \"SPDXID\": \"SPDXRef-a3bdd174be1456b6\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MIT\", \"licenseDeclared\": \"MIT\", \"name\": \"alpine-keys\", \"versionInfo\": \"2.4-r1\" }, { \"SPDXID\": \"SPDXRef-ac6472ba26fb991c\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MPL-2.0 AND MIT\", \"licenseDeclared\": \"MPL-2.0 AND MIT\", \"name\": \"ca-certificates-bundle\", \"versionInfo\": \"20211220-r0\" }, { \"SPDXID\": \"SPDXRef-b2d1b1d70fe90f7d\", \"filesAnalyzed\": false, \"licenseConcluded\": \"OpenSSL\", \"licenseDeclared\": \"OpenSSL\", \"name\": \"libssl1.1\", \"versionInfo\": \"1.1.1n-r0\" }, { \"SPDXID\": \"SPDXRef-c617077ba6649520\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"scanelf\", \"versionInfo\": \"1.3.3-r0\" }, { \"SPDXID\": \"SPDXRef-ca80b810029cde0e\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MIT\", \"licenseDeclared\": \"MIT\", \"name\": \"musl\", \"versionInfo\": \"1.2.2-r7\" }, { \"SPDXID\": \"SPDXRef-d782e64751ba9faa\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"alpine-baselayout\", \"versionInfo\": \"3.2.0-r18\" }, { \"SPDXID\": \"SPDXRef-e5e8a237f6162e22\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MIT BSD GPL2+\", \"licenseDeclared\": \"MIT BSD GPL2+\", \"name\": \"musl-utils\", \"versionInfo\": \"1.2.2-r7\" }, { \"SPDXID\": \"SPDXRef-fdf0ce84f6337be4\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"ssl_client\", \"versionInfo\": \"1.34.1-r5\" } ], \"spdxVersion\": \"SPDX-2.2\" }","title":"SPDX"},{"location":"docs/supply-chain/sbom/#scanning","text":"Trivy can take SBOM documents as input for scanning. See here for more details. Also, Trivy searches for SBOM files in container images. $ trivy image bitnami/elasticsearch:8.7.1 For example, Bitnami images contain SBOM files in /opt/bitnami directory. Trivy automatically detects the SBOM files and uses them for scanning. It is enabled in the following targets. Target Enabled Container Image \u2713 Filesystem Rootfs \u2713 Git Repository VM Image \u2713 Kubernetes AWS SBOM","title":"Scanning"},{"location":"docs/supply-chain/vex/","text":"Vulnerability Exploitability Exchange (VEX) EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy supports filtering detected vulnerabilities using the Vulnerability Exploitability Exchange (VEX) , a standardized format for sharing and exchanging information about vulnerabilities. By providing VEX alongside the Software Bill of Materials (SBOM) during scanning, it is possible to filter vulnerabilities based on their status. Currently, Trivy supports the following two formats: CycloneDX OpenVEX This is still an experimental implementation, with only minimal functionality added. CycloneDX There are two VEX formats for CycloneDX: Independent BOM and VEX BOM BOM With Embedded VEX Trivy only supports the Independent BOM and VEX BOM format, so you need to provide a separate VEX file alongside the SBOM. The input SBOM format must be in CycloneDX format. The following steps are required: Generate a CycloneDX SBOM Create a VEX based on the SBOM generated in step 1 Provide the VEX when scanning the CycloneDX SBOM Generating the SBOM You can generate a CycloneDX SBOM with Trivy as follows: $ trivy image --format cyclonedx --output debian11.sbom.cdx debian:11 Create the VEX Next, create a VEX based on the generated SBOM. Multiple vulnerability statuses can be defined under vulnerabilities . Take a look at the example below. $ cat <<EOF > trivy.vex.cdx { \"bomFormat\": \"CycloneDX\", \"specVersion\": \"1.5\", \"version\": 1, \"vulnerabilities\": [ { \"id\": \"CVE-2020-8911\", \"analysis\": { \"state\": \"not_affected\", \"justification\": \"code_not_reachable\", \"response\": [\"will_not_fix\", \"update\"], \"detail\": \"The vulnerable function is not called\" }, \"affects\": [ { \"ref\": \"urn:cdx:3e671687-395b-41f5-a30f-a58921a69b79/1#pkg:golang/github.com/aws/aws-sdk-go@1.44.234\" } ] } ] } EOF This is a VEX document in the CycloneDX format. The vulnerability ID, such as a CVE-ID or GHSA-ID, should be placed in vulnerabilities.id . When the analysis.state is set to not_affected , Trivy will not detect the vulnerability. BOM-Links must be placed in affects.ref . The BOM-Link has the following syntax and consists of three elements: urn:cdx:serialNumber/version#bom-ref serialNumber version bom-ref These values must be obtained from the CycloneDX SBOM. Please note that while the serialNumber starts with urn:uuid: , the BOM-Link starts with urn:cdx: . The bom-ref must contain the BOM-Ref of the package affected by the vulnerability. In the example above, since the Go package github.com/aws/aws-sdk-go is affected by CVE-2020-8911, it was necessary to specify the SBOM's BOM-Ref, pkg:golang/github.com/aws/aws-sdk-go@1.44.234 . For more details on CycloneDX VEX and BOM-Link, please refer to the following links: CycloneDX VEX BOM-Link Examples Scan SBOM with VEX Provide the VEX when scanning the CycloneDX SBOM. $ trivy sbom trivy.sbom.cdx --vex trivy.vex.cdx ... 2023-04-13T12:55:44.838+0300 INFO Filtered out the detected vulnerability {\"VEX format\": \"CycloneDX\", \"vulnerability-id\": \"CVE-2020-8911\", \"status\": \"not_affected\", \"justification\": \"code_not_reachable\"} go.mod (gomod) ============== Total: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 github.com/aws/aws-sdk-go \u2502 CVE-2020-8912 \u2502 LOW \u2502 1.44.234 \u2502 \u2502 aws-sdk-go: In-band key negotiation issue in AWS S3 Crypto \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 SDK for golang... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2020-8912 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 CVE-2020-8911 is no longer shown as it is filtered out according to the given CycloneDX VEX document. OpenVEX Trivy also supports OpenVEX that is designed to be minimal, compliant, interoperable, and embeddable. Since OpenVEX aims to be SBOM format agnostic, both CycloneDX and SPDX formats are available for use as input SBOMs in Trivy. The following steps are required: Generate a SBOM (CycloneDX or SPDX) Create a VEX based on the SBOM generated in step 1 Provide the VEX when scanning the SBOM Generating the SBOM You can generate a CycloneDX or SPDX SBOM with Trivy as follows: $ trivy image --format spdx-json --output debian11.spdx.json debian:11 Create the VEX Please see also the example . In Trivy, the Package URL (PURL) is used as the product identifier. $ cat <<EOF > debian11.openvex { \"@context\": \"https://openvex.dev/ns/v0.2.0\", \"@id\": \"https://openvex.dev/docs/public/vex-2e67563e128250cbcb3e98930df948dd053e43271d70dc50cfa22d57e03fe96f\", \"author\": \"Aqua Security\", \"timestamp\": \"2023-08-29T19:07:16.853479631-06:00\", \"version\": 1, \"statements\": [ { \"vulnerability\": {\"name\": \"CVE-2019-8457\"}, \"products\": [ {\"@id\": \"pkg:deb/debian/libdb5.3@5.3.28+dfsg1-0.8\"} ], \"status\": \"not_affected\", \"justification\": \"vulnerable_code_not_in_execute_path\" } ] } EOF In the above example, PURLs, located in packages.externalRefs.referenceLocator in SPDX are used for the product identifier. Note If a qualifier is specified in the PURL used as the product id in the VEX, the qualifier is compared. Other qualifiers are ignored in the comparison. pkg:deb/debian/curl@7.50.3-1 in OpenVEX matches pkg:deb/debian/curl@7.50.3-1?arch=i386 , while pkg:deb/debian/curl@7.50.3-1?arch=amd64 does not match pkg:deb/debian/curl@7.50.3-1?arch=i386 . Scan SBOM with VEX Provide the VEX when scanning the SBOM. $ trivy sbom debian11.spdx.json --vex debian11.openvex ... 2023-04-26T17:56:05.358+0300 INFO Filtered out the detected vulnerability {\"VEX format\": \"OpenVEX\", \"vulnerability-id\": \"CVE-2019-8457\", \"status\": \"not_affected\", \"justification\": \"vulnerable_code_not_in_execute_path\"} debian11.spdx.json (debian 11.6) ================================ Total: 80 (UNKNOWN: 0, LOW: 58, MEDIUM: 6, HIGH: 16, CRITICAL: 0) CVE-2019-8457 is no longer shown as it is filtered out according to the given OpenVEX document.","title":"VEX"},{"location":"docs/supply-chain/vex/#vulnerability-exploitability-exchange-vex","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy supports filtering detected vulnerabilities using the Vulnerability Exploitability Exchange (VEX) , a standardized format for sharing and exchanging information about vulnerabilities. By providing VEX alongside the Software Bill of Materials (SBOM) during scanning, it is possible to filter vulnerabilities based on their status. Currently, Trivy supports the following two formats: CycloneDX OpenVEX This is still an experimental implementation, with only minimal functionality added.","title":"Vulnerability Exploitability Exchange (VEX)"},{"location":"docs/supply-chain/vex/#cyclonedx","text":"There are two VEX formats for CycloneDX: Independent BOM and VEX BOM BOM With Embedded VEX Trivy only supports the Independent BOM and VEX BOM format, so you need to provide a separate VEX file alongside the SBOM. The input SBOM format must be in CycloneDX format. The following steps are required: Generate a CycloneDX SBOM Create a VEX based on the SBOM generated in step 1 Provide the VEX when scanning the CycloneDX SBOM","title":"CycloneDX"},{"location":"docs/supply-chain/vex/#generating-the-sbom","text":"You can generate a CycloneDX SBOM with Trivy as follows: $ trivy image --format cyclonedx --output debian11.sbom.cdx debian:11","title":"Generating the SBOM"},{"location":"docs/supply-chain/vex/#create-the-vex","text":"Next, create a VEX based on the generated SBOM. Multiple vulnerability statuses can be defined under vulnerabilities . Take a look at the example below. $ cat <<EOF > trivy.vex.cdx { \"bomFormat\": \"CycloneDX\", \"specVersion\": \"1.5\", \"version\": 1, \"vulnerabilities\": [ { \"id\": \"CVE-2020-8911\", \"analysis\": { \"state\": \"not_affected\", \"justification\": \"code_not_reachable\", \"response\": [\"will_not_fix\", \"update\"], \"detail\": \"The vulnerable function is not called\" }, \"affects\": [ { \"ref\": \"urn:cdx:3e671687-395b-41f5-a30f-a58921a69b79/1#pkg:golang/github.com/aws/aws-sdk-go@1.44.234\" } ] } ] } EOF This is a VEX document in the CycloneDX format. The vulnerability ID, such as a CVE-ID or GHSA-ID, should be placed in vulnerabilities.id . When the analysis.state is set to not_affected , Trivy will not detect the vulnerability. BOM-Links must be placed in affects.ref . The BOM-Link has the following syntax and consists of three elements: urn:cdx:serialNumber/version#bom-ref serialNumber version bom-ref These values must be obtained from the CycloneDX SBOM. Please note that while the serialNumber starts with urn:uuid: , the BOM-Link starts with urn:cdx: . The bom-ref must contain the BOM-Ref of the package affected by the vulnerability. In the example above, since the Go package github.com/aws/aws-sdk-go is affected by CVE-2020-8911, it was necessary to specify the SBOM's BOM-Ref, pkg:golang/github.com/aws/aws-sdk-go@1.44.234 . For more details on CycloneDX VEX and BOM-Link, please refer to the following links: CycloneDX VEX BOM-Link Examples","title":"Create the VEX"},{"location":"docs/supply-chain/vex/#scan-sbom-with-vex","text":"Provide the VEX when scanning the CycloneDX SBOM. $ trivy sbom trivy.sbom.cdx --vex trivy.vex.cdx ... 2023-04-13T12:55:44.838+0300 INFO Filtered out the detected vulnerability {\"VEX format\": \"CycloneDX\", \"vulnerability-id\": \"CVE-2020-8911\", \"status\": \"not_affected\", \"justification\": \"code_not_reachable\"} go.mod (gomod) ============== Total: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 github.com/aws/aws-sdk-go \u2502 CVE-2020-8912 \u2502 LOW \u2502 1.44.234 \u2502 \u2502 aws-sdk-go: In-band key negotiation issue in AWS S3 Crypto \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 SDK for golang... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2020-8912 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 CVE-2020-8911 is no longer shown as it is filtered out according to the given CycloneDX VEX document.","title":"Scan SBOM with VEX"},{"location":"docs/supply-chain/vex/#openvex","text":"Trivy also supports OpenVEX that is designed to be minimal, compliant, interoperable, and embeddable. Since OpenVEX aims to be SBOM format agnostic, both CycloneDX and SPDX formats are available for use as input SBOMs in Trivy. The following steps are required: Generate a SBOM (CycloneDX or SPDX) Create a VEX based on the SBOM generated in step 1 Provide the VEX when scanning the SBOM","title":"OpenVEX"},{"location":"docs/supply-chain/vex/#generating-the-sbom_1","text":"You can generate a CycloneDX or SPDX SBOM with Trivy as follows: $ trivy image --format spdx-json --output debian11.spdx.json debian:11","title":"Generating the SBOM"},{"location":"docs/supply-chain/vex/#create-the-vex_1","text":"Please see also the example . In Trivy, the Package URL (PURL) is used as the product identifier. $ cat <<EOF > debian11.openvex { \"@context\": \"https://openvex.dev/ns/v0.2.0\", \"@id\": \"https://openvex.dev/docs/public/vex-2e67563e128250cbcb3e98930df948dd053e43271d70dc50cfa22d57e03fe96f\", \"author\": \"Aqua Security\", \"timestamp\": \"2023-08-29T19:07:16.853479631-06:00\", \"version\": 1, \"statements\": [ { \"vulnerability\": {\"name\": \"CVE-2019-8457\"}, \"products\": [ {\"@id\": \"pkg:deb/debian/libdb5.3@5.3.28+dfsg1-0.8\"} ], \"status\": \"not_affected\", \"justification\": \"vulnerable_code_not_in_execute_path\" } ] } EOF In the above example, PURLs, located in packages.externalRefs.referenceLocator in SPDX are used for the product identifier. Note If a qualifier is specified in the PURL used as the product id in the VEX, the qualifier is compared. Other qualifiers are ignored in the comparison. pkg:deb/debian/curl@7.50.3-1 in OpenVEX matches pkg:deb/debian/curl@7.50.3-1?arch=i386 , while pkg:deb/debian/curl@7.50.3-1?arch=amd64 does not match pkg:deb/debian/curl@7.50.3-1?arch=i386 .","title":"Create the VEX"},{"location":"docs/supply-chain/vex/#scan-sbom-with-vex_1","text":"Provide the VEX when scanning the SBOM. $ trivy sbom debian11.spdx.json --vex debian11.openvex ... 2023-04-26T17:56:05.358+0300 INFO Filtered out the detected vulnerability {\"VEX format\": \"OpenVEX\", \"vulnerability-id\": \"CVE-2019-8457\", \"status\": \"not_affected\", \"justification\": \"vulnerable_code_not_in_execute_path\"} debian11.spdx.json (debian 11.6) ================================ Total: 80 (UNKNOWN: 0, LOW: 58, MEDIUM: 6, HIGH: 16, CRITICAL: 0) CVE-2019-8457 is no longer shown as it is filtered out according to the given OpenVEX document.","title":"Scan SBOM with VEX"},{"location":"docs/supply-chain/attestation/rekor/","text":"Scan SBOM attestation in Rekor EXPERIMENTAL This feature might change without preserving backwards compatibility. Container images Trivy can retrieve SBOM attestation of the specified container image in the Rekor instance and scan it for vulnerabilities. Prerequisites SBOM attestation stored in Rekor See the \"Keyless signing\" section if you want to upload your SBOM attestation to Rekor. Scanning You need to pass --sbom-sources rekor so that Trivy will look for SBOM attestation in Rekor. Note --sbom-sources can be used only with trivy image at the moment. $ trivy image --sbom-sources rekor otms61/alpine:3.7.3 [ ~/src/github.com/aquasecurity/trivy ] 2022 -09-16T17:37:13.258+0900 INFO Vulnerability scanning is enabled 2022 -09-16T17:37:13.258+0900 INFO Secret scanning is enabled 2022 -09-16T17:37:13.258+0900 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2022 -09-16T17:37:13.258+0900 INFO Please see also https://aquasecurity.github.io/trivy/dev/docs/secret/scanning/#recommendation for faster secret detection 2022 -09-16T17:37:14.827+0900 INFO Detected SBOM format: cyclonedx-json 2022 -09-16T17:37:14.901+0900 INFO Found SBOM ( cyclonedx ) attestation in Rekor 2022 -09-16T17:37:14.903+0900 INFO Detected OS: alpine 2022 -09-16T17:37:14.903+0900 INFO Detecting Alpine vulnerabilities... 2022 -09-16T17:37:14.907+0900 INFO Number of language-specific files: 0 2022 -09-16T17:37:14.908+0900 WARN This OS version is no longer supported by the distribution: alpine 3 .7.3 2022 -09-16T17:37:14.908+0900 WARN The vulnerability detection may be insufficient because security updates are not provided otms61/alpine:3.7.3 ( alpine 3 .7.3 ) ================================== Total: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 musl \u2502 CVE-2019-14697 \u2502 CRITICAL \u2502 1 .1.18-r3 \u2502 1 .1.18-r4 \u2502 musl libc through 1 .1.23 has an x87 floating-point stack \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 adjustment im ...... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-14697 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 If you have your own Rekor instance, you can specify the URL via --rekor-url . $ trivy image --sbom-sources rekor --rekor-url https://my-rekor.dev otms61/alpine:3.7.3 Non-packaged binaries Trivy can retrieve SBOM attestation of non-packaged binaries in the Rekor instance and scan it for vulnerabilities. Prerequisites SBOM attestation stored in Rekor See the \"Keyless signing\" section if you want to upload your SBOM attestation to Rekor. Cosign currently does not support keyless signing for blob attestation, so use our plugin at the moment. This example uses a cat clone bat written in Rust. You need to generate SBOM from lock files like Cargo.lock at first. $ git clone -b v0.20.0 https://github.com/sharkdp/bat $ trivy fs --format cyclonedx --output bat.cdx ./bat/Cargo.lock Then our attestation plugin allows you to store the SBOM attestation linking to a bat binary in the Rekor instance. $ wget https://github.com/sharkdp/bat/releases/download/v0.20.0/bat-v0.20.0-x86_64-apple-darwin.tar.gz $ tar xvf bat-v0.20.0-x86_64-apple-darwin.tar.gz $ trivy plugin install github.com/aquasecurity/trivy-plugin-attest $ trivy attest --predicate ./bat.cdx --type cyclonedx ./bat-v0.20.0-x86_64-apple-darwin/bat Note The public instance of the Rekor maintained by the Sigstore team limits the attestation size. If you are using the public instance, please make sure that your SBOM is small enough. To get more detail, please refer to the Rekor project's documentation . Scan a non-packaged binary Trivy calculates the digest of the bat binary and searches for the SBOM attestation by the digest in Rekor. If it is found, Trivy uses that for vulnerability scanning. $ trivy fs --sbom-sources rekor ./bat-v0.20.0-x86_64-apple-darwin/bat 2022 -10-25T13:27:25.950+0300 INFO Found SBOM attestation in Rekor: bat 2022 -10-25T13:27:25.993+0300 INFO Number of language-specific files: 1 2022 -10-25T13:27:25.993+0300 INFO Detecting cargo vulnerabilities... bat ( cargo ) =========== Total: 1 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 1 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 regex \u2502 CVE-2022-24713 \u2502 HIGH \u2502 1 .5.4 \u2502 1 .5.5 \u2502 Mozilla: Denial of Service via complex regular expressions \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-24713 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Also, it is applied to non-packaged binaries even in container images. $ trivy image --sbom-sources rekor --scanners vuln alpine-with-bat 2022 -10-25T13:40:14.920+0300 INFO Vulnerability scanning is enabled 2022 -10-25T13:40:18.047+0300 INFO Found SBOM attestation in Rekor: bat 2022 -10-25T13:40:18.186+0300 INFO Detected OS: alpine 2022 -10-25T13:40:18.186+0300 INFO Detecting Alpine vulnerabilities... 2022 -10-25T13:40:18.199+0300 INFO Number of language-specific files: 1 2022 -10-25T13:40:18.199+0300 INFO Detecting cargo vulnerabilities... alpine-with-bat ( alpine 3 .15.6 ) =============================== Total: 0 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 ) bat ( cargo ) =========== Total: 4 ( UNKNOWN: 3 , LOW: 0 , MEDIUM: 0 , HIGH: 1 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 regex \u2502 CVE-2022-24713 \u2502 HIGH \u2502 1 .5.4 \u2502 1 .5.5 \u2502 Mozilla: Denial of Service via complex regular expressions \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-24713 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Note The --sbom-sources rekor flag slows down the scanning as it queries Rekor on the Internet for all non-packaged binaries.","title":"SBOM Attestation in Rekor"},{"location":"docs/supply-chain/attestation/rekor/#scan-sbom-attestation-in-rekor","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility.","title":"Scan SBOM attestation in Rekor"},{"location":"docs/supply-chain/attestation/rekor/#container-images","text":"Trivy can retrieve SBOM attestation of the specified container image in the Rekor instance and scan it for vulnerabilities.","title":"Container images"},{"location":"docs/supply-chain/attestation/rekor/#prerequisites","text":"SBOM attestation stored in Rekor See the \"Keyless signing\" section if you want to upload your SBOM attestation to Rekor.","title":"Prerequisites"},{"location":"docs/supply-chain/attestation/rekor/#scanning","text":"You need to pass --sbom-sources rekor so that Trivy will look for SBOM attestation in Rekor. Note --sbom-sources can be used only with trivy image at the moment. $ trivy image --sbom-sources rekor otms61/alpine:3.7.3 [ ~/src/github.com/aquasecurity/trivy ] 2022 -09-16T17:37:13.258+0900 INFO Vulnerability scanning is enabled 2022 -09-16T17:37:13.258+0900 INFO Secret scanning is enabled 2022 -09-16T17:37:13.258+0900 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2022 -09-16T17:37:13.258+0900 INFO Please see also https://aquasecurity.github.io/trivy/dev/docs/secret/scanning/#recommendation for faster secret detection 2022 -09-16T17:37:14.827+0900 INFO Detected SBOM format: cyclonedx-json 2022 -09-16T17:37:14.901+0900 INFO Found SBOM ( cyclonedx ) attestation in Rekor 2022 -09-16T17:37:14.903+0900 INFO Detected OS: alpine 2022 -09-16T17:37:14.903+0900 INFO Detecting Alpine vulnerabilities... 2022 -09-16T17:37:14.907+0900 INFO Number of language-specific files: 0 2022 -09-16T17:37:14.908+0900 WARN This OS version is no longer supported by the distribution: alpine 3 .7.3 2022 -09-16T17:37:14.908+0900 WARN The vulnerability detection may be insufficient because security updates are not provided otms61/alpine:3.7.3 ( alpine 3 .7.3 ) ================================== Total: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 musl \u2502 CVE-2019-14697 \u2502 CRITICAL \u2502 1 .1.18-r3 \u2502 1 .1.18-r4 \u2502 musl libc through 1 .1.23 has an x87 floating-point stack \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 adjustment im ...... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-14697 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 If you have your own Rekor instance, you can specify the URL via --rekor-url . $ trivy image --sbom-sources rekor --rekor-url https://my-rekor.dev otms61/alpine:3.7.3","title":"Scanning"},{"location":"docs/supply-chain/attestation/rekor/#non-packaged-binaries","text":"Trivy can retrieve SBOM attestation of non-packaged binaries in the Rekor instance and scan it for vulnerabilities.","title":"Non-packaged binaries"},{"location":"docs/supply-chain/attestation/rekor/#prerequisites_1","text":"SBOM attestation stored in Rekor See the \"Keyless signing\" section if you want to upload your SBOM attestation to Rekor. Cosign currently does not support keyless signing for blob attestation, so use our plugin at the moment. This example uses a cat clone bat written in Rust. You need to generate SBOM from lock files like Cargo.lock at first. $ git clone -b v0.20.0 https://github.com/sharkdp/bat $ trivy fs --format cyclonedx --output bat.cdx ./bat/Cargo.lock Then our attestation plugin allows you to store the SBOM attestation linking to a bat binary in the Rekor instance. $ wget https://github.com/sharkdp/bat/releases/download/v0.20.0/bat-v0.20.0-x86_64-apple-darwin.tar.gz $ tar xvf bat-v0.20.0-x86_64-apple-darwin.tar.gz $ trivy plugin install github.com/aquasecurity/trivy-plugin-attest $ trivy attest --predicate ./bat.cdx --type cyclonedx ./bat-v0.20.0-x86_64-apple-darwin/bat Note The public instance of the Rekor maintained by the Sigstore team limits the attestation size. If you are using the public instance, please make sure that your SBOM is small enough. To get more detail, please refer to the Rekor project's documentation .","title":"Prerequisites"},{"location":"docs/supply-chain/attestation/rekor/#scan-a-non-packaged-binary","text":"Trivy calculates the digest of the bat binary and searches for the SBOM attestation by the digest in Rekor. If it is found, Trivy uses that for vulnerability scanning. $ trivy fs --sbom-sources rekor ./bat-v0.20.0-x86_64-apple-darwin/bat 2022 -10-25T13:27:25.950+0300 INFO Found SBOM attestation in Rekor: bat 2022 -10-25T13:27:25.993+0300 INFO Number of language-specific files: 1 2022 -10-25T13:27:25.993+0300 INFO Detecting cargo vulnerabilities... bat ( cargo ) =========== Total: 1 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 1 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 regex \u2502 CVE-2022-24713 \u2502 HIGH \u2502 1 .5.4 \u2502 1 .5.5 \u2502 Mozilla: Denial of Service via complex regular expressions \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-24713 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Also, it is applied to non-packaged binaries even in container images. $ trivy image --sbom-sources rekor --scanners vuln alpine-with-bat 2022 -10-25T13:40:14.920+0300 INFO Vulnerability scanning is enabled 2022 -10-25T13:40:18.047+0300 INFO Found SBOM attestation in Rekor: bat 2022 -10-25T13:40:18.186+0300 INFO Detected OS: alpine 2022 -10-25T13:40:18.186+0300 INFO Detecting Alpine vulnerabilities... 2022 -10-25T13:40:18.199+0300 INFO Number of language-specific files: 1 2022 -10-25T13:40:18.199+0300 INFO Detecting cargo vulnerabilities... alpine-with-bat ( alpine 3 .15.6 ) =============================== Total: 0 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 ) bat ( cargo ) =========== Total: 4 ( UNKNOWN: 3 , LOW: 0 , MEDIUM: 0 , HIGH: 1 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 regex \u2502 CVE-2022-24713 \u2502 HIGH \u2502 1 .5.4 \u2502 1 .5.5 \u2502 Mozilla: Denial of Service via complex regular expressions \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-24713 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Note The --sbom-sources rekor flag slows down the scanning as it queries Rekor on the Internet for all non-packaged binaries.","title":"Scan a non-packaged binary"},{"location":"docs/supply-chain/attestation/sbom/","text":"SBOM attestation Cosign supports generating and verifying in-toto attestations . This tool enables you to sign and verify SBOM attestation. And, Trivy can take an SBOM attestation as input and scan for vulnerabilities Note In the following examples, the cosign command will write an attestation to a target OCI registry, so you must have permission to write. If you want to avoid writing an OCI registry and only want to see an attestation, add the --no-upload option to the cosign command. Sign with a local key pair Cosign can generate key pairs and use them for signing and verification. After you run the following command, you will get a public and private key pair. Read more about how to generate key pairs . $ cosign generate-key-pair In the following example, Trivy generates an SBOM in the CycloneDX format, and then Cosign attaches an attestation of the SBOM to a container image with a local key pair. # The cyclonedx type is supported in Cosign v1.10.0 or later. $ trivy image --format cyclonedx -o sbom.cdx.json <IMAGE> $ cosign attest --key /path/to/cosign.key --type cyclonedx --predicate sbom.cdx.json <IMAGE> Then, you can verify attestations on the image. $ cosign verify-attestation --key /path/to/cosign.pub --type cyclonedx <IMAGE> You can also create attestations of other formatted SBOM. # spdx $ trivy image --format spdx -o sbom.spdx <IMAGE> $ cosign attest --key /path/to/cosign.key --type spdx --predicate sbom.spdx <IMAGE> # spdx-json $ trivy image --format spdx-json -o sbom.spdx.json <IMAGE> $ cosign attest --key /path/to/cosign.key --type spdx --predicate sbom.spdx.json <IMAGE> Keyless signing You can use Cosign to sign without keys by authenticating with an OpenID Connect protocol supported by sigstore (Google, GitHub, or Microsoft). # The cyclonedx type is supported in Cosign v1.10.0 or later. $ trivy image --format cyclonedx -o sbom.cdx.json <IMAGE> # The following command uploads SBOM attestation to the public Rekor instance. $ COSIGN_EXPERIMENTAL = 1 cosign attest --type cyclonedx --predicate sbom.cdx.json <IMAGE> You can verify attestations. $ COSIGN_EXPERIMENTAL = 1 cosign verify-attestation --type cyclonedx <IMAGE> Scanning Trivy can take an SBOM attestation as input and scan for vulnerabilities. Currently, Trivy supports CycloneDX-type attestation. In the following example, Cosign can get an CycloneDX-type attestation and trivy scan it. You must create CycloneDX-type attestation before trying the example. To learn more about how to create an CycloneDX-Type attestation and attach it to an image, see the Sign with a local key pair section. $ cosign verify-attestation --key /path/to/cosign.pub --type cyclonedx <IMAGE> > sbom.cdx.intoto.jsonl $ trivy sbom ./sbom.cdx.intoto.jsonl sbom.cdx.intoto.jsonl ( alpine 3 .7.3 ) ========================= Total: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 musl \u2502 CVE-2019-14697 \u2502 CRITICAL \u2502 1 .1.18-r3 \u2502 1 .1.18-r4 \u2502 musl libc through 1 .1.23 has an x87 floating-point stack \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 adjustment im ...... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-14697 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"SBOM"},{"location":"docs/supply-chain/attestation/sbom/#sbom-attestation","text":"Cosign supports generating and verifying in-toto attestations . This tool enables you to sign and verify SBOM attestation. And, Trivy can take an SBOM attestation as input and scan for vulnerabilities Note In the following examples, the cosign command will write an attestation to a target OCI registry, so you must have permission to write. If you want to avoid writing an OCI registry and only want to see an attestation, add the --no-upload option to the cosign command.","title":"SBOM attestation"},{"location":"docs/supply-chain/attestation/sbom/#sign-with-a-local-key-pair","text":"Cosign can generate key pairs and use them for signing and verification. After you run the following command, you will get a public and private key pair. Read more about how to generate key pairs . $ cosign generate-key-pair In the following example, Trivy generates an SBOM in the CycloneDX format, and then Cosign attaches an attestation of the SBOM to a container image with a local key pair. # The cyclonedx type is supported in Cosign v1.10.0 or later. $ trivy image --format cyclonedx -o sbom.cdx.json <IMAGE> $ cosign attest --key /path/to/cosign.key --type cyclonedx --predicate sbom.cdx.json <IMAGE> Then, you can verify attestations on the image. $ cosign verify-attestation --key /path/to/cosign.pub --type cyclonedx <IMAGE> You can also create attestations of other formatted SBOM. # spdx $ trivy image --format spdx -o sbom.spdx <IMAGE> $ cosign attest --key /path/to/cosign.key --type spdx --predicate sbom.spdx <IMAGE> # spdx-json $ trivy image --format spdx-json -o sbom.spdx.json <IMAGE> $ cosign attest --key /path/to/cosign.key --type spdx --predicate sbom.spdx.json <IMAGE>","title":"Sign with a local key pair"},{"location":"docs/supply-chain/attestation/sbom/#keyless-signing","text":"You can use Cosign to sign without keys by authenticating with an OpenID Connect protocol supported by sigstore (Google, GitHub, or Microsoft). # The cyclonedx type is supported in Cosign v1.10.0 or later. $ trivy image --format cyclonedx -o sbom.cdx.json <IMAGE> # The following command uploads SBOM attestation to the public Rekor instance. $ COSIGN_EXPERIMENTAL = 1 cosign attest --type cyclonedx --predicate sbom.cdx.json <IMAGE> You can verify attestations. $ COSIGN_EXPERIMENTAL = 1 cosign verify-attestation --type cyclonedx <IMAGE>","title":"Keyless signing"},{"location":"docs/supply-chain/attestation/sbom/#scanning","text":"Trivy can take an SBOM attestation as input and scan for vulnerabilities. Currently, Trivy supports CycloneDX-type attestation. In the following example, Cosign can get an CycloneDX-type attestation and trivy scan it. You must create CycloneDX-type attestation before trying the example. To learn more about how to create an CycloneDX-Type attestation and attach it to an image, see the Sign with a local key pair section. $ cosign verify-attestation --key /path/to/cosign.pub --type cyclonedx <IMAGE> > sbom.cdx.intoto.jsonl $ trivy sbom ./sbom.cdx.intoto.jsonl sbom.cdx.intoto.jsonl ( alpine 3 .7.3 ) ========================= Total: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 musl \u2502 CVE-2019-14697 \u2502 CRITICAL \u2502 1 .1.18-r3 \u2502 1 .1.18-r4 \u2502 musl libc through 1 .1.23 has an x87 floating-point stack \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 adjustment im ...... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-14697 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"Scanning"},{"location":"docs/supply-chain/attestation/vuln/","text":"Cosign Vulnerability Attestation Generate Cosign Vulnerability Scan Record Trivy generates reports in the Cosign vulnerability scan record format . You can use the regular subcommands (like image, fs and rootfs) and specify cosign-vuln with the --format option. $ trivy image --format cosign-vuln --output vuln.json alpine:3.10 Result { \"invocation\" : { \"parameters\" : null , \"uri\" : \"\" , \"event_id\" : \"\" , \"builder.id\" : \"\" }, \"scanner\" : { \"uri\" : \"pkg:github/aquasecurity/trivy@v0.30.1-8-gf9cb8a28\" , \"version\" : \"v0.30.1-8-gf9cb8a28\" , \"db\" : { \"uri\" : \"\" , \"version\" : \"\" }, \"result\" : { \"SchemaVersion\" : 2 , \"ArtifactName\" : \"alpine:3.10\" , \"ArtifactType\" : \"container_image\" , \"Metadata\" : { \"OS\" : { \"Family\" : \"alpine\" , \"Name\" : \"3.10.9\" , \"EOSL\" : true }, \"ImageID\" : \"sha256:e7b300aee9f9bf3433d32bc9305bfdd22183beb59d933b48d77ab56ba53a197a\" , \"DiffIDs\" : [ \"sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635\" ], \"RepoTags\" : [ \"alpine:3.10\" ], \"RepoDigests\" : [ \"alpine@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98\" ], \"ImageConfig\" : { \"architecture\" : \"amd64\" , \"container\" : \"fdb7e80e3339e8d0599282e606c907aa5881ee4c668a68136119e6dfac6ce3a4\" , \"created\" : \"2021-04-14T19:20:05.338397761Z\" , \"docker_version\" : \"19.03.12\" , \"history\" : [ { \"created\" : \"2021-04-14T19:20:04.987219124Z\" , \"created_by\" : \"/bin/sh -c #(nop) ADD file:c5377eaa926bf412dd8d4a08b0a1f2399cfd708743533b0aa03b53d14cb4bb4e in / \" }, { \"created\" : \"2021-04-14T19:20:05.338397761Z\" , \"created_by\" : \"/bin/sh -c #(nop) CMD [\\\"/bin/sh\\\"]\" , \"empty_layer\" : true } ], \"os\" : \"linux\" , \"rootfs\" : { \"type\" : \"layers\" , \"diff_ids\" : [ \"sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635\" ] }, \"config\" : { \"Cmd\" : [ \"/bin/sh\" ], \"Env\" : [ \"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\" ], \"Image\" : \"sha256:eb2080c455e94c22ae35b3aef9e078c492a00795412e026e4d6b41ef64bc7dd8\" } } }, \"Results\" : [ { \"Target\" : \"alpine:3.10 (alpine 3.10.9)\" , \"Class\" : \"os-pkgs\" , \"Type\" : \"alpine\" , \"Vulnerabilities\" : [ { \"VulnerabilityID\" : \"CVE-2021-36159\" , \"PkgName\" : \"apk-tools\" , \"InstalledVersion\" : \"2.10.6-r0\" , \"FixedVersion\" : \"2.10.7-r0\" , \"Layer\" : { \"Digest\" : \"sha256:396c31837116ac290458afcb928f68b6cc1c7bdd6963fc72f52f365a2a89c1b5\" , \"DiffID\" : \"sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635\" }, \"SeveritySource\" : \"nvd\" , \"PrimaryURL\" : \"https://avd.aquasec.com/nvd/cve-2021-36159\" , \"DataSource\" : { \"ID\" : \"alpine\" , \"Name\" : \"Alpine Secdb\" , \"URL\" : \"https://secdb.alpinelinux.org/\" }, \"Description\" : \"libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\\\\0' terminator one byte too late.\" , \"Severity\" : \"CRITICAL\" , \"CweIDs\" : [ \"CWE-125\" ], \"CVSS\" : { \"nvd\" : { \"V2Vector\" : \"AV:N/AC:L/Au:N/C:P/I:N/A:P\" , \"V3Vector\" : \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\" , \"V2Score\" : 6.4 , \"V3Score\" : 9.1 } }, \"References\" : [ \"https://github.com/freebsd/freebsd-src/commits/main/lib/libfetch\" , \"https://gitlab.alpinelinux.org/alpine/apk-tools/-/issues/10749\" , \"https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E\" , \"https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E\" , \"https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E\" , \"https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E\" ], \"PublishedDate\" : \"2021-08-03T14:15:00Z\" , \"LastModifiedDate\" : \"2021-10-18T12:19:00Z\" } ] } ] } }, \"metadata\" : { \"scanStartedOn\" : \"2022-07-24T17:14:04.864682+09:00\" , \"scanFinishedOn\" : \"2022-07-24T17:14:04.864682+09:00\" } } Create Cosign Vulnerability Attestation Cosign supports generating and verifying in-toto attestations . This tool enables you to sign and verify Cosign vulnerability attestation. Note In the following examples, the cosign command will write an attestation to a target OCI registry, so you must have permission to write. If you want to avoid writing an OCI registry and only want to see an attestation, add the --no-upload option to the cosign command. Sign with a local key pair Cosign can generate key pairs and use them for signing and verification. After you run the following command, you will get a public and private key pair. Read more about how to generate key pairs . $ cosign generate-key-pair In the following example, Trivy generates a cosign vulnerability scan record, and then Cosign attaches an attestation of it to a container image with a local key pair. $ trivy image --format cosign-vuln --output vuln.json <IMAGE> $ cosign attest --key /path/to/cosign.key --type vuln --predicate vuln.json <IMAGE> Then, you can verify attestations on the image. $ cosign verify-attestation --key /path/to/cosign.pub --type vuln <IMAGE> Keyless signing You can use Cosign to sign without keys by authenticating with an OpenID Connect protocol supported by sigstore (Google, GitHub, or Microsoft). $ trivy image --format cosign-vuln -o vuln.json <IMAGE> $ COSIGN_EXPERIMENTAL=1 cosign attest --type vuln --predicate vuln.json <IMAGE> You can verify attestations. $ COSIGN_EXPERIMENTAL=1 cosign verify-attestation --type vuln <IMAGE>","title":"Cosign Vulnerability Scan Record"},{"location":"docs/supply-chain/attestation/vuln/#cosign-vulnerability-attestation","text":"","title":"Cosign Vulnerability Attestation"},{"location":"docs/supply-chain/attestation/vuln/#generate-cosign-vulnerability-scan-record","text":"Trivy generates reports in the Cosign vulnerability scan record format . You can use the regular subcommands (like image, fs and rootfs) and specify cosign-vuln with the --format option. $ trivy image --format cosign-vuln --output vuln.json alpine:3.10 Result { \"invocation\" : { \"parameters\" : null , \"uri\" : \"\" , \"event_id\" : \"\" , \"builder.id\" : \"\" }, \"scanner\" : { \"uri\" : \"pkg:github/aquasecurity/trivy@v0.30.1-8-gf9cb8a28\" , \"version\" : \"v0.30.1-8-gf9cb8a28\" , \"db\" : { \"uri\" : \"\" , \"version\" : \"\" }, \"result\" : { \"SchemaVersion\" : 2 , \"ArtifactName\" : \"alpine:3.10\" , \"ArtifactType\" : \"container_image\" , \"Metadata\" : { \"OS\" : { \"Family\" : \"alpine\" , \"Name\" : \"3.10.9\" , \"EOSL\" : true }, \"ImageID\" : \"sha256:e7b300aee9f9bf3433d32bc9305bfdd22183beb59d933b48d77ab56ba53a197a\" , \"DiffIDs\" : [ \"sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635\" ], \"RepoTags\" : [ \"alpine:3.10\" ], \"RepoDigests\" : [ \"alpine@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98\" ], \"ImageConfig\" : { \"architecture\" : \"amd64\" , \"container\" : \"fdb7e80e3339e8d0599282e606c907aa5881ee4c668a68136119e6dfac6ce3a4\" , \"created\" : \"2021-04-14T19:20:05.338397761Z\" , \"docker_version\" : \"19.03.12\" , \"history\" : [ { \"created\" : \"2021-04-14T19:20:04.987219124Z\" , \"created_by\" : \"/bin/sh -c #(nop) ADD file:c5377eaa926bf412dd8d4a08b0a1f2399cfd708743533b0aa03b53d14cb4bb4e in / \" }, { \"created\" : \"2021-04-14T19:20:05.338397761Z\" , \"created_by\" : \"/bin/sh -c #(nop) CMD [\\\"/bin/sh\\\"]\" , \"empty_layer\" : true } ], \"os\" : \"linux\" , \"rootfs\" : { \"type\" : \"layers\" , \"diff_ids\" : [ \"sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635\" ] }, \"config\" : { \"Cmd\" : [ \"/bin/sh\" ], \"Env\" : [ \"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\" ], \"Image\" : \"sha256:eb2080c455e94c22ae35b3aef9e078c492a00795412e026e4d6b41ef64bc7dd8\" } } }, \"Results\" : [ { \"Target\" : \"alpine:3.10 (alpine 3.10.9)\" , \"Class\" : \"os-pkgs\" , \"Type\" : \"alpine\" , \"Vulnerabilities\" : [ { \"VulnerabilityID\" : \"CVE-2021-36159\" , \"PkgName\" : \"apk-tools\" , \"InstalledVersion\" : \"2.10.6-r0\" , \"FixedVersion\" : \"2.10.7-r0\" , \"Layer\" : { \"Digest\" : \"sha256:396c31837116ac290458afcb928f68b6cc1c7bdd6963fc72f52f365a2a89c1b5\" , \"DiffID\" : \"sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635\" }, \"SeveritySource\" : \"nvd\" , \"PrimaryURL\" : \"https://avd.aquasec.com/nvd/cve-2021-36159\" , \"DataSource\" : { \"ID\" : \"alpine\" , \"Name\" : \"Alpine Secdb\" , \"URL\" : \"https://secdb.alpinelinux.org/\" }, \"Description\" : \"libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\\\\0' terminator one byte too late.\" , \"Severity\" : \"CRITICAL\" , \"CweIDs\" : [ \"CWE-125\" ], \"CVSS\" : { \"nvd\" : { \"V2Vector\" : \"AV:N/AC:L/Au:N/C:P/I:N/A:P\" , \"V3Vector\" : \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\" , \"V2Score\" : 6.4 , \"V3Score\" : 9.1 } }, \"References\" : [ \"https://github.com/freebsd/freebsd-src/commits/main/lib/libfetch\" , \"https://gitlab.alpinelinux.org/alpine/apk-tools/-/issues/10749\" , \"https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E\" , \"https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E\" , \"https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E\" , \"https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E\" ], \"PublishedDate\" : \"2021-08-03T14:15:00Z\" , \"LastModifiedDate\" : \"2021-10-18T12:19:00Z\" } ] } ] } }, \"metadata\" : { \"scanStartedOn\" : \"2022-07-24T17:14:04.864682+09:00\" , \"scanFinishedOn\" : \"2022-07-24T17:14:04.864682+09:00\" } }","title":"Generate Cosign Vulnerability Scan Record"},{"location":"docs/supply-chain/attestation/vuln/#create-cosign-vulnerability-attestation","text":"Cosign supports generating and verifying in-toto attestations . This tool enables you to sign and verify Cosign vulnerability attestation. Note In the following examples, the cosign command will write an attestation to a target OCI registry, so you must have permission to write. If you want to avoid writing an OCI registry and only want to see an attestation, add the --no-upload option to the cosign command.","title":"Create Cosign Vulnerability Attestation"},{"location":"docs/supply-chain/attestation/vuln/#sign-with-a-local-key-pair","text":"Cosign can generate key pairs and use them for signing and verification. After you run the following command, you will get a public and private key pair. Read more about how to generate key pairs . $ cosign generate-key-pair In the following example, Trivy generates a cosign vulnerability scan record, and then Cosign attaches an attestation of it to a container image with a local key pair. $ trivy image --format cosign-vuln --output vuln.json <IMAGE> $ cosign attest --key /path/to/cosign.key --type vuln --predicate vuln.json <IMAGE> Then, you can verify attestations on the image. $ cosign verify-attestation --key /path/to/cosign.pub --type vuln <IMAGE>","title":"Sign with a local key pair"},{"location":"docs/supply-chain/attestation/vuln/#keyless-signing","text":"You can use Cosign to sign without keys by authenticating with an OpenID Connect protocol supported by sigstore (Google, GitHub, or Microsoft). $ trivy image --format cosign-vuln -o vuln.json <IMAGE> $ COSIGN_EXPERIMENTAL=1 cosign attest --type vuln --predicate vuln.json <IMAGE> You can verify attestations. $ COSIGN_EXPERIMENTAL=1 cosign verify-attestation --type vuln <IMAGE>","title":"Keyless signing"},{"location":"docs/target/aws/","text":"Amazon Web Services EXPERIMENTAL This feature might change without preserving backwards compatibility. The Trivy AWS CLI allows you to scan your AWS account for misconfigurations. You can either run the CLI locally or integrate it into your CI/CD pipeline. Whilst you can already scan the infrastructure-as-code that defines your AWS resources with trivy config , you can now scan your live AWS account(s) directly too. The included checks cover all of the aspects of the AWS CIS 1.2 automated benchmarks. Trivy uses the same authentication methods as the AWS CLI to configure and authenticate your access to the AWS platform. You will need permissions configured to read all AWS resources - we recommend using a group/role with the ReadOnlyAccess policy attached. Once you've scanned your account, you can run additional commands to filter the results without having to run the entire scan again - infrastructure information is cached locally per AWS account/region. Trivy currently supports the following scanning for AWS accounts. Misconfigurations CLI Commands Scan a full AWS account (all supported services): trivy aws --region us-east-1 You can allow Trivy to determine the AWS region etc. by using the standard AWS configuration files and environment variables. The --region flag overrides these. The summary view is the default when scanning multiple services. Scan a specific service: trivy aws --service s3 Scan multiple services: # --service s3,ec2 works too trivy aws --service s3 --service ec2 Show results for a specific AWS resource: trivy aws --service s3 --arn arn:aws:s3:::example-bucket All ARNs with detected issues will be displayed when showing results for their associated service. Compliance This section describes AWS specific compliance reports. For an overview of Trivy's Compliance feature, including working with custom compliance, check out the Compliance documentation . Built in reports the following reports are available out of the box: Compliance Name for command More info AWS CIS Foundations Benchmark v1.2 aws-cis-1.2 link AWS CIS Foundations Benchmark v1.4 aws-cis-1.4 link Examples Scan a cloud account and generate a compliance summary report: $ trivy aws --compliance=<compliance_id> --report=summary Note : The Issues column represent the total number of failed checks for this control. Get all of the detailed output for checks: $ trivy aws --compliance=<compliance_id> --report all Report result in JSON format: $ trivy aws --compliance=<compliance_id> --report all --format json Cached Results By default, Trivy will cache a representation of each AWS service for 24 hours. This means you can filter and view results for a service without having to wait for the entire scan to run again. If you want to force the cache to be refreshed with the latest data, you can use --update-cache . Or if you'd like to use cached data for a different timeframe, you can specify --max-cache-age (e.g. --max-cache-age 2h .). Regardless of whether the cache is used or not, rules will be evaluated again with each run of trivy aws . Custom Policies You can write custom policies for Trivy to evaluate against your AWS account. These policies are written in Rego , the same language used by Open Policy Agent . See the Custom Policies page for more information on how to write custom policies. Custom policies in cloud scanning also support passing in custom data. This can be useful when you want to selectively enable/disable certain aspects of your cloud policies. See the Custom Data page for more information on how to provide custom data to custom policies.","title":"AWS"},{"location":"docs/target/aws/#amazon-web-services","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. The Trivy AWS CLI allows you to scan your AWS account for misconfigurations. You can either run the CLI locally or integrate it into your CI/CD pipeline. Whilst you can already scan the infrastructure-as-code that defines your AWS resources with trivy config , you can now scan your live AWS account(s) directly too. The included checks cover all of the aspects of the AWS CIS 1.2 automated benchmarks. Trivy uses the same authentication methods as the AWS CLI to configure and authenticate your access to the AWS platform. You will need permissions configured to read all AWS resources - we recommend using a group/role with the ReadOnlyAccess policy attached. Once you've scanned your account, you can run additional commands to filter the results without having to run the entire scan again - infrastructure information is cached locally per AWS account/region. Trivy currently supports the following scanning for AWS accounts. Misconfigurations","title":"Amazon Web Services"},{"location":"docs/target/aws/#cli-commands","text":"Scan a full AWS account (all supported services): trivy aws --region us-east-1 You can allow Trivy to determine the AWS region etc. by using the standard AWS configuration files and environment variables. The --region flag overrides these. The summary view is the default when scanning multiple services. Scan a specific service: trivy aws --service s3 Scan multiple services: # --service s3,ec2 works too trivy aws --service s3 --service ec2 Show results for a specific AWS resource: trivy aws --service s3 --arn arn:aws:s3:::example-bucket All ARNs with detected issues will be displayed when showing results for their associated service.","title":"CLI Commands"},{"location":"docs/target/aws/#compliance","text":"This section describes AWS specific compliance reports. For an overview of Trivy's Compliance feature, including working with custom compliance, check out the Compliance documentation .","title":"Compliance"},{"location":"docs/target/aws/#built-in-reports","text":"the following reports are available out of the box: Compliance Name for command More info AWS CIS Foundations Benchmark v1.2 aws-cis-1.2 link AWS CIS Foundations Benchmark v1.4 aws-cis-1.4 link","title":"Built in reports"},{"location":"docs/target/aws/#examples","text":"Scan a cloud account and generate a compliance summary report: $ trivy aws --compliance=<compliance_id> --report=summary Note : The Issues column represent the total number of failed checks for this control. Get all of the detailed output for checks: $ trivy aws --compliance=<compliance_id> --report all Report result in JSON format: $ trivy aws --compliance=<compliance_id> --report all --format json","title":"Examples"},{"location":"docs/target/aws/#cached-results","text":"By default, Trivy will cache a representation of each AWS service for 24 hours. This means you can filter and view results for a service without having to wait for the entire scan to run again. If you want to force the cache to be refreshed with the latest data, you can use --update-cache . Or if you'd like to use cached data for a different timeframe, you can specify --max-cache-age (e.g. --max-cache-age 2h .). Regardless of whether the cache is used or not, rules will be evaluated again with each run of trivy aws .","title":"Cached Results"},{"location":"docs/target/aws/#custom-policies","text":"You can write custom policies for Trivy to evaluate against your AWS account. These policies are written in Rego , the same language used by Open Policy Agent . See the Custom Policies page for more information on how to write custom policies. Custom policies in cloud scanning also support passing in custom data. This can be useful when you want to selectively enable/disable certain aspects of your cloud policies. See the Custom Data page for more information on how to provide custom data to custom policies.","title":"Custom Policies"},{"location":"docs/target/container_image/","text":"Container Image Trivy supports two targets for container images. Files inside container images Container image metadata Files inside container images Container images consist of files. For instance, new files will be installed if you install a package. Trivy scans the files inside container images for Vulnerabilities Misconfigurations Secrets Licenses By default, vulnerability and secret scanning are enabled, and you can configure that with --scanners . Vulnerabilities It is enabled by default. You can simply specify your image name (and a tag). It detects known vulnerabilities in your container image. See here for the detail. $ trivy image [YOUR_IMAGE_NAME] For example: $ trivy image python:3.4-alpine Result 2019-05-16T01:20:43.180+0900 INFO Updating vulnerability database... 2019-05-16T01:20:53.029+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 (alpine 3.9.2) =================================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+--------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+--------------------------------+ | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 | | | | | | | with long nonces | +---------+------------------+----------+-------------------+---------------+--------------------------------+ To enable only vulnerability scanning, you can specify --scanners vuln . $ trivy image --scanners vuln [ YOUR_IMAGE_NAME ] Misconfigurations It is supported, but it is not useful in most cases. As mentioned here , Trivy mainly supports Infrastructure as Code (IaC) files for misconfigurations. If your container image includes IaC files such as Kubernetes YAML files or Terraform files, you should enable this feature with --scanners config . $ trivy image --scanners config [YOUR_IMAGE_NAME] Secrets It is enabled by default. See here for the detail. $ trivy image [ YOUR_IMAGE_NAME ] Licenses It is disabled by default. See here for the detail. $ trivy image --scanners license [ YOUR_IMAGE_NAME ] Container image metadata Container images have configuration . docker inspect and docker history show the information according to the configuration. Trivy scans the configuration of container images for Misconfigurations Secrets They are disabled by default. You can enable them with --image-config-scanners . Tips The configuration can be exported as the JSON file by docker save . Misconfigurations Trivy detects misconfigurations on the configuration of container images. The image config is converted into Dockerfile and Trivy handles it as Dockerfile. See here for the detail of Dockerfile scanning. It is disabled by default. You can enable it with --image-config-scanners config . $ trivy image --image-config-scanners config [YOUR_IMAGE_NAME] If you just want to scan the image config, you can disable scanners with --scanners none . For example: $ trivy image --scanners none --image-config-scanners config alpine:3.17.0 Result alpine:3.17 (dockerfile) ======================== Tests: 24 (SUCCESSES: 21, FAILURES: 3, EXCEPTIONS: 0) Failures: 3 (UNKNOWN: 0, LOW: 2, MEDIUM: 0, HIGH: 1, CRITICAL: 0) HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 LOW: Consider using 'COPY file:e4d600fc4c9c293efe360be7b30ee96579925d1b4634c94332e2ec73f7d8eca1 in /' command instead of 'ADD file:e4d600fc4c9c293efe360be7b30ee96579925d1b4634c94332e2ec73f7d8eca1 in /' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files. See https://avd.aquasec.com/misconfig/ds005 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 alpine:3.17:1 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 [ ADD file:e4d600fc4c9c293efe360be7b30ee96579925d1b4634c94332e2ec73f7d8eca1 in / \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 LOW: Add HEALTHCHECK instruction in your Dockerfile \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 You shoud add HEALTHCHECK instruction in your docker container images to perform the health check on running containers. See https://avd.aquasec.com/misconfig/ds026 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Tip You can see how each layer is created with docker history . Secrets Trivy detects secrets on the configuration of container images. The image config is converted into JSON and Trivy scans the file for secrets. It is especially useful for environment variables that are likely to have credentials by accident. See here for the detail. $ trivy image --image-config-scanners secret [ YOUR_IMAGE_NAME ] If you just want to scan the image config, you can disable scanners with --scanners none . For example: $ trivy image --scanners none --image-config-scanners secret vuln-image Result vuln-image (alpine 3.17.1) ========================== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) vuln-image (secrets) ==================== Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 2) CRITICAL: GitHub (github-pat) \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 GitHub Personal Access Token \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 test:16 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 14 { 15 \"created\": \"2023-01-09T17:05:20Z\", 16 [ \"created_by\": \"ENV secret=****************************************\", 17 \"comment\": \"buildkit.dockerfile.v0\", \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 CRITICAL: GitHub (github-pat) \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 GitHub Personal Access Token \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 test:34 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 32 \"Env\": [ 33 \"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", 34 [ \"secret=****************************************\" 35 ] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Tip You can see environment variables with docker inspect . Supported Trivy will look for the specified image in a series of locations. By default, it will first look in the local Docker Engine, then Containerd, Podman, and finally container registry. This behavior can be modified with the --image-src flag. For example, the command trivy image --image-src podman,containerd alpine:3.7.3 Will first search in Podman. If the image is found there, it will be scanned and the results returned. If the image is not found in Podman, then Trivy will search in Containerd. If the image is not found there either, the scan will fail and no more image sources will be searched. Docker Engine Trivy tries to looks for the specified image in your local Docker Engine. It will be skipped if Docker Engine is not running locally. If your docker socket is not the default path, you can override it via DOCKER_HOST . containerd EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy tries to looks for the specified image in your local containerd . It will be skipped if containerd is not running locally. Specify your image name in containerd running locally. $ nerdctl images REPOSITORY TAG IMAGE ID CREATED PLATFORM SIZE BLOB SIZE aquasec/nginx latest 2bcabc23b454 3 hours ago linux/amd64 149 .1 MiB 54 .1 MiB $ trivy image aquasec/nginx If your containerd socket is not the default path ( //run/containerd/containerd.sock ), you can override it via CONTAINERD_ADDRESS . $ export CONTAINERD_ADDRESS = /run/k3s/containerd/containerd.sock $ trivy image aquasec/nginx If your scan targets are images in a namespace other than containerd's default namespace ( default ), you can override it via CONTAINERD_NAMESPACE . $ export CONTAINERD_NAMESPACE = k8s.io $ trivy image aquasec/nginx Podman EXPERIMENTAL This feature might change without preserving backwards compatibility. Scan your image in Podman (>=2.0) running locally. The remote Podman is not supported. Before performing Trivy commands, you must enable the podman.sock systemd service on your machine. For more details, see here . $ systemctl --user enable --now podman.socket Then, you can scan your image in Podman. $ cat Dockerfile FROM alpine:3.12 RUN apk add --no-cache bash $ podman build -t test . $ podman images REPOSITORY TAG IMAGE ID CREATED SIZE localhost/test latest efc372d4e0de About a minute ago 7 .94 MB $ trivy image test Container Registry Trivy supports registries that comply with the following specifications. Docker Registry HTTP API V2 OCI Distribution Specification You can configure credentials with docker login . See here for the detail. Tar Files Trivy supports image tar files generated by the following tools. Docker Image Specification Moby Project Buildah Podman img Kaniko $ docker pull ruby:3.1-alpine3.15 $ docker save ruby:3.1-alpine3.15 -o ruby-3.1.tar $ trivy image --input ruby-3.1.tar Result 2022-02-03T10:08:19.127Z INFO Detected OS: alpine 2022-02-03T10:08:19.127Z WARN This OS version is not on the EOL list: alpine 3.15 2022-02-03T10:08:19.127Z INFO Detecting Alpine vulnerabilities... 2022-02-03T10:08:19.127Z INFO Number of language-specific files: 2 2022-02-03T10:08:19.127Z INFO Detecting gemspec vulnerabilities... 2022-02-03T10:08:19.128Z INFO Detecting node-pkg vulnerabilities... 2022-02-03T10:08:19.128Z WARN This OS version is no longer supported by the distribution: alpine 3.15.0 2022-02-03T10:08:19.128Z WARN The vulnerability detection may be insufficient because security updates are not provided ruby-3.1.tar (alpine 3.15.0) ============================ Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 3, CRITICAL: 0) +----------+------------------+----------+-------------------+---------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +----------+------------------+----------+-------------------+---------------+---------------------------------------+ | gmp | CVE-2021-43618 | HIGH | 6.2.1-r0 | 6.2.1-r1 | gmp: Integer overflow and resultant | | | | | | | buffer overflow via crafted input | | | | | | | -->avd.aquasec.com/nvd/cve-2021-43618 | +----------+ + + + + + | gmp-dev | | | | | | | | | | | | | | | | | | | | +----------+ + + + + + | libgmpxx | | | | | | | | | | | | | | | | | | | | +----------+------------------+----------+-------------------+---------------+---------------------------------------+ Node.js (node-pkg) ================== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) Ruby (gemspec) ============== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) OCI Layout Trivy supports image directories compliant with Open Container Image Layout Specification . Buildah: $ buildah push docker.io/library/alpine:3.11 oci:/path/to/alpine $ trivy image --input /path/to/alpine Skopeo: $ skopeo copy docker-daemon:alpine:3.11 oci:/path/to/alpine $ trivy image --input /path/to/alpine Referencing specific images can be done by their tag or by their manifest digest: # Referenced by tag $ trivy image --input /path/to/alpine:3.15 # Referenced by digest $ trivy image --input /path/to/alpine@sha256:82389ea44e50c696aba18393b168a833929506f5b29b9d75eb817acceb6d54ba SBOM Trivy supports the generation of Software Bill of Materials (SBOM) for container images and the search for SBOMs during vulnerability scanning. Generation Trivy can generate SBOM for container images. See here for the detail. Discovery Trivy can search for Software Bill of Materials (SBOMs) that reference container images. If an SBOM is found, the vulnerability scan is performed using the SBOM instead of the container image. By using the SBOM, you can perform a vulnerability scan more quickly, as it allows you to skip pulling the container image and analyzing its layers. To enable this functionality, you need to specify the --sbom-sources flag. The following two sources are supported: OCI Registry ( oci ) Rekor ( rekor ) Example: $ trivy image --sbom-sources oci ghcr.io/knqyf263/oci-referrers 2023 -03-05T17:36:55.278+0200 INFO Vulnerability scanning is enabled 2023 -03-05T17:36:58.103+0200 INFO Detected SBOM format: cyclonedx-json 2023 -03-05T17:36:58.129+0200 INFO Found SBOM ( cyclonedx ) in the OCI referrers ... ghcr.io/knqyf263/oci-referrers ( alpine 3 .16.2 ) ============================================== Total: 17 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 5 , HIGH: 9 , CRITICAL: 3 ) The OCI Registry utilizes the Referrers API . For more information about Rekor, please refer to its documentation . Compliance EXPERIMENTAL This feature might change without preserving backwards compatibility. This section describes container image specific compliance reports. For an overview of Trivy's Compliance feature, including working with custom compliance, check out the Compliance documentation . Built in reports The following reports are available out of the box: Compliance Version Name for command More info CIS Docker Community Edition Benchmark 1.1.0 docker-cis Link Examples Scan a container image configuration and generate a compliance summary report: $ trivy image --compliance docker-cis [YOUR_IMAGE_NAME] Note The Issues column represent the total number of failed checks for this control. Authentication Please reference this page . Options Scan Image on a specific Architecture and OS By default, Trivy loads an image on a \"linux/amd64\" machine. To customise this, pass a --platform argument in the format OS/Architecture for the image: $ trivy image --platform=os/architecture [YOUR_IMAGE_NAME] For example: $ trivy image --platform=linux/arm alpine:3.16.1 Result 2022-10-25T21:00:50.972+0300 INFO Vulnerability scanning is enabled 2022-10-25T21:00:50.972+0300 INFO Secret scanning is enabled 2022-10-25T21:00:50.972+0300 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2022-10-25T21:00:50.972+0300 INFO Please see also https://aquasecurity.github.io/trivy/dev/docs/secret/scanning/#recommendation for faster secret detection 2022-10-25T21:00:56.190+0300 INFO Detected OS: alpine 2022-10-25T21:00:56.190+0300 INFO Detecting Alpine vulnerabilities... 2022-10-25T21:00:56.191+0300 INFO Number of language-specific files: 0 alpine:3.16.1 (alpine 3.16.1) ============================= Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 zlib \u2502 CVE-2022-37434 \u2502 CRITICAL \u2502 1.2.12-r1 \u2502 1.2.12-r2 \u2502 zlib: heap-based buffer over-read and overflow in inflate() \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 in inflate.c via a... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-37434 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Configure Docker daemon socket to connect to. You can configure Docker daemon socket with DOCKER_HOST or --docker-host . $ trivy image --docker-host tcp://127.0.0.1:2375 YOUR_IMAGE","title":"Container Image"},{"location":"docs/target/container_image/#container-image","text":"Trivy supports two targets for container images. Files inside container images Container image metadata","title":"Container Image"},{"location":"docs/target/container_image/#files-inside-container-images","text":"Container images consist of files. For instance, new files will be installed if you install a package. Trivy scans the files inside container images for Vulnerabilities Misconfigurations Secrets Licenses By default, vulnerability and secret scanning are enabled, and you can configure that with --scanners .","title":"Files inside container images"},{"location":"docs/target/container_image/#vulnerabilities","text":"It is enabled by default. You can simply specify your image name (and a tag). It detects known vulnerabilities in your container image. See here for the detail. $ trivy image [YOUR_IMAGE_NAME] For example: $ trivy image python:3.4-alpine Result 2019-05-16T01:20:43.180+0900 INFO Updating vulnerability database... 2019-05-16T01:20:53.029+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 (alpine 3.9.2) =================================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+--------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+--------------------------------+ | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 | | | | | | | with long nonces | +---------+------------------+----------+-------------------+---------------+--------------------------------+ To enable only vulnerability scanning, you can specify --scanners vuln . $ trivy image --scanners vuln [ YOUR_IMAGE_NAME ]","title":"Vulnerabilities"},{"location":"docs/target/container_image/#misconfigurations","text":"It is supported, but it is not useful in most cases. As mentioned here , Trivy mainly supports Infrastructure as Code (IaC) files for misconfigurations. If your container image includes IaC files such as Kubernetes YAML files or Terraform files, you should enable this feature with --scanners config . $ trivy image --scanners config [YOUR_IMAGE_NAME]","title":"Misconfigurations"},{"location":"docs/target/container_image/#secrets","text":"It is enabled by default. See here for the detail. $ trivy image [ YOUR_IMAGE_NAME ]","title":"Secrets"},{"location":"docs/target/container_image/#licenses","text":"It is disabled by default. See here for the detail. $ trivy image --scanners license [ YOUR_IMAGE_NAME ]","title":"Licenses"},{"location":"docs/target/container_image/#container-image-metadata","text":"Container images have configuration . docker inspect and docker history show the information according to the configuration. Trivy scans the configuration of container images for Misconfigurations Secrets They are disabled by default. You can enable them with --image-config-scanners . Tips The configuration can be exported as the JSON file by docker save .","title":"Container image metadata"},{"location":"docs/target/container_image/#misconfigurations_1","text":"Trivy detects misconfigurations on the configuration of container images. The image config is converted into Dockerfile and Trivy handles it as Dockerfile. See here for the detail of Dockerfile scanning. It is disabled by default. You can enable it with --image-config-scanners config . $ trivy image --image-config-scanners config [YOUR_IMAGE_NAME] If you just want to scan the image config, you can disable scanners with --scanners none . For example: $ trivy image --scanners none --image-config-scanners config alpine:3.17.0 Result alpine:3.17 (dockerfile) ======================== Tests: 24 (SUCCESSES: 21, FAILURES: 3, EXCEPTIONS: 0) Failures: 3 (UNKNOWN: 0, LOW: 2, MEDIUM: 0, HIGH: 1, CRITICAL: 0) HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 LOW: Consider using 'COPY file:e4d600fc4c9c293efe360be7b30ee96579925d1b4634c94332e2ec73f7d8eca1 in /' command instead of 'ADD file:e4d600fc4c9c293efe360be7b30ee96579925d1b4634c94332e2ec73f7d8eca1 in /' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files. See https://avd.aquasec.com/misconfig/ds005 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 alpine:3.17:1 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 [ ADD file:e4d600fc4c9c293efe360be7b30ee96579925d1b4634c94332e2ec73f7d8eca1 in / \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 LOW: Add HEALTHCHECK instruction in your Dockerfile \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 You shoud add HEALTHCHECK instruction in your docker container images to perform the health check on running containers. See https://avd.aquasec.com/misconfig/ds026 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Tip You can see how each layer is created with docker history .","title":"Misconfigurations"},{"location":"docs/target/container_image/#secrets_1","text":"Trivy detects secrets on the configuration of container images. The image config is converted into JSON and Trivy scans the file for secrets. It is especially useful for environment variables that are likely to have credentials by accident. See here for the detail. $ trivy image --image-config-scanners secret [ YOUR_IMAGE_NAME ] If you just want to scan the image config, you can disable scanners with --scanners none . For example: $ trivy image --scanners none --image-config-scanners secret vuln-image Result vuln-image (alpine 3.17.1) ========================== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) vuln-image (secrets) ==================== Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 2) CRITICAL: GitHub (github-pat) \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 GitHub Personal Access Token \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 test:16 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 14 { 15 \"created\": \"2023-01-09T17:05:20Z\", 16 [ \"created_by\": \"ENV secret=****************************************\", 17 \"comment\": \"buildkit.dockerfile.v0\", \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 CRITICAL: GitHub (github-pat) \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 GitHub Personal Access Token \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 test:34 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 32 \"Env\": [ 33 \"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", 34 [ \"secret=****************************************\" 35 ] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Tip You can see environment variables with docker inspect .","title":"Secrets"},{"location":"docs/target/container_image/#supported","text":"Trivy will look for the specified image in a series of locations. By default, it will first look in the local Docker Engine, then Containerd, Podman, and finally container registry. This behavior can be modified with the --image-src flag. For example, the command trivy image --image-src podman,containerd alpine:3.7.3 Will first search in Podman. If the image is found there, it will be scanned and the results returned. If the image is not found in Podman, then Trivy will search in Containerd. If the image is not found there either, the scan will fail and no more image sources will be searched.","title":"Supported"},{"location":"docs/target/container_image/#docker-engine","text":"Trivy tries to looks for the specified image in your local Docker Engine. It will be skipped if Docker Engine is not running locally. If your docker socket is not the default path, you can override it via DOCKER_HOST .","title":"Docker Engine"},{"location":"docs/target/container_image/#containerd","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy tries to looks for the specified image in your local containerd . It will be skipped if containerd is not running locally. Specify your image name in containerd running locally. $ nerdctl images REPOSITORY TAG IMAGE ID CREATED PLATFORM SIZE BLOB SIZE aquasec/nginx latest 2bcabc23b454 3 hours ago linux/amd64 149 .1 MiB 54 .1 MiB $ trivy image aquasec/nginx If your containerd socket is not the default path ( //run/containerd/containerd.sock ), you can override it via CONTAINERD_ADDRESS . $ export CONTAINERD_ADDRESS = /run/k3s/containerd/containerd.sock $ trivy image aquasec/nginx If your scan targets are images in a namespace other than containerd's default namespace ( default ), you can override it via CONTAINERD_NAMESPACE . $ export CONTAINERD_NAMESPACE = k8s.io $ trivy image aquasec/nginx","title":"containerd"},{"location":"docs/target/container_image/#podman","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. Scan your image in Podman (>=2.0) running locally. The remote Podman is not supported. Before performing Trivy commands, you must enable the podman.sock systemd service on your machine. For more details, see here . $ systemctl --user enable --now podman.socket Then, you can scan your image in Podman. $ cat Dockerfile FROM alpine:3.12 RUN apk add --no-cache bash $ podman build -t test . $ podman images REPOSITORY TAG IMAGE ID CREATED SIZE localhost/test latest efc372d4e0de About a minute ago 7 .94 MB $ trivy image test","title":"Podman"},{"location":"docs/target/container_image/#container-registry","text":"Trivy supports registries that comply with the following specifications. Docker Registry HTTP API V2 OCI Distribution Specification You can configure credentials with docker login . See here for the detail.","title":"Container Registry"},{"location":"docs/target/container_image/#tar-files","text":"Trivy supports image tar files generated by the following tools. Docker Image Specification Moby Project Buildah Podman img Kaniko $ docker pull ruby:3.1-alpine3.15 $ docker save ruby:3.1-alpine3.15 -o ruby-3.1.tar $ trivy image --input ruby-3.1.tar Result 2022-02-03T10:08:19.127Z INFO Detected OS: alpine 2022-02-03T10:08:19.127Z WARN This OS version is not on the EOL list: alpine 3.15 2022-02-03T10:08:19.127Z INFO Detecting Alpine vulnerabilities... 2022-02-03T10:08:19.127Z INFO Number of language-specific files: 2 2022-02-03T10:08:19.127Z INFO Detecting gemspec vulnerabilities... 2022-02-03T10:08:19.128Z INFO Detecting node-pkg vulnerabilities... 2022-02-03T10:08:19.128Z WARN This OS version is no longer supported by the distribution: alpine 3.15.0 2022-02-03T10:08:19.128Z WARN The vulnerability detection may be insufficient because security updates are not provided ruby-3.1.tar (alpine 3.15.0) ============================ Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 3, CRITICAL: 0) +----------+------------------+----------+-------------------+---------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +----------+------------------+----------+-------------------+---------------+---------------------------------------+ | gmp | CVE-2021-43618 | HIGH | 6.2.1-r0 | 6.2.1-r1 | gmp: Integer overflow and resultant | | | | | | | buffer overflow via crafted input | | | | | | | -->avd.aquasec.com/nvd/cve-2021-43618 | +----------+ + + + + + | gmp-dev | | | | | | | | | | | | | | | | | | | | +----------+ + + + + + | libgmpxx | | | | | | | | | | | | | | | | | | | | +----------+------------------+----------+-------------------+---------------+---------------------------------------+ Node.js (node-pkg) ================== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) Ruby (gemspec) ============== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)","title":"Tar Files"},{"location":"docs/target/container_image/#oci-layout","text":"Trivy supports image directories compliant with Open Container Image Layout Specification . Buildah: $ buildah push docker.io/library/alpine:3.11 oci:/path/to/alpine $ trivy image --input /path/to/alpine Skopeo: $ skopeo copy docker-daemon:alpine:3.11 oci:/path/to/alpine $ trivy image --input /path/to/alpine Referencing specific images can be done by their tag or by their manifest digest: # Referenced by tag $ trivy image --input /path/to/alpine:3.15 # Referenced by digest $ trivy image --input /path/to/alpine@sha256:82389ea44e50c696aba18393b168a833929506f5b29b9d75eb817acceb6d54ba","title":"OCI Layout"},{"location":"docs/target/container_image/#sbom","text":"Trivy supports the generation of Software Bill of Materials (SBOM) for container images and the search for SBOMs during vulnerability scanning.","title":"SBOM"},{"location":"docs/target/container_image/#generation","text":"Trivy can generate SBOM for container images. See here for the detail.","title":"Generation"},{"location":"docs/target/container_image/#discovery","text":"Trivy can search for Software Bill of Materials (SBOMs) that reference container images. If an SBOM is found, the vulnerability scan is performed using the SBOM instead of the container image. By using the SBOM, you can perform a vulnerability scan more quickly, as it allows you to skip pulling the container image and analyzing its layers. To enable this functionality, you need to specify the --sbom-sources flag. The following two sources are supported: OCI Registry ( oci ) Rekor ( rekor ) Example: $ trivy image --sbom-sources oci ghcr.io/knqyf263/oci-referrers 2023 -03-05T17:36:55.278+0200 INFO Vulnerability scanning is enabled 2023 -03-05T17:36:58.103+0200 INFO Detected SBOM format: cyclonedx-json 2023 -03-05T17:36:58.129+0200 INFO Found SBOM ( cyclonedx ) in the OCI referrers ... ghcr.io/knqyf263/oci-referrers ( alpine 3 .16.2 ) ============================================== Total: 17 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 5 , HIGH: 9 , CRITICAL: 3 ) The OCI Registry utilizes the Referrers API . For more information about Rekor, please refer to its documentation .","title":"Discovery"},{"location":"docs/target/container_image/#compliance","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. This section describes container image specific compliance reports. For an overview of Trivy's Compliance feature, including working with custom compliance, check out the Compliance documentation .","title":"Compliance"},{"location":"docs/target/container_image/#built-in-reports","text":"The following reports are available out of the box: Compliance Version Name for command More info CIS Docker Community Edition Benchmark 1.1.0 docker-cis Link","title":"Built in reports"},{"location":"docs/target/container_image/#examples","text":"Scan a container image configuration and generate a compliance summary report: $ trivy image --compliance docker-cis [YOUR_IMAGE_NAME] Note The Issues column represent the total number of failed checks for this control.","title":"Examples"},{"location":"docs/target/container_image/#authentication","text":"Please reference this page .","title":"Authentication"},{"location":"docs/target/container_image/#options","text":"","title":"Options"},{"location":"docs/target/container_image/#scan-image-on-a-specific-architecture-and-os","text":"By default, Trivy loads an image on a \"linux/amd64\" machine. To customise this, pass a --platform argument in the format OS/Architecture for the image: $ trivy image --platform=os/architecture [YOUR_IMAGE_NAME] For example: $ trivy image --platform=linux/arm alpine:3.16.1 Result 2022-10-25T21:00:50.972+0300 INFO Vulnerability scanning is enabled 2022-10-25T21:00:50.972+0300 INFO Secret scanning is enabled 2022-10-25T21:00:50.972+0300 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2022-10-25T21:00:50.972+0300 INFO Please see also https://aquasecurity.github.io/trivy/dev/docs/secret/scanning/#recommendation for faster secret detection 2022-10-25T21:00:56.190+0300 INFO Detected OS: alpine 2022-10-25T21:00:56.190+0300 INFO Detecting Alpine vulnerabilities... 2022-10-25T21:00:56.191+0300 INFO Number of language-specific files: 0 alpine:3.16.1 (alpine 3.16.1) ============================= Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 zlib \u2502 CVE-2022-37434 \u2502 CRITICAL \u2502 1.2.12-r1 \u2502 1.2.12-r2 \u2502 zlib: heap-based buffer over-read and overflow in inflate() \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 in inflate.c via a... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-37434 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"Scan Image on a specific Architecture and OS"},{"location":"docs/target/container_image/#configure-docker-daemon-socket-to-connect-to","text":"You can configure Docker daemon socket with DOCKER_HOST or --docker-host . $ trivy image --docker-host tcp://127.0.0.1:2375 YOUR_IMAGE","title":"Configure Docker daemon socket to connect to."},{"location":"docs/target/filesystem/","text":"Filesystem Scan your local projects for Vulnerabilities Misconfigurations Secrets Licenses By default, vulnerability and secret scanning are enabled, and you can configure that with --scanners . $ trivy fs /path/to/project It's also possible to scan a single file. $ trivy fs ~/src/github.com/aquasecurity/trivy-ci-test/Pipfile.lock Scanners Vulnerabilities It is enabled by default. Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json. See here for the detail. $ trivy fs ~/src/github.com/aquasecurity/trivy-ci-test Result 2020-06-01T17:06:58.652+0300 WARN OS is not detected and vulnerabilities in OS packages are not detected. 2020-06-01T17:06:58.652+0300 INFO Detecting pipenv vulnerabilities... 2020-06-01T17:06:58.691+0300 INFO Detecting cargo vulnerabilities... Pipfile.lock ============ Total: 10 (UNKNOWN: 2, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0) +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | django | CVE-2020-7471 | HIGH | 2.0.9 | 3.0.3, 2.2.10, 1.11.28 | django: potential | | | | | | | SQL injection via | | | | | | | StringAgg(delimiter) | + +------------------+----------+ +------------------------+------------------------------------+ | | CVE-2019-19844 | MEDIUM | | 3.0.1, 2.2.9, 1.11.27 | Django: crafted email address | | | | | | | allows account takeover | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-3498 | | | 2.1.5, 2.0.10, 1.11.18 | python-django: Content | | | | | | | spoofing via URL path in | | | | | | | default 404 page | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-6975 | | | 2.1.6, 2.0.11, 1.11.19 | python-django: | | | | | | | memory exhaustion in | | | | | | | django.utils.numberformat.format() | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ ... Misconfigurations It is disabled by default and can be enabled with --scanners config . See here for the detail. $ trivy fs --scanners config /path/to/project Secrets It is enabled by default. See here for the detail. $ trivy fs /path/to/project Licenses It is disabled by default. See here for the detail. $ trivy fs --scanners license /path/to/project SBOM generation Trivy can generate SBOM for local projects. See here for the detail.","title":"Filesystem"},{"location":"docs/target/filesystem/#filesystem","text":"Scan your local projects for Vulnerabilities Misconfigurations Secrets Licenses By default, vulnerability and secret scanning are enabled, and you can configure that with --scanners . $ trivy fs /path/to/project It's also possible to scan a single file. $ trivy fs ~/src/github.com/aquasecurity/trivy-ci-test/Pipfile.lock","title":"Filesystem"},{"location":"docs/target/filesystem/#scanners","text":"","title":"Scanners"},{"location":"docs/target/filesystem/#vulnerabilities","text":"It is enabled by default. Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json. See here for the detail. $ trivy fs ~/src/github.com/aquasecurity/trivy-ci-test Result 2020-06-01T17:06:58.652+0300 WARN OS is not detected and vulnerabilities in OS packages are not detected. 2020-06-01T17:06:58.652+0300 INFO Detecting pipenv vulnerabilities... 2020-06-01T17:06:58.691+0300 INFO Detecting cargo vulnerabilities... Pipfile.lock ============ Total: 10 (UNKNOWN: 2, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0) +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | django | CVE-2020-7471 | HIGH | 2.0.9 | 3.0.3, 2.2.10, 1.11.28 | django: potential | | | | | | | SQL injection via | | | | | | | StringAgg(delimiter) | + +------------------+----------+ +------------------------+------------------------------------+ | | CVE-2019-19844 | MEDIUM | | 3.0.1, 2.2.9, 1.11.27 | Django: crafted email address | | | | | | | allows account takeover | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-3498 | | | 2.1.5, 2.0.10, 1.11.18 | python-django: Content | | | | | | | spoofing via URL path in | | | | | | | default 404 page | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-6975 | | | 2.1.6, 2.0.11, 1.11.19 | python-django: | | | | | | | memory exhaustion in | | | | | | | django.utils.numberformat.format() | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ ...","title":"Vulnerabilities"},{"location":"docs/target/filesystem/#misconfigurations","text":"It is disabled by default and can be enabled with --scanners config . See here for the detail. $ trivy fs --scanners config /path/to/project","title":"Misconfigurations"},{"location":"docs/target/filesystem/#secrets","text":"It is enabled by default. See here for the detail. $ trivy fs /path/to/project","title":"Secrets"},{"location":"docs/target/filesystem/#licenses","text":"It is disabled by default. See here for the detail. $ trivy fs --scanners license /path/to/project","title":"Licenses"},{"location":"docs/target/filesystem/#sbom-generation","text":"Trivy can generate SBOM for local projects. See here for the detail.","title":"SBOM generation"},{"location":"docs/target/kubernetes/","text":"Kubernetes EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy can connect to your Kubernetes cluster and scan it for security issues using the trivy k8s command. This page covers the technical capabilities of Trivy Kubernetes scanning. Trivy can also be installed inside your cluster as a Kubernetes Operator, and continuously scan it. For more about this, please see the [Trivy Operator][https://aquasecurity.github.io/trivy-operator/] project. When scanning a Kubernetes cluster, Trivy differentiates between the following: Cluster infrastructure (e.g api-server, kubelet, addons) Cluster configuration (e.g Roles, ClusterRoles). Application workloads (e.g nginx, postgresql). When scanning any of the above, the container image is scanned separately to the Kubernetes resource definition (the YAML manifest) that defines the resource. Container image is scanned for: - Vulnerabilities - Misconfigurations - Exposed secrets Kubernetes resource definition is scanned for: - Vulnerabilities - partially supported through KBOM scanning - Misconfigurations - Exposed secrets Kubernetes target configurations Trivy follows the behavior of the kubectl tool as much as possible. Scope The command expects an argument that selects the scope of the scan (similarly to how kubectl expects an argument after kubectl get ). This argument can be: 1. A Kubernetes Kind. e.g pod , deployment , etc. 2. A Kubernetes Resource. e.g pods/mypod , etc. 3. all . Scan common workload kinds, as listed here 4. cluster scan the entire cluster including all namespaced resources and cluster level resources. Examples: trivy k8s all trivy k8s pods trivy k8s deploy myapp trivy k8s pod/mypod trivy k8s pods,deploy trivy k8s cluster Note that the scope argument must appear last in the command line, after any other flag. Cluster By default Trivy will look for a kubeconfig configuration file in the default location , and use the default cluster that is specified. You can also specify a kubeconfig using the --kubeconfig flag: trivy k8s --kubeconfig ~/.kube/config2 Namespace By default Trivy will scan all namespaces (following kubectl behavior). To specify a namespace use the --namespace flag: trivy k8s --kubeconfig ~/.kube/config2 --namespace default Node You can exclude specific nodes from the scan using the --exclude-nodes flag, which takes a label in the format label-name:label-value and excludes all matching nodes: trivy k8s cluster --report summary --exclude-nodes kubernetes.io/arch:arm6 Components types You can control what kinds of components are discovered using the --components flag: - --components infra will discover only cluster infrastructure components. - --components workloads will discover only application workloads. - If the flag is omitted: infra, workloads, and RBAC are discovered. Reporting and filtering Since scanning an entire cluster for any security issue can be overwhelming, By default Trivy summarizes the results in a simple \"summary\" view. By scoping the scan on a specific resource, you can see the detailed report. You can always choose the report granularity using the --report summary / --report all flag. Scan a full cluster and generate a simple summary report: $ trivy k8s --report=summary cluster Filter by severity: trivy k8s --severity=CRITICAL --report=all cluster Filter by scanners (Vulnerabilities, Secrets or Misconfigurations): trivy k8s --scanners=secret --report=summary cluster # or trivy k8s --scanners=config --report=summary cluster The supported output formats are table , which is the default, and json . trivy k8s --format json -o results.json cluster Result { \"ClusterName\" : \"minikube\" , \"Vulnerabilities\" : [ { \"Namespace\" : \"default\" , \"Kind\" : \"Deployment\" , \"Name\" : \"app\" , \"Results\" : [ { \"Target\" : \"ubuntu:latest (ubuntu 22.04)\" , \"Class\" : \"os-pkgs\" , \"Type\" : \"ubuntu\" , \"Vulnerabilities\" : [ { \"VulnerabilityID\" : \"CVE-2016-2781\" , \"PkgName\" : \"coreutils\" , \"InstalledVersion\" : \"8.32-4.1ubuntu1\" , \"Layer\" : { \"Digest\" : \"sha256:125a6e411906fe6b0aaa50fc9d600bf6ff9bb11a8651727ce1ed482dc271c24c\" , \"DiffID\" : \"sha256:e59fc94956120a6c7629f085027578e6357b48061d45714107e79f04a81a6f0c\" }, \"SeveritySource\" : \"ubuntu\" , \"PrimaryURL\" : \"https://avd.aquasec.com/nvd/cve-2016-2781\" , \"DataSource\" : { \"ID\" : \"ubuntu\" , \"Name\" : \"Ubuntu CVE Tracker\" , \"URL\" : \"https://git.launchpad.net/ubuntu-cve-tracker\" }, \"Title\" : \"coreutils: Non-privileged session can escape to the parent session in chroot\" , \"Description\" : \"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.\" , \"Severity\" : \"LOW\" , \"CweIDs\" : [ \"CWE-20\" ], \"VendorSeverity\" : { \"cbl-mariner\" : 2 , \"nvd\" : 2 , \"redhat\" : 2 , \"ubuntu\" : 1 }, \"CVSS\" : { \"nvd\" : { \"V2Vector\" : \"AV:L/AC:L/Au:N/C:N/I:P/A:N\" , \"V3Vector\" : \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N\" , \"V2Score\" : 2.1 , \"V3Score\" : 6.5 }, \"redhat\" : { \"V2Vector\" : \"AV:L/AC:H/Au:N/C:C/I:C/A:C\" , \"V3Vector\" : \"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\" , \"V2Score\" : 6.2 , \"V3Score\" : 8.6 } }, \"References\" : [ \"http://seclists.org/oss-sec/2016/q1/452\" , \"http://www.openwall.com/lists/oss-security/2016/02/28/2\" , \"http://www.openwall.com/lists/oss-security/2016/02/28/3\" , \"https://access.redhat.com/security/cve/CVE-2016-2781\" , \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781\" , \"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E\" , \"https://lore.kernel.org/patchwork/patch/793178/\" , \"https://nvd.nist.gov/vuln/detail/CVE-2016-2781\" ], \"PublishedDate\" : \"2017-02-07T15:59:00Z\" , \"LastModifiedDate\" : \"2021-02-25T17:15:00Z\" } ] } ] } ], \"Misconfigurations\" : [ { \"Namespace\" : \"default\" , \"Kind\" : \"Deployment\" , \"Name\" : \"app\" , \"Results\" : [ { \"Target\" : \"Deployment/app\" , \"Class\" : \"config\" , \"Type\" : \"kubernetes\" , \"MisconfSummary\" : { \"Successes\" : 20 , \"Failures\" : 19 , \"Exceptions\" : 0 }, \"Misconfigurations\" : [ { \"Type\" : \"Kubernetes Security Check\" , \"ID\" : \"KSV001\" , \"Title\" : \"Process can elevate its own privileges\" , \"Description\" : \"A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node.\" , \"Message\" : \"Container 'app' of Deployment 'app' should set 'securityContext.allowPrivilegeEscalation' to false\" , \"Namespace\" : \"builtin.kubernetes.KSV001\" , \"Query\" : \"data.builtin.kubernetes.KSV001.deny\" , \"Resolution\" : \"Set 'set containers[].securityContext.allowPrivilegeEscalation' to 'false'.\" , \"Severity\" : \"MEDIUM\" , \"PrimaryURL\" : \"https://avd.aquasec.com/misconfig/ksv001\" , \"References\" : [ \"https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted\" , \"https://avd.aquasec.com/misconfig/ksv001\" ], \"Status\" : \"FAIL\" , \"Layer\" : {}, \"IacMetadata\" : { \"Provider\" : \"Kubernetes\" , \"Service\" : \"general\" , \"StartLine\" : 121 , \"EndLine\" : 133 } }, { \"Type\" : \"Kubernetes Security Check\" , \"ID\" : \"KSV003\" , \"Title\" : \"Default capabilities not dropped\" , \"Description\" : \"The container should drop all default capabilities and add only those that are needed for its execution.\" , \"Message\" : \"Container 'app' of Deployment 'app' should add 'ALL' to 'securityContext.capabilities.drop'\" , \"Namespace\" : \"builtin.kubernetes.KSV003\" , \"Query\" : \"data.builtin.kubernetes.KSV003.deny\" , \"Resolution\" : \"Add 'ALL' to containers[].securityContext.capabilities.drop.\" , \"Severity\" : \"LOW\" , \"PrimaryURL\" : \"https://avd.aquasec.com/misconfig/ksv003\" , \"References\" : [ \"https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/\" , \"https://avd.aquasec.com/misconfig/ksv003\" ], \"Status\" : \"FAIL\" , \"Layer\" : {}, \"IacMetadata\" : { \"Provider\" : \"Kubernetes\" , \"Service\" : \"general\" , \"StartLine\" : 121 , \"EndLine\" : 133 } } ] } ] }, { \"Namespace\" : \"default\" , \"Kind\" : \"ConfigMap\" , \"Name\" : \"kube-root-ca.crt\" } ] } Compliance This section describes Kubernetes specific compliance reports. For an overview of Trivy's Compliance feature, including working with custom compliance, check out the Compliance documentation . The following reports are available out of the box: Compliance Name for command More info NSA, CISA Kubernetes Hardening Guidance v1.2 k8s-nsa Link CIS Benchmark for Kubernetes v1.23 k8s-cis Link Pod Security Standards, Baseline k8s-pss-baseline Link Pod Security Standards, Restricted k8s-pss-restricted Link Examples: Scan the cluster for Kubernetes Pod Security Standards Baseline compliance: trivy k8s cluster --compliance=k8s-pss-baseline --report summary Get the detailed report for checks: trivy k8s cluster --compliance=k8s-cis --report all Get summary report in JSON format: trivy k8s cluster --compliance=k8s-cis --report summary --format json Get detailed report in JSON format: trivy k8s cluster --compliance=k8s-cis --report all --format json KBOM KBOM, Kubernetes Bill of Materials, is a manifest of all the important components that make up your Kubernetes cluster \u2013 Control plane components, Node Components, and Addons, including their versions and images. Which \u201capi-server\u201d version are you currently running? Which flavor of \"kubelet\" is running on each node? What kind of etcd or storage are you currently using? And most importantly \u2013 are there any vulnerabilities known to affect these components? These are all questions that KBOM can help you answer. For more background on KBOM, see here . Trivy can generate KBOM in CycloneDX format: trivy k8s cluster --format cyclonedx --output mykbom.cdx.json Trivy can also scan that generated KBOM (or any SBOM) for vulnerabilities: trivy sbom mykbom.cdx.json Result 2023-09-28T22:52:25.707+0300 INFO Vulnerability scanning is enabled 2023-09-28T22:52:25.707+0300 INFO Detected SBOM format: cyclonedx-json 2023-09-28T22:52:25.717+0300 WARN No OS package is detected. Make sure you haven't deleted any files that contain information about the installed packages. 2023-09-28T22:52:25.717+0300 WARN e.g. files under \"/lib/apk/db/\", \"/var/lib/dpkg/\" and \"/var/lib/rpm\" 2023-09-28T22:52:25.717+0300 INFO Detected OS: debian gnu/linux 2023-09-28T22:52:25.717+0300 WARN unsupported os : debian gnu/linux 2023-09-28T22:52:25.717+0300 INFO Number of language-specific files: 3 2023-09-28T22:52:25.717+0300 INFO Detecting kubernetes vulnerabilities... 2023-09-28T22:52:25.718+0300 INFO Detecting gobinary vulnerabilities... Kubernetes (kubernetes) Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Status \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 k8s.io/kubelet \u2502 CVE-2021-25749 \u2502 HIGH \u2502 fixed \u2502 1.24.0 \u2502 1.22.14, 1.23.11, 1.24.5 \u2502 runAsNonRoot logic bypass for Windows containers \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25749 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2023-2431 \u2502 LOW \u2502 \u2502 \u2502 1.24.14, 1.25.9, 1.26.4, 1.27.1 \u2502 Bypass of seccomp profile enforcement \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2023-2431 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Find more in the documentation for SBOM scanning . Currently KBOM vulnerability matching works for plain Kubernetes distributions and does not work well for vendor variants, including some cloud managed distributions.","title":"Kubernetes"},{"location":"docs/target/kubernetes/#kubernetes","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy can connect to your Kubernetes cluster and scan it for security issues using the trivy k8s command. This page covers the technical capabilities of Trivy Kubernetes scanning. Trivy can also be installed inside your cluster as a Kubernetes Operator, and continuously scan it. For more about this, please see the [Trivy Operator][https://aquasecurity.github.io/trivy-operator/] project. When scanning a Kubernetes cluster, Trivy differentiates between the following: Cluster infrastructure (e.g api-server, kubelet, addons) Cluster configuration (e.g Roles, ClusterRoles). Application workloads (e.g nginx, postgresql). When scanning any of the above, the container image is scanned separately to the Kubernetes resource definition (the YAML manifest) that defines the resource. Container image is scanned for: - Vulnerabilities - Misconfigurations - Exposed secrets Kubernetes resource definition is scanned for: - Vulnerabilities - partially supported through KBOM scanning - Misconfigurations - Exposed secrets","title":"Kubernetes"},{"location":"docs/target/kubernetes/#kubernetes-target-configurations","text":"Trivy follows the behavior of the kubectl tool as much as possible.","title":"Kubernetes target configurations"},{"location":"docs/target/kubernetes/#scope","text":"The command expects an argument that selects the scope of the scan (similarly to how kubectl expects an argument after kubectl get ). This argument can be: 1. A Kubernetes Kind. e.g pod , deployment , etc. 2. A Kubernetes Resource. e.g pods/mypod , etc. 3. all . Scan common workload kinds, as listed here 4. cluster scan the entire cluster including all namespaced resources and cluster level resources. Examples: trivy k8s all trivy k8s pods trivy k8s deploy myapp trivy k8s pod/mypod trivy k8s pods,deploy trivy k8s cluster Note that the scope argument must appear last in the command line, after any other flag.","title":"Scope"},{"location":"docs/target/kubernetes/#cluster","text":"By default Trivy will look for a kubeconfig configuration file in the default location , and use the default cluster that is specified. You can also specify a kubeconfig using the --kubeconfig flag: trivy k8s --kubeconfig ~/.kube/config2","title":"Cluster"},{"location":"docs/target/kubernetes/#namespace","text":"By default Trivy will scan all namespaces (following kubectl behavior). To specify a namespace use the --namespace flag: trivy k8s --kubeconfig ~/.kube/config2 --namespace default","title":"Namespace"},{"location":"docs/target/kubernetes/#node","text":"You can exclude specific nodes from the scan using the --exclude-nodes flag, which takes a label in the format label-name:label-value and excludes all matching nodes: trivy k8s cluster --report summary --exclude-nodes kubernetes.io/arch:arm6","title":"Node"},{"location":"docs/target/kubernetes/#components-types","text":"You can control what kinds of components are discovered using the --components flag: - --components infra will discover only cluster infrastructure components. - --components workloads will discover only application workloads. - If the flag is omitted: infra, workloads, and RBAC are discovered.","title":"Components types"},{"location":"docs/target/kubernetes/#reporting-and-filtering","text":"Since scanning an entire cluster for any security issue can be overwhelming, By default Trivy summarizes the results in a simple \"summary\" view. By scoping the scan on a specific resource, you can see the detailed report. You can always choose the report granularity using the --report summary / --report all flag. Scan a full cluster and generate a simple summary report: $ trivy k8s --report=summary cluster Filter by severity: trivy k8s --severity=CRITICAL --report=all cluster Filter by scanners (Vulnerabilities, Secrets or Misconfigurations): trivy k8s --scanners=secret --report=summary cluster # or trivy k8s --scanners=config --report=summary cluster The supported output formats are table , which is the default, and json . trivy k8s --format json -o results.json cluster Result { \"ClusterName\" : \"minikube\" , \"Vulnerabilities\" : [ { \"Namespace\" : \"default\" , \"Kind\" : \"Deployment\" , \"Name\" : \"app\" , \"Results\" : [ { \"Target\" : \"ubuntu:latest (ubuntu 22.04)\" , \"Class\" : \"os-pkgs\" , \"Type\" : \"ubuntu\" , \"Vulnerabilities\" : [ { \"VulnerabilityID\" : \"CVE-2016-2781\" , \"PkgName\" : \"coreutils\" , \"InstalledVersion\" : \"8.32-4.1ubuntu1\" , \"Layer\" : { \"Digest\" : \"sha256:125a6e411906fe6b0aaa50fc9d600bf6ff9bb11a8651727ce1ed482dc271c24c\" , \"DiffID\" : \"sha256:e59fc94956120a6c7629f085027578e6357b48061d45714107e79f04a81a6f0c\" }, \"SeveritySource\" : \"ubuntu\" , \"PrimaryURL\" : \"https://avd.aquasec.com/nvd/cve-2016-2781\" , \"DataSource\" : { \"ID\" : \"ubuntu\" , \"Name\" : \"Ubuntu CVE Tracker\" , \"URL\" : \"https://git.launchpad.net/ubuntu-cve-tracker\" }, \"Title\" : \"coreutils: Non-privileged session can escape to the parent session in chroot\" , \"Description\" : \"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.\" , \"Severity\" : \"LOW\" , \"CweIDs\" : [ \"CWE-20\" ], \"VendorSeverity\" : { \"cbl-mariner\" : 2 , \"nvd\" : 2 , \"redhat\" : 2 , \"ubuntu\" : 1 }, \"CVSS\" : { \"nvd\" : { \"V2Vector\" : \"AV:L/AC:L/Au:N/C:N/I:P/A:N\" , \"V3Vector\" : \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N\" , \"V2Score\" : 2.1 , \"V3Score\" : 6.5 }, \"redhat\" : { \"V2Vector\" : \"AV:L/AC:H/Au:N/C:C/I:C/A:C\" , \"V3Vector\" : \"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\" , \"V2Score\" : 6.2 , \"V3Score\" : 8.6 } }, \"References\" : [ \"http://seclists.org/oss-sec/2016/q1/452\" , \"http://www.openwall.com/lists/oss-security/2016/02/28/2\" , \"http://www.openwall.com/lists/oss-security/2016/02/28/3\" , \"https://access.redhat.com/security/cve/CVE-2016-2781\" , \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781\" , \"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E\" , \"https://lore.kernel.org/patchwork/patch/793178/\" , \"https://nvd.nist.gov/vuln/detail/CVE-2016-2781\" ], \"PublishedDate\" : \"2017-02-07T15:59:00Z\" , \"LastModifiedDate\" : \"2021-02-25T17:15:00Z\" } ] } ] } ], \"Misconfigurations\" : [ { \"Namespace\" : \"default\" , \"Kind\" : \"Deployment\" , \"Name\" : \"app\" , \"Results\" : [ { \"Target\" : \"Deployment/app\" , \"Class\" : \"config\" , \"Type\" : \"kubernetes\" , \"MisconfSummary\" : { \"Successes\" : 20 , \"Failures\" : 19 , \"Exceptions\" : 0 }, \"Misconfigurations\" : [ { \"Type\" : \"Kubernetes Security Check\" , \"ID\" : \"KSV001\" , \"Title\" : \"Process can elevate its own privileges\" , \"Description\" : \"A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node.\" , \"Message\" : \"Container 'app' of Deployment 'app' should set 'securityContext.allowPrivilegeEscalation' to false\" , \"Namespace\" : \"builtin.kubernetes.KSV001\" , \"Query\" : \"data.builtin.kubernetes.KSV001.deny\" , \"Resolution\" : \"Set 'set containers[].securityContext.allowPrivilegeEscalation' to 'false'.\" , \"Severity\" : \"MEDIUM\" , \"PrimaryURL\" : \"https://avd.aquasec.com/misconfig/ksv001\" , \"References\" : [ \"https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted\" , \"https://avd.aquasec.com/misconfig/ksv001\" ], \"Status\" : \"FAIL\" , \"Layer\" : {}, \"IacMetadata\" : { \"Provider\" : \"Kubernetes\" , \"Service\" : \"general\" , \"StartLine\" : 121 , \"EndLine\" : 133 } }, { \"Type\" : \"Kubernetes Security Check\" , \"ID\" : \"KSV003\" , \"Title\" : \"Default capabilities not dropped\" , \"Description\" : \"The container should drop all default capabilities and add only those that are needed for its execution.\" , \"Message\" : \"Container 'app' of Deployment 'app' should add 'ALL' to 'securityContext.capabilities.drop'\" , \"Namespace\" : \"builtin.kubernetes.KSV003\" , \"Query\" : \"data.builtin.kubernetes.KSV003.deny\" , \"Resolution\" : \"Add 'ALL' to containers[].securityContext.capabilities.drop.\" , \"Severity\" : \"LOW\" , \"PrimaryURL\" : \"https://avd.aquasec.com/misconfig/ksv003\" , \"References\" : [ \"https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/\" , \"https://avd.aquasec.com/misconfig/ksv003\" ], \"Status\" : \"FAIL\" , \"Layer\" : {}, \"IacMetadata\" : { \"Provider\" : \"Kubernetes\" , \"Service\" : \"general\" , \"StartLine\" : 121 , \"EndLine\" : 133 } } ] } ] }, { \"Namespace\" : \"default\" , \"Kind\" : \"ConfigMap\" , \"Name\" : \"kube-root-ca.crt\" } ] }","title":"Reporting and filtering"},{"location":"docs/target/kubernetes/#compliance","text":"This section describes Kubernetes specific compliance reports. For an overview of Trivy's Compliance feature, including working with custom compliance, check out the Compliance documentation . The following reports are available out of the box: Compliance Name for command More info NSA, CISA Kubernetes Hardening Guidance v1.2 k8s-nsa Link CIS Benchmark for Kubernetes v1.23 k8s-cis Link Pod Security Standards, Baseline k8s-pss-baseline Link Pod Security Standards, Restricted k8s-pss-restricted Link Examples: Scan the cluster for Kubernetes Pod Security Standards Baseline compliance: trivy k8s cluster --compliance=k8s-pss-baseline --report summary Get the detailed report for checks: trivy k8s cluster --compliance=k8s-cis --report all Get summary report in JSON format: trivy k8s cluster --compliance=k8s-cis --report summary --format json Get detailed report in JSON format: trivy k8s cluster --compliance=k8s-cis --report all --format json","title":"Compliance"},{"location":"docs/target/kubernetes/#kbom","text":"KBOM, Kubernetes Bill of Materials, is a manifest of all the important components that make up your Kubernetes cluster \u2013 Control plane components, Node Components, and Addons, including their versions and images. Which \u201capi-server\u201d version are you currently running? Which flavor of \"kubelet\" is running on each node? What kind of etcd or storage are you currently using? And most importantly \u2013 are there any vulnerabilities known to affect these components? These are all questions that KBOM can help you answer. For more background on KBOM, see here . Trivy can generate KBOM in CycloneDX format: trivy k8s cluster --format cyclonedx --output mykbom.cdx.json Trivy can also scan that generated KBOM (or any SBOM) for vulnerabilities: trivy sbom mykbom.cdx.json Result 2023-09-28T22:52:25.707+0300 INFO Vulnerability scanning is enabled 2023-09-28T22:52:25.707+0300 INFO Detected SBOM format: cyclonedx-json 2023-09-28T22:52:25.717+0300 WARN No OS package is detected. Make sure you haven't deleted any files that contain information about the installed packages. 2023-09-28T22:52:25.717+0300 WARN e.g. files under \"/lib/apk/db/\", \"/var/lib/dpkg/\" and \"/var/lib/rpm\" 2023-09-28T22:52:25.717+0300 INFO Detected OS: debian gnu/linux 2023-09-28T22:52:25.717+0300 WARN unsupported os : debian gnu/linux 2023-09-28T22:52:25.717+0300 INFO Number of language-specific files: 3 2023-09-28T22:52:25.717+0300 INFO Detecting kubernetes vulnerabilities... 2023-09-28T22:52:25.718+0300 INFO Detecting gobinary vulnerabilities... Kubernetes (kubernetes) Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Status \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 k8s.io/kubelet \u2502 CVE-2021-25749 \u2502 HIGH \u2502 fixed \u2502 1.24.0 \u2502 1.22.14, 1.23.11, 1.24.5 \u2502 runAsNonRoot logic bypass for Windows containers \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25749 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2023-2431 \u2502 LOW \u2502 \u2502 \u2502 1.24.14, 1.25.9, 1.26.4, 1.27.1 \u2502 Bypass of seccomp profile enforcement \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2023-2431 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Find more in the documentation for SBOM scanning . Currently KBOM vulnerability matching works for plain Kubernetes distributions and does not work well for vendor variants, including some cloud managed distributions.","title":"KBOM"},{"location":"docs/target/repository/","text":"Code Repository Scan your local or remote code repositories for Vulnerabilities Misconfigurations Secrets Licenses By default, vulnerability and secret scanning are enabled, and you can configure that with --scanners . $ trivy repo ( REPO_PATH | REPO_URL ) For example, you can scan a local repository as below. $ trivy repo ./ It's also possible to scan a single file. $ trivy repo ./trivy-ci-test/Pipfile.lock To scan remote code repositories, you need to specify the URL. $ trivy repo https://github.com/aquasecurity/trivy-ci-test Rationale trivy repo is designed to scan code repositories, and it is intended to be used for scanning local/remote repositories in your machine or in your CI environment. Therefore, unlike container/VM image scanning, it targets lock files such as package-lock.json and does not target artifacts like JAR files, binary files, etc. See here for the detail. Scanners Vulnerabilities It is enabled by default. Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json. See here for the detail. $ trivy repo ~/src/github.com/aquasecurity/trivy-ci-test Result 2020-06-01T17:06:58.652+0300 WARN OS is not detected and vulnerabilities in OS packages are not detected. 2020-06-01T17:06:58.652+0300 INFO Detecting pipenv vulnerabilities... 2020-06-01T17:06:58.691+0300 INFO Detecting cargo vulnerabilities... Pipfile.lock ============ Total: 10 (UNKNOWN: 2, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0) +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | django | CVE-2020-7471 | HIGH | 2.0.9 | 3.0.3, 2.2.10, 1.11.28 | django: potential | | | | | | | SQL injection via | | | | | | | StringAgg(delimiter) | + +------------------+----------+ +------------------------+------------------------------------+ | | CVE-2019-19844 | MEDIUM | | 3.0.1, 2.2.9, 1.11.27 | Django: crafted email address | | | | | | | allows account takeover | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-3498 | | | 2.1.5, 2.0.10, 1.11.18 | python-django: Content | | | | | | | spoofing via URL path in | | | | | | | default 404 page | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-6975 | | | 2.1.6, 2.0.11, 1.11.19 | python-django: | | | | | | | memory exhaustion in | | | | | | | django.utils.numberformat.format() | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ ... Misconfigurations It is disabled by default and can be enabled with --scanners config . See here for the detail. $ trivy repo --scanners config ( REPO_PATH | REPO_URL ) Secrets It is enabled by default. See here for the detail. $ trivy repo ( REPO_PATH | REPO_URL ) Licenses It is disabled by default. See here for the detail. $ trivy repo --scanners license ( REPO_PATH | REPO_URL ) SBOM generation Trivy can generate SBOM for code repositories. See here for the detail. References The following flags and environmental variables are available for remote git repositories. Scanning a Branch Pass a --branch argument with a valid branch name on the remote repository provided: $ trivy repo --branch <branch-name> <repo-name> Scanning upto a Commit Pass a --commit argument with a valid commit hash on the remote repository provided: $ trivy repo --commit <commit-hash> <repo-name> Scanning a Tag Pass a --tag argument with a valid tag on the remote repository provided: $ trivy repo --tag <tag-name> <repo-name> Scanning Private Repositories In order to scan private GitHub or GitLab repositories, the environment variable GITHUB_TOKEN or GITLAB_TOKEN must be set, respectively, with a valid token that has access to the private repository being scanned. The GITHUB_TOKEN environment variable will take precedence over GITLAB_TOKEN , so if a private GitLab repository will be scanned, then GITHUB_TOKEN must be unset. You can find how to generate your GitHub Token in the following GitHub documentation. For example: $ export GITHUB_TOKEN=\"your_private_github_token\" $ trivy repo <your private GitHub repo URL> # or $ export GITLAB_TOKEN=\"your_private_gitlab_token\" $ trivy repo <your private GitLab repo URL>","title":"Code Repository"},{"location":"docs/target/repository/#code-repository","text":"Scan your local or remote code repositories for Vulnerabilities Misconfigurations Secrets Licenses By default, vulnerability and secret scanning are enabled, and you can configure that with --scanners . $ trivy repo ( REPO_PATH | REPO_URL ) For example, you can scan a local repository as below. $ trivy repo ./ It's also possible to scan a single file. $ trivy repo ./trivy-ci-test/Pipfile.lock To scan remote code repositories, you need to specify the URL. $ trivy repo https://github.com/aquasecurity/trivy-ci-test","title":"Code Repository"},{"location":"docs/target/repository/#rationale","text":"trivy repo is designed to scan code repositories, and it is intended to be used for scanning local/remote repositories in your machine or in your CI environment. Therefore, unlike container/VM image scanning, it targets lock files such as package-lock.json and does not target artifacts like JAR files, binary files, etc. See here for the detail.","title":"Rationale"},{"location":"docs/target/repository/#scanners","text":"","title":"Scanners"},{"location":"docs/target/repository/#vulnerabilities","text":"It is enabled by default. Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json. See here for the detail. $ trivy repo ~/src/github.com/aquasecurity/trivy-ci-test Result 2020-06-01T17:06:58.652+0300 WARN OS is not detected and vulnerabilities in OS packages are not detected. 2020-06-01T17:06:58.652+0300 INFO Detecting pipenv vulnerabilities... 2020-06-01T17:06:58.691+0300 INFO Detecting cargo vulnerabilities... Pipfile.lock ============ Total: 10 (UNKNOWN: 2, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0) +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | django | CVE-2020-7471 | HIGH | 2.0.9 | 3.0.3, 2.2.10, 1.11.28 | django: potential | | | | | | | SQL injection via | | | | | | | StringAgg(delimiter) | + +------------------+----------+ +------------------------+------------------------------------+ | | CVE-2019-19844 | MEDIUM | | 3.0.1, 2.2.9, 1.11.27 | Django: crafted email address | | | | | | | allows account takeover | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-3498 | | | 2.1.5, 2.0.10, 1.11.18 | python-django: Content | | | | | | | spoofing via URL path in | | | | | | | default 404 page | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-6975 | | | 2.1.6, 2.0.11, 1.11.19 | python-django: | | | | | | | memory exhaustion in | | | | | | | django.utils.numberformat.format() | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ ...","title":"Vulnerabilities"},{"location":"docs/target/repository/#misconfigurations","text":"It is disabled by default and can be enabled with --scanners config . See here for the detail. $ trivy repo --scanners config ( REPO_PATH | REPO_URL )","title":"Misconfigurations"},{"location":"docs/target/repository/#secrets","text":"It is enabled by default. See here for the detail. $ trivy repo ( REPO_PATH | REPO_URL )","title":"Secrets"},{"location":"docs/target/repository/#licenses","text":"It is disabled by default. See here for the detail. $ trivy repo --scanners license ( REPO_PATH | REPO_URL )","title":"Licenses"},{"location":"docs/target/repository/#sbom-generation","text":"Trivy can generate SBOM for code repositories. See here for the detail.","title":"SBOM generation"},{"location":"docs/target/repository/#references","text":"The following flags and environmental variables are available for remote git repositories.","title":"References"},{"location":"docs/target/repository/#scanning-a-branch","text":"Pass a --branch argument with a valid branch name on the remote repository provided: $ trivy repo --branch <branch-name> <repo-name>","title":"Scanning a Branch"},{"location":"docs/target/repository/#scanning-upto-a-commit","text":"Pass a --commit argument with a valid commit hash on the remote repository provided: $ trivy repo --commit <commit-hash> <repo-name>","title":"Scanning upto a Commit"},{"location":"docs/target/repository/#scanning-a-tag","text":"Pass a --tag argument with a valid tag on the remote repository provided: $ trivy repo --tag <tag-name> <repo-name>","title":"Scanning a Tag"},{"location":"docs/target/repository/#scanning-private-repositories","text":"In order to scan private GitHub or GitLab repositories, the environment variable GITHUB_TOKEN or GITLAB_TOKEN must be set, respectively, with a valid token that has access to the private repository being scanned. The GITHUB_TOKEN environment variable will take precedence over GITLAB_TOKEN , so if a private GitLab repository will be scanned, then GITHUB_TOKEN must be unset. You can find how to generate your GitHub Token in the following GitHub documentation. For example: $ export GITHUB_TOKEN=\"your_private_github_token\" $ trivy repo <your private GitHub repo URL> # or $ export GITLAB_TOKEN=\"your_private_gitlab_token\" $ trivy repo <your private GitLab repo URL>","title":"Scanning Private Repositories"},{"location":"docs/target/rootfs/","text":"Rootfs Rootfs scanning is for special use cases such as Host machine Root filesystem Unpacked filesystem $ trivy rootfs /path/to/rootfs Note Rootfs scanning works differently from the Filesystem scanning. You should use trivy fs to scan your local projects in CI/CD. See here for the differences.","title":"Rootfs"},{"location":"docs/target/rootfs/#rootfs","text":"Rootfs scanning is for special use cases such as Host machine Root filesystem Unpacked filesystem $ trivy rootfs /path/to/rootfs Note Rootfs scanning works differently from the Filesystem scanning. You should use trivy fs to scan your local projects in CI/CD. See here for the differences.","title":"Rootfs"},{"location":"docs/target/sbom/","text":"SBOM scanning Trivy can take the following SBOM formats as an input and scan for vulnerabilities. CycloneDX SPDX SPDX JSON CycloneDX-type attestation KBOM in CycloneDX format To scan SBOM, you can use the sbom subcommand and pass the path to the SBOM. The input format is automatically detected. $ trivy sbom /path/to/sbom_file Note Passing SBOMs generated by tool other than Trivy may result in inaccurate detection because Trivy relies on custom properties in SBOM for accurate scanning. CycloneDX Trivy supports CycloneDX as an input. Note CycloneDX XML is not supported at the moment. $ trivy sbom /path/to/cyclonedx.json SPDX Trivy supports the SPDX SBOM as an input. The following SPDX formats are supported: Tag-value ( --format spdx ) JSON ( --format spdx-json ) $ trivy image --format spdx-json --output spdx.json alpine:3.16.0 $ trivy sbom spdx.json Result 2022-09-15T21:32:27.168+0300 INFO Vulnerability scanning is enabled 2022-09-15T21:32:27.169+0300 INFO Detected SBOM format: spdx-json 2022-09-15T21:32:27.210+0300 INFO Detected OS: alpine 2022-09-15T21:32:27.210+0300 INFO Detecting Alpine vulnerabilities... 2022-09-15T21:32:27.211+0300 INFO Number of language-specific files: 0 spdx.json (alpine 3.16.0) ========================= Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 2, CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 busybox \u2502 CVE-2022-30065 \u2502 HIGH \u2502 1.35.0-r13 \u2502 1.35.0-r15 \u2502 busybox: A use-after-free in Busybox's awk applet leads to \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 denial of service... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-30065 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 libcrypto1.1 \u2502 CVE-2022-2097 \u2502 MEDIUM \u2502 1.1.1o-r0 \u2502 1.1.1q-r0 \u2502 openssl: AES OCB fails to encrypt some bytes \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-2097 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 libssl1.1 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 ssl_client \u2502 CVE-2022-30065 \u2502 HIGH \u2502 1.35.0-r13 \u2502 1.35.0-r15 \u2502 busybox: A use-after-free in Busybox's awk applet leads to \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 denial of service... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-30065 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 zlib \u2502 CVE-2022-37434 \u2502 CRITICAL \u2502 1.2.12-r1 \u2502 1.2.12-r2 \u2502 zlib: a heap-based buffer over-read or buffer overflow in \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 inflate in inflate.c... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-37434 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 SBOM attestation You can also scan an SBOM attestation. In the following example, Cosign gets an attestation and Trivy scans it. You must create CycloneDX-type attestation before trying the example. To learn more about how to create an CycloneDX-Type attestation and attach it to an image, see the SBOM attestation page . $ cosign verify-attestation --key /path/to/cosign.pub --type cyclonedx <IMAGE> > sbom.cdx.intoto.jsonl $ trivy sbom ./sbom.cdx.intoto.jsonl sbom.cdx.intoto.jsonl ( alpine 3 .7.3 ) ========================= Total: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 musl \u2502 CVE-2019-14697 \u2502 CRITICAL \u2502 1 .1.18-r3 \u2502 1 .1.18-r4 \u2502 musl libc through 1 .1.23 has an x87 floating-point stack \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 adjustment im ...... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-14697 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 KBOM To read more about KBOM, see the documentation for Kubernetes scanning . shell $ trivy k8s --format cyclonedx cluster -o kbom.json $ trivy sbom kbom.json 2023-09-28T22:52:25.707+0300 INFO Vulnerability scanning is enabled 2023-09-28T22:52:25.707+0300 INFO Detected SBOM format: cyclonedx-json 2023-09-28T22:52:25.717+0300 WARN No OS package is detected. Make sure you haven't deleted any files that contain information about the installed packages. 2023-09-28T22:52:25.717+0300 WARN e.g. files under \"/lib/apk/db/\", \"/var/lib/dpkg/\" and \"/var/lib/rpm\" 2023-09-28T22:52:25.717+0300 INFO Detected OS: debian gnu/linux 2023-09-28T22:52:25.717+0300 WARN unsupported os : debian gnu/linux 2023-09-28T22:52:25.717+0300 INFO Number of language-specific files: 3 2023-09-28T22:52:25.717+0300 INFO Detecting kubernetes vulnerabilities... 2023-09-28T22:52:25.718+0300 INFO Detecting gobinary vulnerabilities... Kubernetes (kubernetes) Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Status \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 k8s.io/kubelet \u2502 CVE-2021-25749 \u2502 HIGH \u2502 fixed \u2502 1.24.0 \u2502 1.22.14, 1.23.11, 1.24.5 \u2502 runAsNonRoot logic bypass for Windows containers \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25749 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2023-2431 \u2502 LOW \u2502 \u2502 \u2502 1.24.14, 1.25.9, 1.26.4, 1.27.1 \u2502 Bypass of seccomp profile enforcement \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2023-2431 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"SBOM"},{"location":"docs/target/sbom/#sbom-scanning","text":"Trivy can take the following SBOM formats as an input and scan for vulnerabilities. CycloneDX SPDX SPDX JSON CycloneDX-type attestation KBOM in CycloneDX format To scan SBOM, you can use the sbom subcommand and pass the path to the SBOM. The input format is automatically detected. $ trivy sbom /path/to/sbom_file Note Passing SBOMs generated by tool other than Trivy may result in inaccurate detection because Trivy relies on custom properties in SBOM for accurate scanning.","title":"SBOM scanning"},{"location":"docs/target/sbom/#cyclonedx","text":"Trivy supports CycloneDX as an input. Note CycloneDX XML is not supported at the moment. $ trivy sbom /path/to/cyclonedx.json","title":"CycloneDX"},{"location":"docs/target/sbom/#spdx","text":"Trivy supports the SPDX SBOM as an input. The following SPDX formats are supported: Tag-value ( --format spdx ) JSON ( --format spdx-json ) $ trivy image --format spdx-json --output spdx.json alpine:3.16.0 $ trivy sbom spdx.json Result 2022-09-15T21:32:27.168+0300 INFO Vulnerability scanning is enabled 2022-09-15T21:32:27.169+0300 INFO Detected SBOM format: spdx-json 2022-09-15T21:32:27.210+0300 INFO Detected OS: alpine 2022-09-15T21:32:27.210+0300 INFO Detecting Alpine vulnerabilities... 2022-09-15T21:32:27.211+0300 INFO Number of language-specific files: 0 spdx.json (alpine 3.16.0) ========================= Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 2, CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 busybox \u2502 CVE-2022-30065 \u2502 HIGH \u2502 1.35.0-r13 \u2502 1.35.0-r15 \u2502 busybox: A use-after-free in Busybox's awk applet leads to \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 denial of service... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-30065 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 libcrypto1.1 \u2502 CVE-2022-2097 \u2502 MEDIUM \u2502 1.1.1o-r0 \u2502 1.1.1q-r0 \u2502 openssl: AES OCB fails to encrypt some bytes \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-2097 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 libssl1.1 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 ssl_client \u2502 CVE-2022-30065 \u2502 HIGH \u2502 1.35.0-r13 \u2502 1.35.0-r15 \u2502 busybox: A use-after-free in Busybox's awk applet leads to \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 denial of service... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-30065 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 zlib \u2502 CVE-2022-37434 \u2502 CRITICAL \u2502 1.2.12-r1 \u2502 1.2.12-r2 \u2502 zlib: a heap-based buffer over-read or buffer overflow in \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 inflate in inflate.c... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-37434 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"SPDX"},{"location":"docs/target/sbom/#sbom-attestation","text":"You can also scan an SBOM attestation. In the following example, Cosign gets an attestation and Trivy scans it. You must create CycloneDX-type attestation before trying the example. To learn more about how to create an CycloneDX-Type attestation and attach it to an image, see the SBOM attestation page . $ cosign verify-attestation --key /path/to/cosign.pub --type cyclonedx <IMAGE> > sbom.cdx.intoto.jsonl $ trivy sbom ./sbom.cdx.intoto.jsonl sbom.cdx.intoto.jsonl ( alpine 3 .7.3 ) ========================= Total: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 musl \u2502 CVE-2019-14697 \u2502 CRITICAL \u2502 1 .1.18-r3 \u2502 1 .1.18-r4 \u2502 musl libc through 1 .1.23 has an x87 floating-point stack \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 adjustment im ...... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-14697 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"SBOM attestation"},{"location":"docs/target/sbom/#kbom","text":"To read more about KBOM, see the documentation for Kubernetes scanning . shell $ trivy k8s --format cyclonedx cluster -o kbom.json $ trivy sbom kbom.json 2023-09-28T22:52:25.707+0300 INFO Vulnerability scanning is enabled 2023-09-28T22:52:25.707+0300 INFO Detected SBOM format: cyclonedx-json 2023-09-28T22:52:25.717+0300 WARN No OS package is detected. Make sure you haven't deleted any files that contain information about the installed packages. 2023-09-28T22:52:25.717+0300 WARN e.g. files under \"/lib/apk/db/\", \"/var/lib/dpkg/\" and \"/var/lib/rpm\" 2023-09-28T22:52:25.717+0300 INFO Detected OS: debian gnu/linux 2023-09-28T22:52:25.717+0300 WARN unsupported os : debian gnu/linux 2023-09-28T22:52:25.717+0300 INFO Number of language-specific files: 3 2023-09-28T22:52:25.717+0300 INFO Detecting kubernetes vulnerabilities... 2023-09-28T22:52:25.718+0300 INFO Detecting gobinary vulnerabilities... Kubernetes (kubernetes) Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Status \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 k8s.io/kubelet \u2502 CVE-2021-25749 \u2502 HIGH \u2502 fixed \u2502 1.24.0 \u2502 1.22.14, 1.23.11, 1.24.5 \u2502 runAsNonRoot logic bypass for Windows containers \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25749 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2023-2431 \u2502 LOW \u2502 \u2502 \u2502 1.24.14, 1.25.9, 1.26.4, 1.27.1 \u2502 Bypass of seccomp profile enforcement \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2023-2431 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"KBOM"},{"location":"docs/target/vm/","text":"Virtual Machine Image EXPERIMENTAL This feature might change without preserving backwards compatibility. To scan virtual machine (VM) images, you can use the vm subcommand. Targets The following targets are currently supported: Local file AWS EC2 Amazon Machine Image (AMI) Amazon Elastic Block Store (EBS) Snapshot Local file Pass the path to your local VM image file. $ trivy vm --scanners vuln disk.vmdk Result disk.vmdk (amazon 2 (Karoo)) =========================================================================================== Total: 802 (UNKNOWN: 0, LOW: 17, MEDIUM: 554, HIGH: 221, CRITICAL: 10) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 amazon-ssm-agent \u2502 CVE-2022-24675 \u2502 HIGH \u2502 3.0.529.0-1.amzn2 \u2502 3.1.1575.0-1.amzn2 \u2502 golang: encoding/pem: fix stack overflow in Decode \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-24675 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 bind-export-libs \u2502 CVE-2021-25215 \u2502 \u2502 32:9.11.4-26.P2.amzn2.4 \u2502 32:9.11.4-26.P2.amzn2.5 \u2502 bind: An assertion check can fail while answering queries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for DNAME records... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25215 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-25214 \u2502 MEDIUM \u2502 \u2502 32:9.11.4-26.P2.amzn2.5.2 \u2502 bind: Broken inbound incremental zone update (IXFR) can \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 cause named to terminate... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25214 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 bind-libs \u2502 CVE-2021-25215 \u2502 HIGH \u2502 \u2502 32:9.11.4-26.P2.amzn2.5 \u2502 bind: An assertion check can fail while answering queries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for DNAME records... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25215 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-25214 \u2502 MEDIUM \u2502 \u2502 32:9.11.4-26.P2.amzn2.5.2 \u2502 bind: Broken inbound incremental zone update (IXFR) can \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 cause named to terminate... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25214 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 bind-libs-lite \u2502 CVE-2021-25215 \u2502 HIGH \u2502 \u2502 32:9.11.4-26.P2.amzn2.5 \u2502 bind: An assertion check can fail while answering queries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for DNAME records... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25215 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-25214 \u2502 MEDIUM \u2502 \u2502 32:9.11.4-26.P2.amzn2.5.2 \u2502 bind: Broken inbound incremental zone update (IXFR) can \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 cause named to terminate... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25214 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 ... Amazon Machine Image (AMI) You can specify your AMI ID with the ami: prefix. $ trivy vm ami: ${ your_ami_id } Note AMIs in the marketplace are not supported because the EBS direct APIs don't support that. See the AWS documentation for the detail. Example $ trivy vm --scanners vuln ami:ami-0123456789abcdefg If you want to scan a AMI of non-default setting region, you can set any region via --aws-region option. $ trivy vm --aws-region ap-northeast-1 ami:ami-0123456789abcdefg Required Actions Some actions on EBS are also necessary since Trivy scans an EBS snapshot tied to the specified AMI under the hood. ec2:DescribeImages ebs:ListSnapshotBlocks ebs:GetSnapshotBlock Amazon Elastic Block Store (EBS) Snapshot You can specify your EBS snapshot ID with the ebs: prefix. $ trivy vm ebs: ${ your_ebs_snapshot_id } Note Public snapshots are not supported because the EBS direct APIs don't support that. See the AWS documentation for the detail. Example $ trivy vm --scanners vuln ebs:snap-0123456789abcdefg If you want to scan an EBS Snapshot of non-default setting region, you can set any region via --aws-region option. $ trivy vm --aws-region ap-northeast-1 ebs:ebs-0123456789abcdefg The above command takes a while as it calls EBS API and fetches the EBS blocks. If you want to scan the same snapshot several times, you can download the snapshot locally by using coldsnap maintained by AWS. Then, Trivy can scan the local VM image file. $ coldsnap download snap-0123456789abcdefg disk.img $ trivy vm ./disk.img Required Actions ebs:ListSnapshotBlocks ebs:GetSnapshotBlock Scanners Trivy supports VM image scanning for Vulnerabilities Misconfigurations Secrets Licenses Vulnerabilities It is enabled by default. You can simply specify your VM image location. It detects known vulnerabilities in your VM image. See here for the detail. $ trivy vm [YOUR_VM_IMAGE] Misconfigurations It is supported, but it is not useful in most cases. As mentioned here , Trivy mainly supports Infrastructure as Code (IaC) files for misconfigurations. If your VM image includes IaC files such as Kubernetes YAML files or Terraform files, you should enable this feature with --scanners config . $ trivy vm --scanners config [YOUR_VM_IMAGE] Secrets It is enabled by default. See here for the detail. $ trivy vm [ YOUR_VM_IMAGE ] Tip The scanning could be faster if you enable only vulnerability scanning ( --scanners vuln ) because Trivy tries to download only necessary blocks for vulnerability detection. Licenses It is disabled by default. See here for the detail. $ trivy vm --scanners license [ YOUR_VM_IMAGE ] SBOM generation Trivy can generate SBOM for VM images. See here for the detail. Supported Architectures Virtual machine images Image format Support VMDK \u2714 OVA VHD VHDX QCOW2 VMDK disk types VMDK disk type Support streamOptimized \u2714 monolithicSparse vmfs vmfsSparse twoGbMaxExtentSparse monolithicFlat twoGbMaxExtentFlat vmfsRaw fullDevice partitionedDevice vmfsRawDeviceMap vmfsPassthroughRawDeviceMap Reference: VMware Virtual Disk Format 1.1.pdf Disk partitions Disk format Support Master boot record (MBR) \u2714 Extended master boot record GUID partition table (GPT) \u2714 Logical volume manager (LVM) Filesystems Filesystem format Support XFS \u2714 EXT4 \u2714 EXT2/3 ZFS","title":"Virtual Machine Image"},{"location":"docs/target/vm/#virtual-machine-image","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. To scan virtual machine (VM) images, you can use the vm subcommand.","title":"Virtual Machine Image"},{"location":"docs/target/vm/#targets","text":"The following targets are currently supported: Local file AWS EC2 Amazon Machine Image (AMI) Amazon Elastic Block Store (EBS) Snapshot","title":"Targets"},{"location":"docs/target/vm/#local-file","text":"Pass the path to your local VM image file. $ trivy vm --scanners vuln disk.vmdk Result disk.vmdk (amazon 2 (Karoo)) =========================================================================================== Total: 802 (UNKNOWN: 0, LOW: 17, MEDIUM: 554, HIGH: 221, CRITICAL: 10) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 amazon-ssm-agent \u2502 CVE-2022-24675 \u2502 HIGH \u2502 3.0.529.0-1.amzn2 \u2502 3.1.1575.0-1.amzn2 \u2502 golang: encoding/pem: fix stack overflow in Decode \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-24675 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 bind-export-libs \u2502 CVE-2021-25215 \u2502 \u2502 32:9.11.4-26.P2.amzn2.4 \u2502 32:9.11.4-26.P2.amzn2.5 \u2502 bind: An assertion check can fail while answering queries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for DNAME records... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25215 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-25214 \u2502 MEDIUM \u2502 \u2502 32:9.11.4-26.P2.amzn2.5.2 \u2502 bind: Broken inbound incremental zone update (IXFR) can \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 cause named to terminate... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25214 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 bind-libs \u2502 CVE-2021-25215 \u2502 HIGH \u2502 \u2502 32:9.11.4-26.P2.amzn2.5 \u2502 bind: An assertion check can fail while answering queries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for DNAME records... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25215 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-25214 \u2502 MEDIUM \u2502 \u2502 32:9.11.4-26.P2.amzn2.5.2 \u2502 bind: Broken inbound incremental zone update (IXFR) can \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 cause named to terminate... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25214 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 bind-libs-lite \u2502 CVE-2021-25215 \u2502 HIGH \u2502 \u2502 32:9.11.4-26.P2.amzn2.5 \u2502 bind: An assertion check can fail while answering queries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for DNAME records... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25215 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-25214 \u2502 MEDIUM \u2502 \u2502 32:9.11.4-26.P2.amzn2.5.2 \u2502 bind: Broken inbound incremental zone update (IXFR) can \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 cause named to terminate... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25214 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 ...","title":"Local file"},{"location":"docs/target/vm/#amazon-machine-image-ami","text":"You can specify your AMI ID with the ami: prefix. $ trivy vm ami: ${ your_ami_id } Note AMIs in the marketplace are not supported because the EBS direct APIs don't support that. See the AWS documentation for the detail.","title":"Amazon Machine Image (AMI)"},{"location":"docs/target/vm/#example","text":"$ trivy vm --scanners vuln ami:ami-0123456789abcdefg If you want to scan a AMI of non-default setting region, you can set any region via --aws-region option. $ trivy vm --aws-region ap-northeast-1 ami:ami-0123456789abcdefg","title":"Example"},{"location":"docs/target/vm/#required-actions","text":"Some actions on EBS are also necessary since Trivy scans an EBS snapshot tied to the specified AMI under the hood. ec2:DescribeImages ebs:ListSnapshotBlocks ebs:GetSnapshotBlock","title":"Required Actions"},{"location":"docs/target/vm/#amazon-elastic-block-store-ebs-snapshot","text":"You can specify your EBS snapshot ID with the ebs: prefix. $ trivy vm ebs: ${ your_ebs_snapshot_id } Note Public snapshots are not supported because the EBS direct APIs don't support that. See the AWS documentation for the detail.","title":"Amazon Elastic Block Store (EBS) Snapshot"},{"location":"docs/target/vm/#example_1","text":"$ trivy vm --scanners vuln ebs:snap-0123456789abcdefg If you want to scan an EBS Snapshot of non-default setting region, you can set any region via --aws-region option. $ trivy vm --aws-region ap-northeast-1 ebs:ebs-0123456789abcdefg The above command takes a while as it calls EBS API and fetches the EBS blocks. If you want to scan the same snapshot several times, you can download the snapshot locally by using coldsnap maintained by AWS. Then, Trivy can scan the local VM image file. $ coldsnap download snap-0123456789abcdefg disk.img $ trivy vm ./disk.img","title":"Example"},{"location":"docs/target/vm/#required-actions_1","text":"ebs:ListSnapshotBlocks ebs:GetSnapshotBlock","title":"Required Actions"},{"location":"docs/target/vm/#scanners","text":"Trivy supports VM image scanning for Vulnerabilities Misconfigurations Secrets Licenses","title":"Scanners"},{"location":"docs/target/vm/#vulnerabilities","text":"It is enabled by default. You can simply specify your VM image location. It detects known vulnerabilities in your VM image. See here for the detail. $ trivy vm [YOUR_VM_IMAGE]","title":"Vulnerabilities"},{"location":"docs/target/vm/#misconfigurations","text":"It is supported, but it is not useful in most cases. As mentioned here , Trivy mainly supports Infrastructure as Code (IaC) files for misconfigurations. If your VM image includes IaC files such as Kubernetes YAML files or Terraform files, you should enable this feature with --scanners config . $ trivy vm --scanners config [YOUR_VM_IMAGE]","title":"Misconfigurations"},{"location":"docs/target/vm/#secrets","text":"It is enabled by default. See here for the detail. $ trivy vm [ YOUR_VM_IMAGE ] Tip The scanning could be faster if you enable only vulnerability scanning ( --scanners vuln ) because Trivy tries to download only necessary blocks for vulnerability detection.","title":"Secrets"},{"location":"docs/target/vm/#licenses","text":"It is disabled by default. See here for the detail. $ trivy vm --scanners license [ YOUR_VM_IMAGE ]","title":"Licenses"},{"location":"docs/target/vm/#sbom-generation","text":"Trivy can generate SBOM for VM images. See here for the detail.","title":"SBOM generation"},{"location":"docs/target/vm/#supported-architectures","text":"","title":"Supported Architectures"},{"location":"docs/target/vm/#virtual-machine-images","text":"Image format Support VMDK \u2714 OVA VHD VHDX QCOW2","title":"Virtual machine images"},{"location":"docs/target/vm/#vmdk-disk-types","text":"VMDK disk type Support streamOptimized \u2714 monolithicSparse vmfs vmfsSparse twoGbMaxExtentSparse monolithicFlat twoGbMaxExtentFlat vmfsRaw fullDevice partitionedDevice vmfsRawDeviceMap vmfsPassthroughRawDeviceMap Reference: VMware Virtual Disk Format 1.1.pdf","title":"VMDK disk types"},{"location":"docs/target/vm/#disk-partitions","text":"Disk format Support Master boot record (MBR) \u2714 Extended master boot record GUID partition table (GPT) \u2714 Logical volume manager (LVM)","title":"Disk partitions"},{"location":"docs/target/vm/#filesystems","text":"Filesystem format Support XFS \u2714 EXT4 \u2714 EXT2/3 ZFS","title":"Filesystems"},{"location":"ecosystem/","text":"Ecosystem Trivy is integrated into many popular tools and applications, so that you can easily add security to your workflow. In this section you will find an aggregation of the different integrations. Integrations are listed as either \"official\" or \"community\". Official integrations are developed by the core Trivy team and supported by it. Community integrations are integrations developed by the community, and collected here for your convenience. For support or questions about community integrations, please contact the original developers. \ud83d\udc48 Please use the side-navigation on the left in order to browse the different topics. Add missing integration We are happy to showcase community integrations in this section. To suggest an addition simply make a Pull Request to add the missing integration.","title":"Overview"},{"location":"ecosystem/#ecosystem","text":"Trivy is integrated into many popular tools and applications, so that you can easily add security to your workflow. In this section you will find an aggregation of the different integrations. Integrations are listed as either \"official\" or \"community\". Official integrations are developed by the core Trivy team and supported by it. Community integrations are integrations developed by the community, and collected here for your convenience. For support or questions about community integrations, please contact the original developers. \ud83d\udc48 Please use the side-navigation on the left in order to browse the different topics.","title":"Ecosystem"},{"location":"ecosystem/#add-missing-integration","text":"We are happy to showcase community integrations in this section. To suggest an addition simply make a Pull Request to add the missing integration.","title":"Add missing integration"},{"location":"ecosystem/cicd/","text":"CI/CD Integrations GitHub Actions GitHub Actions is GitHub's native CI/CD and job orchestration service. trivy-action (Official) GitHub Action for integrating Trivy into your GitHub pipeline \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-action Azure DevOps (Official) Azure Devops is Microsoft Azure cloud native CI/CD service. Trivy has a \"Azure Devops Pipelines Task\" for Trivy, that lets you easily introduce security scanning into your workflow, with an integrated Azure Devops UI. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-azure-pipelines-task trivy-action (Community) GitHub Action to scan vulnerability using Trivy. If vulnerabilities are found by Trivy, it creates a GitHub Issue. \ud83d\udc49 Get it at: https://github.com/marketplace/actions/trivy-action trivy-github-issues (Community) In this action, Trivy scans the dependency files such as package-lock.json and go.sum in your repository, then create GitHub issues according to the result. \ud83d\udc49 Get it at: https://github.com/marketplace/actions/trivy-github-issues Buildkite Plugin (Community) The trivy buildkite plugin provides a convenient mechanism for running the open-source trivy static analysis tool on your project. \ud83d\udc49 Get it at: https://github.com/equinixmetal-buildkite/trivy-buildkite-plugin Semaphore (Community) Semaphore is a CI/CD service. You can use Trivy in Semaphore for scanning code, containers, infrastructure, and Kubernetes in Semaphore workflow. \ud83d\udc49 Get it at: https://semaphoreci.com/blog/continuous-container-vulnerability-testing-with-trivy CircleCI (Community) CircleCI is a CI/CD service. You can use the Trivy Orb for Circle CI to introduce security scanning into your workflow. \ud83d\udc49 Get it at: https://circleci.com/developer/orbs/orb/fifteen5/trivy-orb Source: https://github.com/15five/trivy-orb Woodpecker CI (Community) Example Trivy step in pipeline pipeline: securitycheck: image: aquasec/trivy:latest commands: # use any trivy command, if exit code is 0 woodpecker marks it as passed, else it assumes it failed - trivy fs --exit-code 1 --skip-dirs web/ --skip-dirs docs/ --severity MEDIUM,HIGH,CRITICAL . Woodpecker does use Trivy itself so you can see it in use there . Concourse CI (Community) Concourse CI is a CI/CD service. You can use Trivy Resource in Concourse for scanning containers and introducing security scanning into your workflow. It has capabilities to fail the pipeline, create issues, alert communication channels (using respective resources) based on Trivy scan output. \ud83d\udc49 Get it at: https://github.com/Comcast/trivy-resource/","title":"CI/CD"},{"location":"ecosystem/cicd/#cicd-integrations","text":"","title":"CI/CD Integrations"},{"location":"ecosystem/cicd/#github-actions","text":"GitHub Actions is GitHub's native CI/CD and job orchestration service.","title":"GitHub Actions"},{"location":"ecosystem/cicd/#trivy-action-official","text":"GitHub Action for integrating Trivy into your GitHub pipeline \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-action","title":"trivy-action (Official)"},{"location":"ecosystem/cicd/#azure-devops-official","text":"Azure Devops is Microsoft Azure cloud native CI/CD service. Trivy has a \"Azure Devops Pipelines Task\" for Trivy, that lets you easily introduce security scanning into your workflow, with an integrated Azure Devops UI. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-azure-pipelines-task","title":"Azure DevOps (Official)"},{"location":"ecosystem/cicd/#trivy-action-community","text":"GitHub Action to scan vulnerability using Trivy. If vulnerabilities are found by Trivy, it creates a GitHub Issue. \ud83d\udc49 Get it at: https://github.com/marketplace/actions/trivy-action","title":"trivy-action (Community)"},{"location":"ecosystem/cicd/#trivy-github-issues-community","text":"In this action, Trivy scans the dependency files such as package-lock.json and go.sum in your repository, then create GitHub issues according to the result. \ud83d\udc49 Get it at: https://github.com/marketplace/actions/trivy-github-issues","title":"trivy-github-issues (Community)"},{"location":"ecosystem/cicd/#buildkite-plugin-community","text":"The trivy buildkite plugin provides a convenient mechanism for running the open-source trivy static analysis tool on your project. \ud83d\udc49 Get it at: https://github.com/equinixmetal-buildkite/trivy-buildkite-plugin","title":"Buildkite Plugin (Community)"},{"location":"ecosystem/cicd/#semaphore-community","text":"Semaphore is a CI/CD service. You can use Trivy in Semaphore for scanning code, containers, infrastructure, and Kubernetes in Semaphore workflow. \ud83d\udc49 Get it at: https://semaphoreci.com/blog/continuous-container-vulnerability-testing-with-trivy","title":"Semaphore (Community)"},{"location":"ecosystem/cicd/#circleci-community","text":"CircleCI is a CI/CD service. You can use the Trivy Orb for Circle CI to introduce security scanning into your workflow. \ud83d\udc49 Get it at: https://circleci.com/developer/orbs/orb/fifteen5/trivy-orb Source: https://github.com/15five/trivy-orb","title":"CircleCI (Community)"},{"location":"ecosystem/cicd/#woodpecker-ci-community","text":"Example Trivy step in pipeline pipeline: securitycheck: image: aquasec/trivy:latest commands: # use any trivy command, if exit code is 0 woodpecker marks it as passed, else it assumes it failed - trivy fs --exit-code 1 --skip-dirs web/ --skip-dirs docs/ --severity MEDIUM,HIGH,CRITICAL . Woodpecker does use Trivy itself so you can see it in use there .","title":"Woodpecker CI (Community)"},{"location":"ecosystem/cicd/#concourse-ci-community","text":"Concourse CI is a CI/CD service. You can use Trivy Resource in Concourse for scanning containers and introducing security scanning into your workflow. It has capabilities to fail the pipeline, create issues, alert communication channels (using respective resources) based on Trivy scan output. \ud83d\udc49 Get it at: https://github.com/Comcast/trivy-resource/","title":"Concourse CI (Community)"},{"location":"ecosystem/ide/","text":"IDE and developer tools Integrations VSCode (Official) Visual Studio Code is an open source versatile code editor and development environment. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-vscode-extension JetBrains (Official) JetBrains makes IDEs such as Goland, Pycharm, IntelliJ, Webstorm, and more. The Trivy plugin for JetBrains IDEs lets you use Trivy right from your development environment. \ud83d\udc49 Get it at: https://plugins.jetbrains.com/plugin/18690-trivy-findings-explorer Kubernetes Lens (Official) Kubernetes Lens is a management application for Kubernetes clusters. Trivy has an extension for Kubernetes Lens that lets you scan Kubernetes workloads and view the results in the Lens UI. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-operator-lens-extension Vim (Community) Vim is a terminal based text editor. Vim plugin for Trivy to install and run Trivy. \ud83d\udc49 Get it at: https://github.com/aquasecurity/vim-trivy Docker Desktop (Community) Docker Desktop is an easy way to install Docker container engine on your development machine, and manage it in a GUI . Trivy Docker Desktop extension for scanning container images for vulnerabilities and generating SBOMs \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-docker-extension Rancher Desktop (Community) Rancher Desktop is an easy way to use containers and Kubernetes on your development machine, and manage it in a GUI. Trivy is natively integrated with Rancher, no installation is needed. More info in Rancher documentation: https://docs.rancherdesktop.io/getting-started/features#scanning-images LazyTrivy (Community) A terminal native UI for Trivy \ud83d\udc49 Get it at: https://github.com/owenrumney/lazytrivy Trivy Vulnerability explorer (Community) Web application that allows to load a Trivy report in json format and displays the vulnerabilities of a single target in an interactive data table \ud83d\udc49 Get it at: https://github.com/dbsystel/trivy-vulnerability-explorer Trivy pre-commit (Community) A trivy pre-commit hook that runs a trivy fs in your git repo before commiting, preventing you from commiting secrets in the first place. \ud83d\udc49 Get it at: https://github.com/mxab/pre-commit-trivy AWS CDK The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. image-scanner-with-trivy (Community) A CDK Construct Library to scan an image with trivy in CDK codes. \ud83d\udc49 Get it at: https://constructs.dev/packages/image-scanner-with-trivy","title":"IDE and Dev tools"},{"location":"ecosystem/ide/#ide-and-developer-tools-integrations","text":"","title":"IDE and developer tools Integrations"},{"location":"ecosystem/ide/#vscode-official","text":"Visual Studio Code is an open source versatile code editor and development environment. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-vscode-extension","title":"VSCode (Official)"},{"location":"ecosystem/ide/#jetbrains-official","text":"JetBrains makes IDEs such as Goland, Pycharm, IntelliJ, Webstorm, and more. The Trivy plugin for JetBrains IDEs lets you use Trivy right from your development environment. \ud83d\udc49 Get it at: https://plugins.jetbrains.com/plugin/18690-trivy-findings-explorer","title":"JetBrains (Official)"},{"location":"ecosystem/ide/#kubernetes-lens-official","text":"Kubernetes Lens is a management application for Kubernetes clusters. Trivy has an extension for Kubernetes Lens that lets you scan Kubernetes workloads and view the results in the Lens UI. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-operator-lens-extension","title":"Kubernetes Lens (Official)"},{"location":"ecosystem/ide/#vim-community","text":"Vim is a terminal based text editor. Vim plugin for Trivy to install and run Trivy. \ud83d\udc49 Get it at: https://github.com/aquasecurity/vim-trivy","title":"Vim (Community)"},{"location":"ecosystem/ide/#docker-desktop-community","text":"Docker Desktop is an easy way to install Docker container engine on your development machine, and manage it in a GUI . Trivy Docker Desktop extension for scanning container images for vulnerabilities and generating SBOMs \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-docker-extension","title":"Docker Desktop (Community)"},{"location":"ecosystem/ide/#rancher-desktop-community","text":"Rancher Desktop is an easy way to use containers and Kubernetes on your development machine, and manage it in a GUI. Trivy is natively integrated with Rancher, no installation is needed. More info in Rancher documentation: https://docs.rancherdesktop.io/getting-started/features#scanning-images","title":"Rancher Desktop (Community)"},{"location":"ecosystem/ide/#lazytrivy-community","text":"A terminal native UI for Trivy \ud83d\udc49 Get it at: https://github.com/owenrumney/lazytrivy","title":"LazyTrivy (Community)"},{"location":"ecosystem/ide/#trivy-vulnerability-explorer-community","text":"Web application that allows to load a Trivy report in json format and displays the vulnerabilities of a single target in an interactive data table \ud83d\udc49 Get it at: https://github.com/dbsystel/trivy-vulnerability-explorer","title":"Trivy Vulnerability explorer (Community)"},{"location":"ecosystem/ide/#trivy-pre-commit-community","text":"A trivy pre-commit hook that runs a trivy fs in your git repo before commiting, preventing you from commiting secrets in the first place. \ud83d\udc49 Get it at: https://github.com/mxab/pre-commit-trivy","title":"Trivy pre-commit (Community)"},{"location":"ecosystem/ide/#aws-cdk","text":"The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation.","title":"AWS CDK"},{"location":"ecosystem/ide/#image-scanner-with-trivy-community","text":"A CDK Construct Library to scan an image with trivy in CDK codes. \ud83d\udc49 Get it at: https://constructs.dev/packages/image-scanner-with-trivy","title":"image-scanner-with-trivy (Community)"},{"location":"ecosystem/prod/","text":"Production and cloud Integrations Kubernetes Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. Trivy Operator (Official) Using the Trivy Operator you can install Trivy into a Kubernetes cluster so that it automatically and continuously scan your workloads and cluster for security issues. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-operator Harbor (Official) Harbor is an open source cloud native container and artifact registry. Trivy is natively integrated into Harbor, no installation is needed. More info in Harbor documentation: https://goharbor.io/docs/2.6.0/administration/vulnerability-scanning Kyverno (Community) Kyverno is a policy management tool for Kubernetes. You can use Kyverno to ensure and enforce that deployed workloads' images are scanned for vulnerabilities. \ud83d\udc49 Get it at: https://neonmirrors.net/post/2022-07/attesting-image-scans-kyverno","title":"Production and Clouds"},{"location":"ecosystem/prod/#production-and-cloud-integrations","text":"","title":"Production and cloud Integrations"},{"location":"ecosystem/prod/#kubernetes","text":"Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications.","title":"Kubernetes"},{"location":"ecosystem/prod/#trivy-operator-official","text":"Using the Trivy Operator you can install Trivy into a Kubernetes cluster so that it automatically and continuously scan your workloads and cluster for security issues. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-operator","title":"Trivy Operator (Official)"},{"location":"ecosystem/prod/#harbor-official","text":"Harbor is an open source cloud native container and artifact registry. Trivy is natively integrated into Harbor, no installation is needed. More info in Harbor documentation: https://goharbor.io/docs/2.6.0/administration/vulnerability-scanning","title":"Harbor (Official)"},{"location":"ecosystem/prod/#kyverno-community","text":"Kyverno is a policy management tool for Kubernetes. You can use Kyverno to ensure and enforce that deployed workloads' images are scanned for vulnerabilities. \ud83d\udc49 Get it at: https://neonmirrors.net/post/2022-07/attesting-image-scans-kyverno","title":"Kyverno (Community)"},{"location":"ecosystem/security/","text":"Security Management SonarQube (Community) A Trivy plugin that converts JSON report to SonarQube generic issues format . \ud83d\udc49 Get it at: https://github.com/umax/trivy-plugin-sonarqube DefectDojo (Community) DefectDojo can parse Trivy JSON reports. The parser supports deduplication and auto-close features. \ud83d\udc49 Get it at: https://github.com/DefectDojo/django-DefectDojo","title":"Security Management"},{"location":"ecosystem/security/#security-management","text":"","title":"Security Management"},{"location":"ecosystem/security/#sonarqube-community","text":"A Trivy plugin that converts JSON report to SonarQube generic issues format . \ud83d\udc49 Get it at: https://github.com/umax/trivy-plugin-sonarqube","title":"SonarQube (Community)"},{"location":"ecosystem/security/#defectdojo-community","text":"DefectDojo can parse Trivy JSON reports. The parser supports deduplication and auto-close features. \ud83d\udc49 Get it at: https://github.com/DefectDojo/django-DefectDojo","title":"DefectDojo (Community)"},{"location":"getting-started/faq/","text":"FAQ How to pronounce the name \"Trivy\"? tri is pronounced like tri gger, vy is pronounced like en vy . Does Trivy support X? Check out the Scanning coverage page . Is there a paid version of Trivy? If you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering. You can find a high level comparison table specific to Trivy users here . In addition check out the https://aquasec.com website for more information about our products and services. If you'd like to contact Aqua or request a demo, please use this form: https://www.aquasec.com/demo How to generate multiple reports? See here . How to run Trivy under air-gapped environment? See here . Why trivy fs and trivy repo does not scan JAR files for vulnerabilities? See here .","title":"FAQ"},{"location":"getting-started/faq/#faq","text":"","title":"FAQ"},{"location":"getting-started/faq/#how-to-pronounce-the-name-trivy","text":"tri is pronounced like tri gger, vy is pronounced like en vy .","title":"How to pronounce the name \"Trivy\"?"},{"location":"getting-started/faq/#does-trivy-support-x","text":"Check out the Scanning coverage page .","title":"Does Trivy support X?"},{"location":"getting-started/faq/#is-there-a-paid-version-of-trivy","text":"If you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering. You can find a high level comparison table specific to Trivy users here . In addition check out the https://aquasec.com website for more information about our products and services. If you'd like to contact Aqua or request a demo, please use this form: https://www.aquasec.com/demo","title":"Is there a paid version of Trivy?"},{"location":"getting-started/faq/#how-to-generate-multiple-reports","text":"See here .","title":"How to generate multiple reports?"},{"location":"getting-started/faq/#how-to-run-trivy-under-air-gapped-environment","text":"See here .","title":"How to run Trivy under air-gapped environment?"},{"location":"getting-started/faq/#why-trivy-fs-and-trivy-repo-does-not-scan-jar-files-for-vulnerabilities","text":"See here .","title":"Why trivy fs and trivy repo does not scan JAR files for vulnerabilities?"},{"location":"getting-started/installation/","text":"Installing Trivy In this section you will find an aggregation of the different ways to install Trivy. installations are listed as either \"official\" or \"community\". Official integrations are developed by the core Trivy team and supported by it. Community integrations are integrations developed by the community, and collected here for your convenience. For support or questions about community integrations, please contact the original developers. Install using Package Manager RHEL/CentOS (Official) Repository RPM Add repository setting to /etc/yum.repos.d . RELEASE_VERSION = $( grep -Po '(?<=VERSION_ID=\")[0-9]' /etc/os-release ) cat << EOF | sudo tee -a /etc/yum.repos.d/trivy.repo [trivy] name=Trivy repository baseurl=https://aquasecurity.github.io/trivy-repo/rpm/releases/$RELEASE_VERSION/\\$basearch/ gpgcheck=1 enabled=1 gpgkey=https://aquasecurity.github.io/trivy-repo/rpm/public.key EOF sudo yum -y update sudo yum -y install trivy rpm -ivh https://github.com/aquasecurity/trivy/releases/download/v0.45.1/trivy_0.45.1_Linux-64bit.rpm Debian/Ubuntu (Official) Repository DEB Add repository setting to /etc/apt/sources.list.d . sudo apt-get install wget apt-transport-https gnupg lsb-release wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null echo \"deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $( lsb_release -sc ) main\" | sudo tee -a /etc/apt/sources.list.d/trivy.list sudo apt-get update sudo apt-get install trivy wget https://github.com/aquasecurity/trivy/releases/download/v0.45.1/trivy_0.45.1_Linux-64bit.deb sudo dpkg -i trivy_0.45.1_Linux-64bit.deb Homebrew (Official) Homebrew for MacOS and Linux. brew install trivy Arch Linux (Community) Arch Community Package Manager. pacman -S trivy References: - https://archlinux.org/packages/community/x86_64/trivy/ - https://github.com/archlinux/svntogit-community/blob/packages/trivy/trunk/PKGBUILD MacPorts (Community) MacPorts for MacOS. sudo port install trivy References: - https://ports.macports.org/port/trivy/details/ Nix/NixOS (Community) Nix package manager for Linux and MacOS. Command line nix-env --install -A nixpkgs.trivy Configuration # your other config ... environment . systemPackages = with pkgs ; [ # your other packages ... trivy ]; Home Manager # your other config ... home . packages = with pkgs ; [ # your other packages ... trivy ]; References: - https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/admin/trivy/default.nix Install from GitHub Release (Official) Download Binary Download the file for your operating system/architecture from GitHub Release assets ( curl -LO https://url.to/trivy.tar.gz ). Unpack the downloaded archive ( tar -xzf ./trivy.tar.gz ). Put the binary somewhere in your $PATH (e.g mv ./trivy /usr/local/bin/ ). Make sure the binary has execution bit turned on ( chmod +x ./trivy ). Install Script The process above can be automated by the following script: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.45.1 Install from source git clone --depth 1 --branch v0.45.1 https://github.com/aquasecurity/trivy cd trivy go install ./cmd/trivy Use container image Pull Trivy image ( docker pull aquasec/trivy:0.45.1 ) It is advisable to mount a consistent cache dir on the host into the Trivy container. For scanning container images with Trivy, mount docker.sock from the host into the Trivy container. Example: docker run -v /var/run/docker.sock:/var/run/docker.sock -v $HOME /Library/Caches:/root/.cache/ aquasec/trivy:0.45.1 image python:3.4-alpine Registry | Repository | Link | Supportability Docker Hub | docker.io/aquasec/trivy | https://hub.docker.com/r/aquasec/trivy | Official GitHub Container Registry (GHCR) | ghcr.io/aquasecurity/trivy | https://github.com/orgs/aquasecurity/packages/container/package/trivy | Official AWS Elastic Container Registry (ECR) | public.ecr.aws/aquasecurity/trivy | https://gallery.ecr.aws/aquasecurity/trivy | Official Other Tools to use and deploy Trivy For additional tools and ways to install and use Trivy in different environments such as in IDE, Kubernetes or CI/CD, see Ecosystem section .","title":"Installation"},{"location":"getting-started/installation/#installing-trivy","text":"In this section you will find an aggregation of the different ways to install Trivy. installations are listed as either \"official\" or \"community\". Official integrations are developed by the core Trivy team and supported by it. Community integrations are integrations developed by the community, and collected here for your convenience. For support or questions about community integrations, please contact the original developers.","title":"Installing Trivy"},{"location":"getting-started/installation/#install-using-package-manager","text":"","title":"Install using Package Manager"},{"location":"getting-started/installation/#rhelcentos-official","text":"Repository RPM Add repository setting to /etc/yum.repos.d . RELEASE_VERSION = $( grep -Po '(?<=VERSION_ID=\")[0-9]' /etc/os-release ) cat << EOF | sudo tee -a /etc/yum.repos.d/trivy.repo [trivy] name=Trivy repository baseurl=https://aquasecurity.github.io/trivy-repo/rpm/releases/$RELEASE_VERSION/\\$basearch/ gpgcheck=1 enabled=1 gpgkey=https://aquasecurity.github.io/trivy-repo/rpm/public.key EOF sudo yum -y update sudo yum -y install trivy rpm -ivh https://github.com/aquasecurity/trivy/releases/download/v0.45.1/trivy_0.45.1_Linux-64bit.rpm","title":"RHEL/CentOS (Official)"},{"location":"getting-started/installation/#debianubuntu-official","text":"Repository DEB Add repository setting to /etc/apt/sources.list.d . sudo apt-get install wget apt-transport-https gnupg lsb-release wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null echo \"deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $( lsb_release -sc ) main\" | sudo tee -a /etc/apt/sources.list.d/trivy.list sudo apt-get update sudo apt-get install trivy wget https://github.com/aquasecurity/trivy/releases/download/v0.45.1/trivy_0.45.1_Linux-64bit.deb sudo dpkg -i trivy_0.45.1_Linux-64bit.deb","title":"Debian/Ubuntu (Official)"},{"location":"getting-started/installation/#homebrew-official","text":"Homebrew for MacOS and Linux. brew install trivy","title":"Homebrew (Official)"},{"location":"getting-started/installation/#arch-linux-community","text":"Arch Community Package Manager. pacman -S trivy References: - https://archlinux.org/packages/community/x86_64/trivy/ - https://github.com/archlinux/svntogit-community/blob/packages/trivy/trunk/PKGBUILD","title":"Arch Linux (Community)"},{"location":"getting-started/installation/#macports-community","text":"MacPorts for MacOS. sudo port install trivy References: - https://ports.macports.org/port/trivy/details/","title":"MacPorts (Community)"},{"location":"getting-started/installation/#nixnixos-community","text":"Nix package manager for Linux and MacOS. Command line nix-env --install -A nixpkgs.trivy Configuration # your other config ... environment . systemPackages = with pkgs ; [ # your other packages ... trivy ]; Home Manager # your other config ... home . packages = with pkgs ; [ # your other packages ... trivy ]; References: - https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/admin/trivy/default.nix","title":"Nix/NixOS (Community)"},{"location":"getting-started/installation/#install-from-github-release-official","text":"","title":"Install from GitHub Release (Official)"},{"location":"getting-started/installation/#download-binary","text":"Download the file for your operating system/architecture from GitHub Release assets ( curl -LO https://url.to/trivy.tar.gz ). Unpack the downloaded archive ( tar -xzf ./trivy.tar.gz ). Put the binary somewhere in your $PATH (e.g mv ./trivy /usr/local/bin/ ). Make sure the binary has execution bit turned on ( chmod +x ./trivy ).","title":"Download Binary"},{"location":"getting-started/installation/#install-script","text":"The process above can be automated by the following script: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.45.1","title":"Install Script"},{"location":"getting-started/installation/#install-from-source","text":"git clone --depth 1 --branch v0.45.1 https://github.com/aquasecurity/trivy cd trivy go install ./cmd/trivy","title":"Install from source"},{"location":"getting-started/installation/#use-container-image","text":"Pull Trivy image ( docker pull aquasec/trivy:0.45.1 ) It is advisable to mount a consistent cache dir on the host into the Trivy container. For scanning container images with Trivy, mount docker.sock from the host into the Trivy container. Example: docker run -v /var/run/docker.sock:/var/run/docker.sock -v $HOME /Library/Caches:/root/.cache/ aquasec/trivy:0.45.1 image python:3.4-alpine Registry | Repository | Link | Supportability Docker Hub | docker.io/aquasec/trivy | https://hub.docker.com/r/aquasec/trivy | Official GitHub Container Registry (GHCR) | ghcr.io/aquasecurity/trivy | https://github.com/orgs/aquasecurity/packages/container/package/trivy | Official AWS Elastic Container Registry (ECR) | public.ecr.aws/aquasecurity/trivy | https://gallery.ecr.aws/aquasecurity/trivy | Official","title":"Use container image"},{"location":"getting-started/installation/#other-tools-to-use-and-deploy-trivy","text":"For additional tools and ways to install and use Trivy in different environments such as in IDE, Kubernetes or CI/CD, see Ecosystem section .","title":"Other Tools to use and deploy Trivy"},{"location":"getting-started/signature-verification/","text":"Signature Verification Verifying a Cosign signature All binaries and container images are signed by Cosign . You need the following tool: Cosign Verifying signed container images Use the following command for keyless verification : cosign verify aquasec/trivy:<version> \\ --certificate-identity-regexp 'https://github\\.com/aquasecurity/trivy/\\.github/workflows/.+' \\ --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" You should get the following output Verification for index.docker.io/aquasec/trivy:latest -- The following checks were performed on each of these signatures: - The cosign claims were validated - Existence of the claims in the transparency log was verified offline - The code-signing certificate was verified using trusted certificate authority certificates .... Verifying signed binaries Download the required tarball, associated signature and certificate files Use the following command for keyless verification: cosign verify-blob <path to binray> \\ --certificate <path to cert> \\ --signature <path to sig> \\ --certificate-identity-regexp 'https://github\\.com/aquasecurity/trivy/\\.github/workflows/.+' \\ --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" You should get the following output Verified OK For example: $ wget \"https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy_0.45.0_Linux-32bit.tar.gz\" $ wget \"https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy_0.45.0_Linux-32bit.tar.gz.pem\" $ wget \"https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy_0.45.0_Linux-32bit.tar.gz.sig\" $ cosign verify-blob trivy_0.45.0_Linux-32bit.tar.gz \\ --certificate trivy_0.45.0_Linux-32bit.tar.gz.pem \\ --signature trivy_0.45.0_Linux-32bit.tar.gz.sig \\ --certificate-identity-regexp 'https://github\\.com/aquasecurity/trivy/\\.github/workflows/.+' \\ --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" Vetified OK Verifying a GPG signature RPM and Deb packages are also signed by GPG. Verifying RPM The public key downloaded here . Download the public key curl https://aquasecurity.github.io/trivy-repo/rpm/public.key \\ --output pub.key Import the key rpm --import pub.key Verify that the key has been imported rpm -q --queryformat \"%{SUMMARY}\\n\" $( rpm -q gpg-pubkey ) You should get the following output gpg ( trivy ) Download the required binary curl -L https://github.com/aquasecurity/trivy/releases/download/<version>/<file name>.rpm \\ --output trivy.rpm Check the binary with the following command rpm -K trivy.rpm You should get the following output trivy.rpm: digests signatures OK","title":"Signature Verification"},{"location":"getting-started/signature-verification/#signature-verification","text":"","title":"Signature Verification"},{"location":"getting-started/signature-verification/#verifying-a-cosign-signature","text":"All binaries and container images are signed by Cosign . You need the following tool: Cosign","title":"Verifying a Cosign signature"},{"location":"getting-started/signature-verification/#verifying-signed-container-images","text":"Use the following command for keyless verification : cosign verify aquasec/trivy:<version> \\ --certificate-identity-regexp 'https://github\\.com/aquasecurity/trivy/\\.github/workflows/.+' \\ --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" You should get the following output Verification for index.docker.io/aquasec/trivy:latest -- The following checks were performed on each of these signatures: - The cosign claims were validated - Existence of the claims in the transparency log was verified offline - The code-signing certificate was verified using trusted certificate authority certificates ....","title":"Verifying signed container images"},{"location":"getting-started/signature-verification/#verifying-signed-binaries","text":"Download the required tarball, associated signature and certificate files Use the following command for keyless verification: cosign verify-blob <path to binray> \\ --certificate <path to cert> \\ --signature <path to sig> \\ --certificate-identity-regexp 'https://github\\.com/aquasecurity/trivy/\\.github/workflows/.+' \\ --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" You should get the following output Verified OK For example: $ wget \"https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy_0.45.0_Linux-32bit.tar.gz\" $ wget \"https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy_0.45.0_Linux-32bit.tar.gz.pem\" $ wget \"https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy_0.45.0_Linux-32bit.tar.gz.sig\" $ cosign verify-blob trivy_0.45.0_Linux-32bit.tar.gz \\ --certificate trivy_0.45.0_Linux-32bit.tar.gz.pem \\ --signature trivy_0.45.0_Linux-32bit.tar.gz.sig \\ --certificate-identity-regexp 'https://github\\.com/aquasecurity/trivy/\\.github/workflows/.+' \\ --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" Vetified OK","title":"Verifying signed binaries"},{"location":"getting-started/signature-verification/#verifying-a-gpg-signature","text":"RPM and Deb packages are also signed by GPG.","title":"Verifying a GPG signature"},{"location":"getting-started/signature-verification/#verifying-rpm","text":"The public key downloaded here . Download the public key curl https://aquasecurity.github.io/trivy-repo/rpm/public.key \\ --output pub.key Import the key rpm --import pub.key Verify that the key has been imported rpm -q --queryformat \"%{SUMMARY}\\n\" $( rpm -q gpg-pubkey ) You should get the following output gpg ( trivy ) Download the required binary curl -L https://github.com/aquasecurity/trivy/releases/download/<version>/<file name>.rpm \\ --output trivy.rpm Check the binary with the following command rpm -K trivy.rpm You should get the following output trivy.rpm: digests signatures OK","title":"Verifying RPM"},{"location":"tutorials/overview/","text":"Tutorials In this section you can find step-by-step guides that help you accomplish specific tasks. \ud83d\udc48 Please use the side-navigation on the left in order to browse the different topics. Adding tutorials You are welcome to create tutorials and showcase them here. Tutorials can be either included in here as full articles, or included as external links under external community resources . Before sending PR, please first create an issue (of kind \"Documentation\") and describe the suggestion, if it's external link or article, and what category it's under. Guidelines: Focus on a specific use case. Start by clearly describing the use case and when/who it is relevant for. Provide an end-to-end set of instructions. Make sure anyone can easily follow. Describe the expected outcome after each step. Include examples as much as possible.","title":"Overview"},{"location":"tutorials/overview/#tutorials","text":"In this section you can find step-by-step guides that help you accomplish specific tasks. \ud83d\udc48 Please use the side-navigation on the left in order to browse the different topics.","title":"Tutorials"},{"location":"tutorials/overview/#adding-tutorials","text":"You are welcome to create tutorials and showcase them here. Tutorials can be either included in here as full articles, or included as external links under external community resources . Before sending PR, please first create an issue (of kind \"Documentation\") and describe the suggestion, if it's external link or article, and what category it's under. Guidelines: Focus on a specific use case. Start by clearly describing the use case and when/who it is relevant for. Provide an end-to-end set of instructions. Make sure anyone can easily follow. Describe the expected outcome after each step. Include examples as much as possible.","title":"Adding tutorials"},{"location":"tutorials/additional-resources/cks/","text":"CKS preparation resources The Certified Kubernetes Security Specialist (CKS) Exam is offered by The Linux Foundation. It provides assurance that a CKS has the skills, knowledge, and competence on a broad range of best practices for securing container-based applications and Kubernetes platforms during build, deployment and runtime. CKA certification is required to sit for this exam. Community Resources Trivy Video overview (short) Example questions from the exam More example questions CKS exam study guide Docker Image Vulnerabilities & Trivy Image Scanning Demo | K21Academy Aqua Security Blog posts to learn more Supply chain security best practices Supply chain attacks If you know of interesting resources, please start a PR to add those to the list.","title":"CKS Reference"},{"location":"tutorials/additional-resources/cks/#cks-preparation-resources","text":"The Certified Kubernetes Security Specialist (CKS) Exam is offered by The Linux Foundation. It provides assurance that a CKS has the skills, knowledge, and competence on a broad range of best practices for securing container-based applications and Kubernetes platforms during build, deployment and runtime. CKA certification is required to sit for this exam.","title":"CKS preparation resources"},{"location":"tutorials/additional-resources/cks/#community-resources","text":"Trivy Video overview (short) Example questions from the exam More example questions CKS exam study guide Docker Image Vulnerabilities & Trivy Image Scanning Demo | K21Academy","title":"Community Resources"},{"location":"tutorials/additional-resources/cks/#aqua-security-blog-posts-to-learn-more","text":"Supply chain security best practices Supply chain attacks If you know of interesting resources, please start a PR to add those to the list.","title":"Aqua Security Blog posts to learn more"},{"location":"tutorials/additional-resources/community/","text":"Community References Below is a list of additional resources from the community. Vulnerability Scanning Detecting Spring4Shell with Trivy and Grype Scan OS of your EC2 instances with Trivy CI/CD Pipelines How to use Tekton to set up a CI pipeline with OpenShift Pipelines Continuous Container Vulnerability Testing with Trivy Getting Started With Trivy and Jenkins How to use Tekton to set up a CI pipeline with OpenShift Pipelines Misconfiguration Scanning Identifying Misconfigurations in your Terraform How to write custom policies for Trivy SBOM, Attestation & related Attesting Image Scans With Kyverno Trivy Kubernetes Using Trivy Kubernetes in OVHCloud documentation. Comparisons the vulnerability remediation lifecycle of Alpine containers Open Source CVE Scanner Round-Up: Clair vs Anchore vs Trivy Docker Image Security: Static Analysis Tool Comparison \u2013 Anchore Engine vs Clair vs Trivy Evaluations Istio evaluating to use Trivy Research Spike: evaluate Trivy for scanning running containers","title":"Community References"},{"location":"tutorials/additional-resources/community/#community-references","text":"Below is a list of additional resources from the community.","title":"Community References"},{"location":"tutorials/additional-resources/community/#vulnerability-scanning","text":"Detecting Spring4Shell with Trivy and Grype Scan OS of your EC2 instances with Trivy","title":"Vulnerability Scanning"},{"location":"tutorials/additional-resources/community/#cicd-pipelines","text":"How to use Tekton to set up a CI pipeline with OpenShift Pipelines Continuous Container Vulnerability Testing with Trivy Getting Started With Trivy and Jenkins How to use Tekton to set up a CI pipeline with OpenShift Pipelines","title":"CI/CD Pipelines"},{"location":"tutorials/additional-resources/community/#misconfiguration-scanning","text":"Identifying Misconfigurations in your Terraform How to write custom policies for Trivy","title":"Misconfiguration Scanning"},{"location":"tutorials/additional-resources/community/#sbom-attestation-related","text":"Attesting Image Scans With Kyverno","title":"SBOM, Attestation &amp; related"},{"location":"tutorials/additional-resources/community/#trivy-kubernetes","text":"Using Trivy Kubernetes in OVHCloud documentation.","title":"Trivy Kubernetes"},{"location":"tutorials/additional-resources/community/#comparisons","text":"the vulnerability remediation lifecycle of Alpine containers Open Source CVE Scanner Round-Up: Clair vs Anchore vs Trivy Docker Image Security: Static Analysis Tool Comparison \u2013 Anchore Engine vs Clair vs Trivy","title":"Comparisons"},{"location":"tutorials/additional-resources/community/#evaluations","text":"Istio evaluating to use Trivy Research Spike: evaluate Trivy for scanning running containers","title":"Evaluations"},{"location":"tutorials/additional-resources/references/","text":"Additional Resources and Tutorials Below is a list of additional resources from Aqua Security. Announcements Trivy Vulnerability Scanner Joins the Aqua Open-source Family Trivy Image Vulnerability Scanner Now Under Apache 2.0 License Vulnerability Scanning Using Trivy to Discover Vulnerabilities in VS Code Projects How does a vulnerability scanner identify packages? Handling Container Vulnerabilities with Open Policy Agent - Teppei Fukuda, Aqua Security CI/CD Pipelines DevSecOps with Trivy and GitHub Actions Find Image Vulnerabilities Using GitHub and Aqua Security Trivy Action Misconfiguration Scanning Identifying Misconfigurations in your Terraform Client/Server Using Trivy in client server mode Workshops Trivy Live Demo & Q&A First Steps to Full Lifecycle Security with Open Source Tools - Rory McCune & Anais Urlichs Older Resources Webinar: Trivy Open Source Scanner for Container Images \u2013 Just Download and Run! Kubernetes Security through GitOps Best Practices: ArgoCD and Starboard Get started with Kubernetes Security and Starboard","title":"Additional Resources"},{"location":"tutorials/additional-resources/references/#additional-resources-and-tutorials","text":"Below is a list of additional resources from Aqua Security.","title":"Additional Resources and Tutorials"},{"location":"tutorials/additional-resources/references/#announcements","text":"Trivy Vulnerability Scanner Joins the Aqua Open-source Family Trivy Image Vulnerability Scanner Now Under Apache 2.0 License","title":"Announcements"},{"location":"tutorials/additional-resources/references/#vulnerability-scanning","text":"Using Trivy to Discover Vulnerabilities in VS Code Projects How does a vulnerability scanner identify packages? Handling Container Vulnerabilities with Open Policy Agent - Teppei Fukuda, Aqua Security","title":"Vulnerability Scanning"},{"location":"tutorials/additional-resources/references/#cicd-pipelines","text":"DevSecOps with Trivy and GitHub Actions Find Image Vulnerabilities Using GitHub and Aqua Security Trivy Action","title":"CI/CD Pipelines"},{"location":"tutorials/additional-resources/references/#misconfiguration-scanning","text":"Identifying Misconfigurations in your Terraform","title":"Misconfiguration Scanning"},{"location":"tutorials/additional-resources/references/#clientserver","text":"Using Trivy in client server mode","title":"Client/Server"},{"location":"tutorials/additional-resources/references/#workshops","text":"Trivy Live Demo & Q&A First Steps to Full Lifecycle Security with Open Source Tools - Rory McCune & Anais Urlichs","title":"Workshops"},{"location":"tutorials/additional-resources/references/#older-resources","text":"Webinar: Trivy Open Source Scanner for Container Images \u2013 Just Download and Run! Kubernetes Security through GitOps Best Practices: ArgoCD and Starboard Get started with Kubernetes Security and Starboard","title":"Older Resources"},{"location":"tutorials/integrations/","text":"Integrations Scan your image automatically as part of your CI workflow, failing the workflow if a vulnerability is found. When you don't want to fail the test, specify --exit-code 0 .","title":"Overview"},{"location":"tutorials/integrations/#integrations","text":"Scan your image automatically as part of your CI workflow, failing the workflow if a vulnerability is found. When you don't want to fail the test, specify --exit-code 0 .","title":"Integrations"},{"location":"tutorials/integrations/aws-codepipeline/","text":"AWS CodePipeline See this blog post for an example of using Trivy within AWS CodePipeline.","title":"AWS CodePipeline"},{"location":"tutorials/integrations/aws-codepipeline/#aws-codepipeline","text":"See this blog post for an example of using Trivy within AWS CodePipeline.","title":"AWS CodePipeline"},{"location":"tutorials/integrations/aws-security-hub/","text":"AWS Security Hub Upload findings to Security Hub In the following example using the template asff.tpl , ASFF file can be generated. $ AWS_REGION=us-west-1 AWS_ACCOUNT_ID=123456789012 trivy image --format template --template \"@contrib/asff.tpl\" -o report.asff golang:1.12-alpine ASFF template needs AWS_REGION and AWS_ACCOUNT_ID from environment variables. The Product ARN field follows the pattern below to match what AWS requires for the product resource type . \"ProductArn\": \"arn:aws:securityhub:{{ env \"AWS_REGION\" }}::product/aquasecurity/aquasecurity\", In order to upload results you must first run enable-import-findings-for-product like: aws securityhub enable-import-findings-for-product --product-arn arn:aws:securityhub:<AWS_REGION>::product/aquasecurity/aquasecurity The findings are formatted for the API with a key of Findings and a value of the array of findings. In order to upload via the CLI the outer wrapping must be removed being left with only the array of findings. The easiest way of doing this is with the jq library using the command cat report.asff | jq '.Findings' Then, you can upload it with AWS CLI. $ aws securityhub batch-import-findings --findings file://report.asff Note The batch-import-findings command limits the number of findings uploaded to 100 per request. The best known workaround to this problem is using jq to run the following command jq '.[:100]' report.asff 1> short_report.asff Customize You can customize asff.tpl $ export AWS_REGION=us-west-1 $ export AWS_ACCOUNT_ID=123456789012 $ trivy image --format template --template \"@your-asff.tpl\" -o report.asff golang:1.12-alpine Reference aws.amazon.com/blogs/security/how-to-build-ci-cd-pipeline-container-vulnerability-scanning-trivy-and-aws-security-hub/","title":"AWS Security Hub"},{"location":"tutorials/integrations/aws-security-hub/#aws-security-hub","text":"","title":"AWS Security Hub"},{"location":"tutorials/integrations/aws-security-hub/#upload-findings-to-security-hub","text":"In the following example using the template asff.tpl , ASFF file can be generated. $ AWS_REGION=us-west-1 AWS_ACCOUNT_ID=123456789012 trivy image --format template --template \"@contrib/asff.tpl\" -o report.asff golang:1.12-alpine ASFF template needs AWS_REGION and AWS_ACCOUNT_ID from environment variables. The Product ARN field follows the pattern below to match what AWS requires for the product resource type . \"ProductArn\": \"arn:aws:securityhub:{{ env \"AWS_REGION\" }}::product/aquasecurity/aquasecurity\", In order to upload results you must first run enable-import-findings-for-product like: aws securityhub enable-import-findings-for-product --product-arn arn:aws:securityhub:<AWS_REGION>::product/aquasecurity/aquasecurity The findings are formatted for the API with a key of Findings and a value of the array of findings. In order to upload via the CLI the outer wrapping must be removed being left with only the array of findings. The easiest way of doing this is with the jq library using the command cat report.asff | jq '.Findings' Then, you can upload it with AWS CLI. $ aws securityhub batch-import-findings --findings file://report.asff","title":"Upload findings to Security Hub"},{"location":"tutorials/integrations/aws-security-hub/#note","text":"The batch-import-findings command limits the number of findings uploaded to 100 per request. The best known workaround to this problem is using jq to run the following command jq '.[:100]' report.asff 1> short_report.asff","title":"Note"},{"location":"tutorials/integrations/aws-security-hub/#customize","text":"You can customize asff.tpl $ export AWS_REGION=us-west-1 $ export AWS_ACCOUNT_ID=123456789012 $ trivy image --format template --template \"@your-asff.tpl\" -o report.asff golang:1.12-alpine","title":"Customize"},{"location":"tutorials/integrations/aws-security-hub/#reference","text":"aws.amazon.com/blogs/security/how-to-build-ci-cd-pipeline-container-vulnerability-scanning-trivy-and-aws-security-hub/","title":"Reference"},{"location":"tutorials/integrations/azure-devops/","text":"Azure Devops Here is the Azure DevOps Pipelines Task for Trivy Use ImageCleaner to clean up stale images on your Azure Kubernetes Service cluster It's common to use pipelines to build and deploy images on Azure Kubernetes Service (AKS) clusters. While great for image creation, this process often doesn't account for the stale images left behind and can lead to image bloat on cluster nodes. These images can present security issues as they may contain vulnerabilities. By cleaning these unreferenced images, you can remove an area of risk in your clusters. When done manually, this process can be time intensive, which ImageCleaner can mitigate via automatic image identification and removal. Vulnerability is determined based on a trivy scan, after which images with a LOW, MEDIUM, HIGH, or CRITICAL classification are flagged. An updated ImageList will be automatically generated by ImageCleaner based on a set time interval, and can also be supplied manually. Microsoft Defender for container registries and Trivy This blog explains how to scan your Azure Container Registry-based container images with the integrated vulnerability scanner when they're built as part of your GitHub workflows. To set up the scanner, you'll need to enable Microsoft Defender for Containers and the CI/CD integration. When your CI/CD workflows push images to your registries, you can view registry scan results and a summary of CI/CD scan results. The findings of the CI/CD scans are an enrichment to the existing registry scan findings by Qualys. Defender for Cloud's CI/CD scanning is powered by Aqua Trivy","title":"Azure"},{"location":"tutorials/integrations/azure-devops/#azure-devops","text":"Here is the Azure DevOps Pipelines Task for Trivy","title":"Azure Devops"},{"location":"tutorials/integrations/azure-devops/#use-imagecleaner-to-clean-up-stale-images-on-your-azure-kubernetes-service-cluster","text":"It's common to use pipelines to build and deploy images on Azure Kubernetes Service (AKS) clusters. While great for image creation, this process often doesn't account for the stale images left behind and can lead to image bloat on cluster nodes. These images can present security issues as they may contain vulnerabilities. By cleaning these unreferenced images, you can remove an area of risk in your clusters. When done manually, this process can be time intensive, which ImageCleaner can mitigate via automatic image identification and removal. Vulnerability is determined based on a trivy scan, after which images with a LOW, MEDIUM, HIGH, or CRITICAL classification are flagged. An updated ImageList will be automatically generated by ImageCleaner based on a set time interval, and can also be supplied manually.","title":"Use ImageCleaner to clean up stale images on your Azure Kubernetes Service cluster"},{"location":"tutorials/integrations/azure-devops/#microsoft-defender-for-container-registries-and-trivy","text":"This blog explains how to scan your Azure Container Registry-based container images with the integrated vulnerability scanner when they're built as part of your GitHub workflows. To set up the scanner, you'll need to enable Microsoft Defender for Containers and the CI/CD integration. When your CI/CD workflows push images to your registries, you can view registry scan results and a summary of CI/CD scan results. The findings of the CI/CD scans are an enrichment to the existing registry scan findings by Qualys. Defender for Cloud's CI/CD scanning is powered by Aqua Trivy","title":"Microsoft Defender for container registries and Trivy"},{"location":"tutorials/integrations/bitbucket/","text":"Bitbucket Pipelines See trivy-pipe for the details.","title":"Bitbucket Pipelines"},{"location":"tutorials/integrations/bitbucket/#bitbucket-pipelines","text":"See trivy-pipe for the details.","title":"Bitbucket Pipelines"},{"location":"tutorials/integrations/circleci/","text":"CircleCI $ cat .circleci/config.yml jobs: build: docker: - image: docker:stable-git steps: - checkout - setup_remote_docker - run: name: Build image command: docker build -t trivy-ci-test:${CIRCLE_SHA1} . - run: name: Install trivy command: | apk add --update-cache --upgrade curl curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin - run: name: Scan the local image with trivy command: trivy image --exit-code 0 --no-progress trivy-ci-test:${CIRCLE_SHA1} workflows: version: 2 release: jobs: - build Example Repository","title":"CircleCI"},{"location":"tutorials/integrations/circleci/#circleci","text":"$ cat .circleci/config.yml jobs: build: docker: - image: docker:stable-git steps: - checkout - setup_remote_docker - run: name: Build image command: docker build -t trivy-ci-test:${CIRCLE_SHA1} . - run: name: Install trivy command: | apk add --update-cache --upgrade curl curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin - run: name: Scan the local image with trivy command: trivy image --exit-code 0 --no-progress trivy-ci-test:${CIRCLE_SHA1} workflows: version: 2 release: jobs: - build Example Repository","title":"CircleCI"},{"location":"tutorials/integrations/github-actions/","text":"GitHub Actions Here is the Trivy GitHub Action The Microsoft Azure team have written a container-scan action that uses Trivy and Dockle For full control over the options specified to Trivy, this blog post describes adding Trivy into your own GitHub action workflows","title":"GitHub Actions"},{"location":"tutorials/integrations/github-actions/#github-actions","text":"Here is the Trivy GitHub Action The Microsoft Azure team have written a container-scan action that uses Trivy and Dockle For full control over the options specified to Trivy, this blog post describes adding Trivy into your own GitHub action workflows","title":"GitHub Actions"},{"location":"tutorials/integrations/gitlab-ci/","text":"GitLab CI GitLab 15.0 includes free integration with Trivy. To configure container scanning with Trivy in GitLab , simply include the CI template in your .gitlab-ci.yml file: include : - template : Security/Container-Scanning.gitlab-ci.yml If you're a GitLab 14.x Ultimate customer, you can use the same configuration above. Alternatively, you can always use the example configurations below. stages : - test trivy : stage : test image : docker:stable services : - name : docker:dind entrypoint : [ \"env\" , \"-u\" , \"DOCKER_HOST\" ] command : [ \"dockerd-entrypoint.sh\" ] variables : DOCKER_HOST : tcp://docker:2375/ DOCKER_DRIVER : overlay2 # See https://github.com/docker-library/docker/pull/166 DOCKER_TLS_CERTDIR : \"\" IMAGE : trivy-ci-test:$CI_COMMIT_SHA TRIVY_NO_PROGRESS : \"true\" TRIVY_CACHE_DIR : \".trivycache/\" before_script : - export TRIVY_VERSION=$(wget -qO - \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | grep '\"tag_name\":' | sed -E 's/.*\"v([^\"]+)\".*/\\1/') - echo $TRIVY_VERSION - wget --no-verbose https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz -O - | tar -zxvf - allow_failure : true script : # Build image - docker build -t $IMAGE . # Build report - ./trivy image --exit-code 0 --format template --template \"@contrib/gitlab.tpl\" -o gl-container-scanning-report.json $IMAGE # Print report - ./trivy image --exit-code 0 --severity HIGH $IMAGE # Fail on severe vulnerabilities - ./trivy image --exit-code 1 --severity CRITICAL $IMAGE cache : paths : - .trivycache/ # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold) artifacts : reports : container_scanning : gl-container-scanning-report.json Example Repository GitLab CI using Trivy container To scan a previously built image that has already been pushed into the GitLab container registry the following CI job manifest can be used. Note that entrypoint needs to be unset for the script section to work. In case of a non-public GitLab project Trivy additionally needs to authenticate to the registry to be able to pull your application image. Finally, it is not necessary to clone the project repo as we only work with the container image. container_scanning : image : name : docker.io/aquasec/trivy:latest entrypoint : [ \"\" ] variables : # No need to clone the repo, we exclusively work on artifacts. See # https://docs.gitlab.com/ee/ci/runners/configure_runners.html#git-strategy GIT_STRATEGY : none TRIVY_USERNAME : \"$CI_REGISTRY_USER\" TRIVY_PASSWORD : \"$CI_REGISTRY_PASSWORD\" TRIVY_AUTH_URL : \"$CI_REGISTRY\" TRIVY_NO_PROGRESS : \"true\" TRIVY_CACHE_DIR : \".trivycache/\" FULL_IMAGE_NAME : $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG script : - trivy --version # cache cleanup is needed when scanning images with the same tags, it does not remove the database - time trivy image --clear-cache # update vulnerabilities db - time trivy image --download-db-only # Builds report and puts it in the default workdir $CI_PROJECT_DIR, so `artifacts:` can take it from there - time trivy image --exit-code 0 --format template --template \"@/contrib/gitlab.tpl\" --output \"$CI_PROJECT_DIR/gl-container-scanning-report.json\" \"$FULL_IMAGE_NAME\" # Prints full report - time trivy image --exit-code 0 \"$FULL_IMAGE_NAME\" # Fail on critical vulnerabilities - time trivy image --exit-code 1 --severity CRITICAL \"$FULL_IMAGE_NAME\" cache : paths : - .trivycache/ # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold) artifacts : when : always reports : container_scanning : gl-container-scanning-report.json tags : - docker-runner GitLab CI alternative template Depending on the edition of gitlab you have or your desired workflow, the container scanning template may not meet your needs. As an addition to the above container scanning template, a template for code climate has been included. The key things to update from the above examples are the template and report type. An updated example is below. stages : - test trivy : stage : test image : docker:stable services : - name : docker:dind entrypoint : [ \"env\" , \"-u\" , \"DOCKER_HOST\" ] command : [ \"dockerd-entrypoint.sh\" ] variables : DOCKER_HOST : tcp://docker:2375/ DOCKER_DRIVER : overlay2 # See https://github.com/docker-library/docker/pull/166 DOCKER_TLS_CERTDIR : \"\" IMAGE : trivy-ci-test:$CI_COMMIT_SHA TRIVY_NO_PROGRESS : \"true\" TRIVY_CACHE_DIR : \".trivycache/\" before_script : - export TRIVY_VERSION=$(wget -qO - \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | grep '\"tag_name\":' | sed -E 's/.*\"v([^\"]+)\".*/\\1/') - echo $TRIVY_VERSION - wget --no-verbose https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz -O - | tar -zxvf - allow_failure : true script : # Build image - docker build -t $IMAGE . # Image report - ./trivy image --exit-code 0 --format template --template \"@contrib/gitlab-codequality.tpl\" -o gl-codeclimate-image.json $IMAGE # Filesystem report - ./trivy filesystem --scanners config,vuln --exit-code 0 --format template --template \"@contrib/gitlab-codequality.tpl\" -o gl-codeclimate-fs.json . # Combine report - apk update && apk add jq - jq -s 'add' gl-codeclimate-image.json gl-codeclimate-fs.json > gl-codeclimate.json cache : paths : - .trivycache/ # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold) artifacts : paths : - gl-codeclimate.json reports : codequality : gl-codeclimate.json Currently gitlab only supports a single code quality report. There is an open feature request to support multiple reports. Until this has been implemented, if you already have a code quality report in your pipeline, you can use jq to combine reports. Depending on how you name your artifacts, it may be necessary to rename the artifact if you want to reuse the name. To then combine the previous artifact with the output of trivy, the following jq command can be used, jq -s 'add' prev-codeclimate.json trivy-codeclimate.json > gl-codeclimate.json . GitLab CI alternative template example report You'll be able to see a full report in the GitLab pipeline code quality UI, where filesystem vulnerabilities and misconfigurations include links to the flagged files and image vulnerabilities report the image/os or runtime/library that the vulnerability originates from instead.","title":"GitLab CI"},{"location":"tutorials/integrations/gitlab-ci/#gitlab-ci","text":"GitLab 15.0 includes free integration with Trivy. To configure container scanning with Trivy in GitLab , simply include the CI template in your .gitlab-ci.yml file: include : - template : Security/Container-Scanning.gitlab-ci.yml If you're a GitLab 14.x Ultimate customer, you can use the same configuration above. Alternatively, you can always use the example configurations below. stages : - test trivy : stage : test image : docker:stable services : - name : docker:dind entrypoint : [ \"env\" , \"-u\" , \"DOCKER_HOST\" ] command : [ \"dockerd-entrypoint.sh\" ] variables : DOCKER_HOST : tcp://docker:2375/ DOCKER_DRIVER : overlay2 # See https://github.com/docker-library/docker/pull/166 DOCKER_TLS_CERTDIR : \"\" IMAGE : trivy-ci-test:$CI_COMMIT_SHA TRIVY_NO_PROGRESS : \"true\" TRIVY_CACHE_DIR : \".trivycache/\" before_script : - export TRIVY_VERSION=$(wget -qO - \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | grep '\"tag_name\":' | sed -E 's/.*\"v([^\"]+)\".*/\\1/') - echo $TRIVY_VERSION - wget --no-verbose https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz -O - | tar -zxvf - allow_failure : true script : # Build image - docker build -t $IMAGE . # Build report - ./trivy image --exit-code 0 --format template --template \"@contrib/gitlab.tpl\" -o gl-container-scanning-report.json $IMAGE # Print report - ./trivy image --exit-code 0 --severity HIGH $IMAGE # Fail on severe vulnerabilities - ./trivy image --exit-code 1 --severity CRITICAL $IMAGE cache : paths : - .trivycache/ # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold) artifacts : reports : container_scanning : gl-container-scanning-report.json Example Repository","title":"GitLab CI"},{"location":"tutorials/integrations/gitlab-ci/#gitlab-ci-using-trivy-container","text":"To scan a previously built image that has already been pushed into the GitLab container registry the following CI job manifest can be used. Note that entrypoint needs to be unset for the script section to work. In case of a non-public GitLab project Trivy additionally needs to authenticate to the registry to be able to pull your application image. Finally, it is not necessary to clone the project repo as we only work with the container image. container_scanning : image : name : docker.io/aquasec/trivy:latest entrypoint : [ \"\" ] variables : # No need to clone the repo, we exclusively work on artifacts. See # https://docs.gitlab.com/ee/ci/runners/configure_runners.html#git-strategy GIT_STRATEGY : none TRIVY_USERNAME : \"$CI_REGISTRY_USER\" TRIVY_PASSWORD : \"$CI_REGISTRY_PASSWORD\" TRIVY_AUTH_URL : \"$CI_REGISTRY\" TRIVY_NO_PROGRESS : \"true\" TRIVY_CACHE_DIR : \".trivycache/\" FULL_IMAGE_NAME : $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG script : - trivy --version # cache cleanup is needed when scanning images with the same tags, it does not remove the database - time trivy image --clear-cache # update vulnerabilities db - time trivy image --download-db-only # Builds report and puts it in the default workdir $CI_PROJECT_DIR, so `artifacts:` can take it from there - time trivy image --exit-code 0 --format template --template \"@/contrib/gitlab.tpl\" --output \"$CI_PROJECT_DIR/gl-container-scanning-report.json\" \"$FULL_IMAGE_NAME\" # Prints full report - time trivy image --exit-code 0 \"$FULL_IMAGE_NAME\" # Fail on critical vulnerabilities - time trivy image --exit-code 1 --severity CRITICAL \"$FULL_IMAGE_NAME\" cache : paths : - .trivycache/ # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold) artifacts : when : always reports : container_scanning : gl-container-scanning-report.json tags : - docker-runner","title":"GitLab CI using Trivy container"},{"location":"tutorials/integrations/gitlab-ci/#gitlab-ci-alternative-template","text":"Depending on the edition of gitlab you have or your desired workflow, the container scanning template may not meet your needs. As an addition to the above container scanning template, a template for code climate has been included. The key things to update from the above examples are the template and report type. An updated example is below. stages : - test trivy : stage : test image : docker:stable services : - name : docker:dind entrypoint : [ \"env\" , \"-u\" , \"DOCKER_HOST\" ] command : [ \"dockerd-entrypoint.sh\" ] variables : DOCKER_HOST : tcp://docker:2375/ DOCKER_DRIVER : overlay2 # See https://github.com/docker-library/docker/pull/166 DOCKER_TLS_CERTDIR : \"\" IMAGE : trivy-ci-test:$CI_COMMIT_SHA TRIVY_NO_PROGRESS : \"true\" TRIVY_CACHE_DIR : \".trivycache/\" before_script : - export TRIVY_VERSION=$(wget -qO - \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | grep '\"tag_name\":' | sed -E 's/.*\"v([^\"]+)\".*/\\1/') - echo $TRIVY_VERSION - wget --no-verbose https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz -O - | tar -zxvf - allow_failure : true script : # Build image - docker build -t $IMAGE . # Image report - ./trivy image --exit-code 0 --format template --template \"@contrib/gitlab-codequality.tpl\" -o gl-codeclimate-image.json $IMAGE # Filesystem report - ./trivy filesystem --scanners config,vuln --exit-code 0 --format template --template \"@contrib/gitlab-codequality.tpl\" -o gl-codeclimate-fs.json . # Combine report - apk update && apk add jq - jq -s 'add' gl-codeclimate-image.json gl-codeclimate-fs.json > gl-codeclimate.json cache : paths : - .trivycache/ # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold) artifacts : paths : - gl-codeclimate.json reports : codequality : gl-codeclimate.json Currently gitlab only supports a single code quality report. There is an open feature request to support multiple reports. Until this has been implemented, if you already have a code quality report in your pipeline, you can use jq to combine reports. Depending on how you name your artifacts, it may be necessary to rename the artifact if you want to reuse the name. To then combine the previous artifact with the output of trivy, the following jq command can be used, jq -s 'add' prev-codeclimate.json trivy-codeclimate.json > gl-codeclimate.json .","title":"GitLab CI alternative template"},{"location":"tutorials/integrations/gitlab-ci/#gitlab-ci-alternative-template-example-report","text":"You'll be able to see a full report in the GitLab pipeline code quality UI, where filesystem vulnerabilities and misconfigurations include links to the flagged files and image vulnerabilities report the image/os or runtime/library that the vulnerability originates from instead.","title":"GitLab CI alternative template example report"},{"location":"tutorials/integrations/travis-ci/","text":"Travis CI $ cat .travis.yml services: - docker env: global: - COMMIT=${TRAVIS_COMMIT::8} before_install: - docker build -t trivy-ci-test:${COMMIT} . - export VERSION=$(curl --silent \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | grep '\"tag_name\":' | sed -E 's/.*\"v([^\"]+)\".*/\\1/') - wget https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz - tar zxvf trivy_${VERSION}_Linux-64bit.tar.gz script: - ./trivy image --exit-code 0 --severity HIGH --no-progress trivy-ci-test:${COMMIT} - ./trivy image --exit-code 1 --severity CRITICAL --no-progress trivy-ci-test:${COMMIT} cache: directories: - $HOME/.cache/trivy Example Repository","title":"Travis CI"},{"location":"tutorials/integrations/travis-ci/#travis-ci","text":"$ cat .travis.yml services: - docker env: global: - COMMIT=${TRAVIS_COMMIT::8} before_install: - docker build -t trivy-ci-test:${COMMIT} . - export VERSION=$(curl --silent \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | grep '\"tag_name\":' | sed -E 's/.*\"v([^\"]+)\".*/\\1/') - wget https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz - tar zxvf trivy_${VERSION}_Linux-64bit.tar.gz script: - ./trivy image --exit-code 0 --severity HIGH --no-progress trivy-ci-test:${COMMIT} - ./trivy image --exit-code 1 --severity CRITICAL --no-progress trivy-ci-test:${COMMIT} cache: directories: - $HOME/.cache/trivy Example Repository","title":"Travis CI"},{"location":"tutorials/kubernetes/cluster-scanning/","text":"Kubernetes Scanning Tutorial Prerequisites To test the following commands yourself, make sure that you\u2019re connected to a Kubernetes cluster. A simple kind, a Docker-Desktop or microk8s cluster will do. In our case, we\u2019ll use a one-node kind cluster. Pro tip: The output of the commands will be even more interesting if you have some workloads running in your cluster. Cluster Scanning Trivy K8s is great to get an overview of all the vulnerabilities and misconfiguration issues or to scan specific workloads that are running in your cluster. You would want to use the Trivy K8s command either on your own local cluster or in your CI/CD pipeline post deployments. The trivy k8s command is part of the Trivy CLI. With the following command, we can scan our entire Kubernetes cluster for vulnerabilities and get a summary of the scan: trivy k8s --report=summary cluster To get detailed information for all your resources, just replace \u2018summary\u2019 with \u2018all\u2019: trivy k8s --report=all cluster However, we recommend displaying all information only in case you scan a specific namespace or resource since you can get overwhelmed with additional details. Furthermore, we can specify the namespace that Trivy is supposed to scan to focus on specific resources in the scan result: trivy k8s -n kube-system --report=summary cluster Again, if you\u2019d like to receive additional details, use the \u2018--report=all\u2019 flag: trivy k8s -n kube-system --report=all cluster Like with scanning for vulnerabilities, we can also filter in-cluster security issues by severity of the vulnerabilities: trivy k8s --severity=CRITICAL --report=summary cluster Note that you can use any of the Trivy flags on the Trivy K8s command. With the Trivy K8s command, you can also scan specific workloads that are running within your cluster, such as our deployment: trivy k8s --namespace app --report=summary deployments/react-application Trivy Operator The Trivy K8s command is an imperative model to scan resources. We wouldn\u2019t want to manually scan each resource across different environments. The larger the cluster and the more workloads are running in it, the more error-prone this process would become. With the Trivy Operator, we can automate the scanning process after the deployment. The Trivy Operator follows the Kubernetes Operator Model. Operators automate human actions, and the result of the task is saved as custom resource definitions (CRDs) within your cluster. This has several benefits: Trivy Operator is installed CRDs in our cluster. As a result, all our resources, including our security scanner and its scan results, are Kubernetes resources. This makes it much easier to integrate the Trivy Operator directly into our existing processes, such as connecting Trivy with Prometheus, a monitoring system. The Trivy Operator will automatically scan your resources every six hours. You can set up automatic alerting in case new critical security issues are discovered. The CRDs can be both machine and human-readable depending on which applications consume the CRDs. This allows for more versatile applications of the Trivy operator. There are several ways that you can install the Trivy Operator in your cluster. In this guide, we\u2019re going to use the Helm installation based on the following documentation. Please follow the Trivy Operator documentation for further information on: Installation of the Trivy Operator Getting started guide","title":"Cluster Scanning"},{"location":"tutorials/kubernetes/cluster-scanning/#kubernetes-scanning-tutorial","text":"","title":"Kubernetes Scanning Tutorial"},{"location":"tutorials/kubernetes/cluster-scanning/#prerequisites","text":"To test the following commands yourself, make sure that you\u2019re connected to a Kubernetes cluster. A simple kind, a Docker-Desktop or microk8s cluster will do. In our case, we\u2019ll use a one-node kind cluster. Pro tip: The output of the commands will be even more interesting if you have some workloads running in your cluster.","title":"Prerequisites"},{"location":"tutorials/kubernetes/cluster-scanning/#cluster-scanning","text":"Trivy K8s is great to get an overview of all the vulnerabilities and misconfiguration issues or to scan specific workloads that are running in your cluster. You would want to use the Trivy K8s command either on your own local cluster or in your CI/CD pipeline post deployments. The trivy k8s command is part of the Trivy CLI. With the following command, we can scan our entire Kubernetes cluster for vulnerabilities and get a summary of the scan: trivy k8s --report=summary cluster To get detailed information for all your resources, just replace \u2018summary\u2019 with \u2018all\u2019: trivy k8s --report=all cluster However, we recommend displaying all information only in case you scan a specific namespace or resource since you can get overwhelmed with additional details. Furthermore, we can specify the namespace that Trivy is supposed to scan to focus on specific resources in the scan result: trivy k8s -n kube-system --report=summary cluster Again, if you\u2019d like to receive additional details, use the \u2018--report=all\u2019 flag: trivy k8s -n kube-system --report=all cluster Like with scanning for vulnerabilities, we can also filter in-cluster security issues by severity of the vulnerabilities: trivy k8s --severity=CRITICAL --report=summary cluster Note that you can use any of the Trivy flags on the Trivy K8s command. With the Trivy K8s command, you can also scan specific workloads that are running within your cluster, such as our deployment: trivy k8s --namespace app --report=summary deployments/react-application","title":"Cluster Scanning"},{"location":"tutorials/kubernetes/cluster-scanning/#trivy-operator","text":"The Trivy K8s command is an imperative model to scan resources. We wouldn\u2019t want to manually scan each resource across different environments. The larger the cluster and the more workloads are running in it, the more error-prone this process would become. With the Trivy Operator, we can automate the scanning process after the deployment. The Trivy Operator follows the Kubernetes Operator Model. Operators automate human actions, and the result of the task is saved as custom resource definitions (CRDs) within your cluster. This has several benefits: Trivy Operator is installed CRDs in our cluster. As a result, all our resources, including our security scanner and its scan results, are Kubernetes resources. This makes it much easier to integrate the Trivy Operator directly into our existing processes, such as connecting Trivy with Prometheus, a monitoring system. The Trivy Operator will automatically scan your resources every six hours. You can set up automatic alerting in case new critical security issues are discovered. The CRDs can be both machine and human-readable depending on which applications consume the CRDs. This allows for more versatile applications of the Trivy operator. There are several ways that you can install the Trivy Operator in your cluster. In this guide, we\u2019re going to use the Helm installation based on the following documentation. Please follow the Trivy Operator documentation for further information on: Installation of the Trivy Operator Getting started guide","title":"Trivy Operator"},{"location":"tutorials/kubernetes/gitops/","text":"Installing the Trivy-Operator through GitOps This tutorial shows you how to install the Trivy Operator through GitOps platforms, namely ArgoCD and FluxCD. ArgoCD Make sure to have ArgoCD installed and running in your Kubernetes cluster. You can either deploy the Trivy Operator through the argocd CLI or by applying a Kubernetes manifest. ArgoCD command: > kubectl create ns trivy-system > argocd app create trivy-operator --repo https://github.com/aquasecurity/trivy-operator --path deploy/helm --dest-server https://kubernetes.default.svc --dest-namespace trivy-system Note that this installation is directly related to our official Helm Chart. If you want to change any of the value, we'd suggest you to create a separate values.yaml file. Kubernetes manifest trivy-operator.yaml : apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: trivy-operator namespace: argocd spec: project: default source: chart: trivy-operator repoURL: https://aquasecurity.github.io/helm-charts/ targetRevision: 0.0.3 helm: values: | trivy: ignoreUnfixed: true destination: server: https://kubernetes.default.svc namespace: trivy-system syncPolicy: automated: prune: true selfHeal: true To apply the Kubernetes manifest, if you have the manifest locally, you can use the following command through kubectl: > kubectl apply -f trivy-operator.yaml application.argoproj.io/trivy-operator created If you have the manifest in a Git repository, you can apply it to your cluster through the following command: > kubectl apply -n argocd -f https://raw.githubusercontent.com/AnaisUrlichs/argocd-starboard/main/starboard/argocd-starboard.yaml The latter command would allow you to make changes to the YAML manifest that ArgoCD would register automatically. Once deployed, you want to tell ArgoCD to sync the application from the actual state to the desired state: argocd app sync trivy-operator Now you can see the deployment in the ArgoCD UI. Have a look at the ArgoCD documentation to know how to access the UI. Note that ArgoCD is unable to show the Trivy CRDs as synced. FluxCD Make sure to have FluxCD installed and running in your Kubernetes cluster. You can either deploy the Trivy Operator through the Flux CLI or by applying a Kubernetes manifest. Flux command: > kubectl create ns trivy-system > flux create source helm trivy-operator --url https://aquasecurity.github.io/helm-charts --namespace trivy-system > flux create helmrelease trivy-operator --chart trivy-operator --source HelmRepository/trivy-operator --chart-version 0.0.3 --namespace trivy-system Kubernetes manifest trivy-operator.yaml : apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository metadata: name: trivy-operator namespace: flux-system spec: interval: 60m url: https://aquasecurity.github.io/helm-charts/ --- apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: name: trivy-operator namespace: trivy-system spec: chart: spec: chart: trivy-operator sourceRef: kind: HelmRepository name: trivy-operator namespace: flux-system version: 0.10.1 interval: 60m values: trivy: ignoreUnfixed: true install: crds: CreateReplace createNamespace: true You can then apply the file to your Kubernetes cluster: kubectl apply -f trivy-operator.yaml After the installation After the install, you want to check that the Trivy operator is running in the trivy-system namespace: kubectl get deployment -n trivy-system","title":"GitOps"},{"location":"tutorials/kubernetes/gitops/#installing-the-trivy-operator-through-gitops","text":"This tutorial shows you how to install the Trivy Operator through GitOps platforms, namely ArgoCD and FluxCD.","title":"Installing the Trivy-Operator through GitOps"},{"location":"tutorials/kubernetes/gitops/#argocd","text":"Make sure to have ArgoCD installed and running in your Kubernetes cluster. You can either deploy the Trivy Operator through the argocd CLI or by applying a Kubernetes manifest. ArgoCD command: > kubectl create ns trivy-system > argocd app create trivy-operator --repo https://github.com/aquasecurity/trivy-operator --path deploy/helm --dest-server https://kubernetes.default.svc --dest-namespace trivy-system Note that this installation is directly related to our official Helm Chart. If you want to change any of the value, we'd suggest you to create a separate values.yaml file. Kubernetes manifest trivy-operator.yaml : apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: trivy-operator namespace: argocd spec: project: default source: chart: trivy-operator repoURL: https://aquasecurity.github.io/helm-charts/ targetRevision: 0.0.3 helm: values: | trivy: ignoreUnfixed: true destination: server: https://kubernetes.default.svc namespace: trivy-system syncPolicy: automated: prune: true selfHeal: true To apply the Kubernetes manifest, if you have the manifest locally, you can use the following command through kubectl: > kubectl apply -f trivy-operator.yaml application.argoproj.io/trivy-operator created If you have the manifest in a Git repository, you can apply it to your cluster through the following command: > kubectl apply -n argocd -f https://raw.githubusercontent.com/AnaisUrlichs/argocd-starboard/main/starboard/argocd-starboard.yaml The latter command would allow you to make changes to the YAML manifest that ArgoCD would register automatically. Once deployed, you want to tell ArgoCD to sync the application from the actual state to the desired state: argocd app sync trivy-operator Now you can see the deployment in the ArgoCD UI. Have a look at the ArgoCD documentation to know how to access the UI. Note that ArgoCD is unable to show the Trivy CRDs as synced.","title":"ArgoCD"},{"location":"tutorials/kubernetes/gitops/#fluxcd","text":"Make sure to have FluxCD installed and running in your Kubernetes cluster. You can either deploy the Trivy Operator through the Flux CLI or by applying a Kubernetes manifest. Flux command: > kubectl create ns trivy-system > flux create source helm trivy-operator --url https://aquasecurity.github.io/helm-charts --namespace trivy-system > flux create helmrelease trivy-operator --chart trivy-operator --source HelmRepository/trivy-operator --chart-version 0.0.3 --namespace trivy-system Kubernetes manifest trivy-operator.yaml : apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository metadata: name: trivy-operator namespace: flux-system spec: interval: 60m url: https://aquasecurity.github.io/helm-charts/ --- apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: name: trivy-operator namespace: trivy-system spec: chart: spec: chart: trivy-operator sourceRef: kind: HelmRepository name: trivy-operator namespace: flux-system version: 0.10.1 interval: 60m values: trivy: ignoreUnfixed: true install: crds: CreateReplace createNamespace: true You can then apply the file to your Kubernetes cluster: kubectl apply -f trivy-operator.yaml","title":"FluxCD"},{"location":"tutorials/kubernetes/gitops/#after-the-installation","text":"After the install, you want to check that the Trivy operator is running in the trivy-system namespace: kubectl get deployment -n trivy-system","title":"After the installation"},{"location":"tutorials/kubernetes/kyverno/","text":"Attesting Image Scans With Kyverno This tutorial is based on the following blog post by Chip Zoller: Attesting Image Scans With Kyverno This tutorial details Verify the container image has an attestation with Kyverno Prerequisites Attestation of the vulnerability scan uploaded A running Kubernetes cluster that kubectl is connected to Kyverno Policy to check attestation The following policy ensures that the attestation is no older than 168h: vuln-attestation.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: check-vulnerabilities spec: validationFailureAction: enforce webhookTimeoutSeconds: 10 failurePolicy: Fail rules: - name: not-older-than-one-week match: any: - resources: kinds: - Pod verifyImages: - imageReferences: - \"CONTAINER-REGISTRY/*:*\" attestations: - predicateType: cosign.sigstore.dev/attestation/vuln/v1 conditions: - all: - key: \"{{ time_since('','{{metadata.scanFinishedOn}}','') }}\" operator: LessThanOrEquals value: \"168h\" Apply the policy to your Kubernetes cluster Ensure that you have Kyverno already deployed and running on your cluster -- for instance through he Kyverno Helm Chart. Next, apply the above policy: kubectl apply -f vuln-attestation.yaml To ensure that the policy worked, we can deploye an example deployment file with our container image: deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: cns-website namespace: app spec: replicas: 2 selector: matchLabels: run: cns-website template: metadata: labels: run: cns-website spec: containers: - name: cns-website image: docker.io/anaisurlichs/cns-website:0.0.6 ports: - containerPort: 80 imagePullPolicy: Always resources: limits: memory: 512Mi cpu: 200m securityContext: allowPrivilegeEscalation: false Once we apply the deployment, it should pass since our attestation is available: kubectl apply -f deployment.yaml -n app deployment.apps/cns-website created However, if we try to deploy any other container image, our deployment will fail. We can verify this by replacing the image referenced in the deployment with docker.io/anaisurlichs/cns-website:0.0.5 and applying the deployment: kubectl apply -f deployment-two.yaml Resource: \"apps/v1, Resource=deployments\", GroupVersionKind: \"apps/v1, Kind=Deployment\" Name: \"cns-website\", Namespace: \"app\" for: \"deployment-two.yaml\": admission webhook \"mutate.kyverno.svc-fail\" denied the request: resource Deployment/app/cns-website was blocked due to the following policies check-image: autogen-check-image: | failed to verify signature for docker.io/anaisurlichs/cns-website:0.0.5: .attestors[0].entries[0].keys: no matching signatures:","title":"Kyverno"},{"location":"tutorials/kubernetes/kyverno/#attesting-image-scans-with-kyverno","text":"This tutorial is based on the following blog post by Chip Zoller: Attesting Image Scans With Kyverno This tutorial details Verify the container image has an attestation with Kyverno","title":"Attesting Image Scans With Kyverno"},{"location":"tutorials/kubernetes/kyverno/#prerequisites","text":"Attestation of the vulnerability scan uploaded A running Kubernetes cluster that kubectl is connected to","title":"Prerequisites"},{"location":"tutorials/kubernetes/kyverno/#kyverno-policy-to-check-attestation","text":"The following policy ensures that the attestation is no older than 168h: vuln-attestation.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: check-vulnerabilities spec: validationFailureAction: enforce webhookTimeoutSeconds: 10 failurePolicy: Fail rules: - name: not-older-than-one-week match: any: - resources: kinds: - Pod verifyImages: - imageReferences: - \"CONTAINER-REGISTRY/*:*\" attestations: - predicateType: cosign.sigstore.dev/attestation/vuln/v1 conditions: - all: - key: \"{{ time_since('','{{metadata.scanFinishedOn}}','') }}\" operator: LessThanOrEquals value: \"168h\"","title":"Kyverno Policy to check attestation"},{"location":"tutorials/kubernetes/kyverno/#apply-the-policy-to-your-kubernetes-cluster","text":"Ensure that you have Kyverno already deployed and running on your cluster -- for instance through he Kyverno Helm Chart. Next, apply the above policy: kubectl apply -f vuln-attestation.yaml To ensure that the policy worked, we can deploye an example deployment file with our container image: deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: cns-website namespace: app spec: replicas: 2 selector: matchLabels: run: cns-website template: metadata: labels: run: cns-website spec: containers: - name: cns-website image: docker.io/anaisurlichs/cns-website:0.0.6 ports: - containerPort: 80 imagePullPolicy: Always resources: limits: memory: 512Mi cpu: 200m securityContext: allowPrivilegeEscalation: false Once we apply the deployment, it should pass since our attestation is available: kubectl apply -f deployment.yaml -n app deployment.apps/cns-website created However, if we try to deploy any other container image, our deployment will fail. We can verify this by replacing the image referenced in the deployment with docker.io/anaisurlichs/cns-website:0.0.5 and applying the deployment: kubectl apply -f deployment-two.yaml Resource: \"apps/v1, Resource=deployments\", GroupVersionKind: \"apps/v1, Kind=Deployment\" Name: \"cns-website\", Namespace: \"app\" for: \"deployment-two.yaml\": admission webhook \"mutate.kyverno.svc-fail\" denied the request: resource Deployment/app/cns-website was blocked due to the following policies check-image: autogen-check-image: | failed to verify signature for docker.io/anaisurlichs/cns-website:0.0.5: .attestors[0].entries[0].keys: no matching signatures:","title":"Apply the policy to your Kubernetes cluster"},{"location":"tutorials/misconfiguration/terraform/","text":"Scanning Terraform files with Trivy This tutorial is focused on ways Trivy can scan Terraform IaC configuration files. A video tutorial on Terraform Misconfiguration scans can be found on the Aqua Open Source YouTube account. A note to tfsec users We have been consolidating all of our scanning-related efforts in one place, and that is Trivy. You can read more on the decision in the tfsec discussions. Trivy Config Command Terraform configuration scanning is available as part of the trivy config command. This command scans all configuration files for misconfiguration issues. You can find the details within misconfiguration scans in the Trivy documentation. Command structure: trivy config <any flags you want to use> <file or directory that you would like to scan> The trivy config command can scan Terraform configuration, CloudFormation, Dockerfile, Kubernetes manifests, and Helm Charts for misconfiguration. Trivy will compare the configuration found in the file with a set of best practices. If the configuration is following best practices, the check will pass, If the configuration does not define the resource of some configuration, Trivy will assume the default configuration for the resource creation is used. In this case, the check might fail. If the configuration that has been defined does not follow best practices, the check will fail. Prerequisites Install Trivy on your local machines. The documentation provides several different installation options. This tutorial will use this example Terraform tutorial for terraform misconfiguration scanning with Trivy. Git clone the tutorial and cd into the directory: git clone git@github.com:Cloud-Native-Security/trivy-demo.git cd bad_iac/terraform In this case, the folder only containes Terraform configuration files. However, you could scan a directory that contains several different configurations e.g. Kubernetes YAML manifests, Dockerfile, and Terraform. Trivy will then detect the different configuration files and apply the right rules automatically. Different types of trivy config scans Below are several examples of how the trivy config scan can be used. General Terraform scan with trivy: trivy config <specify the directory> So if we are already in the directory that we want to scan: trivy config ./ Specify the scan format The --format flag changes the way that Trivy displays the scan result: JSON: trivy config -f json terraform-infra Sarif: trivy config -f sarif terraform-infra Specifying the output location The --output flag specifies the file location in which the scan result should be saved: JSON: trivy config -f json -o example.json terraform-infra Sarif: trivy config -f sarif -o example.sarif terraform-infra Filtering by severity If you are presented with lots and lots of misconfiguration across different files, you might want to filter or the misconfiguration with the highest severity: trivy config --severity CRITICAL, MEDIUM terraform-infra Passing tf.tfvars files into trivy config scans You can pass terraform values to Trivy to override default values found in the Terraform HCL code. More information are provided in the documentation. trivy conf --tf-vars terraform.tfvars ./ Custom Checks We have lots of examples in the documentation on how you can write and pass custom Rego policies into terraform misconfiguration scans. Secret and vulnerability scans The trivy config command does not perform secrete and vulnerability checks out of the box. However, you can specify as part of your trivy fs scan that you would like to scan you terraform files for exposed secrets and misconfiguraction through the following flags: trivy fs --scanners secret,config ./ The trivy config command is a sub-command of the trivy fs command. You can learn more about this command in the documentation. Scanning Terraform Plan files Instead of scanning your different Terraform resources individually, you could also scan your terraform plan output before it is deployed for misconfiguration. This will give you insights into any misconfiguration of your resources as they would become deployed. Here is the link to the documentation. First, create a terraform plan and save it to a file: terraform plan --out tfplan.binary Next, convert the file into json format: terraform show -json tfplan.binary > tfplan.json Lastly, scan the file with the trivy config command: trivy config ./tfplan.json Note that you need to be able to create a terraform init and plan without any errors. Using Trivy in your CI/CD pipeline Similar to tfsec, Trivy can be used either on local developer machines or integrated into your CI/CD pipeline. There are several steps available for different pipelines, including GitHub Actions, Circle CI, GitLab, Travis and more in the tutorials section of the documentation: https://aquasecurity.github.io/trivy/latest/tutorials/integrations/","title":"Terraform scanning"},{"location":"tutorials/misconfiguration/terraform/#scanning-terraform-files-with-trivy","text":"This tutorial is focused on ways Trivy can scan Terraform IaC configuration files. A video tutorial on Terraform Misconfiguration scans can be found on the Aqua Open Source YouTube account. A note to tfsec users We have been consolidating all of our scanning-related efforts in one place, and that is Trivy. You can read more on the decision in the tfsec discussions.","title":"Scanning Terraform files with Trivy"},{"location":"tutorials/misconfiguration/terraform/#trivy-config-command","text":"Terraform configuration scanning is available as part of the trivy config command. This command scans all configuration files for misconfiguration issues. You can find the details within misconfiguration scans in the Trivy documentation. Command structure: trivy config <any flags you want to use> <file or directory that you would like to scan> The trivy config command can scan Terraform configuration, CloudFormation, Dockerfile, Kubernetes manifests, and Helm Charts for misconfiguration. Trivy will compare the configuration found in the file with a set of best practices. If the configuration is following best practices, the check will pass, If the configuration does not define the resource of some configuration, Trivy will assume the default configuration for the resource creation is used. In this case, the check might fail. If the configuration that has been defined does not follow best practices, the check will fail.","title":"Trivy Config Command"},{"location":"tutorials/misconfiguration/terraform/#prerequisites","text":"Install Trivy on your local machines. The documentation provides several different installation options. This tutorial will use this example Terraform tutorial for terraform misconfiguration scanning with Trivy. Git clone the tutorial and cd into the directory: git clone git@github.com:Cloud-Native-Security/trivy-demo.git cd bad_iac/terraform In this case, the folder only containes Terraform configuration files. However, you could scan a directory that contains several different configurations e.g. Kubernetes YAML manifests, Dockerfile, and Terraform. Trivy will then detect the different configuration files and apply the right rules automatically.","title":"Prerequisites"},{"location":"tutorials/misconfiguration/terraform/#different-types-of-trivy-config-scans","text":"Below are several examples of how the trivy config scan can be used. General Terraform scan with trivy: trivy config <specify the directory> So if we are already in the directory that we want to scan: trivy config ./","title":"Different types of trivy config scans"},{"location":"tutorials/misconfiguration/terraform/#specify-the-scan-format","text":"The --format flag changes the way that Trivy displays the scan result: JSON: trivy config -f json terraform-infra Sarif: trivy config -f sarif terraform-infra","title":"Specify the scan format"},{"location":"tutorials/misconfiguration/terraform/#specifying-the-output-location","text":"The --output flag specifies the file location in which the scan result should be saved: JSON: trivy config -f json -o example.json terraform-infra Sarif: trivy config -f sarif -o example.sarif terraform-infra","title":"Specifying the output location"},{"location":"tutorials/misconfiguration/terraform/#filtering-by-severity","text":"If you are presented with lots and lots of misconfiguration across different files, you might want to filter or the misconfiguration with the highest severity: trivy config --severity CRITICAL, MEDIUM terraform-infra","title":"Filtering by severity"},{"location":"tutorials/misconfiguration/terraform/#passing-tftfvars-files-into-trivy-config-scans","text":"You can pass terraform values to Trivy to override default values found in the Terraform HCL code. More information are provided in the documentation. trivy conf --tf-vars terraform.tfvars ./","title":"Passing tf.tfvars files into trivy config scans"},{"location":"tutorials/misconfiguration/terraform/#custom-checks","text":"We have lots of examples in the documentation on how you can write and pass custom Rego policies into terraform misconfiguration scans.","title":"Custom Checks"},{"location":"tutorials/misconfiguration/terraform/#secret-and-vulnerability-scans","text":"The trivy config command does not perform secrete and vulnerability checks out of the box. However, you can specify as part of your trivy fs scan that you would like to scan you terraform files for exposed secrets and misconfiguraction through the following flags: trivy fs --scanners secret,config ./ The trivy config command is a sub-command of the trivy fs command. You can learn more about this command in the documentation.","title":"Secret and vulnerability scans"},{"location":"tutorials/misconfiguration/terraform/#scanning-terraform-plan-files","text":"Instead of scanning your different Terraform resources individually, you could also scan your terraform plan output before it is deployed for misconfiguration. This will give you insights into any misconfiguration of your resources as they would become deployed. Here is the link to the documentation. First, create a terraform plan and save it to a file: terraform plan --out tfplan.binary Next, convert the file into json format: terraform show -json tfplan.binary > tfplan.json Lastly, scan the file with the trivy config command: trivy config ./tfplan.json Note that you need to be able to create a terraform init and plan without any errors.","title":"Scanning Terraform Plan files"},{"location":"tutorials/misconfiguration/terraform/#using-trivy-in-your-cicd-pipeline","text":"Similar to tfsec, Trivy can be used either on local developer machines or integrated into your CI/CD pipeline. There are several steps available for different pipelines, including GitHub Actions, Circle CI, GitLab, Travis and more in the tutorials section of the documentation: https://aquasecurity.github.io/trivy/latest/tutorials/integrations/","title":"Using Trivy in your CI/CD pipeline"},{"location":"tutorials/shell/shell-completion/","text":"Enable shell completion Below is example steps to enable shell completion feature for trivy cli: 1. Know your current shell $ echo $SHELL /bin/zsh # For this example it is zsh, but will be vary depend on your $SHELL, maybe /bin/bash or /bin/fish 2. Run completion command to get sub-commands $ trivy completion zsh -h Generate the autocompletion script for the zsh shell. If shell completion is not already enabled in your environment you will need to enable it. You can execute the following once: echo \"autoload -U compinit; compinit\" >> ~/.zshrc To load completions in your current shell session: source < ( trivy completion zsh ) ; compdef _trivy trivy To load completions for every new session, execute once: #### Linux: trivy completion zsh > \" ${ fpath [1] } /_trivy\" #### macOS: trivy completion zsh > $( brew --prefix ) /share/zsh/site-functions/_trivy You will need to start a new shell for this setup to take effect. 3. Run the sub-commands following the instruction echo \"autoload -U compinit; compinit\" >> ~/.zshrc source < ( trivy completion zsh ) ; compdef _trivy trivy trivy completion zsh > \" ${ fpath [1] } /_trivy\" 4. Start a new shell and you can see the shell completion $ trivy [ tab ] aws -- scan aws account completion -- Generate the autocompletion script for the specified shell config -- Scan config files for misconfigurations filesystem -- Scan local filesystem help -- Help about any command image -- Scan a container image kubernetes -- scan kubernetes cluster module -- Manage modules plugin -- Manage plugins repository -- Scan a repository rootfs -- Scan rootfs sbom -- Scan SBOM for vulnerabilities server -- Server mode version -- Print the version","title":"Completion"},{"location":"tutorials/shell/shell-completion/#enable-shell-completion","text":"Below is example steps to enable shell completion feature for trivy cli:","title":"Enable shell completion"},{"location":"tutorials/shell/shell-completion/#1-know-your-current-shell","text":"$ echo $SHELL /bin/zsh # For this example it is zsh, but will be vary depend on your $SHELL, maybe /bin/bash or /bin/fish","title":"1. Know your current shell"},{"location":"tutorials/shell/shell-completion/#2-run-completion-command-to-get-sub-commands","text":"$ trivy completion zsh -h Generate the autocompletion script for the zsh shell. If shell completion is not already enabled in your environment you will need to enable it. You can execute the following once: echo \"autoload -U compinit; compinit\" >> ~/.zshrc To load completions in your current shell session: source < ( trivy completion zsh ) ; compdef _trivy trivy To load completions for every new session, execute once: #### Linux: trivy completion zsh > \" ${ fpath [1] } /_trivy\" #### macOS: trivy completion zsh > $( brew --prefix ) /share/zsh/site-functions/_trivy You will need to start a new shell for this setup to take effect.","title":"2. Run completion command to get sub-commands"},{"location":"tutorials/shell/shell-completion/#3-run-the-sub-commands-following-the-instruction","text":"echo \"autoload -U compinit; compinit\" >> ~/.zshrc source < ( trivy completion zsh ) ; compdef _trivy trivy trivy completion zsh > \" ${ fpath [1] } /_trivy\"","title":"3. Run the sub-commands following the instruction"},{"location":"tutorials/shell/shell-completion/#4-start-a-new-shell-and-you-can-see-the-shell-completion","text":"$ trivy [ tab ] aws -- scan aws account completion -- Generate the autocompletion script for the specified shell config -- Scan config files for misconfigurations filesystem -- Scan local filesystem help -- Help about any command image -- Scan a container image kubernetes -- scan kubernetes cluster module -- Manage modules plugin -- Manage plugins repository -- Scan a repository rootfs -- Scan rootfs sbom -- Scan SBOM for vulnerabilities server -- Server mode version -- Print the version","title":"4. Start a new shell and you can see the shell completion"},{"location":"tutorials/signing/vuln-attestation/","text":"Vulnerability Scan Record Attestation This tutorial details Scan your container image for vulnerabilities Generate an attestation with Cosign Prerequisites Trivy CLI installed Cosign installed Scan Container Image for vulnerabilities Scan your container image for vulnerabilities and save the scan result to a scan.json file: trivy image --ignore-unfixed --format json --output scan.json anaisurlichs/cns-website:0.0.6 --ignore-unfixed: Ensures that only the vulnerabilities are displayed that have a already a fix available --output scan.json: The scan output is saved to a scan.json file instead of being displayed in the terminal. Note: Replace the container image with the container image that you would like to scan. Attestation of the vulnerability scan with Cosign The following command generates an attestation for the vulnerability scan and uploads it to our container image: cosign attest --replace --predicate scan.json --type vuln anaisurlichs/cns-website:0.0.6 Note: Replace the container image with the container image that you would like to scan. See here for more details.","title":"Vulnerability Scan Record Attestation"},{"location":"tutorials/signing/vuln-attestation/#vulnerability-scan-record-attestation","text":"This tutorial details Scan your container image for vulnerabilities Generate an attestation with Cosign","title":"Vulnerability Scan Record Attestation"},{"location":"tutorials/signing/vuln-attestation/#prerequisites","text":"Trivy CLI installed Cosign installed","title":"Prerequisites"},{"location":"tutorials/signing/vuln-attestation/#scan-container-image-for-vulnerabilities","text":"Scan your container image for vulnerabilities and save the scan result to a scan.json file: trivy image --ignore-unfixed --format json --output scan.json anaisurlichs/cns-website:0.0.6 --ignore-unfixed: Ensures that only the vulnerabilities are displayed that have a already a fix available --output scan.json: The scan output is saved to a scan.json file instead of being displayed in the terminal. Note: Replace the container image with the container image that you would like to scan.","title":"Scan Container Image for vulnerabilities"},{"location":"tutorials/signing/vuln-attestation/#attestation-of-the-vulnerability-scan-with-cosign","text":"The following command generates an attestation for the vulnerability scan and uploads it to our container image: cosign attest --replace --predicate scan.json --type vuln anaisurlichs/cns-website:0.0.6 Note: Replace the container image with the container image that you would like to scan. See here for more details.","title":"Attestation of the vulnerability scan with Cosign"}]}
\ No newline at end of file
+{"config":{"indexing":"full","lang":["en"],"min_search_length":3,"prebuild_index":false,"separator":"[\\s\\-]+"},"docs":[{"location":"","text":"Trivy Documentation \ud83d\udc4b Welcome to Trivy Documentation! To help you get around, please notice the different sections at the top global menu: You are currently in the Getting Started section where you can find general information and help with first steps. In the Tutorials section you can find step-by-step guides that help you accomplish specific tasks. In the Docs section you can find the complete reference documentation for all of the different features and settings that Trivy has to offer. In the Ecosystem section you can find how Trivy works together with other tools and applications that you might already use. In the Contributing section you can find technical developer documentation and contribution guidelines. About Trivy Trivy ( pronunciation ) is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues. Targets (what Trivy can scan): Container Image Filesystem Git Repository (remote) Virtual Machine Image Kubernetes AWS Scanners (what Trivy can find there): OS packages and software dependencies in use (SBOM) Known vulnerabilities (CVEs) IaC issues and misconfigurations Sensitive information and secrets Software licenses Trivy supports most popular programming languages, operating systems, and platforms. For a complete list, see the Scanning Coverage page. To learn more, go to the Trivy homepage for feature highlights, or to the Documentation site for detailed information. Quick Start Get Trivy Trivy is available in most common distribution channels. The complete list of installation options is available in the Installation page. Here are a few popular examples: brew install trivy docker run aquasec/trivy Download binary from https://github.com/aquasecurity/trivy/releases/latest/ See Installation for more Trivy is integrated with many popular platforms and applications. The complete list of integrations is available in the Ecosystem page. Here are a few popular options examples: GitHub Actions Kubernetes operator VS Code plugin See Ecosystem for more General usage trivy <target> [ --scanners <scanner1,scanner2> ] <subject> Examples: trivy image python:3.4-alpine Result Demo: Vulnerability Detection trivy fs --scanners vuln,secret,config myproject/ Result Demo: Misconfiguration Detection trivy k8s --report summary cluster Result Demo: Secret Detection Want more? Check out Aqua If you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering. You can find a high level comparison table specific to Trivy users here . In addition check out the https://aquasec.com website for more information about our products and services. If you'd like to contact Aqua or request a demo, please use this form: https://www.aquasec.com/demo Trivy is an Aqua Security open source project. Learn about our open source work and portfolio here . Contact us about any matter by opening a GitHub Discussion here","title":"Overview"},{"location":"#trivy-documentation","text":"\ud83d\udc4b Welcome to Trivy Documentation! To help you get around, please notice the different sections at the top global menu: You are currently in the Getting Started section where you can find general information and help with first steps. In the Tutorials section you can find step-by-step guides that help you accomplish specific tasks. In the Docs section you can find the complete reference documentation for all of the different features and settings that Trivy has to offer. In the Ecosystem section you can find how Trivy works together with other tools and applications that you might already use. In the Contributing section you can find technical developer documentation and contribution guidelines.","title":"Trivy Documentation"},{"location":"#about-trivy","text":"Trivy ( pronunciation ) is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues. Targets (what Trivy can scan): Container Image Filesystem Git Repository (remote) Virtual Machine Image Kubernetes AWS Scanners (what Trivy can find there): OS packages and software dependencies in use (SBOM) Known vulnerabilities (CVEs) IaC issues and misconfigurations Sensitive information and secrets Software licenses Trivy supports most popular programming languages, operating systems, and platforms. For a complete list, see the Scanning Coverage page. To learn more, go to the Trivy homepage for feature highlights, or to the Documentation site for detailed information.","title":"About Trivy"},{"location":"#quick-start","text":"","title":"Quick Start"},{"location":"#get-trivy","text":"Trivy is available in most common distribution channels. The complete list of installation options is available in the Installation page. Here are a few popular examples: brew install trivy docker run aquasec/trivy Download binary from https://github.com/aquasecurity/trivy/releases/latest/ See Installation for more Trivy is integrated with many popular platforms and applications. The complete list of integrations is available in the Ecosystem page. Here are a few popular options examples: GitHub Actions Kubernetes operator VS Code plugin See Ecosystem for more","title":"Get Trivy"},{"location":"#general-usage","text":"trivy <target> [ --scanners <scanner1,scanner2> ] <subject> Examples: trivy image python:3.4-alpine Result Demo: Vulnerability Detection trivy fs --scanners vuln,secret,config myproject/ Result Demo: Misconfiguration Detection trivy k8s --report summary cluster Result Demo: Secret Detection","title":"General usage"},{"location":"#want-more-check-out-aqua","text":"If you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering. You can find a high level comparison table specific to Trivy users here . In addition check out the https://aquasec.com website for more information about our products and services. If you'd like to contact Aqua or request a demo, please use this form: https://www.aquasec.com/demo Trivy is an Aqua Security open source project. Learn about our open source work and portfolio here . Contact us about any matter by opening a GitHub Discussion here","title":"Want more? Check out Aqua"},{"location":"community/contribute/discussion/","text":"Discussions Thank you for taking interest in contributing to Trivy! Trivy uses GitHub Discussion for bug reports, feature requests, and questions. If maintainers decide to accept a new feature or confirm that it is a bug, they will close the discussion and create a GitHub Issue associated with that discussion. Feel free to open discussions for any reason. When you open a new discussion, you'll have to select a discussion category as described below. Please spend a small amount of time giving due diligence to the issue/discussion tracker. Your discussion might be a duplicate. If it is, please add your comment to the existing issue/discussion. Remember that users might search for your issue/discussion in the future, so please give it a meaningful title to help others. The issue should clearly explain the reason for opening, the proposal if you have any, and any relevant technical information. There are 4 categories: \ud83d\udca1 Ideas Share ideas for new features \ud83d\udd0e False Detection Report false positives/negatives \ud83d\udc1b Bugs Report something that is not working as expected \ud83d\ude4f Q&A Ask the community for help Note If you find any false positives or false negatives, please make sure to report them under the \"False Detection\" category, not \"Bugs\". False detection Trivy depends on multiple data sources . Sometime these databases contain mistakes. If Trivy can't detect any CVE-IDs or shows false positive result, at first please follow the next steps: Run Trivy with -f json that shows data sources. According to the shown data source, make sure that the security advisory in the data source is correct. If the data source is correct and Trivy shows wrong results, please raise an issue on Trivy. GitHub Advisory Database Visit here and search CVE-ID. If you find a problem, it'll be nice to fix it: How to contribute to a GitHub security advisory GitLab Advisory Database Visit here and search CVE-ID. If you find a problem, it'll be nice to fix it: Create an issue to GitLab Advisory Database Red Hat CVE Database Visit here and search CVE-ID.","title":"Discussions"},{"location":"community/contribute/discussion/#discussions","text":"Thank you for taking interest in contributing to Trivy! Trivy uses GitHub Discussion for bug reports, feature requests, and questions. If maintainers decide to accept a new feature or confirm that it is a bug, they will close the discussion and create a GitHub Issue associated with that discussion. Feel free to open discussions for any reason. When you open a new discussion, you'll have to select a discussion category as described below. Please spend a small amount of time giving due diligence to the issue/discussion tracker. Your discussion might be a duplicate. If it is, please add your comment to the existing issue/discussion. Remember that users might search for your issue/discussion in the future, so please give it a meaningful title to help others. The issue should clearly explain the reason for opening, the proposal if you have any, and any relevant technical information. There are 4 categories: \ud83d\udca1 Ideas Share ideas for new features \ud83d\udd0e False Detection Report false positives/negatives \ud83d\udc1b Bugs Report something that is not working as expected \ud83d\ude4f Q&A Ask the community for help Note If you find any false positives or false negatives, please make sure to report them under the \"False Detection\" category, not \"Bugs\".","title":"Discussions"},{"location":"community/contribute/discussion/#false-detection","text":"Trivy depends on multiple data sources . Sometime these databases contain mistakes. If Trivy can't detect any CVE-IDs or shows false positive result, at first please follow the next steps: Run Trivy with -f json that shows data sources. According to the shown data source, make sure that the security advisory in the data source is correct. If the data source is correct and Trivy shows wrong results, please raise an issue on Trivy.","title":"False detection"},{"location":"community/contribute/discussion/#github-advisory-database","text":"Visit here and search CVE-ID. If you find a problem, it'll be nice to fix it: How to contribute to a GitHub security advisory","title":"GitHub Advisory Database"},{"location":"community/contribute/discussion/#gitlab-advisory-database","text":"Visit here and search CVE-ID. If you find a problem, it'll be nice to fix it: Create an issue to GitLab Advisory Database","title":"GitLab Advisory Database"},{"location":"community/contribute/discussion/#red-hat-cve-database","text":"Visit here and search CVE-ID.","title":"Red Hat CVE Database"},{"location":"community/contribute/issue/","text":"Issues Thank you for taking interest in contributing to Trivy! Trivy uses GitHub Discussion for bug reports, feature requests, and questions. Warning Issues created by non-maintainers will be immediately closed.","title":"Issues"},{"location":"community/contribute/issue/#issues","text":"Thank you for taking interest in contributing to Trivy! Trivy uses GitHub Discussion for bug reports, feature requests, and questions. Warning Issues created by non-maintainers will be immediately closed.","title":"Issues"},{"location":"community/contribute/pr/","text":"Thank you for taking interest in contributing to Trivy! Every Pull Request should have an associated bug or feature issue unless you are fixing a trivial documentation issue. Please add the associated Issue link in the PR description. Your PR is more likely to be accepted if it focuses on just one change. There's no need to add or tag reviewers. If a reviewer commented on your code or asked for changes, please remember to respond with comment. Do not mark discussion as resolved. It's up to reviewer to mark it resolved (in case if suggested fix addresses problem properly). PRs with unresolved issues should not be merged (even if the comment is unclear or requires no action from your side). Please include a comment with the results before and after your change. Your PR is more likely to be accepted if it includes tests (We have not historically been very strict about tests, but we would like to improve this!). If your PR affects the user experience in some way, please update the README.md and the CLI help accordingly. Development Install the necessary tools for development by following their respective installation instructions. Go Mage Build After making changes to the Go source code, build the project with the following command: $ mage build $ ./trivy -h Lint You must pass the linter checks: $ mage lint:run Additionally, you need to have run go mod tidy , so execute the following command as well: $ mage tidy To autofix linters use the following command: $ mage lint:fix Unit tests Your PR must pass all the unit tests. You can test it as below. $ mage test:unit Integration tests Your PR must pass all the integration tests. You can test it as below. $ mage test:integration Documentation If you update CLI flags, you need to generate the CLI references. The test will fail if they are not up-to-date. $ mage docs:generate You can build the documents as below and view it at http://localhost:8000. $ mage docs:serve Title It is not that strict, but we use the title conventions in this repository. Each commit message doesn't have to follow the conventions as long as it is clear and descriptive since it will be squashed and merged. Format of the title <type>(<scope>): <subject> The type and scope should always be lowercase as shown below. Allowed <type> values: feat for a new feature for the user, not a new feature for build script. Such commit will trigger a release bumping a MINOR version. fix for a bug fix for the user, not a fix to a build script. Such commit will trigger a release bumping a PATCH version. perf for performance improvements. Such commit will trigger a release bumping a PATCH version. docs for changes to the documentation. style for formatting changes, missing semicolons, etc. refactor for refactoring production code, e.g. renaming a variable. test for adding missing tests, refactoring tests; no production code change. build for updating build configuration, development tools or other changes irrelevant to the user. chore for updates that do not apply to the above, such as dependency updates. ci for changes to CI configuration files and scripts revert for revert to a previous commit Allowed <scope> values: checks: vuln misconf secret license mode: image fs repo sbom k8s server aws vm os: alpine redhat alma rocky mariner oracle debian ubuntu amazon suse photon distroless language: ruby php python nodejs rust dotnet java go elixir dart vuln: os lang config: kubernetes dockerfile terraform cloudformation container docker podman containerd oci cli: cli flag SBOM: cyclonedx spdx purl others: helm report db deps The <scope> can be empty (e.g. if the change is a global or difficult to assign to a single component), in which case the parentheses are omitted. Example titles feat(alma): add support for AlmaLinux fix(oracle): handle advisories with ksplice versions docs(misconf): add comparison with Conftest and TFsec chore(deps): bump go.uber.org/zap from 1.19.1 to 1.20.0 NOTE : please do not use chore(deps): update fanal and something like that if you add new features or fix bugs in Trivy-related projects. The PR title should describe what the PR adds or fixes even though it just updates the dependency in Trivy. Commits Understand where your pull request belongs Trivy is composed of several repositories that work together: Trivy is the client-side, user-facing, command line tool. vuln-list is a vulnerability database, aggregated from different sources, and normalized for easy consumption. Think of this as the \"server\" side of the trivy command line tool. There should be no pull requests to this repo vuln-list-update is the code that maintains the vuln-list database. trivy-db maintains the vulnerability database pulled by Trivy CLI. go-dep-parser is a library for parsing lock files such as package-lock.json and Gemfile.lock.","title":"Pull Requests"},{"location":"community/contribute/pr/#development","text":"Install the necessary tools for development by following their respective installation instructions. Go Mage","title":"Development"},{"location":"community/contribute/pr/#build","text":"After making changes to the Go source code, build the project with the following command: $ mage build $ ./trivy -h","title":"Build"},{"location":"community/contribute/pr/#lint","text":"You must pass the linter checks: $ mage lint:run Additionally, you need to have run go mod tidy , so execute the following command as well: $ mage tidy To autofix linters use the following command: $ mage lint:fix","title":"Lint"},{"location":"community/contribute/pr/#unit-tests","text":"Your PR must pass all the unit tests. You can test it as below. $ mage test:unit","title":"Unit tests"},{"location":"community/contribute/pr/#integration-tests","text":"Your PR must pass all the integration tests. You can test it as below. $ mage test:integration","title":"Integration tests"},{"location":"community/contribute/pr/#documentation","text":"If you update CLI flags, you need to generate the CLI references. The test will fail if they are not up-to-date. $ mage docs:generate You can build the documents as below and view it at http://localhost:8000. $ mage docs:serve","title":"Documentation"},{"location":"community/contribute/pr/#title","text":"It is not that strict, but we use the title conventions in this repository. Each commit message doesn't have to follow the conventions as long as it is clear and descriptive since it will be squashed and merged.","title":"Title"},{"location":"community/contribute/pr/#format-of-the-title","text":"<type>(<scope>): <subject> The type and scope should always be lowercase as shown below. Allowed <type> values: feat for a new feature for the user, not a new feature for build script. Such commit will trigger a release bumping a MINOR version. fix for a bug fix for the user, not a fix to a build script. Such commit will trigger a release bumping a PATCH version. perf for performance improvements. Such commit will trigger a release bumping a PATCH version. docs for changes to the documentation. style for formatting changes, missing semicolons, etc. refactor for refactoring production code, e.g. renaming a variable. test for adding missing tests, refactoring tests; no production code change. build for updating build configuration, development tools or other changes irrelevant to the user. chore for updates that do not apply to the above, such as dependency updates. ci for changes to CI configuration files and scripts revert for revert to a previous commit Allowed <scope> values: checks: vuln misconf secret license mode: image fs repo sbom k8s server aws vm os: alpine redhat alma rocky mariner oracle debian ubuntu amazon suse photon distroless language: ruby php python nodejs rust dotnet java go elixir dart vuln: os lang config: kubernetes dockerfile terraform cloudformation container docker podman containerd oci cli: cli flag SBOM: cyclonedx spdx purl others: helm report db deps The <scope> can be empty (e.g. if the change is a global or difficult to assign to a single component), in which case the parentheses are omitted.","title":"Format of the title"},{"location":"community/contribute/pr/#example-titles","text":"feat(alma): add support for AlmaLinux fix(oracle): handle advisories with ksplice versions docs(misconf): add comparison with Conftest and TFsec chore(deps): bump go.uber.org/zap from 1.19.1 to 1.20.0 NOTE : please do not use chore(deps): update fanal and something like that if you add new features or fix bugs in Trivy-related projects. The PR title should describe what the PR adds or fixes even though it just updates the dependency in Trivy.","title":"Example titles"},{"location":"community/contribute/pr/#commits","text":"","title":"Commits"},{"location":"community/contribute/pr/#understand-where-your-pull-request-belongs","text":"Trivy is composed of several repositories that work together: Trivy is the client-side, user-facing, command line tool. vuln-list is a vulnerability database, aggregated from different sources, and normalized for easy consumption. Think of this as the \"server\" side of the trivy command line tool. There should be no pull requests to this repo vuln-list-update is the code that maintains the vuln-list database. trivy-db maintains the vulnerability database pulled by Trivy CLI. go-dep-parser is a library for parsing lock files such as package-lock.json and Gemfile.lock.","title":"Understand where your pull request belongs"},{"location":"community/maintainer/help-wanted/","text":"Overview We use two labels help wanted and good first issue to identify issues that have been specially groomed for new contributors. The good first issue label is a subset of help wanted label, indicating that members have committed to providing extra assistance for new contributors. All good first issue items also have the help wanted label. Help Wanted Items marked with the help wanted label need to ensure that they are: Low Barrier to Entry It should be tractable for new contributors. Documentation on how that type of change should be made should already exist. Clear Task The task is agreed upon and does not require further discussions in the community. Call out if that area of code is untested and requires new fixtures. API / CLI behavior is decided and included in the OP issue, for example: \"The new command syntax is trivy --format yaml IMAGE_NAME \"_ with expected validations called out. Goldilocks priority Not too high that a core contributor should do it, but not too low that it isn't useful enough for a core contributor to spend time to review it, answer questions, help get it into a release, etc. Up-To-Date Often these issues become obsolete and have already been done, are no longer desired, no longer make sense, have changed priority or difficulty , etc. Good First Issue Items marked with the good first issue label are intended for first-time contributors . It indicates that members will keep an eye out for these pull requests and shepherd it through our processes. These items need to ensure that they follow the guidelines for help wanted labels (above) in addition to meeting the following criteria: No Barrier to Entry The task is something that a new contributor can tackle without advanced setup, or domain knowledge. Solution Explained The recommended solution is clearly described in the issue. Provides Context If background knowledge is required, this should be explicitly mentioned and a list of suggested readings included. Gives Examples Link to examples of similar implementations so new contributors have a reference guide for their changes. Identifies Relevant Code The relevant code and tests to be changed should be linked in the issue. Ready to Test There should be existing tests that can be modified, or existing test cases fit to be copied. If the area of code doesn't have tests, before labeling the issue, add a test fixture. This prep often makes a great help wanted task!","title":"Help Wanted"},{"location":"community/maintainer/help-wanted/#overview","text":"We use two labels help wanted and good first issue to identify issues that have been specially groomed for new contributors. The good first issue label is a subset of help wanted label, indicating that members have committed to providing extra assistance for new contributors. All good first issue items also have the help wanted label.","title":"Overview"},{"location":"community/maintainer/help-wanted/#help-wanted","text":"Items marked with the help wanted label need to ensure that they are: Low Barrier to Entry It should be tractable for new contributors. Documentation on how that type of change should be made should already exist. Clear Task The task is agreed upon and does not require further discussions in the community. Call out if that area of code is untested and requires new fixtures. API / CLI behavior is decided and included in the OP issue, for example: \"The new command syntax is trivy --format yaml IMAGE_NAME \"_ with expected validations called out. Goldilocks priority Not too high that a core contributor should do it, but not too low that it isn't useful enough for a core contributor to spend time to review it, answer questions, help get it into a release, etc. Up-To-Date Often these issues become obsolete and have already been done, are no longer desired, no longer make sense, have changed priority or difficulty , etc.","title":"Help Wanted"},{"location":"community/maintainer/help-wanted/#good-first-issue","text":"Items marked with the good first issue label are intended for first-time contributors . It indicates that members will keep an eye out for these pull requests and shepherd it through our processes. These items need to ensure that they follow the guidelines for help wanted labels (above) in addition to meeting the following criteria: No Barrier to Entry The task is something that a new contributor can tackle without advanced setup, or domain knowledge. Solution Explained The recommended solution is clearly described in the issue. Provides Context If background knowledge is required, this should be explicitly mentioned and a list of suggested readings included. Gives Examples Link to examples of similar implementations so new contributors have a reference guide for their changes. Identifies Relevant Code The relevant code and tests to be changed should be linked in the issue. Ready to Test There should be existing tests that can be modified, or existing test cases fit to be copied. If the area of code doesn't have tests, before labeling the issue, add a test fixture. This prep often makes a great help wanted task!","title":"Good First Issue"},{"location":"community/maintainer/triage/","text":"Triage Triage is an important part of maintaining the health of the trivy repo. A well organized repo allows maintainers to prioritize feature requests, fix bugs, and respond to users facing difficulty with the tool as quickly as possible. Triage includes: Labeling issues Responding to issues Closing issues Daily Triage Daily triage has two goals: Responsiveness for new issues Responsiveness when explicitly requested information was provided It covers: Issues without a kind/ or triage/ label Issues without a priority/ label triage/needs-information issues which the user has followed up on, and now require a response. Categorization The most important level of categorizing the issue is defining what type it is. We typically want at least one of the following labels on every issue, and some issues may fall into multiple categories: triage/support - The default for most incoming issues kind/bug - When it\u2019s a bug or we aren\u2019t delivering the best user experience Other possibilities: - kind/feature - Identify new feature requests - kind/testing - Update or fix unit/integration tests - kind/cleanup - Cleaning up/refactoring the codebase - kind/documentation - Updates or additions to trivy documentation If the issue is specific to a driver for OS packages or libraries: co/[driver for OS packages] co/alpine co/amazon co/debian co/oracle co/photon co/redhat co/suse co/ubuntu co/[driver for libraries of programming languages] co/bundler co/cargo co/composer co/npm co/yarn co/pipenv co/poetry Help wanted? Good First Issue - bug has a proposed solution, can be implemented w/o further discussion. Help wanted - if the bug could use help from a contributor Prioritization If the issue is not triage/support , it needs a priority label. priority/critical-urgent - someones top priority ASAP, such as security issue, user-visible bug, or build breakage. Rarely used. priority/important-soon : in time for the next two releases. It should be attached to a milestone. priority/important-longterm : 2-4 releases from now priority/backlog : agreed that this would be good to have, but no one is available at the moment. Consider tagging as help wanted priority/awaiting-more-evidence : may be useful, but there is not yet enough support. Weekly Triage Weekly triage has three goals: Catching up on unresponded issues Reviewing and closing PR\u2019s Closing stale issues Post-Release Triage Post-release triage occurs after a major release (around every 4-6 weeks). It focuses on: Closing bugs that have been resolved by the release Reprioritizing bugs that have not been resolved by the release Letting users know if we believe that there is still an issue This includes reviewing: Every issue that hasn\u2019t been touched in the last 2 days Re-evaluation of long-term issues Re-evaluation of short-term issues Responding to Issues Needs More Information A sample response to ask for more info: I don\u2019t yet have a clear way to replicate this issue. Do you mind adding some additional details. Here is additional information that would be helpful: * The exact trivy command line used * The exact image you want to scan * The full output of the trivy command, preferably with --debug for extra logging. Thank you for sharing your experience! Then: Label with triage/needs-information . Issue might be resolved If you think a release may have resolved an issue, ask the author to see if their issue has been resolved: Could you please check to see if trivy addresses this issue? We've made some changes with how this is handled, and improved the trivy logs output to help us debug tricky cases like this. Then: Label with triage/needs-information . Closing with Care Issues typically need to be closed for the following reasons: The issue has been addressed The issue is a duplicate of an existing issue There has been a lack of information over a long period of time In any of these situations, we aim to be kind when closing the issue, and offer the author action items should they need to reopen their issue or still require a solution. Samples responses for these situations include: Issue has been addressed @author: I believe this issue is now addressed by trivy v1.0.0, as it . If you still see this issue with trivy v1.0 or higher, please reopen this issue. Thank you for reporting this issue! Then: Close the issue Duplicate Issue This issue appears to be a duplicate of #X, do you mind if we move the conversation there? This way we can centralize the content relating to the issue. If you feel that this issue is not in fact a duplicate, please re-open it. If you have additional information to share, please add it to the new issue. Thank you for reporting this! Then: Label with triage/duplicate and close the issue. Lack of Information If an issue hasn't been active for more than four weeks, and the author has been pinged at least once, then the issue can be closed. Hey @author -- hopefully it's OK if I close this - there wasn't enough information to make it actionable, and some time has already passed. If you are able to provide additional details, you may reopen it at any point. Here is additional information that may be helpful to us: * Whether the issue occurs with the latest trivy release * The exact trivy command line used * The exact image you want to scan * The full output of the trivy command, preferably with --debug for extra logging. Thank you for sharing your experience! Then: Close the issue. Help Wanted issues We use two labels help wanted and good first issue to identify issues that have been specially groomed for new contributors. We have specific guidelines for how to use these labels. If you see an issue that satisfies these guidelines, you can add the help wanted label and the good first issue label. Please note that adding the good first issue label must also add the help wanted label. If an issue has these labels but does not satisfy the guidelines, please ask for more details to be added to the issue or remove the labels.","title":"Triage"},{"location":"community/maintainer/triage/#triage","text":"Triage is an important part of maintaining the health of the trivy repo. A well organized repo allows maintainers to prioritize feature requests, fix bugs, and respond to users facing difficulty with the tool as quickly as possible. Triage includes: Labeling issues Responding to issues Closing issues","title":"Triage"},{"location":"community/maintainer/triage/#daily-triage","text":"Daily triage has two goals: Responsiveness for new issues Responsiveness when explicitly requested information was provided It covers: Issues without a kind/ or triage/ label Issues without a priority/ label triage/needs-information issues which the user has followed up on, and now require a response.","title":"Daily Triage"},{"location":"community/maintainer/triage/#categorization","text":"The most important level of categorizing the issue is defining what type it is. We typically want at least one of the following labels on every issue, and some issues may fall into multiple categories: triage/support - The default for most incoming issues kind/bug - When it\u2019s a bug or we aren\u2019t delivering the best user experience Other possibilities: - kind/feature - Identify new feature requests - kind/testing - Update or fix unit/integration tests - kind/cleanup - Cleaning up/refactoring the codebase - kind/documentation - Updates or additions to trivy documentation If the issue is specific to a driver for OS packages or libraries: co/[driver for OS packages] co/alpine co/amazon co/debian co/oracle co/photon co/redhat co/suse co/ubuntu co/[driver for libraries of programming languages] co/bundler co/cargo co/composer co/npm co/yarn co/pipenv co/poetry Help wanted? Good First Issue - bug has a proposed solution, can be implemented w/o further discussion. Help wanted - if the bug could use help from a contributor","title":"Categorization"},{"location":"community/maintainer/triage/#prioritization","text":"If the issue is not triage/support , it needs a priority label. priority/critical-urgent - someones top priority ASAP, such as security issue, user-visible bug, or build breakage. Rarely used. priority/important-soon : in time for the next two releases. It should be attached to a milestone. priority/important-longterm : 2-4 releases from now priority/backlog : agreed that this would be good to have, but no one is available at the moment. Consider tagging as help wanted priority/awaiting-more-evidence : may be useful, but there is not yet enough support.","title":"Prioritization"},{"location":"community/maintainer/triage/#weekly-triage","text":"Weekly triage has three goals: Catching up on unresponded issues Reviewing and closing PR\u2019s Closing stale issues","title":"Weekly Triage"},{"location":"community/maintainer/triage/#post-release-triage","text":"Post-release triage occurs after a major release (around every 4-6 weeks). It focuses on: Closing bugs that have been resolved by the release Reprioritizing bugs that have not been resolved by the release Letting users know if we believe that there is still an issue This includes reviewing: Every issue that hasn\u2019t been touched in the last 2 days Re-evaluation of long-term issues Re-evaluation of short-term issues","title":"Post-Release Triage"},{"location":"community/maintainer/triage/#responding-to-issues","text":"","title":"Responding to Issues"},{"location":"community/maintainer/triage/#needs-more-information","text":"A sample response to ask for more info: I don\u2019t yet have a clear way to replicate this issue. Do you mind adding some additional details. Here is additional information that would be helpful: * The exact trivy command line used * The exact image you want to scan * The full output of the trivy command, preferably with --debug for extra logging. Thank you for sharing your experience! Then: Label with triage/needs-information .","title":"Needs More Information"},{"location":"community/maintainer/triage/#issue-might-be-resolved","text":"If you think a release may have resolved an issue, ask the author to see if their issue has been resolved: Could you please check to see if trivy addresses this issue? We've made some changes with how this is handled, and improved the trivy logs output to help us debug tricky cases like this. Then: Label with triage/needs-information .","title":"Issue might be resolved"},{"location":"community/maintainer/triage/#closing-with-care","text":"Issues typically need to be closed for the following reasons: The issue has been addressed The issue is a duplicate of an existing issue There has been a lack of information over a long period of time In any of these situations, we aim to be kind when closing the issue, and offer the author action items should they need to reopen their issue or still require a solution. Samples responses for these situations include:","title":"Closing with Care"},{"location":"community/maintainer/triage/#issue-has-been-addressed","text":"@author: I believe this issue is now addressed by trivy v1.0.0, as it . If you still see this issue with trivy v1.0 or higher, please reopen this issue. Thank you for reporting this issue! Then: Close the issue","title":"Issue has been addressed"},{"location":"community/maintainer/triage/#duplicate-issue","text":"This issue appears to be a duplicate of #X, do you mind if we move the conversation there? This way we can centralize the content relating to the issue. If you feel that this issue is not in fact a duplicate, please re-open it. If you have additional information to share, please add it to the new issue. Thank you for reporting this! Then: Label with triage/duplicate and close the issue.","title":"Duplicate Issue"},{"location":"community/maintainer/triage/#lack-of-information","text":"If an issue hasn't been active for more than four weeks, and the author has been pinged at least once, then the issue can be closed. Hey @author -- hopefully it's OK if I close this - there wasn't enough information to make it actionable, and some time has already passed. If you are able to provide additional details, you may reopen it at any point. Here is additional information that may be helpful to us: * Whether the issue occurs with the latest trivy release * The exact trivy command line used * The exact image you want to scan * The full output of the trivy command, preferably with --debug for extra logging. Thank you for sharing your experience! Then: Close the issue.","title":"Lack of Information"},{"location":"community/maintainer/triage/#help-wanted-issues","text":"We use two labels help wanted and good first issue to identify issues that have been specially groomed for new contributors. We have specific guidelines for how to use these labels. If you see an issue that satisfies these guidelines, you can add the help wanted label and the good first issue label. Please note that adding the good first issue label must also add the help wanted label. If an issue has these labels but does not satisfy the guidelines, please ask for more details to be added to the issue or remove the labels.","title":"Help Wanted issues"},{"location":"docs/","text":"Docs In this section you can find the complete reference documentation for all of the different features and settings that Trivy has to offer. \ud83d\udc48 Please use the side-navigation on the left in order to browse the different topics.","title":"Overview"},{"location":"docs/#docs","text":"In this section you can find the complete reference documentation for all of the different features and settings that Trivy has to offer. \ud83d\udc48 Please use the side-navigation on the left in order to browse the different topics.","title":"Docs"},{"location":"docs/advanced/air-gap/","text":"Air-Gapped Environment Trivy can be used in air-gapped environments. Note that an allowlist is here . Air-Gapped Environment for vulnerabilities Download the vulnerability database At first, you need to download the vulnerability database for use in air-gapped environments. Trivy oras >= v0.13.0 oras < v0.13.0 TRIVY_TEMP_DIR=$(mktemp -d) trivy --cache-dir $TRIVY_TEMP_DIR image --download-db-only tar -cf ./db.tar.gz -C $TRIVY_TEMP_DIR/db metadata.json trivy.db rm -rf $TRIVY_TEMP_DIR Please follow oras installation instruction . Download db.tar.gz : $ oras pull ghcr.io/aquasecurity/trivy-db:2 Please follow oras installation instruction . Download db.tar.gz : $ oras pull -a ghcr.io/aquasecurity/trivy-db:2 Download the Java index database 1 Java users also need to download the Java index database for use in air-gapped environments. Note You container image may contain JAR files even though you don't use Java directly. In that case, you also need to download the Java index database. Trivy oras >= v0.13.0 oras < v0.13.0 TRIVY_TEMP_DIR=$(mktemp -d) trivy --cache-dir $TRIVY_TEMP_DIR image --download-java-db-only tar -cf ./javadb.tar.gz -C $TRIVY_TEMP_DIR/java-db metadata.json trivy-java.db rm -rf $TRIVY_TEMP_DIR Please follow oras installation instruction . Download javadb.tar.gz : $ oras pull ghcr.io/aquasecurity/trivy-java-db:1 Please follow oras installation instruction . Download javadb.tar.gz : $ oras pull -a ghcr.io/aquasecurity/trivy-java-db:1 Transfer the DB files into the air-gapped environment The way of transfer depends on the environment. Vulnerability db Java index db 1 $ rsync -av -e ssh /path/to/db.tar.gz [user]@[host]:dst $ rsync -av -e ssh /path/to/javadb.tar.gz [user]@[host]:dst Put the DB files in Trivy's cache directory You have to know where to put the DB files. The following command shows the default cache directory. $ ssh user@host $ trivy -h | grep cache --cache-dir value cache directory (default: \"/home/myuser/.cache/trivy\") [$TRIVY_CACHE_DIR] Vulnerability db Java index db 1 Put the DB file in the cache directory + /db . $ mkdir -p /home/myuser/.cache/trivy/db $ cd /home/myuser/.cache/trivy/db $ tar xvf /path/to/db.tar.gz -C /home/myuser/.cache/trivy/db x trivy.db x metadata.json $ rm /path/to/db.tar.gz Put the DB file in the cache directory + /java-db . $ mkdir -p /home/myuser/.cache/trivy/java-db $ cd /home/myuser/.cache/trivy/java-db $ tar xvf /path/to/javadb.tar.gz -C /home/myuser/.cache/trivy/java-db x trivy-java.db x metadata.json $ rm /path/to/javadb.tar.gz In an air-gapped environment it is your responsibility to update the Trivy databases on a regular basis, so that the scanner can detect recently-identified vulnerabilities. Run Trivy with the specific flags. In an air-gapped environment, you have to specify --skip-db-update and --skip-java-db-update 1 so that Trivy doesn't attempt to download the latest database files. In addition, if you want to scan pom.xml dependencies, you need to specify --offline-scan since Trivy tries to issue API requests for scanning Java applications by default. $ trivy image --skip-db-update --skip-java-db-update --offline-scan alpine:3.12 Air-Gapped Environment for misconfigurations No special measures are required to detect misconfigurations in an air-gapped environment. Run Trivy with --skip-policy-update option In an air-gapped environment, specify --skip-policy-update so that Trivy doesn't attempt to download the latest misconfiguration policies. $ trivy conf --skip-policy-update /path/to/conf This is only required to scan jar files. More information about Java index db here \u21a9 \u21a9 \u21a9 \u21a9","title":"Air-Gapped Environment"},{"location":"docs/advanced/air-gap/#air-gapped-environment","text":"Trivy can be used in air-gapped environments. Note that an allowlist is here .","title":"Air-Gapped Environment"},{"location":"docs/advanced/air-gap/#air-gapped-environment-for-vulnerabilities","text":"","title":"Air-Gapped Environment for vulnerabilities"},{"location":"docs/advanced/air-gap/#download-the-vulnerability-database","text":"At first, you need to download the vulnerability database for use in air-gapped environments. Trivy oras >= v0.13.0 oras < v0.13.0 TRIVY_TEMP_DIR=$(mktemp -d) trivy --cache-dir $TRIVY_TEMP_DIR image --download-db-only tar -cf ./db.tar.gz -C $TRIVY_TEMP_DIR/db metadata.json trivy.db rm -rf $TRIVY_TEMP_DIR Please follow oras installation instruction . Download db.tar.gz : $ oras pull ghcr.io/aquasecurity/trivy-db:2 Please follow oras installation instruction . Download db.tar.gz : $ oras pull -a ghcr.io/aquasecurity/trivy-db:2","title":"Download the vulnerability database"},{"location":"docs/advanced/air-gap/#download-the-java-index-database1","text":"Java users also need to download the Java index database for use in air-gapped environments. Note You container image may contain JAR files even though you don't use Java directly. In that case, you also need to download the Java index database. Trivy oras >= v0.13.0 oras < v0.13.0 TRIVY_TEMP_DIR=$(mktemp -d) trivy --cache-dir $TRIVY_TEMP_DIR image --download-java-db-only tar -cf ./javadb.tar.gz -C $TRIVY_TEMP_DIR/java-db metadata.json trivy-java.db rm -rf $TRIVY_TEMP_DIR Please follow oras installation instruction . Download javadb.tar.gz : $ oras pull ghcr.io/aquasecurity/trivy-java-db:1 Please follow oras installation instruction . Download javadb.tar.gz : $ oras pull -a ghcr.io/aquasecurity/trivy-java-db:1","title":"Download the Java index database1"},{"location":"docs/advanced/air-gap/#transfer-the-db-files-into-the-air-gapped-environment","text":"The way of transfer depends on the environment. Vulnerability db Java index db 1 $ rsync -av -e ssh /path/to/db.tar.gz [user]@[host]:dst $ rsync -av -e ssh /path/to/javadb.tar.gz [user]@[host]:dst","title":"Transfer the DB files into the air-gapped environment"},{"location":"docs/advanced/air-gap/#put-the-db-files-in-trivys-cache-directory","text":"You have to know where to put the DB files. The following command shows the default cache directory. $ ssh user@host $ trivy -h | grep cache --cache-dir value cache directory (default: \"/home/myuser/.cache/trivy\") [$TRIVY_CACHE_DIR] Vulnerability db Java index db 1 Put the DB file in the cache directory + /db . $ mkdir -p /home/myuser/.cache/trivy/db $ cd /home/myuser/.cache/trivy/db $ tar xvf /path/to/db.tar.gz -C /home/myuser/.cache/trivy/db x trivy.db x metadata.json $ rm /path/to/db.tar.gz Put the DB file in the cache directory + /java-db . $ mkdir -p /home/myuser/.cache/trivy/java-db $ cd /home/myuser/.cache/trivy/java-db $ tar xvf /path/to/javadb.tar.gz -C /home/myuser/.cache/trivy/java-db x trivy-java.db x metadata.json $ rm /path/to/javadb.tar.gz In an air-gapped environment it is your responsibility to update the Trivy databases on a regular basis, so that the scanner can detect recently-identified vulnerabilities.","title":"Put the DB files in Trivy's cache directory"},{"location":"docs/advanced/air-gap/#run-trivy-with-the-specific-flags","text":"In an air-gapped environment, you have to specify --skip-db-update and --skip-java-db-update 1 so that Trivy doesn't attempt to download the latest database files. In addition, if you want to scan pom.xml dependencies, you need to specify --offline-scan since Trivy tries to issue API requests for scanning Java applications by default. $ trivy image --skip-db-update --skip-java-db-update --offline-scan alpine:3.12","title":"Run Trivy with the specific flags."},{"location":"docs/advanced/air-gap/#air-gapped-environment-for-misconfigurations","text":"No special measures are required to detect misconfigurations in an air-gapped environment.","title":"Air-Gapped Environment for misconfigurations"},{"location":"docs/advanced/air-gap/#run-trivy-with-skip-policy-update-option","text":"In an air-gapped environment, specify --skip-policy-update so that Trivy doesn't attempt to download the latest misconfiguration policies. $ trivy conf --skip-policy-update /path/to/conf This is only required to scan jar files. More information about Java index db here \u21a9 \u21a9 \u21a9 \u21a9","title":"Run Trivy with --skip-policy-update option"},{"location":"docs/advanced/modules/","text":"Modules EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy provides a module feature to allow others to extend the Trivy CLI without the need to change the Trivy code base. It changes the behavior during scanning by WebAssembly. Overview Trivy modules are add-on tools that integrate seamlessly with Trivy. They provide a way to extend the core feature set of Trivy, but without updating the Trivy binary. They can be added and removed from a Trivy installation without impacting the core Trivy tool. They can be written in any programming language supporting WebAssembly. It supports only TinyGo at the moment. You can write your own detection logic. Evaluate complex vulnerability conditions like Spring4Shell Detect a shell script communicating with malicious domains Detect malicious python install script (setup.py) Even detect misconfigurations in WordPress setting etc. Then, you can update the scan result however you want. Change a severity Remove a vulnerability Add a new vulnerability etc. Modules should be distributed in OCI registries like GitHub Container Registry. Warning WebAssembly doesn't allow file access and network access by default. Modules can read required files only, but cannot overwrite them. WebAssembly is sandboxed and secure by design, but Trivy modules available in public are not audited for security. You should install and run third-party modules at your own risk even though Under the hood Trivy leverages wazero to run WebAssembly modules without CGO. Installing a Module A module can be installed using the trivy module install command. This command takes an url. It will download the module and install it in the module cache. Trivy adheres to the XDG specification, so the location depends on whether XDG_DATA_HOME is set. Trivy will now search XDG_DATA_HOME for the location of the Trivy modules cache. The preference order is as follows: XDG_DATA_HOME if set and .trivy/plugins exists within the XDG_DATA_HOME dir $HOME/.trivy/plugins For example, to download the WebAssembly module, you can execute the following command: $ trivy module install ghcr.io/aquasecurity/trivy-module-spring4shell Using Modules Once the module is installed, Trivy will load all available modules in the cache on the start of the next Trivy execution. The modules may inject custom logic into scanning and change the result. You can run Trivy as usual and modules are loaded automatically. You will see the log messages about WASM modules. $ trivy image ghcr.io/aquasecurity/trivy-test-images:spring4shell-jre8 2022 -06-12T12:57:13.210+0300 INFO Loading ghcr.io/aquasecurity/trivy-module-spring4shell/spring4shell.wasm... 2022 -06-12T12:57:13.596+0300 INFO Registering WASM module: spring4shell@v1 ... 2022 -06-12T12:57:14.865+0300 INFO Module spring4shell: Java Version: 8 , Tomcat Version: 8 .5.77 2022 -06-12T12:57:14.865+0300 INFO Module spring4shell: change CVE-2022-22965 severity from CRITICAL to LOW Java ( jar ) Total: 9 ( UNKNOWN: 1 , LOW: 3 , MEDIUM: 2 , HIGH: 3 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 org.springframework.boot:spring-boot ( helloworld.war ) \u2502 CVE-2022-22965 \u2502 LOW \u2502 2 .6.3 \u2502 2 .5.12, 2 .6.6 \u2502 spring-framework: RCE via Data Binding on JDK 9 + \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-22965 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 ... ( snip ) ... In the above example, the Spring4Shell module changed the severity from CRITICAL to LOW because the application doesn't satisfy one of conditions. Uninstalling Modules Specify a module repository with trivy module uninstall command. $ trivy module uninstall ghcr.io/aquasecurity/trivy-module-spring4shell Building Modules It supports TinyGo only at the moment. TinyGo Trivy provides Go SDK including three interfaces. Your own module needs to implement either or both Analyzer and PostScanner in addition to Module . type Module interface { Version () int Name () string } type Analyzer interface { RequiredFiles () [] string Analyze ( filePath string ) ( * serialize . AnalysisResult , error ) } type PostScanner interface { PostScanSpec () serialize . PostScanSpec PostScan ( serialize . Results ) ( serialize . Results , error ) } In the following tutorial, it creates a WordPress module that detects a WordPress version and a critical vulnerability accordingly. Tips You can use logging functions such as Debug and Info for debugging. See examples for the detail. Initialize your module Replace the repository name with yours. $ go mod init github.com/aquasecurity/trivy-module-wordpress Module interface Version() returns your module version and should be incremented after updates. Name() returns your module name. package main const ( version = 1 name = \"wordpress-module\" ) type WordpressModule struct { // Cannot define fields as modules can't keep state. } func ( WordpressModule ) Version () int { return version } func ( WordpressModule ) Name () string { return name } Info A struct cannot have any fields. Each method invocation is performed in different states. Analyzer interface If you implement the Analyzer interface, Analyze method is called when the file path is matched to file patterns returned by RequiredFiles() . A file pattern must be a regular expression. The syntax detail is here . Analyze takes the matched file path, then the file can be opened by os.Open() . const typeWPVersion = \"wordpress-version\" func ( WordpressModule ) RequiredFiles () [] string { return [] string { `wp-includes\\/version.php` , } } func ( WordpressModule ) Analyze ( filePath string ) ( * serialize . AnalysisResult , error ) { f , err := os . Open ( filePath ) // e.g. filePath: /usr/src/wordpress/wp-includes/version.php if err != nil { return nil , err } defer f . Close () var wpVersion string scanner := bufio . NewScanner ( f ) for scanner . Scan () { line := scanner . Text () if ! strings . HasPrefix ( line , \"$wp_version=\" ) { continue } ss := strings . Split ( line , \"=\" ) if len ( ss ) != 2 { return nil , fmt . Errorf ( \"invalid wordpress version: %s\" , line ) } // NOTE: it is an example; you actually need to handle comments, etc ss [ 1 ] = strings . TrimSpace ( ss [ 1 ]) wpVersion = strings . Trim ( ss [ 1 ], `\";` ) } if err = scanner . Err (); err != nil { return nil , err } return & serialize . AnalysisResult { CustomResources : [] serialize . CustomResource { { Type : typeWPVersion , FilePath : filePath , Data : wpVersion , }, }, }, nil } Tips Trivy caches analysis results according to the module version. We'd recommend cleaning the cache or changing the module version every time you update Analyzer . PostScanner interface PostScan is called after scanning and takes the scan result as an argument from Trivy. In post scanning, your module can perform one of three actions: Insert Add a new security finding e.g. Add a new vulnerability and misconfiguration Update Update the detected vulnerability and misconfiguration e.g. Change a severity Delete Delete the detected vulnerability and misconfiguration e.g. Remove Spring4Shell because it is not actually affected. PostScanSpec() returns which action the module does. If it is Update or Delete , it also needs to return IDs such as CVE-ID and misconfiguration ID, which your module wants to update or delete. serialize.Results contains the filtered results matching IDs you specified. Also, it includes CustomResources with the values your Analyze returns, so you can modify the scan result according to the custom resources. func ( WordpressModule ) PostScanSpec () serialize . PostScanSpec { return serialize . PostScanSpec { Action : api . ActionInsert , // Add new vulnerabilities } } func ( WordpressModule ) PostScan ( results serialize . Results ) ( serialize . Results , error ) { // e.g. results // [ // { // \"Target\": \"\", // \"Class\": \"custom\", // \"CustomResources\": [ // { // \"Type\": \"wordpress-version\", // \"FilePath\": \"/usr/src/wordpress/wp-includes/version.php\", // \"Layer\": { // \"DiffID\": \"sha256:057649e61046e02c975b84557c03c6cca095b8c9accd3bd20eb4e432f7aec887\" // }, // \"Data\": \"5.7.1\" // } // ] // } // ] var wpVersion int for _ , result := range results { if result . Class != types . ClassCustom { continue } for _ , c := range result . CustomResources { if c . Type != typeWPVersion { continue } wpVersion = c . Data .( string ) wasm . Info ( fmt . Sprintf ( \"WordPress Version: %s\" , wpVersion )) ... snip ... if affectedVersion . Check ( ver ) { vulnerable = true } break } } if vulnerable { // Add CVE-2020-36326 results = append ( results , serialize . Result { Target : wpPath , Class : types . ClassLangPkg , Type : \"wordpress\" , Vulnerabilities : [] types . DetectedVulnerability { { VulnerabilityID : \"CVE-2020-36326\" , PkgName : \"wordpress\" , InstalledVersion : wpVersion , FixedVersion : \"5.7.2\" , Vulnerability : dbTypes . Vulnerability { Title : \"PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname.\" , Severity : \"CRITICAL\" , }, }, }, }) } return results , nil } The new vulnerability will be added to the scan results. This example shows how the module inserts a new finding. If you are interested in Update , you can see an example of Spring4Shell . In the Delete action, PostScan needs to return results you want to delete. If PostScan returns an empty, Trivy will not delete anything. Build Follow the install guide and install TinyGo. $ tinygo build -o wordpress.wasm -scheduler = none -target = wasi --no-debug wordpress.go Put the built binary to the module directory that is under the home directory by default. $ mkdir -p ~/.trivy/modules $ cp spring4shell.wasm ~/.trivy/modules Distribute Your Module You can distribute your own module in OCI registries. Please follow the oras installation instruction . oras push ghcr.io/aquasecurity/trivy-module-wordpress:latest wordpress.wasm:application/vnd.module.wasm.content.layer.v1+wasm Uploading 3daa3dac086b wordpress.wasm Pushed ghcr.io/aquasecurity/trivy-module-wordpress:latest Digest: sha256:6416d0199d66ce52ced19f01d75454b22692ff3aa7737e45f7a189880840424f Examples Spring4Shell WordPress","title":"Modules"},{"location":"docs/advanced/modules/#modules","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy provides a module feature to allow others to extend the Trivy CLI without the need to change the Trivy code base. It changes the behavior during scanning by WebAssembly.","title":"Modules"},{"location":"docs/advanced/modules/#overview","text":"Trivy modules are add-on tools that integrate seamlessly with Trivy. They provide a way to extend the core feature set of Trivy, but without updating the Trivy binary. They can be added and removed from a Trivy installation without impacting the core Trivy tool. They can be written in any programming language supporting WebAssembly. It supports only TinyGo at the moment. You can write your own detection logic. Evaluate complex vulnerability conditions like Spring4Shell Detect a shell script communicating with malicious domains Detect malicious python install script (setup.py) Even detect misconfigurations in WordPress setting etc. Then, you can update the scan result however you want. Change a severity Remove a vulnerability Add a new vulnerability etc. Modules should be distributed in OCI registries like GitHub Container Registry. Warning WebAssembly doesn't allow file access and network access by default. Modules can read required files only, but cannot overwrite them. WebAssembly is sandboxed and secure by design, but Trivy modules available in public are not audited for security. You should install and run third-party modules at your own risk even though Under the hood Trivy leverages wazero to run WebAssembly modules without CGO.","title":"Overview"},{"location":"docs/advanced/modules/#installing-a-module","text":"A module can be installed using the trivy module install command. This command takes an url. It will download the module and install it in the module cache. Trivy adheres to the XDG specification, so the location depends on whether XDG_DATA_HOME is set. Trivy will now search XDG_DATA_HOME for the location of the Trivy modules cache. The preference order is as follows: XDG_DATA_HOME if set and .trivy/plugins exists within the XDG_DATA_HOME dir $HOME/.trivy/plugins For example, to download the WebAssembly module, you can execute the following command: $ trivy module install ghcr.io/aquasecurity/trivy-module-spring4shell","title":"Installing a Module"},{"location":"docs/advanced/modules/#using-modules","text":"Once the module is installed, Trivy will load all available modules in the cache on the start of the next Trivy execution. The modules may inject custom logic into scanning and change the result. You can run Trivy as usual and modules are loaded automatically. You will see the log messages about WASM modules. $ trivy image ghcr.io/aquasecurity/trivy-test-images:spring4shell-jre8 2022 -06-12T12:57:13.210+0300 INFO Loading ghcr.io/aquasecurity/trivy-module-spring4shell/spring4shell.wasm... 2022 -06-12T12:57:13.596+0300 INFO Registering WASM module: spring4shell@v1 ... 2022 -06-12T12:57:14.865+0300 INFO Module spring4shell: Java Version: 8 , Tomcat Version: 8 .5.77 2022 -06-12T12:57:14.865+0300 INFO Module spring4shell: change CVE-2022-22965 severity from CRITICAL to LOW Java ( jar ) Total: 9 ( UNKNOWN: 1 , LOW: 3 , MEDIUM: 2 , HIGH: 3 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 org.springframework.boot:spring-boot ( helloworld.war ) \u2502 CVE-2022-22965 \u2502 LOW \u2502 2 .6.3 \u2502 2 .5.12, 2 .6.6 \u2502 spring-framework: RCE via Data Binding on JDK 9 + \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-22965 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 ... ( snip ) ... In the above example, the Spring4Shell module changed the severity from CRITICAL to LOW because the application doesn't satisfy one of conditions.","title":"Using Modules"},{"location":"docs/advanced/modules/#uninstalling-modules","text":"Specify a module repository with trivy module uninstall command. $ trivy module uninstall ghcr.io/aquasecurity/trivy-module-spring4shell","title":"Uninstalling Modules"},{"location":"docs/advanced/modules/#building-modules","text":"It supports TinyGo only at the moment.","title":"Building Modules"},{"location":"docs/advanced/modules/#tinygo","text":"Trivy provides Go SDK including three interfaces. Your own module needs to implement either or both Analyzer and PostScanner in addition to Module . type Module interface { Version () int Name () string } type Analyzer interface { RequiredFiles () [] string Analyze ( filePath string ) ( * serialize . AnalysisResult , error ) } type PostScanner interface { PostScanSpec () serialize . PostScanSpec PostScan ( serialize . Results ) ( serialize . Results , error ) } In the following tutorial, it creates a WordPress module that detects a WordPress version and a critical vulnerability accordingly. Tips You can use logging functions such as Debug and Info for debugging. See examples for the detail.","title":"TinyGo"},{"location":"docs/advanced/modules/#initialize-your-module","text":"Replace the repository name with yours. $ go mod init github.com/aquasecurity/trivy-module-wordpress","title":"Initialize your module"},{"location":"docs/advanced/modules/#module-interface","text":"Version() returns your module version and should be incremented after updates. Name() returns your module name. package main const ( version = 1 name = \"wordpress-module\" ) type WordpressModule struct { // Cannot define fields as modules can't keep state. } func ( WordpressModule ) Version () int { return version } func ( WordpressModule ) Name () string { return name } Info A struct cannot have any fields. Each method invocation is performed in different states.","title":"Module interface"},{"location":"docs/advanced/modules/#analyzer-interface","text":"If you implement the Analyzer interface, Analyze method is called when the file path is matched to file patterns returned by RequiredFiles() . A file pattern must be a regular expression. The syntax detail is here . Analyze takes the matched file path, then the file can be opened by os.Open() . const typeWPVersion = \"wordpress-version\" func ( WordpressModule ) RequiredFiles () [] string { return [] string { `wp-includes\\/version.php` , } } func ( WordpressModule ) Analyze ( filePath string ) ( * serialize . AnalysisResult , error ) { f , err := os . Open ( filePath ) // e.g. filePath: /usr/src/wordpress/wp-includes/version.php if err != nil { return nil , err } defer f . Close () var wpVersion string scanner := bufio . NewScanner ( f ) for scanner . Scan () { line := scanner . Text () if ! strings . HasPrefix ( line , \"$wp_version=\" ) { continue } ss := strings . Split ( line , \"=\" ) if len ( ss ) != 2 { return nil , fmt . Errorf ( \"invalid wordpress version: %s\" , line ) } // NOTE: it is an example; you actually need to handle comments, etc ss [ 1 ] = strings . TrimSpace ( ss [ 1 ]) wpVersion = strings . Trim ( ss [ 1 ], `\";` ) } if err = scanner . Err (); err != nil { return nil , err } return & serialize . AnalysisResult { CustomResources : [] serialize . CustomResource { { Type : typeWPVersion , FilePath : filePath , Data : wpVersion , }, }, }, nil } Tips Trivy caches analysis results according to the module version. We'd recommend cleaning the cache or changing the module version every time you update Analyzer .","title":"Analyzer interface"},{"location":"docs/advanced/modules/#postscanner-interface","text":"PostScan is called after scanning and takes the scan result as an argument from Trivy. In post scanning, your module can perform one of three actions: Insert Add a new security finding e.g. Add a new vulnerability and misconfiguration Update Update the detected vulnerability and misconfiguration e.g. Change a severity Delete Delete the detected vulnerability and misconfiguration e.g. Remove Spring4Shell because it is not actually affected. PostScanSpec() returns which action the module does. If it is Update or Delete , it also needs to return IDs such as CVE-ID and misconfiguration ID, which your module wants to update or delete. serialize.Results contains the filtered results matching IDs you specified. Also, it includes CustomResources with the values your Analyze returns, so you can modify the scan result according to the custom resources. func ( WordpressModule ) PostScanSpec () serialize . PostScanSpec { return serialize . PostScanSpec { Action : api . ActionInsert , // Add new vulnerabilities } } func ( WordpressModule ) PostScan ( results serialize . Results ) ( serialize . Results , error ) { // e.g. results // [ // { // \"Target\": \"\", // \"Class\": \"custom\", // \"CustomResources\": [ // { // \"Type\": \"wordpress-version\", // \"FilePath\": \"/usr/src/wordpress/wp-includes/version.php\", // \"Layer\": { // \"DiffID\": \"sha256:057649e61046e02c975b84557c03c6cca095b8c9accd3bd20eb4e432f7aec887\" // }, // \"Data\": \"5.7.1\" // } // ] // } // ] var wpVersion int for _ , result := range results { if result . Class != types . ClassCustom { continue } for _ , c := range result . CustomResources { if c . Type != typeWPVersion { continue } wpVersion = c . Data .( string ) wasm . Info ( fmt . Sprintf ( \"WordPress Version: %s\" , wpVersion )) ... snip ... if affectedVersion . Check ( ver ) { vulnerable = true } break } } if vulnerable { // Add CVE-2020-36326 results = append ( results , serialize . Result { Target : wpPath , Class : types . ClassLangPkg , Type : \"wordpress\" , Vulnerabilities : [] types . DetectedVulnerability { { VulnerabilityID : \"CVE-2020-36326\" , PkgName : \"wordpress\" , InstalledVersion : wpVersion , FixedVersion : \"5.7.2\" , Vulnerability : dbTypes . Vulnerability { Title : \"PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname.\" , Severity : \"CRITICAL\" , }, }, }, }) } return results , nil } The new vulnerability will be added to the scan results. This example shows how the module inserts a new finding. If you are interested in Update , you can see an example of Spring4Shell . In the Delete action, PostScan needs to return results you want to delete. If PostScan returns an empty, Trivy will not delete anything.","title":"PostScanner interface"},{"location":"docs/advanced/modules/#build","text":"Follow the install guide and install TinyGo. $ tinygo build -o wordpress.wasm -scheduler = none -target = wasi --no-debug wordpress.go Put the built binary to the module directory that is under the home directory by default. $ mkdir -p ~/.trivy/modules $ cp spring4shell.wasm ~/.trivy/modules","title":"Build"},{"location":"docs/advanced/modules/#distribute-your-module","text":"You can distribute your own module in OCI registries. Please follow the oras installation instruction . oras push ghcr.io/aquasecurity/trivy-module-wordpress:latest wordpress.wasm:application/vnd.module.wasm.content.layer.v1+wasm Uploading 3daa3dac086b wordpress.wasm Pushed ghcr.io/aquasecurity/trivy-module-wordpress:latest Digest: sha256:6416d0199d66ce52ced19f01d75454b22692ff3aa7737e45f7a189880840424f","title":"Distribute Your Module"},{"location":"docs/advanced/modules/#examples","text":"Spring4Shell WordPress","title":"Examples"},{"location":"docs/advanced/plugins/","text":"Plugins Trivy provides a plugin feature to allow others to extend the Trivy CLI without the need to change the Trivycode base. This plugin system was inspired by the plugin system used in kubectl , Helm , and Conftest . Overview Trivy plugins are add-on tools that integrate seamlessly with Trivy. They provide a way to extend the core feature set of Trivy, but without requiring every new feature to be written in Go and added to the core tool. They can be added and removed from a Trivy installation without impacting the core Trivy tool. They can be written in any programming language. They integrate with Trivy, and will show up in Trivy help and subcommands. Warning Trivy plugins available in public are not audited for security. You should install and run third-party plugins at your own risk, since they are arbitrary programs running on your machine. Installing a Plugin A plugin can be installed using the trivy plugin install command. This command takes a url and will download the plugin and install it in the plugin cache. Trivy adheres to the XDG specification, so the location depends on whether XDG_DATA_HOME is set. Trivy will now search XDG_DATA_HOME for the location of the Trivy plugins cache. The preference order is as follows: XDG_DATA_HOME if set and .trivy/plugins exists within the XDG_DATA_HOME dir ~/.trivy/plugins Under the hood Trivy leverages go-getter to download plugins. This means the following protocols are supported for downloading plugins: OCI Registries Local Files Git HTTP/HTTPS Mercurial Amazon S3 Google Cloud Storage For example, to download the Kubernetes Trivy plugin you can execute the following command: $ trivy plugin install github.com/aquasecurity/trivy-plugin-kubectl Also, Trivy plugin can be installed from a local archive: $ trivy plugin install myplugin.tar.gz Using Plugins Once the plugin is installed, Trivy will load all available plugins in the cache on the start of the next Trivy execution. A plugin will be made in the Trivy CLI based on the plugin name. To display all plugins, you can list them by trivy --help $ trivy --help NAME: trivy - A simple and comprehensive vulnerability scanner for containers USAGE: trivy [ global options ] command [ command options ] target VERSION: dev COMMANDS: image, i scan an image filesystem, fs scan local filesystem repository, repo scan remote repository client, c client mode server, s server mode plugin, p manage plugins kubectl scan kubectl resources help, h Shows a list of commands or help for one command As shown above, kubectl subcommand exists in the COMMANDS section. To call the kubectl plugin and scan existing Kubernetes deployments, you can execute the following command: $ trivy kubectl deployment <deployment-id> -- --ignore-unfixed --severity CRITICAL Internally the kubectl plugin calls the kubectl binary to fetch information about that deployment and passes the using images to Trivy. You can see the detail here . If you want to omit even the subcommand, you can use TRIVY_RUN_AS_PLUGIN environment variable. $ TRIVY_RUN_AS_PLUGIN = kubectl trivy job your-job -- --format json Installing and Running Plugins on the fly trivy plugin run installs a plugin and runs it on the fly. If the plugin is already present in the cache, the installation is skipped. trivy plugin run github.com/aquasecurity/trivy-plugin-kubectl pod your-pod -- --exit-code 1 Uninstalling Plugins Specify a plugin name with trivy plugin uninstall command. $ trivy plugin uninstall kubectl Building Plugins Each plugin has a top-level directory, and then a plugin.yaml file. your-plugin/ | | - plugin.yaml | - your-plugin.sh In the example above, the plugin is contained inside of a directory named your-plugin . It has two files: plugin.yaml (required) and an executable script, your-plugin.sh (optional). The core of a plugin is a simple YAML file named plugin.yaml. Here is an example YAML of trivy-plugin-kubectl plugin that adds support for Kubernetes scanning. name : \"kubectl\" repository : github.com/aquasecurity/trivy-plugin-kubectl version : \"0.1.0\" usage : scan kubectl resources description : |- A Trivy plugin that scans the images of a kubernetes resource. Usage: trivy kubectl TYPE[.VERSION][.GROUP] NAME platforms : - selector : # optional os : darwin arch : amd64 uri : ./trivy-kubectl # where the execution file is (local file, http, git, etc.) bin : ./trivy-kubectl # path to the execution file - selector : # optional os : linux arch : amd64 uri : https://github.com/aquasecurity/trivy-plugin-kubectl/releases/download/v0.1.0/trivy-kubectl.tar.gz bin : ./trivy-kubectl The plugin.yaml field should contain the following information: name: The name of the plugin. This also determines how the plugin will be made available in the Trivy CLI. For example, if the plugin is named kubectl, you can call the plugin with trivy kubectl . (required) version: The version of the plugin. (required) usage: A short usage description. (required) description: A long description of the plugin. This is where you could provide a helpful documentation of your plugin. (required) platforms: (required) selector: The OS/Architecture specific variations of a execution file. (optional) os: OS information based on GOOS (linux, darwin, etc.) (optional) arch: The architecture information based on GOARCH (amd64, arm64, etc.) (optional) uri: Where the executable file is. Relative path from the root directory of the plugin or remote URL such as HTTP and S3. (required) bin: Which file to call when the plugin is executed. Relative path from the root directory of the plugin. (required) The following rules will apply in deciding which platform to select: If both os and arch under selector match the current platform, search will stop and the platform will be used. If selector is not present, the platform will be used. If os matches and there is no more specific arch match, the platform will be used. If no platform match is found, Trivy will exit with an error. After determining platform, Trivy will download the execution file from uri and store it in the plugin cache. When the plugin is called via Trivy CLI, bin command will be executed. The plugin is responsible for handling flags and arguments. Any arguments are passed to the plugin from the trivy command. A plugin should be archived *.tar.gz . $ tar -czvf myplugin.tar.gz plugin.yaml script.py plugin.yaml script.py $ trivy plugin install myplugin.tar.gz 2023 -03-03T19:04:42.026+0600 INFO Installing the plugin from myplugin.tar.gz... 2023 -03-03T19:04:42.026+0600 INFO Loading the plugin metadata... $ trivy myplugin Hello from Trivy demo plugin! Example https://github.com/aquasecurity/trivy-plugin-kubectl","title":"Plugins"},{"location":"docs/advanced/plugins/#plugins","text":"Trivy provides a plugin feature to allow others to extend the Trivy CLI without the need to change the Trivycode base. This plugin system was inspired by the plugin system used in kubectl , Helm , and Conftest .","title":"Plugins"},{"location":"docs/advanced/plugins/#overview","text":"Trivy plugins are add-on tools that integrate seamlessly with Trivy. They provide a way to extend the core feature set of Trivy, but without requiring every new feature to be written in Go and added to the core tool. They can be added and removed from a Trivy installation without impacting the core Trivy tool. They can be written in any programming language. They integrate with Trivy, and will show up in Trivy help and subcommands. Warning Trivy plugins available in public are not audited for security. You should install and run third-party plugins at your own risk, since they are arbitrary programs running on your machine.","title":"Overview"},{"location":"docs/advanced/plugins/#installing-a-plugin","text":"A plugin can be installed using the trivy plugin install command. This command takes a url and will download the plugin and install it in the plugin cache. Trivy adheres to the XDG specification, so the location depends on whether XDG_DATA_HOME is set. Trivy will now search XDG_DATA_HOME for the location of the Trivy plugins cache. The preference order is as follows: XDG_DATA_HOME if set and .trivy/plugins exists within the XDG_DATA_HOME dir ~/.trivy/plugins Under the hood Trivy leverages go-getter to download plugins. This means the following protocols are supported for downloading plugins: OCI Registries Local Files Git HTTP/HTTPS Mercurial Amazon S3 Google Cloud Storage For example, to download the Kubernetes Trivy plugin you can execute the following command: $ trivy plugin install github.com/aquasecurity/trivy-plugin-kubectl Also, Trivy plugin can be installed from a local archive: $ trivy plugin install myplugin.tar.gz","title":"Installing a Plugin"},{"location":"docs/advanced/plugins/#using-plugins","text":"Once the plugin is installed, Trivy will load all available plugins in the cache on the start of the next Trivy execution. A plugin will be made in the Trivy CLI based on the plugin name. To display all plugins, you can list them by trivy --help $ trivy --help NAME: trivy - A simple and comprehensive vulnerability scanner for containers USAGE: trivy [ global options ] command [ command options ] target VERSION: dev COMMANDS: image, i scan an image filesystem, fs scan local filesystem repository, repo scan remote repository client, c client mode server, s server mode plugin, p manage plugins kubectl scan kubectl resources help, h Shows a list of commands or help for one command As shown above, kubectl subcommand exists in the COMMANDS section. To call the kubectl plugin and scan existing Kubernetes deployments, you can execute the following command: $ trivy kubectl deployment <deployment-id> -- --ignore-unfixed --severity CRITICAL Internally the kubectl plugin calls the kubectl binary to fetch information about that deployment and passes the using images to Trivy. You can see the detail here . If you want to omit even the subcommand, you can use TRIVY_RUN_AS_PLUGIN environment variable. $ TRIVY_RUN_AS_PLUGIN = kubectl trivy job your-job -- --format json","title":"Using Plugins"},{"location":"docs/advanced/plugins/#installing-and-running-plugins-on-the-fly","text":"trivy plugin run installs a plugin and runs it on the fly. If the plugin is already present in the cache, the installation is skipped. trivy plugin run github.com/aquasecurity/trivy-plugin-kubectl pod your-pod -- --exit-code 1","title":"Installing and Running Plugins on the fly"},{"location":"docs/advanced/plugins/#uninstalling-plugins","text":"Specify a plugin name with trivy plugin uninstall command. $ trivy plugin uninstall kubectl","title":"Uninstalling Plugins"},{"location":"docs/advanced/plugins/#building-plugins","text":"Each plugin has a top-level directory, and then a plugin.yaml file. your-plugin/ | | - plugin.yaml | - your-plugin.sh In the example above, the plugin is contained inside of a directory named your-plugin . It has two files: plugin.yaml (required) and an executable script, your-plugin.sh (optional). The core of a plugin is a simple YAML file named plugin.yaml. Here is an example YAML of trivy-plugin-kubectl plugin that adds support for Kubernetes scanning. name : \"kubectl\" repository : github.com/aquasecurity/trivy-plugin-kubectl version : \"0.1.0\" usage : scan kubectl resources description : |- A Trivy plugin that scans the images of a kubernetes resource. Usage: trivy kubectl TYPE[.VERSION][.GROUP] NAME platforms : - selector : # optional os : darwin arch : amd64 uri : ./trivy-kubectl # where the execution file is (local file, http, git, etc.) bin : ./trivy-kubectl # path to the execution file - selector : # optional os : linux arch : amd64 uri : https://github.com/aquasecurity/trivy-plugin-kubectl/releases/download/v0.1.0/trivy-kubectl.tar.gz bin : ./trivy-kubectl The plugin.yaml field should contain the following information: name: The name of the plugin. This also determines how the plugin will be made available in the Trivy CLI. For example, if the plugin is named kubectl, you can call the plugin with trivy kubectl . (required) version: The version of the plugin. (required) usage: A short usage description. (required) description: A long description of the plugin. This is where you could provide a helpful documentation of your plugin. (required) platforms: (required) selector: The OS/Architecture specific variations of a execution file. (optional) os: OS information based on GOOS (linux, darwin, etc.) (optional) arch: The architecture information based on GOARCH (amd64, arm64, etc.) (optional) uri: Where the executable file is. Relative path from the root directory of the plugin or remote URL such as HTTP and S3. (required) bin: Which file to call when the plugin is executed. Relative path from the root directory of the plugin. (required) The following rules will apply in deciding which platform to select: If both os and arch under selector match the current platform, search will stop and the platform will be used. If selector is not present, the platform will be used. If os matches and there is no more specific arch match, the platform will be used. If no platform match is found, Trivy will exit with an error. After determining platform, Trivy will download the execution file from uri and store it in the plugin cache. When the plugin is called via Trivy CLI, bin command will be executed. The plugin is responsible for handling flags and arguments. Any arguments are passed to the plugin from the trivy command. A plugin should be archived *.tar.gz . $ tar -czvf myplugin.tar.gz plugin.yaml script.py plugin.yaml script.py $ trivy plugin install myplugin.tar.gz 2023 -03-03T19:04:42.026+0600 INFO Installing the plugin from myplugin.tar.gz... 2023 -03-03T19:04:42.026+0600 INFO Loading the plugin metadata... $ trivy myplugin Hello from Trivy demo plugin!","title":"Building Plugins"},{"location":"docs/advanced/plugins/#example","text":"https://github.com/aquasecurity/trivy-plugin-kubectl","title":"Example"},{"location":"docs/advanced/container/embed-in-dockerfile/","text":"Embed in Dockerfile Scan your image as part of the build process by embedding Trivy in the Dockerfile. This approach can be used to update Dockerfiles currently using Aqua\u2019s Microscanner . $ cat Dockerfile FROM alpine:3.7 RUN apk add curl \\ && curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin \\ && trivy rootfs --exit-code 1 --no-progress / $ docker build -t vulnerable-image . Alternatively you can use Trivy in a multistage build. Thus avoiding the insecure curl | sh . Also the image is not changed. [ ... ] # Run vulnerability scan on build image FROM build AS vulnscan COPY --from = aquasec/trivy:latest /usr/local/bin/trivy /usr/local/bin/trivy RUN trivy rootfs --exit-code 1 --no-progress / [ ... ]","title":"Embed in Dockerfile"},{"location":"docs/advanced/container/embed-in-dockerfile/#embed-in-dockerfile","text":"Scan your image as part of the build process by embedding Trivy in the Dockerfile. This approach can be used to update Dockerfiles currently using Aqua\u2019s Microscanner . $ cat Dockerfile FROM alpine:3.7 RUN apk add curl \\ && curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin \\ && trivy rootfs --exit-code 1 --no-progress / $ docker build -t vulnerable-image . Alternatively you can use Trivy in a multistage build. Thus avoiding the insecure curl | sh . Also the image is not changed. [ ... ] # Run vulnerability scan on build image FROM build AS vulnscan COPY --from = aquasec/trivy:latest /usr/local/bin/trivy /usr/local/bin/trivy RUN trivy rootfs --exit-code 1 --no-progress / [ ... ]","title":"Embed in Dockerfile"},{"location":"docs/advanced/container/unpacked-filesystem/","text":"Unpacked Filesystem Scan an unpacked container image filesystem. In this case, Trivy works the same way when scanning containers $ docker export $( docker create alpine:3.10.2 ) | tar -C /tmp/rootfs -xvf - $ trivy rootfs /tmp/rootfs Result 2021 -03-08T05:22:26.378Z INFO Need to update DB 2021 -03-08T05:22:26.380Z INFO Downloading DB... 20 .37 MiB / 20 .37 MiB [ ------------------------------------------------------------------------------------------------------------------------------------- ] 100 .00% 8 .24 MiB p/s 2s 2021 -03-08T05:22:30.134Z INFO Detecting Alpine vulnerabilities... /tmp/rootfs ( alpine 3 .10.2 ) =========================== Total: 20 ( UNKNOWN: 0 , LOW: 2 , MEDIUM: 10 , HIGH: 8 , CRITICAL: 0 ) +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | libcrypto1.1 | CVE-2020-1967 | HIGH | 1 .1.1c-r0 | 1 .1.1g-r0 | openssl: Segmentation | | | | | | | fault in SSL_check_chain | | | | | | | causes denial of service | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1967 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2021-23839 | | | 1 .1.1j-r0 | openssl: incorrect SSLv2 | | | | | | | rollback protection | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23839 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23840 | | | | openssl: integer | | | | | | | overflow in CipherUpdate | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23840 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23841 | | | | openssl: NULL pointer dereference | | | | | | | in X509_issuer_and_serial_hash () | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23841 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1547 | MEDIUM | | 1 .1.1d-r0 | openssl: side-channel weak | | | | | | | encryption vulnerability | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1547 | + +------------------+ + + +---------------------------------------+ | | CVE-2019-1549 | | | | openssl: information | | | | | | | disclosure in fork () | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1549 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2019-1551 | | | 1 .1.1d-r2 | openssl: Integer overflow in RSAZ | | | | | | | modular exponentiation on x86_64 | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1551 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2020-1971 | | | 1 .1.1i-r0 | openssl: EDIPARTYNAME | | | | | | | NULL pointer de-reference | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1971 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1563 | LOW | | 1 .1.1d-r0 | openssl: information | | | | | | | disclosure in PKCS7_dataDecode | | | | | | | and CMS_decrypt_set1_pkey | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1563 | +--------------+------------------+----------+ +---------------+---------------------------------------+ | libssl1.1 | CVE-2020-1967 | HIGH | | 1 .1.1g-r0 | openssl: Segmentation | | | | | | | fault in SSL_check_chain | | | | | | | causes denial of service | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1967 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2021-23839 | | | 1 .1.1j-r0 | openssl: incorrect SSLv2 | | | | | | | rollback protection | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23839 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23840 | | | | openssl: integer | | | | | | | overflow in CipherUpdate | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23840 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23841 | | | | openssl: NULL pointer dereference | | | | | | | in X509_issuer_and_serial_hash () | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23841 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1547 | MEDIUM | | 1 .1.1d-r0 | openssl: side-channel weak | | | | | | | encryption vulnerability | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1547 | + +------------------+ + + +---------------------------------------+ | | CVE-2019-1549 | | | | openssl: information | | | | | | | disclosure in fork () | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1549 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2019-1551 | | | 1 .1.1d-r2 | openssl: Integer overflow in RSAZ | | | | | | | modular exponentiation on x86_64 | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1551 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2020-1971 | | | 1 .1.1i-r0 | openssl: EDIPARTYNAME | | | | | | | NULL pointer de-reference | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1971 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1563 | LOW | | 1 .1.1d-r0 | openssl: information | | | | | | | disclosure in PKCS7_dataDecode | | | | | | | and CMS_decrypt_set1_pkey | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1563 | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | musl | CVE-2020-28928 | MEDIUM | 1 .1.22-r3 | 1 .1.22-r4 | In musl libc through 1 .2.1, | | | | | | | wcsnrtombs mishandles particular | | | | | | | combinations of destination buffer... | | | | | | | -->avd.aquasec.com/nvd/cve-2020-28928 | +--------------+ + + + + + | musl-utils | | | | | | | | | | | | | | | | | | | | | | | | | | | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+","title":"Unpacked container image filesystem"},{"location":"docs/advanced/container/unpacked-filesystem/#unpacked-filesystem","text":"Scan an unpacked container image filesystem. In this case, Trivy works the same way when scanning containers $ docker export $( docker create alpine:3.10.2 ) | tar -C /tmp/rootfs -xvf - $ trivy rootfs /tmp/rootfs Result 2021 -03-08T05:22:26.378Z INFO Need to update DB 2021 -03-08T05:22:26.380Z INFO Downloading DB... 20 .37 MiB / 20 .37 MiB [ ------------------------------------------------------------------------------------------------------------------------------------- ] 100 .00% 8 .24 MiB p/s 2s 2021 -03-08T05:22:30.134Z INFO Detecting Alpine vulnerabilities... /tmp/rootfs ( alpine 3 .10.2 ) =========================== Total: 20 ( UNKNOWN: 0 , LOW: 2 , MEDIUM: 10 , HIGH: 8 , CRITICAL: 0 ) +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | libcrypto1.1 | CVE-2020-1967 | HIGH | 1 .1.1c-r0 | 1 .1.1g-r0 | openssl: Segmentation | | | | | | | fault in SSL_check_chain | | | | | | | causes denial of service | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1967 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2021-23839 | | | 1 .1.1j-r0 | openssl: incorrect SSLv2 | | | | | | | rollback protection | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23839 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23840 | | | | openssl: integer | | | | | | | overflow in CipherUpdate | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23840 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23841 | | | | openssl: NULL pointer dereference | | | | | | | in X509_issuer_and_serial_hash () | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23841 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1547 | MEDIUM | | 1 .1.1d-r0 | openssl: side-channel weak | | | | | | | encryption vulnerability | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1547 | + +------------------+ + + +---------------------------------------+ | | CVE-2019-1549 | | | | openssl: information | | | | | | | disclosure in fork () | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1549 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2019-1551 | | | 1 .1.1d-r2 | openssl: Integer overflow in RSAZ | | | | | | | modular exponentiation on x86_64 | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1551 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2020-1971 | | | 1 .1.1i-r0 | openssl: EDIPARTYNAME | | | | | | | NULL pointer de-reference | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1971 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1563 | LOW | | 1 .1.1d-r0 | openssl: information | | | | | | | disclosure in PKCS7_dataDecode | | | | | | | and CMS_decrypt_set1_pkey | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1563 | +--------------+------------------+----------+ +---------------+---------------------------------------+ | libssl1.1 | CVE-2020-1967 | HIGH | | 1 .1.1g-r0 | openssl: Segmentation | | | | | | | fault in SSL_check_chain | | | | | | | causes denial of service | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1967 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2021-23839 | | | 1 .1.1j-r0 | openssl: incorrect SSLv2 | | | | | | | rollback protection | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23839 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23840 | | | | openssl: integer | | | | | | | overflow in CipherUpdate | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23840 | + +------------------+ + + +---------------------------------------+ | | CVE-2021-23841 | | | | openssl: NULL pointer dereference | | | | | | | in X509_issuer_and_serial_hash () | | | | | | | -->avd.aquasec.com/nvd/cve-2021-23841 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1547 | MEDIUM | | 1 .1.1d-r0 | openssl: side-channel weak | | | | | | | encryption vulnerability | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1547 | + +------------------+ + + +---------------------------------------+ | | CVE-2019-1549 | | | | openssl: information | | | | | | | disclosure in fork () | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1549 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2019-1551 | | | 1 .1.1d-r2 | openssl: Integer overflow in RSAZ | | | | | | | modular exponentiation on x86_64 | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1551 | + +------------------+ + +---------------+---------------------------------------+ | | CVE-2020-1971 | | | 1 .1.1i-r0 | openssl: EDIPARTYNAME | | | | | | | NULL pointer de-reference | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1971 | + +------------------+----------+ +---------------+---------------------------------------+ | | CVE-2019-1563 | LOW | | 1 .1.1d-r0 | openssl: information | | | | | | | disclosure in PKCS7_dataDecode | | | | | | | and CMS_decrypt_set1_pkey | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1563 | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | musl | CVE-2020-28928 | MEDIUM | 1 .1.22-r3 | 1 .1.22-r4 | In musl libc through 1 .2.1, | | | | | | | wcsnrtombs mishandles particular | | | | | | | combinations of destination buffer... | | | | | | | -->avd.aquasec.com/nvd/cve-2020-28928 | +--------------+ + + + + + | musl-utils | | | | | | | | | | | | | | | | | | | | | | | | | | | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+","title":"Unpacked Filesystem"},{"location":"docs/advanced/private-registries/","text":"Trivy can download images from a private registry without the need for installing Docker or any other 3rd party tools. This makes it easy to run within a CI process. Credential To use Trivy with private images, simply install it and provide your credentials: $ TRIVY_USERNAME = YOUR_USERNAME TRIVY_PASSWORD = YOUR_PASSWORD trivy image YOUR_PRIVATE_IMAGE Trivy also supports providing credentials through CLI flags: $ TRIVY_PASSWORD = YOUR_PASSWORD trivy image --username YOUR_USERNAME YOUR_PRIVATE_IMAGE Warning The CLI flag --password is available, but its use is not recommended for security reasons. You can also store your credentials in trivy.yaml . For more information, please refer to the documentation . It can handle multiple sets of credentials as well: $ export TRIVY_USERNAME = USERNAME1,USERNAME2 $ export TRIVY_PASSWORD = PASSWORD1,PASSWORD2 $ trivy image YOUR_PRIVATE_IMAGE In the example above, Trivy attempts to use two pairs of credentials: USERNAME1/PASSWORD1 USERNAME2/PASSWORD2 Please note that the number of usernames and passwords must be the same. docker login If you have Docker configured locally and have set up the credentials, Trivy can access them. $ docker login ghcr.io Username: Password: $ trivy image ghcr.io/your/private_image Note docker login can be used with any container runtime, such as Podman.","title":"Overview"},{"location":"docs/advanced/private-registries/#credential","text":"To use Trivy with private images, simply install it and provide your credentials: $ TRIVY_USERNAME = YOUR_USERNAME TRIVY_PASSWORD = YOUR_PASSWORD trivy image YOUR_PRIVATE_IMAGE Trivy also supports providing credentials through CLI flags: $ TRIVY_PASSWORD = YOUR_PASSWORD trivy image --username YOUR_USERNAME YOUR_PRIVATE_IMAGE Warning The CLI flag --password is available, but its use is not recommended for security reasons. You can also store your credentials in trivy.yaml . For more information, please refer to the documentation . It can handle multiple sets of credentials as well: $ export TRIVY_USERNAME = USERNAME1,USERNAME2 $ export TRIVY_PASSWORD = PASSWORD1,PASSWORD2 $ trivy image YOUR_PRIVATE_IMAGE In the example above, Trivy attempts to use two pairs of credentials: USERNAME1/PASSWORD1 USERNAME2/PASSWORD2 Please note that the number of usernames and passwords must be the same.","title":"Credential"},{"location":"docs/advanced/private-registries/#docker-login","text":"If you have Docker configured locally and have set up the credentials, Trivy can access them. $ docker login ghcr.io Username: Password: $ trivy image ghcr.io/your/private_image Note docker login can be used with any container runtime, such as Podman.","title":"docker login"},{"location":"docs/advanced/private-registries/acr/","text":"Requirements None, Trivy uses Azure SDK for Go. You don't need to install az command. Privileges Service principal must have the AcrPull permissions. Creation of a service principal export SP_DATA = $( az ad sp create-for-rbac --name TrivyTest --role AcrPull --scope \"/subscriptions/<subscription_id>/resourceGroups/<resource_group>/providers/Microsoft.ContainerRegistry/registries/<registry_name>\" ) Usage # must set TRIVY_USERNAME empty char export AZURE_CLIENT_ID = $( echo $SP_DATA | jq -r '.appId' ) export AZURE_CLIENT_SECRET = $( echo $SP_DATA | jq -r '.password' ) export AZURE_TENANT_ID = $( echo $SP_DATA | jq -r '.tenant' ) Testing You can test credentials in the following manner. docker run -it --rm -v /tmp:/tmp \\ -e AZURE_CLIENT_ID -e AZURE_CLIENT_SECRET -e AZURE_TENANT_ID \\ aquasec/trivy image your_special_project.azurecr.io/your_special_image:your_special_tag","title":"ACR (Azure Container Registry)"},{"location":"docs/advanced/private-registries/acr/#requirements","text":"None, Trivy uses Azure SDK for Go. You don't need to install az command.","title":"Requirements"},{"location":"docs/advanced/private-registries/acr/#privileges","text":"Service principal must have the AcrPull permissions.","title":"Privileges"},{"location":"docs/advanced/private-registries/acr/#creation-of-a-service-principal","text":"export SP_DATA = $( az ad sp create-for-rbac --name TrivyTest --role AcrPull --scope \"/subscriptions/<subscription_id>/resourceGroups/<resource_group>/providers/Microsoft.ContainerRegistry/registries/<registry_name>\" )","title":"Creation of a service principal"},{"location":"docs/advanced/private-registries/acr/#usage","text":"# must set TRIVY_USERNAME empty char export AZURE_CLIENT_ID = $( echo $SP_DATA | jq -r '.appId' ) export AZURE_CLIENT_SECRET = $( echo $SP_DATA | jq -r '.password' ) export AZURE_TENANT_ID = $( echo $SP_DATA | jq -r '.tenant' )","title":"Usage"},{"location":"docs/advanced/private-registries/acr/#testing","text":"You can test credentials in the following manner. docker run -it --rm -v /tmp:/tmp \\ -e AZURE_CLIENT_ID -e AZURE_CLIENT_SECRET -e AZURE_TENANT_ID \\ aquasec/trivy image your_special_project.azurecr.io/your_special_image:your_special_tag","title":"Testing"},{"location":"docs/advanced/private-registries/docker-hub/","text":"See here for the detail. You don't need to provide a credential when download from public repository.","title":"Docker Hub"},{"location":"docs/advanced/private-registries/ecr/","text":"Trivy uses AWS SDK. You don't need to install aws CLI tool. You can use AWS CLI's ENV Vars . AWS private registry permissions You may need to grant permissions to allow Trivy to pull images from private ECR. It depends on how you want to provide AWS Role to trivy. IAM Role Service account Kube2iam or Kiam IAM Role Service account Add the AWS role in trivy's service account annotations: trivy : serviceAccount : annotations : {} # eks.amazonaws.com/role-arn: arn:aws:iam::ACCOUNT_ID:role/IAM_ROLE_NAME Kube2iam or Kiam Add the AWS role to pod's annotations: podAnnotations : {} ## kube2iam/kiam annotation # iam.amazonaws.com/role: arn:aws:iam::ACCOUNT_ID:role/IAM_ROLE_NAME","title":"AWS ECR (Elastic Container Registry)"},{"location":"docs/advanced/private-registries/ecr/#aws-private-registry-permissions","text":"You may need to grant permissions to allow Trivy to pull images from private ECR. It depends on how you want to provide AWS Role to trivy. IAM Role Service account Kube2iam or Kiam","title":"AWS private registry permissions"},{"location":"docs/advanced/private-registries/ecr/#iam-role-service-account","text":"Add the AWS role in trivy's service account annotations: trivy : serviceAccount : annotations : {} # eks.amazonaws.com/role-arn: arn:aws:iam::ACCOUNT_ID:role/IAM_ROLE_NAME","title":"IAM Role Service account"},{"location":"docs/advanced/private-registries/ecr/#kube2iam-or-kiam","text":"Add the AWS role to pod's annotations: podAnnotations : {} ## kube2iam/kiam annotation # iam.amazonaws.com/role: arn:aws:iam::ACCOUNT_ID:role/IAM_ROLE_NAME","title":"Kube2iam or Kiam"},{"location":"docs/advanced/private-registries/gcr/","text":"Requirements None, Trivy uses Google Cloud SDK. You don't need to install gcloud command. Privileges Credential file must have the roles/storage.objectViewer permissions. More information can be found in Google's documentation JSON File Format The JSON file specified should have the following format provided by google's service account mechanisms: { \"type\" : \"service_account\" , \"project_id\" : \"your_special_project\" , \"private_key_id\" : \"XXXXXXXXXXXXXXXXXXXXxx\" , \"private_key\" : \"-----BEGIN PRIVATE KEY-----\\nNONONONO\\n-----END PRIVATE KEY-----\\n\" , \"client_email\" : \"somedude@your_special_project.iam.gserviceaccount.com\" , \"client_id\" : \"1234567890\" , \"auth_uri\" : \"https://accounts.google.com/o/oauth2/auth\" , \"token_uri\" : \"https://oauth2.googleapis.com/token\" , \"auth_provider_x509_cert_url\" : \"https://www.googleapis.com/oauth2/v1/certs\" , \"client_x509_cert_url\" : \"https://www.googleapis.com/robot/v1/metadata/x509/somedude%40your_special_project.iam.gserviceaccount.com\" } Usage If you want to use target project's repository, you can set them via GOOGLE_APPLICATION_CREDENTIALS . # must set TRIVY_USERNAME empty char export GOOGLE_APPLICATION_CREDENTIALS = /path/to/credential.json Testing You can test credentials in the following manner (assuming they are in /tmp on host machine). docker run -it --rm -v /tmp:/tmp \\ -e GOOGLE_APPLICATION_CREDENTIALS = /tmp/service_account.json \\ aquasec/trivy image gcr.io/your_special_project/your_special_image:your_special_tag","title":"GCR (Google Container Registry)"},{"location":"docs/advanced/private-registries/gcr/#requirements","text":"None, Trivy uses Google Cloud SDK. You don't need to install gcloud command.","title":"Requirements"},{"location":"docs/advanced/private-registries/gcr/#privileges","text":"Credential file must have the roles/storage.objectViewer permissions. More information can be found in Google's documentation","title":"Privileges"},{"location":"docs/advanced/private-registries/gcr/#json-file-format","text":"The JSON file specified should have the following format provided by google's service account mechanisms: { \"type\" : \"service_account\" , \"project_id\" : \"your_special_project\" , \"private_key_id\" : \"XXXXXXXXXXXXXXXXXXXXxx\" , \"private_key\" : \"-----BEGIN PRIVATE KEY-----\\nNONONONO\\n-----END PRIVATE KEY-----\\n\" , \"client_email\" : \"somedude@your_special_project.iam.gserviceaccount.com\" , \"client_id\" : \"1234567890\" , \"auth_uri\" : \"https://accounts.google.com/o/oauth2/auth\" , \"token_uri\" : \"https://oauth2.googleapis.com/token\" , \"auth_provider_x509_cert_url\" : \"https://www.googleapis.com/oauth2/v1/certs\" , \"client_x509_cert_url\" : \"https://www.googleapis.com/robot/v1/metadata/x509/somedude%40your_special_project.iam.gserviceaccount.com\" }","title":"JSON File Format"},{"location":"docs/advanced/private-registries/gcr/#usage","text":"If you want to use target project's repository, you can set them via GOOGLE_APPLICATION_CREDENTIALS . # must set TRIVY_USERNAME empty char export GOOGLE_APPLICATION_CREDENTIALS = /path/to/credential.json","title":"Usage"},{"location":"docs/advanced/private-registries/gcr/#testing","text":"You can test credentials in the following manner (assuming they are in /tmp on host machine). docker run -it --rm -v /tmp:/tmp \\ -e GOOGLE_APPLICATION_CREDENTIALS = /tmp/service_account.json \\ aquasec/trivy image gcr.io/your_special_project/your_special_image:your_special_tag","title":"Testing"},{"location":"docs/advanced/private-registries/self/","text":"BasicAuth server needs TRIVY_USERNAME and TRIVY_PASSWORD . export TRIVY_USERNAME ={ USERNAME } export TRIVY_PASSWORD ={ PASSWORD } # if you want to use 80 port, use NonSSL export TRIVY_NON_SSL = true","title":"Self-Hosted"},{"location":"docs/compliance/compliance/","text":"Compliance Reports EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy\u2019s compliance flag lets you curate a specific set of checks into a report. In a typical Trivy scan, there are hundreds of different checks for many different components and configurations, but sometimes you already know which specific checks you are interested in. Often this would be an industry accepted set of checks such as CIS, or some vendor specific guideline, or your own organization policy that you want to comply with. These are all possible using the flexible compliance infrastructure that's built into Trivy. Compliance reports are defined as simple YAML documents that select checks to include in the report. Usage Compliance report is currently supported in the following targets (trivy sub-commands): trivy image trivy aws trivy k8s Add the --compliance flag to the command line, and set it's value to desired report. For example: trivy k8s cluster --compliance k8s-nsa (see below for built-in and custom reports) Options The following flags are compatible with --compliance flag and allows customizing it's output: flag effect --report summary shows a summary of the results. for every control shows the number of failed checks. --report all shows fully detailed results. for every control shows where it failed and why. --format table shows results in textual table format (good for human readability). --format json shows results in json format (good for machine readability). Built-in compliance Trivy has a number of built-in compliance reports that you can asses right out of the box. to specify a built-in compliance report, select it by ID like trivy --compliance <compliance_id> . For the list of built-in compliance reports, please see the relevant section: Docker compliance Kubernetes compliance AWS compliance Custom compliance You can create your own custom compliance report. A compliance report is a simple YAML document in the following format: spec : id : \"k8s-myreport\" # report unique identifier. this should not container spaces. title : \"My custom Kubernetes report\" # report title. Any one-line title. description : \"Describe your report\" # description of the report. Any text. relatedResources : - https://some.url # useful references. URLs only. version : \"1.0\" # spec version (string) controls : - name : \"Non-root containers\" # Name for the control (appears in the report as is). Any one-line name. description : 'Check that container is not running as root' # Description (appears in the report as is). Any text. id : \"1.0\" # control identifier (string) checks : # list of existing Trivy checks that define the control - id : AVD-KSV-0012 # check ID. Must start with `AVD-` or `CVE-` severity : \"MEDIUM\" # Severity for the control (note that checks severity isn't used) - name : \"Immutable container file systems\" description : 'Check that container root file system is immutable' id : \"1.1\" checks : - id : AVD-KSV-0014 severity : \"LOW\" The check id field ( controls[].checks[].id ) is referring to existing check by it's \"AVD ID\". This AVD ID is easily located in the check's source code metadata header, or by browsing Aqua vulnerability DB , specifically in the Misconfigurations and Vulnerabilities sections. Once you have a compliance spec, you can select it by file path: trivy --compliance @</path/to/compliance.yaml> (note the @ indicating file path instead of report id).","title":"Reports"},{"location":"docs/compliance/compliance/#compliance-reports","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy\u2019s compliance flag lets you curate a specific set of checks into a report. In a typical Trivy scan, there are hundreds of different checks for many different components and configurations, but sometimes you already know which specific checks you are interested in. Often this would be an industry accepted set of checks such as CIS, or some vendor specific guideline, or your own organization policy that you want to comply with. These are all possible using the flexible compliance infrastructure that's built into Trivy. Compliance reports are defined as simple YAML documents that select checks to include in the report.","title":"Compliance Reports"},{"location":"docs/compliance/compliance/#usage","text":"Compliance report is currently supported in the following targets (trivy sub-commands): trivy image trivy aws trivy k8s Add the --compliance flag to the command line, and set it's value to desired report. For example: trivy k8s cluster --compliance k8s-nsa (see below for built-in and custom reports)","title":"Usage"},{"location":"docs/compliance/compliance/#options","text":"The following flags are compatible with --compliance flag and allows customizing it's output: flag effect --report summary shows a summary of the results. for every control shows the number of failed checks. --report all shows fully detailed results. for every control shows where it failed and why. --format table shows results in textual table format (good for human readability). --format json shows results in json format (good for machine readability).","title":"Options"},{"location":"docs/compliance/compliance/#built-in-compliance","text":"Trivy has a number of built-in compliance reports that you can asses right out of the box. to specify a built-in compliance report, select it by ID like trivy --compliance <compliance_id> . For the list of built-in compliance reports, please see the relevant section: Docker compliance Kubernetes compliance AWS compliance","title":"Built-in compliance"},{"location":"docs/compliance/compliance/#custom-compliance","text":"You can create your own custom compliance report. A compliance report is a simple YAML document in the following format: spec : id : \"k8s-myreport\" # report unique identifier. this should not container spaces. title : \"My custom Kubernetes report\" # report title. Any one-line title. description : \"Describe your report\" # description of the report. Any text. relatedResources : - https://some.url # useful references. URLs only. version : \"1.0\" # spec version (string) controls : - name : \"Non-root containers\" # Name for the control (appears in the report as is). Any one-line name. description : 'Check that container is not running as root' # Description (appears in the report as is). Any text. id : \"1.0\" # control identifier (string) checks : # list of existing Trivy checks that define the control - id : AVD-KSV-0012 # check ID. Must start with `AVD-` or `CVE-` severity : \"MEDIUM\" # Severity for the control (note that checks severity isn't used) - name : \"Immutable container file systems\" description : 'Check that container root file system is immutable' id : \"1.1\" checks : - id : AVD-KSV-0014 severity : \"LOW\" The check id field ( controls[].checks[].id ) is referring to existing check by it's \"AVD ID\". This AVD ID is easily located in the check's source code metadata header, or by browsing Aqua vulnerability DB , specifically in the Misconfigurations and Vulnerabilities sections. Once you have a compliance spec, you can select it by file path: trivy --compliance @</path/to/compliance.yaml> (note the @ indicating file path instead of report id).","title":"Custom compliance"},{"location":"docs/configuration/","text":"Configuration Trivy can be configured using the following ways. Each item takes precedence over the item below it: CLI flags Environment variables Configuration file CLI Flags You can view the list of available flags using the --help option. For more details, please refer to the CLI reference . Environment Variables Trivy can be customized by environment variables. The environment variable key is the flag name converted by the following procedure. Add TRIVY_ prefix Make it all uppercase Replace - with _ For example, --debug => TRIVY_DEBUG --cache-dir => TRIVY_CACHE_DIR $ TRIVY_DEBUG=true TRIVY_SEVERITY=CRITICAL trivy image alpine:3.15 Configuration File By default, Trivy reads the trivy.yaml file. For more details, please refer to the page .","title":"Overview"},{"location":"docs/configuration/#configuration","text":"Trivy can be configured using the following ways. Each item takes precedence over the item below it: CLI flags Environment variables Configuration file","title":"Configuration"},{"location":"docs/configuration/#cli-flags","text":"You can view the list of available flags using the --help option. For more details, please refer to the CLI reference .","title":"CLI Flags"},{"location":"docs/configuration/#environment-variables","text":"Trivy can be customized by environment variables. The environment variable key is the flag name converted by the following procedure. Add TRIVY_ prefix Make it all uppercase Replace - with _ For example, --debug => TRIVY_DEBUG --cache-dir => TRIVY_CACHE_DIR $ TRIVY_DEBUG=true TRIVY_SEVERITY=CRITICAL trivy image alpine:3.15","title":"Environment Variables"},{"location":"docs/configuration/#configuration-file","text":"By default, Trivy reads the trivy.yaml file. For more details, please refer to the page .","title":"Configuration File"},{"location":"docs/configuration/cache/","text":"Cache The cache directory includes Vulnerability Database 1 Java Index Database 2 Misconfiguration Policies 3 Cache of previous scans. The cache option is common to all scanners. Clear Caches The --clear-cache option removes caches. The scan is not performed. $ trivy image --clear-cache Result 2019-11-15T15:13:26.209+0200 INFO Reopening vulnerability DB 2019-11-15T15:13:26.209+0200 INFO Removing image caches... Cache Directory Specify where the cache is stored with --cache-dir . $ trivy --cache-dir /tmp/trivy/ image python:3.4-alpine3.9 Cache Backend EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy supports local filesystem and Redis as the cache backend. This option is useful especially for client/server mode. Two options: fs the cache path can be specified by --cache-dir redis:// redis://[HOST]:[PORT] TTL can be configured via --cache-ttl $ trivy server --cache-backend redis://localhost:6379 If you want to use TLS with Redis, you can enable it by specifying the --redis-tls flag. $ trivy server --cache-backend redis://localhost:6379 --redis-tls Trivy also supports for connecting to Redis with your certificates. You need to specify --redis-ca , --redis-cert , and --redis-key options. $ trivy server --cache-backend redis://localhost:6379 \\ --redis-ca /path/to/ca-cert.pem \\ --redis-cert /path/to/cert.pem \\ --redis-key /path/to/key.pem Downloaded when scanning for vulnerabilities \u21a9 Downloaded when scanning jar/war/par/ear files \u21a9 Downloaded when scanning for misconfigurations \u21a9","title":"Cache"},{"location":"docs/configuration/cache/#cache","text":"The cache directory includes Vulnerability Database 1 Java Index Database 2 Misconfiguration Policies 3 Cache of previous scans. The cache option is common to all scanners.","title":"Cache"},{"location":"docs/configuration/cache/#clear-caches","text":"The --clear-cache option removes caches. The scan is not performed. $ trivy image --clear-cache Result 2019-11-15T15:13:26.209+0200 INFO Reopening vulnerability DB 2019-11-15T15:13:26.209+0200 INFO Removing image caches...","title":"Clear Caches"},{"location":"docs/configuration/cache/#cache-directory","text":"Specify where the cache is stored with --cache-dir . $ trivy --cache-dir /tmp/trivy/ image python:3.4-alpine3.9","title":"Cache Directory"},{"location":"docs/configuration/cache/#cache-backend","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy supports local filesystem and Redis as the cache backend. This option is useful especially for client/server mode. Two options: fs the cache path can be specified by --cache-dir redis:// redis://[HOST]:[PORT] TTL can be configured via --cache-ttl $ trivy server --cache-backend redis://localhost:6379 If you want to use TLS with Redis, you can enable it by specifying the --redis-tls flag. $ trivy server --cache-backend redis://localhost:6379 --redis-tls Trivy also supports for connecting to Redis with your certificates. You need to specify --redis-ca , --redis-cert , and --redis-key options. $ trivy server --cache-backend redis://localhost:6379 \\ --redis-ca /path/to/ca-cert.pem \\ --redis-cert /path/to/cert.pem \\ --redis-key /path/to/key.pem Downloaded when scanning for vulnerabilities \u21a9 Downloaded when scanning jar/war/par/ear files \u21a9 Downloaded when scanning for misconfigurations \u21a9","title":"Cache Backend"},{"location":"docs/configuration/db/","text":"DB Scanner Supported Vulnerability \u2713 Misconfiguration Secret License The vulnerability database and the Java index database are needed only for vulnerability scanning. See here for the detail. Vulnerability Database Skip update of vulnerability DB If you want to skip downloading the vulnerability database, use the --skip-db-update option. $ trivy image --skip-db-update python:3.4-alpine3.9 Result 2019-05-16T12:48:08.703+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 (alpine 3.9.2) =================================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+--------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+--------------------------------+ | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 | | | | | | | with long nonces | +---------+------------------+----------+-------------------+---------------+--------------------------------+ Only download vulnerability database You can also ask Trivy to simply retrieve the vulnerability database. This is useful to initialize workers in Continuous Integration systems. $ trivy image --download-db-only DB Repository Trivy could also download the vulnerability database from an external OCI registry by using --db-repository option. $ trivy image --db-repository registry.gitlab.com/gitlab-org/security-products/dependencies/trivy-db Java Index Database The same options are also available for the Java index DB, which is used for scanning Java applications. Skipping an update can be done by using the --skip-java-db-update option, while --download-java-db-only can be used to only download the Java index DB. Downloading the Java index DB from an external OCI registry can be done by using the --java-db-repository option. $ trivy image --java-db-repository registry.gitlab.com/gitlab-org/security-products/dependencies/trivy-java-db --download-java-db-only Note In Client/Server mode, Java index DB is currently only used on the client side. Remove DBs The --reset flag removes all caches and databases. $ trivy image --reset","title":"DB"},{"location":"docs/configuration/db/#db","text":"Scanner Supported Vulnerability \u2713 Misconfiguration Secret License The vulnerability database and the Java index database are needed only for vulnerability scanning. See here for the detail.","title":"DB"},{"location":"docs/configuration/db/#vulnerability-database","text":"","title":"Vulnerability Database"},{"location":"docs/configuration/db/#skip-update-of-vulnerability-db","text":"If you want to skip downloading the vulnerability database, use the --skip-db-update option. $ trivy image --skip-db-update python:3.4-alpine3.9 Result 2019-05-16T12:48:08.703+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 (alpine 3.9.2) =================================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+--------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+--------------------------------+ | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 | | | | | | | with long nonces | +---------+------------------+----------+-------------------+---------------+--------------------------------+","title":"Skip update of vulnerability DB"},{"location":"docs/configuration/db/#only-download-vulnerability-database","text":"You can also ask Trivy to simply retrieve the vulnerability database. This is useful to initialize workers in Continuous Integration systems. $ trivy image --download-db-only","title":"Only download vulnerability database"},{"location":"docs/configuration/db/#db-repository","text":"Trivy could also download the vulnerability database from an external OCI registry by using --db-repository option. $ trivy image --db-repository registry.gitlab.com/gitlab-org/security-products/dependencies/trivy-db","title":"DB Repository"},{"location":"docs/configuration/db/#java-index-database","text":"The same options are also available for the Java index DB, which is used for scanning Java applications. Skipping an update can be done by using the --skip-java-db-update option, while --download-java-db-only can be used to only download the Java index DB. Downloading the Java index DB from an external OCI registry can be done by using the --java-db-repository option. $ trivy image --java-db-repository registry.gitlab.com/gitlab-org/security-products/dependencies/trivy-java-db --download-java-db-only Note In Client/Server mode, Java index DB is currently only used on the client side.","title":"Java Index Database"},{"location":"docs/configuration/db/#remove-dbs","text":"The --reset flag removes all caches and databases. $ trivy image --reset","title":"Remove DBs"},{"location":"docs/configuration/filtering/","text":"Filtering Trivy provides various methods for filtering the results. By Status Scanner Supported Vulnerability \u2713 Misconfiguration Secret License Trivy supports the following vulnerability statuses: unknown not_affected : this package is not affected by this vulnerability on this platform affected : this package is affected by this vulnerability on this platform, but there is no patch released yet fixed : this vulnerability is fixed on this platform under_investigation : it is currently unknown whether or not this vulnerability affects this package on this platform, and it is under investigation will_not_fix : this package is affected by this vulnerability on this platform, but there is currently no intention to fix it (this would primarily be for flaws that are of Low or Moderate impact that pose no significant risk to customers) fix_deferred : this package is affected by this vulnerability on this platform, and may be fixed in the future end_of_life : this package has been identified to contain the impacted component, but analysis to determine whether it is affected or not by this vulnerability was not performed Note that vulnerabilities with the unknown , not_affected or under_investigation status are not detected. These are only defined for comprehensiveness, and you will not have the opportunity to specify these statuses. Some statuses are supported in limited distributions. OS Fixed Affected Under Investigation Will Not Fix Fix Deferred End of Life Debian \u2713 \u2713 \u2713 \u2713 RHEL \u2713 \u2713 \u2713 \u2713 \u2713 \u2713 Other OSes \u2713 \u2713 To ignore vulnerabilities with specific statuses, use the --ignore-status <list_of_statuses> option. $ trivy image --ignore-status affected,fixed ruby:2.4.0 Result 2019-05-16T12:50:14.786+0900 INFO Detecting Debian vulnerabilities... ruby:2.4.0 (debian 8.7) ======================= Total: 527 (UNKNOWN: 0, LOW: 276, MEDIUM: 83, HIGH: 158, CRITICAL: 10) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Status \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 binutils \u2502 CVE-2014-9939 \u2502 CRITICAL \u2502 will_not_fix \u2502 2.25-5 \u2502 \u2502 binutils: buffer overflow in ihex.c \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2014-9939 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2017-6969 \u2502 \u2502 \u2502 \u2502 \u2502 binutils: Heap-based buffer over-read in readelf when \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 processing corrupt RL78 binaries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2017-6969 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 ... Tip To skip all unfixed vulnerabilities, you can use the --ignore-unfixed flag . It is a shorthand of --ignore-status affected,will_not_fix,fix_deferred,end_of_life . It displays \"fixed\" vulnerabilities only. $ trivy image --ignore-unfixed ruby:2.4.0 By Severity Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 Use --severity option. $ trivy image --severity HIGH,CRITICAL ruby:2.4.0 Result 2019 -05-16T01:51:46.255+0900 INFO Updating vulnerability database... 2019 -05-16T01:51:49.213+0900 INFO Detecting Debian vulnerabilities... ruby:2.4.0 ( debian 8 .7 ) ======================= Total: 1785 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 1680 , CRITICAL: 105 ) +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ | apt | CVE-2019-3462 | CRITICAL | 1 .0.9.8.3 | 1 .0.9.8.5 | Incorrect sanitation of the | | | | | | | 302 redirect field in HTTP | | | | | | | transport method of... | +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ | bash | CVE-2019-9924 | HIGH | 4 .3-11 | 4 .3-11+deb8u2 | bash: BASH_CMD is writable in | | | | | | | restricted bash shells | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2016-7543 | | | 4 .3-11+deb8u1 | bash: Specially crafted | | | | | | | SHELLOPTS+PS4 variables allows | | | | | | | command substitution | +-----------------------------+------------------+ +---------------------------+----------------------------------+-------------------------------------------------+ | binutils | CVE-2017-8421 | | 2 .25-5 | | binutils: Memory exhaustion in | | | | | | | objdump via a crafted PE file | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2017-14930 | | | | binutils: Memory leak in | | | | | | | decode_line_info | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2017-7614 | | | | binutils: NULL | | | | | | | pointer dereference in | | | | | | | bfd_elf_final_link function | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2014-9939 | | | | binutils: buffer overflow in | | | | | | | ihex.c | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2017-13716 | | | | binutils: Memory leak with the | | | | | | | C++ symbol demangler routine | | | | | | | in libiberty | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2018-12699 | | | | binutils: heap-based buffer | | | | | | | overflow in finish_stab in | | | | | | | stabs.c | +-----------------------------+------------------+ +---------------------------+----------------------------------+-------------------------------------------------+ | bsdutils | CVE-2015-5224 | | 2 .25.2-6 | | util-linux: File name | | | | | | | collision due to incorrect | | | | | | | mkstemp use | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2016-2779 | | | | util-linux: runuser tty hijack | | | | | | | via TIOCSTI ioctl | +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ trivy conf --severity HIGH,CRITICAL examples/misconf/mixed Result 2022 -05-16T13:50:42.718+0100 INFO Detected config files: 3 Dockerfile ( dockerfile ) ======================= Tests: 17 ( SUCCESSES: 16 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 1 , CRITICAL: 0 ) HIGH: Last USER command in Dockerfile should not be 'root' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:3 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 3 [ USER root \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml ( kubernetes ) ============================ Tests: 8 ( SUCCESSES: 8 , FAILURES: 0 , EXCEPTIONS: 0 ) Failures: 0 ( HIGH: 0 , CRITICAL: 0 ) main.tf ( terraform ) =================== Tests: 1 ( SUCCESSES: 0 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 0 , CRITICAL: 1 ) CRITICAL: Classic resources should not be used. \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 AWS Classic resources run in a shared environment with infrastructure owned by other AWS customers. You should run resources in a VPC instead. See https://avd.aquasec.com/misconfig/avd-aws-0081 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 main.tf:2-4 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 2 \u250c resource \"aws_db_security_group\" \"sg\" { 3 \u2502 4 \u2514 } \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 By Finding IDs Trivy supports the .trivyignore and .trivyignore.yaml ignore files. .trivyignore Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License $ cat .trivyignore # Accept the risk CVE-2018-14618 # Accept the risk until 2023-01-01 CVE-2019-14697 exp:2023-01-01 # No impact in our settings CVE-2019-1543 # Ignore misconfigurations AVD-DS-0002 # Ignore secrets generic-unwanted-rule aws-account-id $ trivy image python:3.4-alpine3.9 Result 2019 -05-16T12:53:10.076+0900 INFO Updating vulnerability database... 2019 -05-16T12:53:28.134+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 ( alpine 3 .9.2 ) =================================== Total: 0 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 ) .trivyignore.yaml Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 EXPERIMENTAL This feature might change without preserving backwards compatibility. When the extension of the specified ignore file is either .yml or .yaml , Trivy will load the file as YAML. For the .trivyignore.yaml file, you can set ignored IDs separately for vulnerabilities , misconfigurations , secrets , or licenses 1 . Available fields: Field Required Type Description id \u2713 string The identifier of the vulnerability, misconfiguration, secret, or license 1 . paths string array The list of file paths to be ignored. If paths is not set, the ignore finding is applied to all files. expired_at date ( yyyy-mm-dd ) The expiration date of the ignore finding. If expired_at is not set, the ignore finding is always valid. statement string The reason for ignoring the finding. (This field is not used for filtering.) $ cat .trivyignore.yaml vulnerabilities: - id: CVE-2022-40897 paths: - \"usr/local/lib/python3.9/site-packages/setuptools-58.1.0.dist-info/METADATA\" statement: Accept the risk - id: CVE-2023-2650 - id: CVE-2023-3446 - id: CVE-2023-3817 - id: CVE-2023-29491 expired_at: 2023 -09-01 misconfigurations: - id: AVD-DS-0001 - id: AVD-DS-0002 paths: - \"docs/Dockerfile\" statement: The image needs root privileges secrets: - id: aws-access-key-id - id: aws-secret-access-key paths: - \"foo/bar/aws.secret\" licenses: - id: GPL-3.0 # License name is used as ID paths: - \"usr/share/gcc/python/libstdcxx/v6/__init__.py\" Since this feature is experimental, you must explicitly specify the YAML file path using the --ignorefile flag. Once this functionality is stable, the YAML file will be loaded automatically. $ trivy image --ignorefile ./.trivyignore.yaml python:3.9.16-alpine3.16 Result 2023 -08-31T11:10:27.155+0600 INFO Vulnerability scanning is enabled 2023 -08-31T11:10:27.155+0600 INFO Secret scanning is enabled 2023 -08-31T11:10:27.155+0600 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2023 -08-31T11:10:27.155+0600 INFO Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection 2023 -08-31T11:10:29.164+0600 INFO Detected OS: alpine 2023 -08-31T11:10:29.164+0600 INFO Detecting Alpine vulnerabilities... 2023 -08-31T11:10:29.169+0600 INFO Number of language-specific files: 1 2023 -08-31T11:10:29.170+0600 INFO Detecting python-pkg vulnerabilities... python:3.9.16-alpine3.16 ( alpine 3 .16.5 ) ======================================== Total: 0 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 ) By Vulnerability Target Scanner Supported Vulnerability \u2713 Misconfiguration Secret License Use --vuln-type option. $ trivy image --vuln-type os ruby:2.4.0 Available values: library os Result 2019 -05-22T19:36:50.530+0200 \u001b [ 34mINFO\u001b [ 0m Updating vulnerability database... 2019 -05-22T19:36:51.681+0200 \u001b [ 34mINFO\u001b [ 0m Detecting Alpine vulnerabilities... 2019 -05-22T19:36:51.685+0200 \u001b [ 34mINFO\u001b [ 0m Updating npm Security DB... 2019 -05-22T19:36:52.389+0200 \u001b [ 34mINFO\u001b [ 0m Detecting npm vulnerabilities... 2019 -05-22T19:36:52.390+0200 \u001b [ 34mINFO\u001b [ 0m Updating pipenv Security DB... 2019 -05-22T19:36:53.406+0200 \u001b [ 34mINFO\u001b [ 0m Detecting pipenv vulnerabilities... ruby:2.4.0 ( debian 8 .7 ) ======================= Total: 7 ( UNKNOWN: 0 , LOW: 1 , MEDIUM: 1 , HIGH: 3 , CRITICAL: 2 ) +---------+------------------+----------+-------------------+---------------+----------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | curl | CVE-2018-14618 | CRITICAL | 7 .61.0-r0 | 7 .61.1-r0 | curl: NTLM password overflow | | | | | | | via integer overflow | + +------------------+----------+ +---------------+----------------------------------+ | | CVE-2018-16839 | HIGH | | 7 .61.1-r1 | curl: Integer overflow leading | | | | | | | to heap-based buffer overflow in | | | | | | | Curl_sasl_create_plain_message () | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | git | CVE-2018-17456 | HIGH | 2 .15.2-r0 | 2 .15.3-r0 | git: arbitrary code execution | | | | | | | via .gitmodules | + +------------------+ + + +----------------------------------+ | | CVE-2018-19486 | | | | git: Improper handling of | | | | | | | PATH allows for commands to be | | | | | | | executed from... | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | libssh2 | CVE-2019-3855 | CRITICAL | 1 .8.0-r2 | 1 .8.1-r0 | libssh2: Integer overflow in | | | | | | | transport read resulting in | | | | | | | out of bounds write... | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | sqlite | CVE-2018-20346 | MEDIUM | 3 .21.0-r1 | 3 .25.3-r0 | CVE-2018-20505 CVE-2018-20506 | | | | | | | sqlite: Multiple flaws in | | | | | | | sqlite which can be triggered | | | | | | | via... | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | tar | CVE-2018-20482 | LOW | 1 .29-r1 | 1 .31-r0 | tar: Infinite read loop in | | | | | | | sparse_dump_region function in | | | | | | | sparse.c | +---------+------------------+----------+-------------------+---------------+----------------------------------+ By Open Policy Agent Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy supports Open Policy Agent (OPA) to filter vulnerabilities. You can specify a Rego file with --ignore-policy option. The Rego package name must be trivy and it must include a rule called ignore which determines if each individual vulnerability should be excluded (ignore=true) or not (ignore=false). In the policy, each vulnerability will be available for inspection as the input variable. The structure of each vulnerability input is the same as for the Trivy JSON output. There is a built-in Rego library with helper functions that you can import into your policy using: import data.lib.trivy . For more info about the helper functions, look at the library here To get started, see the example policy . $ trivy image --ignore-policy contrib/example_policy/basic.rego centos:7 Result centos:7 ( centos 7 .9.2009 ) ========================== Total: 9 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 4 , CRITICAL: 5 ) +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | glib2 | CVE-2015-8385 | HIGH | 2 .56.1-7.el7 | | pcre: buffer overflow caused | | | | | | | by named forward reference | | | | | | | to duplicate group number... | | | | | | | -->avd.aquasec.com/nvd/cve-2015-8385 | + +------------------+ + +-------------------+-----------------------------------------+ | | CVE-2016-3191 | | | | pcre: workspace overflow for | | | | | | | ( *ACCEPT ) with deeply nested | | | | | | | parentheses ( 8 .39/13, 10 .22/12 ) | | | | | | | -->avd.aquasec.com/nvd/cve-2016-3191 | + +------------------+ + +-------------------+-----------------------------------------+ | | CVE-2021-27219 | | | 2 .56.1-9.el7_9 | glib: integer overflow in | | | | | | | g_bytes_new function on | | | | | | | 64 -bit platforms due to an... | | | | | | | -->avd.aquasec.com/nvd/cve-2021-27219 | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | glibc | CVE-2019-1010022 | CRITICAL | 2 .17-317.el7 | | glibc: stack guard protection bypass | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1010022 | +--------------+ + + +-------------------+ + | glibc-common | | | | | | | | | | | | | +--------------+------------------+ +-------------------+-------------------+-----------------------------------------+ | nss | CVE-2021-43527 | | 3 .53.1-3.el7_9 | 3 .67.0-4.el7_9 | nss: Memory corruption in | | | | | | | decodeECorDsaSignature with | | | | | | | DSA signatures ( and RSA-PSS ) | | | | | | | -->avd.aquasec.com/nvd/cve-2021-43527 | +--------------+ + + + + + | nss-sysinit | | | | | | | | | | | | | | | | | | | | | | | | | | | +--------------+ + + + + + | nss-tools | | | | | | | | | | | | | | | | | | | | | | | | | | | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | openssl-libs | CVE-2020-1971 | HIGH | 1 :1.0.2k-19.el7 | 1 :1.0.2k-21.el7_9 | openssl: EDIPARTYNAME | | | | | | | NULL pointer de-reference | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1971 | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ By Inline Comments Scanner Supported Vulnerability Misconfiguration \u2713 Secret License Some configuration file formats (e.g. Terraform) support inline comments. In cases where trivy can detect comments of a specific format immediately adjacent to resource definitions, it is possible to filter/ignore findings from a single point of resource definition (in contrast to .trivyignore , which has a directory-wide scope on all of the files scanned). The format for these comments is trivy:ignore:<Vulnerability ID> immediately following the format-specific line-comment token. For example, to filter a Vulnerability ID \"AVD-GCP-0051\" in a Terraform HCL file: #trivy:ignore:AVD-GCP-0051 resource \"google_container_cluster\" \"one_off_test\" { name = var.cluster_name location = var.region } license name is used as id for .trivyignore.yaml files \u21a9 \u21a9","title":"Filtering"},{"location":"docs/configuration/filtering/#filtering","text":"Trivy provides various methods for filtering the results.","title":"Filtering"},{"location":"docs/configuration/filtering/#by-status","text":"Scanner Supported Vulnerability \u2713 Misconfiguration Secret License Trivy supports the following vulnerability statuses: unknown not_affected : this package is not affected by this vulnerability on this platform affected : this package is affected by this vulnerability on this platform, but there is no patch released yet fixed : this vulnerability is fixed on this platform under_investigation : it is currently unknown whether or not this vulnerability affects this package on this platform, and it is under investigation will_not_fix : this package is affected by this vulnerability on this platform, but there is currently no intention to fix it (this would primarily be for flaws that are of Low or Moderate impact that pose no significant risk to customers) fix_deferred : this package is affected by this vulnerability on this platform, and may be fixed in the future end_of_life : this package has been identified to contain the impacted component, but analysis to determine whether it is affected or not by this vulnerability was not performed Note that vulnerabilities with the unknown , not_affected or under_investigation status are not detected. These are only defined for comprehensiveness, and you will not have the opportunity to specify these statuses. Some statuses are supported in limited distributions. OS Fixed Affected Under Investigation Will Not Fix Fix Deferred End of Life Debian \u2713 \u2713 \u2713 \u2713 RHEL \u2713 \u2713 \u2713 \u2713 \u2713 \u2713 Other OSes \u2713 \u2713 To ignore vulnerabilities with specific statuses, use the --ignore-status <list_of_statuses> option. $ trivy image --ignore-status affected,fixed ruby:2.4.0 Result 2019-05-16T12:50:14.786+0900 INFO Detecting Debian vulnerabilities... ruby:2.4.0 (debian 8.7) ======================= Total: 527 (UNKNOWN: 0, LOW: 276, MEDIUM: 83, HIGH: 158, CRITICAL: 10) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Status \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 binutils \u2502 CVE-2014-9939 \u2502 CRITICAL \u2502 will_not_fix \u2502 2.25-5 \u2502 \u2502 binutils: buffer overflow in ihex.c \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2014-9939 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2017-6969 \u2502 \u2502 \u2502 \u2502 \u2502 binutils: Heap-based buffer over-read in readelf when \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 processing corrupt RL78 binaries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2017-6969 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 ... Tip To skip all unfixed vulnerabilities, you can use the --ignore-unfixed flag . It is a shorthand of --ignore-status affected,will_not_fix,fix_deferred,end_of_life . It displays \"fixed\" vulnerabilities only. $ trivy image --ignore-unfixed ruby:2.4.0","title":"By Status"},{"location":"docs/configuration/filtering/#by-severity","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 Use --severity option. $ trivy image --severity HIGH,CRITICAL ruby:2.4.0 Result 2019 -05-16T01:51:46.255+0900 INFO Updating vulnerability database... 2019 -05-16T01:51:49.213+0900 INFO Detecting Debian vulnerabilities... ruby:2.4.0 ( debian 8 .7 ) ======================= Total: 1785 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 1680 , CRITICAL: 105 ) +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ | apt | CVE-2019-3462 | CRITICAL | 1 .0.9.8.3 | 1 .0.9.8.5 | Incorrect sanitation of the | | | | | | | 302 redirect field in HTTP | | | | | | | transport method of... | +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ | bash | CVE-2019-9924 | HIGH | 4 .3-11 | 4 .3-11+deb8u2 | bash: BASH_CMD is writable in | | | | | | | restricted bash shells | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2016-7543 | | | 4 .3-11+deb8u1 | bash: Specially crafted | | | | | | | SHELLOPTS+PS4 variables allows | | | | | | | command substitution | +-----------------------------+------------------+ +---------------------------+----------------------------------+-------------------------------------------------+ | binutils | CVE-2017-8421 | | 2 .25-5 | | binutils: Memory exhaustion in | | | | | | | objdump via a crafted PE file | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2017-14930 | | | | binutils: Memory leak in | | | | | | | decode_line_info | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2017-7614 | | | | binutils: NULL | | | | | | | pointer dereference in | | | | | | | bfd_elf_final_link function | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2014-9939 | | | | binutils: buffer overflow in | | | | | | | ihex.c | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2017-13716 | | | | binutils: Memory leak with the | | | | | | | C++ symbol demangler routine | | | | | | | in libiberty | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2018-12699 | | | | binutils: heap-based buffer | | | | | | | overflow in finish_stab in | | | | | | | stabs.c | +-----------------------------+------------------+ +---------------------------+----------------------------------+-------------------------------------------------+ | bsdutils | CVE-2015-5224 | | 2 .25.2-6 | | util-linux: File name | | | | | | | collision due to incorrect | | | | | | | mkstemp use | + +------------------+ + +----------------------------------+-------------------------------------------------+ | | CVE-2016-2779 | | | | util-linux: runuser tty hijack | | | | | | | via TIOCSTI ioctl | +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+ trivy conf --severity HIGH,CRITICAL examples/misconf/mixed Result 2022 -05-16T13:50:42.718+0100 INFO Detected config files: 3 Dockerfile ( dockerfile ) ======================= Tests: 17 ( SUCCESSES: 16 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 1 , CRITICAL: 0 ) HIGH: Last USER command in Dockerfile should not be 'root' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:3 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 3 [ USER root \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml ( kubernetes ) ============================ Tests: 8 ( SUCCESSES: 8 , FAILURES: 0 , EXCEPTIONS: 0 ) Failures: 0 ( HIGH: 0 , CRITICAL: 0 ) main.tf ( terraform ) =================== Tests: 1 ( SUCCESSES: 0 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 0 , CRITICAL: 1 ) CRITICAL: Classic resources should not be used. \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 AWS Classic resources run in a shared environment with infrastructure owned by other AWS customers. You should run resources in a VPC instead. See https://avd.aquasec.com/misconfig/avd-aws-0081 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 main.tf:2-4 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 2 \u250c resource \"aws_db_security_group\" \"sg\" { 3 \u2502 4 \u2514 } \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500","title":"By Severity"},{"location":"docs/configuration/filtering/#by-finding-ids","text":"Trivy supports the .trivyignore and .trivyignore.yaml ignore files.","title":"By Finding IDs"},{"location":"docs/configuration/filtering/#trivyignore","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License $ cat .trivyignore # Accept the risk CVE-2018-14618 # Accept the risk until 2023-01-01 CVE-2019-14697 exp:2023-01-01 # No impact in our settings CVE-2019-1543 # Ignore misconfigurations AVD-DS-0002 # Ignore secrets generic-unwanted-rule aws-account-id $ trivy image python:3.4-alpine3.9 Result 2019 -05-16T12:53:10.076+0900 INFO Updating vulnerability database... 2019 -05-16T12:53:28.134+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 ( alpine 3 .9.2 ) =================================== Total: 0 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 )","title":".trivyignore"},{"location":"docs/configuration/filtering/#trivyignoreyaml","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 EXPERIMENTAL This feature might change without preserving backwards compatibility. When the extension of the specified ignore file is either .yml or .yaml , Trivy will load the file as YAML. For the .trivyignore.yaml file, you can set ignored IDs separately for vulnerabilities , misconfigurations , secrets , or licenses 1 . Available fields: Field Required Type Description id \u2713 string The identifier of the vulnerability, misconfiguration, secret, or license 1 . paths string array The list of file paths to be ignored. If paths is not set, the ignore finding is applied to all files. expired_at date ( yyyy-mm-dd ) The expiration date of the ignore finding. If expired_at is not set, the ignore finding is always valid. statement string The reason for ignoring the finding. (This field is not used for filtering.) $ cat .trivyignore.yaml vulnerabilities: - id: CVE-2022-40897 paths: - \"usr/local/lib/python3.9/site-packages/setuptools-58.1.0.dist-info/METADATA\" statement: Accept the risk - id: CVE-2023-2650 - id: CVE-2023-3446 - id: CVE-2023-3817 - id: CVE-2023-29491 expired_at: 2023 -09-01 misconfigurations: - id: AVD-DS-0001 - id: AVD-DS-0002 paths: - \"docs/Dockerfile\" statement: The image needs root privileges secrets: - id: aws-access-key-id - id: aws-secret-access-key paths: - \"foo/bar/aws.secret\" licenses: - id: GPL-3.0 # License name is used as ID paths: - \"usr/share/gcc/python/libstdcxx/v6/__init__.py\" Since this feature is experimental, you must explicitly specify the YAML file path using the --ignorefile flag. Once this functionality is stable, the YAML file will be loaded automatically. $ trivy image --ignorefile ./.trivyignore.yaml python:3.9.16-alpine3.16 Result 2023 -08-31T11:10:27.155+0600 INFO Vulnerability scanning is enabled 2023 -08-31T11:10:27.155+0600 INFO Secret scanning is enabled 2023 -08-31T11:10:27.155+0600 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2023 -08-31T11:10:27.155+0600 INFO Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection 2023 -08-31T11:10:29.164+0600 INFO Detected OS: alpine 2023 -08-31T11:10:29.164+0600 INFO Detecting Alpine vulnerabilities... 2023 -08-31T11:10:29.169+0600 INFO Number of language-specific files: 1 2023 -08-31T11:10:29.170+0600 INFO Detecting python-pkg vulnerabilities... python:3.9.16-alpine3.16 ( alpine 3 .16.5 ) ======================================== Total: 0 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 )","title":".trivyignore.yaml"},{"location":"docs/configuration/filtering/#by-vulnerability-target","text":"Scanner Supported Vulnerability \u2713 Misconfiguration Secret License Use --vuln-type option. $ trivy image --vuln-type os ruby:2.4.0 Available values: library os Result 2019 -05-22T19:36:50.530+0200 \u001b [ 34mINFO\u001b [ 0m Updating vulnerability database... 2019 -05-22T19:36:51.681+0200 \u001b [ 34mINFO\u001b [ 0m Detecting Alpine vulnerabilities... 2019 -05-22T19:36:51.685+0200 \u001b [ 34mINFO\u001b [ 0m Updating npm Security DB... 2019 -05-22T19:36:52.389+0200 \u001b [ 34mINFO\u001b [ 0m Detecting npm vulnerabilities... 2019 -05-22T19:36:52.390+0200 \u001b [ 34mINFO\u001b [ 0m Updating pipenv Security DB... 2019 -05-22T19:36:53.406+0200 \u001b [ 34mINFO\u001b [ 0m Detecting pipenv vulnerabilities... ruby:2.4.0 ( debian 8 .7 ) ======================= Total: 7 ( UNKNOWN: 0 , LOW: 1 , MEDIUM: 1 , HIGH: 3 , CRITICAL: 2 ) +---------+------------------+----------+-------------------+---------------+----------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | curl | CVE-2018-14618 | CRITICAL | 7 .61.0-r0 | 7 .61.1-r0 | curl: NTLM password overflow | | | | | | | via integer overflow | + +------------------+----------+ +---------------+----------------------------------+ | | CVE-2018-16839 | HIGH | | 7 .61.1-r1 | curl: Integer overflow leading | | | | | | | to heap-based buffer overflow in | | | | | | | Curl_sasl_create_plain_message () | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | git | CVE-2018-17456 | HIGH | 2 .15.2-r0 | 2 .15.3-r0 | git: arbitrary code execution | | | | | | | via .gitmodules | + +------------------+ + + +----------------------------------+ | | CVE-2018-19486 | | | | git: Improper handling of | | | | | | | PATH allows for commands to be | | | | | | | executed from... | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | libssh2 | CVE-2019-3855 | CRITICAL | 1 .8.0-r2 | 1 .8.1-r0 | libssh2: Integer overflow in | | | | | | | transport read resulting in | | | | | | | out of bounds write... | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | sqlite | CVE-2018-20346 | MEDIUM | 3 .21.0-r1 | 3 .25.3-r0 | CVE-2018-20505 CVE-2018-20506 | | | | | | | sqlite: Multiple flaws in | | | | | | | sqlite which can be triggered | | | | | | | via... | +---------+------------------+----------+-------------------+---------------+----------------------------------+ | tar | CVE-2018-20482 | LOW | 1 .29-r1 | 1 .31-r0 | tar: Infinite read loop in | | | | | | | sparse_dump_region function in | | | | | | | sparse.c | +---------+------------------+----------+-------------------+---------------+----------------------------------+","title":"By Vulnerability Target"},{"location":"docs/configuration/filtering/#by-open-policy-agent","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy supports Open Policy Agent (OPA) to filter vulnerabilities. You can specify a Rego file with --ignore-policy option. The Rego package name must be trivy and it must include a rule called ignore which determines if each individual vulnerability should be excluded (ignore=true) or not (ignore=false). In the policy, each vulnerability will be available for inspection as the input variable. The structure of each vulnerability input is the same as for the Trivy JSON output. There is a built-in Rego library with helper functions that you can import into your policy using: import data.lib.trivy . For more info about the helper functions, look at the library here To get started, see the example policy . $ trivy image --ignore-policy contrib/example_policy/basic.rego centos:7 Result centos:7 ( centos 7 .9.2009 ) ========================== Total: 9 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 4 , CRITICAL: 5 ) +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | glib2 | CVE-2015-8385 | HIGH | 2 .56.1-7.el7 | | pcre: buffer overflow caused | | | | | | | by named forward reference | | | | | | | to duplicate group number... | | | | | | | -->avd.aquasec.com/nvd/cve-2015-8385 | + +------------------+ + +-------------------+-----------------------------------------+ | | CVE-2016-3191 | | | | pcre: workspace overflow for | | | | | | | ( *ACCEPT ) with deeply nested | | | | | | | parentheses ( 8 .39/13, 10 .22/12 ) | | | | | | | -->avd.aquasec.com/nvd/cve-2016-3191 | + +------------------+ + +-------------------+-----------------------------------------+ | | CVE-2021-27219 | | | 2 .56.1-9.el7_9 | glib: integer overflow in | | | | | | | g_bytes_new function on | | | | | | | 64 -bit platforms due to an... | | | | | | | -->avd.aquasec.com/nvd/cve-2021-27219 | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | glibc | CVE-2019-1010022 | CRITICAL | 2 .17-317.el7 | | glibc: stack guard protection bypass | | | | | | | -->avd.aquasec.com/nvd/cve-2019-1010022 | +--------------+ + + +-------------------+ + | glibc-common | | | | | | | | | | | | | +--------------+------------------+ +-------------------+-------------------+-----------------------------------------+ | nss | CVE-2021-43527 | | 3 .53.1-3.el7_9 | 3 .67.0-4.el7_9 | nss: Memory corruption in | | | | | | | decodeECorDsaSignature with | | | | | | | DSA signatures ( and RSA-PSS ) | | | | | | | -->avd.aquasec.com/nvd/cve-2021-43527 | +--------------+ + + + + + | nss-sysinit | | | | | | | | | | | | | | | | | | | | | | | | | | | +--------------+ + + + + + | nss-tools | | | | | | | | | | | | | | | | | | | | | | | | | | | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+ | openssl-libs | CVE-2020-1971 | HIGH | 1 :1.0.2k-19.el7 | 1 :1.0.2k-21.el7_9 | openssl: EDIPARTYNAME | | | | | | | NULL pointer de-reference | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1971 | +--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+","title":"By Open Policy Agent"},{"location":"docs/configuration/filtering/#by-inline-comments","text":"Scanner Supported Vulnerability Misconfiguration \u2713 Secret License Some configuration file formats (e.g. Terraform) support inline comments. In cases where trivy can detect comments of a specific format immediately adjacent to resource definitions, it is possible to filter/ignore findings from a single point of resource definition (in contrast to .trivyignore , which has a directory-wide scope on all of the files scanned). The format for these comments is trivy:ignore:<Vulnerability ID> immediately following the format-specific line-comment token. For example, to filter a Vulnerability ID \"AVD-GCP-0051\" in a Terraform HCL file: #trivy:ignore:AVD-GCP-0051 resource \"google_container_cluster\" \"one_off_test\" { name = var.cluster_name location = var.region } license name is used as id for .trivyignore.yaml files \u21a9 \u21a9","title":"By Inline Comments"},{"location":"docs/configuration/others/","text":"Others Enable/Disable Scanners You can enable/disable scanners with the --scanners flag. Supported values: vuln config secret license For example, container image scanning enables vulnerability and secret scanners by default. If you don't need secret scanning, it can be disabled. $ trivy image --scanners vuln alpine:3.15 Exit Code Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 By default, Trivy exits with code 0 even when security issues are detected. Use the --exit-code option if you want to exit with a non-zero exit code. $ trivy image --exit-code 1 python:3.4-alpine3.9 Result 2019-05-16T12:51:43.500+0900 INFO Updating vulnerability database... 2019-05-16T12:52:00.387+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 (alpine 3.9.2) =================================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+--------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+--------------------------------+ | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 | | | | | | | with long nonces | +---------+------------------+----------+-------------------+---------------+--------------------------------+ This option is useful for CI/CD. In the following example, the test will fail only when a critical vulnerability is found. $ trivy image --exit-code 0 --severity MEDIUM,HIGH ruby:2.4.0 $ trivy image --exit-code 1 --severity CRITICAL ruby:2.4.0 Exit on EOL Scanner Supported Vulnerability \u2713 Misconfiguration Secret License Sometimes you may surprisingly get 0 vulnerabilities in an old image: Enabling --ignore-unfixed option while all packages have no fixed versions. Scanning a rather outdated OS (e.g. Ubuntu 10.04). An OS at the end of service/life (EOL) usually gets into this situation, which is definitely full of vulnerabilities. --exit-on-eol can fail scanning on EOL OS with a non-zero code. This flag is available with the following targets. Container images ( trivy image ) Virtual machine images ( trivy vm ) SBOM ( trivy sbom ) Root filesystem ( trivy rootfs ) $ trivy image --exit-on-eol 1 alpine:3.10 Result 2023-03-01T11:07:15.455+0200 INFO Vulnerability scanning is enabled ... 2023-03-01T11:07:17.938+0200 WARN This OS version is no longer supported by the distribution: alpine 3.10.9 2023-03-01T11:07:17.938+0200 WARN The vulnerability detection may be insufficient because security updates are not provided alpine:3.10 (alpine 3.10.9) =========================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 apk-tools \u2502 CVE-2021-36159 \u2502 CRITICAL \u2502 2.10.6-r0 \u2502 2.10.7-r0 \u2502 libfetch before 2021-07-26, as used in apk-tools, xbps, and \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 other products, mishandles... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-36159 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 2023-03-01T11:07:17.941+0200 ERROR Detected EOL OS: alpine 3.10.9 This option is useful for CI/CD. The following example will fail when a critical vulnerability is found or the OS is EOSL: $ trivy image --exit-code 1 --exit-on-eol 1 --severity CRITICAL alpine:3.16.3","title":"Others"},{"location":"docs/configuration/others/#others","text":"","title":"Others"},{"location":"docs/configuration/others/#enabledisable-scanners","text":"You can enable/disable scanners with the --scanners flag. Supported values: vuln config secret license For example, container image scanning enables vulnerability and secret scanners by default. If you don't need secret scanning, it can be disabled. $ trivy image --scanners vuln alpine:3.15","title":"Enable/Disable Scanners"},{"location":"docs/configuration/others/#exit-code","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 By default, Trivy exits with code 0 even when security issues are detected. Use the --exit-code option if you want to exit with a non-zero exit code. $ trivy image --exit-code 1 python:3.4-alpine3.9 Result 2019-05-16T12:51:43.500+0900 INFO Updating vulnerability database... 2019-05-16T12:52:00.387+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 (alpine 3.9.2) =================================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+--------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+--------------------------------+ | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 | | | | | | | with long nonces | +---------+------------------+----------+-------------------+---------------+--------------------------------+ This option is useful for CI/CD. In the following example, the test will fail only when a critical vulnerability is found. $ trivy image --exit-code 0 --severity MEDIUM,HIGH ruby:2.4.0 $ trivy image --exit-code 1 --severity CRITICAL ruby:2.4.0","title":"Exit Code"},{"location":"docs/configuration/others/#exit-on-eol","text":"Scanner Supported Vulnerability \u2713 Misconfiguration Secret License Sometimes you may surprisingly get 0 vulnerabilities in an old image: Enabling --ignore-unfixed option while all packages have no fixed versions. Scanning a rather outdated OS (e.g. Ubuntu 10.04). An OS at the end of service/life (EOL) usually gets into this situation, which is definitely full of vulnerabilities. --exit-on-eol can fail scanning on EOL OS with a non-zero code. This flag is available with the following targets. Container images ( trivy image ) Virtual machine images ( trivy vm ) SBOM ( trivy sbom ) Root filesystem ( trivy rootfs ) $ trivy image --exit-on-eol 1 alpine:3.10 Result 2023-03-01T11:07:15.455+0200 INFO Vulnerability scanning is enabled ... 2023-03-01T11:07:17.938+0200 WARN This OS version is no longer supported by the distribution: alpine 3.10.9 2023-03-01T11:07:17.938+0200 WARN The vulnerability detection may be insufficient because security updates are not provided alpine:3.10 (alpine 3.10.9) =========================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 apk-tools \u2502 CVE-2021-36159 \u2502 CRITICAL \u2502 2.10.6-r0 \u2502 2.10.7-r0 \u2502 libfetch before 2021-07-26, as used in apk-tools, xbps, and \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 other products, mishandles... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-36159 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 2023-03-01T11:07:17.941+0200 ERROR Detected EOL OS: alpine 3.10.9 This option is useful for CI/CD. The following example will fail when a critical vulnerability is found or the OS is EOSL: $ trivy image --exit-code 1 --exit-on-eol 1 --severity CRITICAL alpine:3.16.3","title":"Exit on EOL"},{"location":"docs/configuration/reporting/","text":"Reporting Supported Formats Trivy supports the following formats: Table JSON SARIF Template SBOM GitHub dependency snapshot Table (Default) Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 $ trivy image -f table golang:1.12-alpine Show origins of vulnerable dependencies Scanner Supported Vulnerability \u2713 Misconfiguration Secret License EXPERIMENTAL This feature might change without preserving backwards compatibility. Modern software development relies on the use of third-party libraries. Third-party dependencies also depend on others so a list of dependencies can be represented as a dependency graph. In some cases, vulnerable dependencies are not linked directly, and it requires analyses of the tree. To make this task simpler Trivy can show a dependency origin tree with the --dependency-tree flag. This flag is only available with the --format table flag. The following packages/languages are currently supported: OS packages apk dpkg rpm Node.js npm: package-lock.json pnpm: pnpm-lock.yaml yarn: yarn.lock .NET NuGet: packages.lock.json Python Poetry: poetry.lock Ruby Bundler: Gemfile.lock Rust Binaries built with cargo-auditable Go Modules: go.mod PHP Composer Java Maven: pom.xml This tree is the reverse of the npm list command. However, if you want to resolve a vulnerability in a particular indirect dependency, the reversed tree is useful to know where that dependency comes from and identify which package you actually need to update. In table output, it looks like: $ trivy fs --severity HIGH,CRITICAL --dependency-tree /path/to/your_node_project package-lock.json ( npm ) ======================= Total: 2 ( HIGH: 1 , CRITICAL: 1 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 follow-redirects \u2502 CVE-2022-0155 \u2502 HIGH \u2502 1 .14.6 \u2502 1 .14.7 \u2502 follow-redirects: Exposure of Private Personal Information \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 to an Unauthorized Actor \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-0155 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 glob-parent \u2502 CVE-2020-28469 \u2502 CRITICAL \u2502 3 .1.0 \u2502 5 .1.2 \u2502 nodejs-glob-parent: Regular expression denial of service \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2020-28469 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Dependency Origin Tree ( Reversed ) ================================= package-lock.json \u251c\u2500\u2500 follow-redirects@1.14.6, ( HIGH: 1 , CRITICAL: 0 ) \u2502 \u2514\u2500\u2500 axios@0.21.4 \u2514\u2500\u2500 glob-parent@3.1.0, ( HIGH: 0 , CRITICAL: 1 ) \u2514\u2500\u2500 chokidar@2.1.8 \u2514\u2500\u2500 watchpack-chokidar2@2.0.1 \u2514\u2500\u2500 watchpack@1.7.5 \u2514\u2500\u2500 webpack@4.46.0 \u2514\u2500\u2500 cra-append-sw@2.7.0 Vulnerable dependencies are shown in the top level of the tree. Lower levels show how those vulnerabilities are introduced. In the example above axios@0.21.4 included in the project directly depends on the vulnerable follow-redirects@1.14.6 . Also, glob-parent@3.1.0 with some vulnerabilities is included through chain of dependencies that is added by cra-append-sw@2.7.0 . Then, you can try to update axios@0.21.4 and cra-append-sw@2.7.0 to resolve vulnerabilities in follow-redirects@1.14.6 and glob-parent@3.1.0 . JSON Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 $ trivy image -f json -o results.json golang:1.12-alpine Result 2019-05-16T01:46:31.777+0900 INFO Updating vulnerability database... 2019-05-16T01:47:03.007+0900 INFO Detecting Alpine vulnerabilities... JSON [ { \"Target\": \"php-app/composer.lock\", \"Vulnerabilities\": null }, { \"Target\": \"node-app/package-lock.json\", \"Vulnerabilities\": [ { \"VulnerabilityID\": \"CVE-2018-16487\", \"PkgName\": \"lodash\", \"InstalledVersion\": \"4.17.4\", \"FixedVersion\": \"\\u003e=4.17.11\", \"Title\": \"lodash: Prototype pollution in utilities function\", \"Description\": \"A prototype pollution vulnerability was found in lodash \\u003c4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.\", \"Severity\": \"HIGH\", \"References\": [ \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16487\", ] } ] }, { \"Target\": \"trivy-ci-test (alpine 3.7.1)\", \"Vulnerabilities\": [ { \"VulnerabilityID\": \"CVE-2018-16840\", \"PkgName\": \"curl\", \"InstalledVersion\": \"7.61.0-r0\", \"FixedVersion\": \"7.61.1-r1\", \"Title\": \"curl: Use-after-free when closing \\\"easy\\\" handle in Curl_close()\", \"Description\": \"A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. \", \"Severity\": \"HIGH\", \"References\": [ \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16840\", ] }, { \"VulnerabilityID\": \"CVE-2019-3822\", \"PkgName\": \"curl\", \"InstalledVersion\": \"7.61.0-r0\", \"FixedVersion\": \"7.61.1-r2\", \"Title\": \"curl: NTLMv2 type-3 header stack buffer overflow\", \"Description\": \"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. \", \"Severity\": \"HIGH\", \"References\": [ \"https://curl.haxx.se/docs/CVE-2019-3822.html\", \"https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f@%3Cdevnull.infra.apache.org%3E\" ] }, { \"VulnerabilityID\": \"CVE-2018-16839\", \"PkgName\": \"curl\", \"InstalledVersion\": \"7.61.0-r0\", \"FixedVersion\": \"7.61.1-r1\", \"Title\": \"curl: Integer overflow leading to heap-based buffer overflow in Curl_sasl_create_plain_message()\", \"Description\": \"Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.\", \"Severity\": \"HIGH\", \"References\": [ \"https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5\", ] }, { \"VulnerabilityID\": \"CVE-2018-19486\", \"PkgName\": \"git\", \"InstalledVersion\": \"2.15.2-r0\", \"FixedVersion\": \"2.15.3-r0\", \"Title\": \"git: Improper handling of PATH allows for commands to be executed from the current directory\", \"Description\": \"Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.\", \"Severity\": \"HIGH\", \"References\": [ \"https://usn.ubuntu.com/3829-1/\", ] }, { \"VulnerabilityID\": \"CVE-2018-17456\", \"PkgName\": \"git\", \"InstalledVersion\": \"2.15.2-r0\", \"FixedVersion\": \"2.15.3-r0\", \"Title\": \"git: arbitrary code execution via .gitmodules\", \"Description\": \"Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \\\"git clone\\\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.\", \"Severity\": \"HIGH\", \"References\": [ \"http://www.securitytracker.com/id/1041811\", ] } ] }, { \"Target\": \"python-app/Pipfile.lock\", \"Vulnerabilities\": null }, { \"Target\": \"ruby-app/Gemfile.lock\", \"Vulnerabilities\": null }, { \"Target\": \"rust-app/Cargo.lock\", \"Vulnerabilities\": null } ] VulnerabilityID , PkgName , InstalledVersion , and Severity in Vulnerabilities are always filled with values, but other fields might be empty. SARIF Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 SARIF can be generated with the --format sarif flag. $ trivy image --format sarif -o report.sarif golang:1.12-alpine This SARIF file can be uploaded to GitHub code scanning results, and there is a Trivy GitHub Action for automating this process. GitHub dependency snapshot Trivy supports the following packages. OS packages Language-specific packages GitHub dependency snapshots can be generated with the --format github flag. $ trivy image --format github -o report.gsbom alpine This snapshot file can be submitted to your GitHub repository. Template Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 Custom Template $ trivy image --format template --template \"{{ range . }} {{ .Target }} {{ end }}\" golang:1.12-alpine Result 2020-01-02T18:02:32.856+0100 INFO Detecting Alpine vulnerabilities... golang:1.12-alpine (alpine 3.10.2) You can compute different figures within the template using sprig functions. As an example you can summarize the different classes of issues: $ trivy image --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if eq .Severity \"CRITICAL\" }}{{- $critical = add $critical 1 }}{{- end }}{{- if eq .Severity \"HIGH\" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' golang:1.12-alpine Result Critical: 0, High: 2 For other features of sprig, see the official sprig documentation. Load templates from a file You can load templates from a file prefixing the template path with an @. $ trivy image --format template --template \"@/path/to/template\" golang:1.12-alpine Default Templates If Trivy is installed using rpm then default templates can be found at /usr/local/share/trivy/templates . JUnit Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License In the following example using the template junit.tpl XML can be generated. $ trivy image --format template --template \"@contrib/junit.tpl\" -o junit-report.xml golang:1.12-alpine ASFF Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License Trivy also supports an ASFF template for reporting findings to AWS Security Hub HTML Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License $ trivy image --format template --template \"@contrib/html.tpl\" -o report.html golang:1.12-alpine The following example shows use of default HTML template when Trivy is installed using rpm. $ trivy image --format template --template \"@/usr/local/share/trivy/templates/html.tpl\" -o report.html golang:1.12-alpine SBOM See here for details. Converting To generate multiple reports, you can generate the JSON report first and convert it to other formats with the convert subcommand. $ trivy image --format json -o result.json --list-all-pkgs debian:11 $ trivy convert --format cyclonedx --output result.cdx result.json Note Please note that if you want to convert to a format that requires a list of packages, such as SBOM, you need to add the --list-all-pkgs flag when outputting in JSON. Filtering options such as --severity are also available with convert . # Output all severities in JSON $ trivy image --format json -o result.json --list-all-pkgs debian:11 # Output only critical issues in table format $ trivy convert --format table --severity CRITICAL result.json Note JSON reports from \"trivy aws\" and \"trivy k8s\" are not yet supported.","title":"Reporting"},{"location":"docs/configuration/reporting/#reporting","text":"","title":"Reporting"},{"location":"docs/configuration/reporting/#supported-formats","text":"Trivy supports the following formats: Table JSON SARIF Template SBOM GitHub dependency snapshot","title":"Supported Formats"},{"location":"docs/configuration/reporting/#table-default","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 $ trivy image -f table golang:1.12-alpine","title":"Table (Default)"},{"location":"docs/configuration/reporting/#show-origins-of-vulnerable-dependencies","text":"Scanner Supported Vulnerability \u2713 Misconfiguration Secret License EXPERIMENTAL This feature might change without preserving backwards compatibility. Modern software development relies on the use of third-party libraries. Third-party dependencies also depend on others so a list of dependencies can be represented as a dependency graph. In some cases, vulnerable dependencies are not linked directly, and it requires analyses of the tree. To make this task simpler Trivy can show a dependency origin tree with the --dependency-tree flag. This flag is only available with the --format table flag. The following packages/languages are currently supported: OS packages apk dpkg rpm Node.js npm: package-lock.json pnpm: pnpm-lock.yaml yarn: yarn.lock .NET NuGet: packages.lock.json Python Poetry: poetry.lock Ruby Bundler: Gemfile.lock Rust Binaries built with cargo-auditable Go Modules: go.mod PHP Composer Java Maven: pom.xml This tree is the reverse of the npm list command. However, if you want to resolve a vulnerability in a particular indirect dependency, the reversed tree is useful to know where that dependency comes from and identify which package you actually need to update. In table output, it looks like: $ trivy fs --severity HIGH,CRITICAL --dependency-tree /path/to/your_node_project package-lock.json ( npm ) ======================= Total: 2 ( HIGH: 1 , CRITICAL: 1 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 follow-redirects \u2502 CVE-2022-0155 \u2502 HIGH \u2502 1 .14.6 \u2502 1 .14.7 \u2502 follow-redirects: Exposure of Private Personal Information \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 to an Unauthorized Actor \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-0155 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 glob-parent \u2502 CVE-2020-28469 \u2502 CRITICAL \u2502 3 .1.0 \u2502 5 .1.2 \u2502 nodejs-glob-parent: Regular expression denial of service \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2020-28469 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Dependency Origin Tree ( Reversed ) ================================= package-lock.json \u251c\u2500\u2500 follow-redirects@1.14.6, ( HIGH: 1 , CRITICAL: 0 ) \u2502 \u2514\u2500\u2500 axios@0.21.4 \u2514\u2500\u2500 glob-parent@3.1.0, ( HIGH: 0 , CRITICAL: 1 ) \u2514\u2500\u2500 chokidar@2.1.8 \u2514\u2500\u2500 watchpack-chokidar2@2.0.1 \u2514\u2500\u2500 watchpack@1.7.5 \u2514\u2500\u2500 webpack@4.46.0 \u2514\u2500\u2500 cra-append-sw@2.7.0 Vulnerable dependencies are shown in the top level of the tree. Lower levels show how those vulnerabilities are introduced. In the example above axios@0.21.4 included in the project directly depends on the vulnerable follow-redirects@1.14.6 . Also, glob-parent@3.1.0 with some vulnerabilities is included through chain of dependencies that is added by cra-append-sw@2.7.0 . Then, you can try to update axios@0.21.4 and cra-append-sw@2.7.0 to resolve vulnerabilities in follow-redirects@1.14.6 and glob-parent@3.1.0 .","title":"Show origins of vulnerable dependencies"},{"location":"docs/configuration/reporting/#json","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 $ trivy image -f json -o results.json golang:1.12-alpine Result 2019-05-16T01:46:31.777+0900 INFO Updating vulnerability database... 2019-05-16T01:47:03.007+0900 INFO Detecting Alpine vulnerabilities... JSON [ { \"Target\": \"php-app/composer.lock\", \"Vulnerabilities\": null }, { \"Target\": \"node-app/package-lock.json\", \"Vulnerabilities\": [ { \"VulnerabilityID\": \"CVE-2018-16487\", \"PkgName\": \"lodash\", \"InstalledVersion\": \"4.17.4\", \"FixedVersion\": \"\\u003e=4.17.11\", \"Title\": \"lodash: Prototype pollution in utilities function\", \"Description\": \"A prototype pollution vulnerability was found in lodash \\u003c4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.\", \"Severity\": \"HIGH\", \"References\": [ \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16487\", ] } ] }, { \"Target\": \"trivy-ci-test (alpine 3.7.1)\", \"Vulnerabilities\": [ { \"VulnerabilityID\": \"CVE-2018-16840\", \"PkgName\": \"curl\", \"InstalledVersion\": \"7.61.0-r0\", \"FixedVersion\": \"7.61.1-r1\", \"Title\": \"curl: Use-after-free when closing \\\"easy\\\" handle in Curl_close()\", \"Description\": \"A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. \", \"Severity\": \"HIGH\", \"References\": [ \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16840\", ] }, { \"VulnerabilityID\": \"CVE-2019-3822\", \"PkgName\": \"curl\", \"InstalledVersion\": \"7.61.0-r0\", \"FixedVersion\": \"7.61.1-r2\", \"Title\": \"curl: NTLMv2 type-3 header stack buffer overflow\", \"Description\": \"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. \", \"Severity\": \"HIGH\", \"References\": [ \"https://curl.haxx.se/docs/CVE-2019-3822.html\", \"https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f@%3Cdevnull.infra.apache.org%3E\" ] }, { \"VulnerabilityID\": \"CVE-2018-16839\", \"PkgName\": \"curl\", \"InstalledVersion\": \"7.61.0-r0\", \"FixedVersion\": \"7.61.1-r1\", \"Title\": \"curl: Integer overflow leading to heap-based buffer overflow in Curl_sasl_create_plain_message()\", \"Description\": \"Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.\", \"Severity\": \"HIGH\", \"References\": [ \"https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5\", ] }, { \"VulnerabilityID\": \"CVE-2018-19486\", \"PkgName\": \"git\", \"InstalledVersion\": \"2.15.2-r0\", \"FixedVersion\": \"2.15.3-r0\", \"Title\": \"git: Improper handling of PATH allows for commands to be executed from the current directory\", \"Description\": \"Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.\", \"Severity\": \"HIGH\", \"References\": [ \"https://usn.ubuntu.com/3829-1/\", ] }, { \"VulnerabilityID\": \"CVE-2018-17456\", \"PkgName\": \"git\", \"InstalledVersion\": \"2.15.2-r0\", \"FixedVersion\": \"2.15.3-r0\", \"Title\": \"git: arbitrary code execution via .gitmodules\", \"Description\": \"Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \\\"git clone\\\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.\", \"Severity\": \"HIGH\", \"References\": [ \"http://www.securitytracker.com/id/1041811\", ] } ] }, { \"Target\": \"python-app/Pipfile.lock\", \"Vulnerabilities\": null }, { \"Target\": \"ruby-app/Gemfile.lock\", \"Vulnerabilities\": null }, { \"Target\": \"rust-app/Cargo.lock\", \"Vulnerabilities\": null } ] VulnerabilityID , PkgName , InstalledVersion , and Severity in Vulnerabilities are always filled with values, but other fields might be empty.","title":"JSON"},{"location":"docs/configuration/reporting/#sarif","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 SARIF can be generated with the --format sarif flag. $ trivy image --format sarif -o report.sarif golang:1.12-alpine This SARIF file can be uploaded to GitHub code scanning results, and there is a Trivy GitHub Action for automating this process.","title":"SARIF"},{"location":"docs/configuration/reporting/#github-dependency-snapshot","text":"Trivy supports the following packages. OS packages Language-specific packages GitHub dependency snapshots can be generated with the --format github flag. $ trivy image --format github -o report.gsbom alpine This snapshot file can be submitted to your GitHub repository.","title":"GitHub dependency snapshot"},{"location":"docs/configuration/reporting/#template","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713","title":"Template"},{"location":"docs/configuration/reporting/#custom-template","text":"$ trivy image --format template --template \"{{ range . }} {{ .Target }} {{ end }}\" golang:1.12-alpine Result 2020-01-02T18:02:32.856+0100 INFO Detecting Alpine vulnerabilities... golang:1.12-alpine (alpine 3.10.2) You can compute different figures within the template using sprig functions. As an example you can summarize the different classes of issues: $ trivy image --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if eq .Severity \"CRITICAL\" }}{{- $critical = add $critical 1 }}{{- end }}{{- if eq .Severity \"HIGH\" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' golang:1.12-alpine Result Critical: 0, High: 2 For other features of sprig, see the official sprig documentation.","title":"Custom Template"},{"location":"docs/configuration/reporting/#load-templates-from-a-file","text":"You can load templates from a file prefixing the template path with an @. $ trivy image --format template --template \"@/path/to/template\" golang:1.12-alpine","title":"Load templates from a file"},{"location":"docs/configuration/reporting/#default-templates","text":"If Trivy is installed using rpm then default templates can be found at /usr/local/share/trivy/templates .","title":"Default Templates"},{"location":"docs/configuration/reporting/#junit","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License In the following example using the template junit.tpl XML can be generated. $ trivy image --format template --template \"@contrib/junit.tpl\" -o junit-report.xml golang:1.12-alpine","title":"JUnit"},{"location":"docs/configuration/reporting/#asff","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License Trivy also supports an ASFF template for reporting findings to AWS Security Hub","title":"ASFF"},{"location":"docs/configuration/reporting/#html","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License $ trivy image --format template --template \"@contrib/html.tpl\" -o report.html golang:1.12-alpine The following example shows use of default HTML template when Trivy is installed using rpm. $ trivy image --format template --template \"@/usr/local/share/trivy/templates/html.tpl\" -o report.html golang:1.12-alpine","title":"HTML"},{"location":"docs/configuration/reporting/#sbom","text":"See here for details.","title":"SBOM"},{"location":"docs/configuration/reporting/#converting","text":"To generate multiple reports, you can generate the JSON report first and convert it to other formats with the convert subcommand. $ trivy image --format json -o result.json --list-all-pkgs debian:11 $ trivy convert --format cyclonedx --output result.cdx result.json Note Please note that if you want to convert to a format that requires a list of packages, such as SBOM, you need to add the --list-all-pkgs flag when outputting in JSON. Filtering options such as --severity are also available with convert . # Output all severities in JSON $ trivy image --format json -o result.json --list-all-pkgs debian:11 # Output only critical issues in table format $ trivy convert --format table --severity CRITICAL result.json Note JSON reports from \"trivy aws\" and \"trivy k8s\" are not yet supported.","title":"Converting"},{"location":"docs/configuration/skipping/","text":"Skipping Files and Directories This section details ways to specify the files and directories that Trivy should not scan. Skip Files Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 By default, Trivy traverses directories and searches for all necessary files for scanning. You can skip files that you don't maintain using the --skip-files flag, or the equivalent Trivy YAML config option. Using the --skip-files flag: $ trivy image --skip-files \"/Gemfile.lock\" --skip-files \"/var/lib/gems/2.5.0/gems/http_parser.rb-0.6.0/Gemfile.lock\" quay.io/fluentd_elasticsearch/fluentd:v2.9.0 Using the Trivy YAML configuration: image : skip-files : - foo - \"testdata/*/bar\" It's possible to specify globs as part of the value. $ trivy image --skip-files \"./testdata/*/bar\" . This will skip any file named bar in the subdirectories of testdata. $ trivy config --skip-files \"./foo/**/*.tf\" . This will skip any files with the extension .tf in subdirectories of foo at any depth. Skip Directories Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 By default, Trivy traverses directories and searches for all necessary files for scanning. You can skip directories that you don't maintain using the --skip-dirs flag, or the equivalent Trivy YAML config option. Using the --skip-dirs flag: $ trivy image --skip-dirs /var/lib/gems/2.5.0/gems/fluent-plugin-detect-exceptions-0.0.13 --skip-dirs \"/var/lib/gems/2.5.0/gems/http_parser.rb-0.6.0\" quay.io/fluentd_elasticsearch/fluentd:v2.9.0 Using the Trivy YAML configuration: image : skip-dirs : - foo/bar/ - \"**/.terraform\" It's possible to specify globs as part of the value. $ trivy image --skip-dirs \"./testdata/*\" . This will skip all subdirectories of the testdata directory. $ trivy config --skip-dirs \"**/.terraform\" . This will skip subdirectories at any depth named .terraform/ . (Note: this will match ./foo/.terraform or ./foo/bar/.terraform , but not ./.terraform .) Tip Glob patterns work with any trivy subcommand (image, config, etc.) and can be specified to skip both directories (with --skip-dirs ) and files (with --skip-files ). Advanced globbing Trivy also supports bash style extended glob pattern matching. $ trivy image --skip-files \"**/foo\" image:tag This will skip the file foo that happens to be nested under any parent(s). File patterns Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License When a directory is given as an input, Trivy will recursively look for and test all files based on file patterns. The default file patterns are here . In addition to the default file patterns, the --file-patterns option takes regexp patterns to look for your files. For example, it may be useful when your file name of Dockerfile doesn't match the default patterns. This can be repeated for specifying multiple file patterns. A file pattern contains the analyzer it is used for, and the pattern itself, joined by a semicolon. For example: --file-patterns \"dockerfile:.*.docker\" --file-patterns \"kubernetes:*.tpl\" --file-patterns \"pip:requirements-.*\\.txt\" The prefixes are listed here","title":"Skipping Files"},{"location":"docs/configuration/skipping/#skipping-files-and-directories","text":"This section details ways to specify the files and directories that Trivy should not scan.","title":"Skipping Files and Directories"},{"location":"docs/configuration/skipping/#skip-files","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 By default, Trivy traverses directories and searches for all necessary files for scanning. You can skip files that you don't maintain using the --skip-files flag, or the equivalent Trivy YAML config option. Using the --skip-files flag: $ trivy image --skip-files \"/Gemfile.lock\" --skip-files \"/var/lib/gems/2.5.0/gems/http_parser.rb-0.6.0/Gemfile.lock\" quay.io/fluentd_elasticsearch/fluentd:v2.9.0 Using the Trivy YAML configuration: image : skip-files : - foo - \"testdata/*/bar\" It's possible to specify globs as part of the value. $ trivy image --skip-files \"./testdata/*/bar\" . This will skip any file named bar in the subdirectories of testdata. $ trivy config --skip-files \"./foo/**/*.tf\" . This will skip any files with the extension .tf in subdirectories of foo at any depth.","title":"Skip Files"},{"location":"docs/configuration/skipping/#skip-directories","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret \u2713 License \u2713 By default, Trivy traverses directories and searches for all necessary files for scanning. You can skip directories that you don't maintain using the --skip-dirs flag, or the equivalent Trivy YAML config option. Using the --skip-dirs flag: $ trivy image --skip-dirs /var/lib/gems/2.5.0/gems/fluent-plugin-detect-exceptions-0.0.13 --skip-dirs \"/var/lib/gems/2.5.0/gems/http_parser.rb-0.6.0\" quay.io/fluentd_elasticsearch/fluentd:v2.9.0 Using the Trivy YAML configuration: image : skip-dirs : - foo/bar/ - \"**/.terraform\" It's possible to specify globs as part of the value. $ trivy image --skip-dirs \"./testdata/*\" . This will skip all subdirectories of the testdata directory. $ trivy config --skip-dirs \"**/.terraform\" . This will skip subdirectories at any depth named .terraform/ . (Note: this will match ./foo/.terraform or ./foo/bar/.terraform , but not ./.terraform .) Tip Glob patterns work with any trivy subcommand (image, config, etc.) and can be specified to skip both directories (with --skip-dirs ) and files (with --skip-files ).","title":"Skip Directories"},{"location":"docs/configuration/skipping/#advanced-globbing","text":"Trivy also supports bash style extended glob pattern matching. $ trivy image --skip-files \"**/foo\" image:tag This will skip the file foo that happens to be nested under any parent(s).","title":"Advanced globbing"},{"location":"docs/configuration/skipping/#file-patterns","text":"Scanner Supported Vulnerability \u2713 Misconfiguration \u2713 Secret License When a directory is given as an input, Trivy will recursively look for and test all files based on file patterns. The default file patterns are here . In addition to the default file patterns, the --file-patterns option takes regexp patterns to look for your files. For example, it may be useful when your file name of Dockerfile doesn't match the default patterns. This can be repeated for specifying multiple file patterns. A file pattern contains the analyzer it is used for, and the pattern itself, joined by a semicolon. For example: --file-patterns \"dockerfile:.*.docker\" --file-patterns \"kubernetes:*.tpl\" --file-patterns \"pip:requirements-.*\\.txt\" The prefixes are listed here","title":"File patterns"},{"location":"docs/coverage/","text":"Scanning Coverage Trivy can detect security issues in many different platforms, languages and configuration files. This section gives a general overview of that coverage, and can help answer the frequently asked question \"Does Trivy support X?\". For more detailed information about the specific platforms and languages, check the relevant documentation. OS Packages Language-specific Packages IaC files Kubernetes clusters","title":"Overview"},{"location":"docs/coverage/#scanning-coverage","text":"Trivy can detect security issues in many different platforms, languages and configuration files. This section gives a general overview of that coverage, and can help answer the frequently asked question \"Does Trivy support X?\". For more detailed information about the specific platforms and languages, check the relevant documentation. OS Packages Language-specific Packages IaC files Kubernetes clusters","title":"Scanning Coverage"},{"location":"docs/coverage/kubernetes/","text":"Kubernetes When scanning a Kubernetes cluster, Trivy differentiates between the following: Cluster infrastructure (e.g api-server, kubelet, addons) Cluster configuration (e.g Roles, ClusterRoles). Application workloads (e.g nginx, postgresql). Whenever Trivy scans either of these Kubernetes resources, the container image is scanned separately to the Kubernetes resource definition (the YAML manifest) that defines the resource. When scanning any of the above, the container image is scanned separately to the Kubernetes resource definition (the YAML manifest) that defines the resource. Container image is scanned for: - Vulnerabilities - Misconfigurations - Exposed secrets Kubernetes resource definition is scanned for: - Vulnerabilities - partially supported through KBOM scanning - Misconfigurations - Exposed secrets To learn more, please see the documentation for Kubernetes scanning","title":"Kubernetes"},{"location":"docs/coverage/kubernetes/#kubernetes","text":"When scanning a Kubernetes cluster, Trivy differentiates between the following: Cluster infrastructure (e.g api-server, kubelet, addons) Cluster configuration (e.g Roles, ClusterRoles). Application workloads (e.g nginx, postgresql). Whenever Trivy scans either of these Kubernetes resources, the container image is scanned separately to the Kubernetes resource definition (the YAML manifest) that defines the resource. When scanning any of the above, the container image is scanned separately to the Kubernetes resource definition (the YAML manifest) that defines the resource. Container image is scanned for: - Vulnerabilities - Misconfigurations - Exposed secrets Kubernetes resource definition is scanned for: - Vulnerabilities - partially supported through KBOM scanning - Misconfigurations - Exposed secrets To learn more, please see the documentation for Kubernetes scanning","title":"Kubernetes"},{"location":"docs/coverage/iac/","text":"Infrastructure as Code Scanner Trivy scans Infrastructure as Code (IaC) files for Misconfigurations Secrets Supported configurations Config type File patterns Kubernetes .yml, .yaml, *.json Docker Dockerfile, Containerfile Terraform .tf, .tf.json, *.tfvars, CloudFormation .yml, .yaml, *.json Azure ARM Template *.json Helm .yaml, .tpl, *.tar.gz, etc.","title":"Overview"},{"location":"docs/coverage/iac/#infrastructure-as-code","text":"","title":"Infrastructure as Code"},{"location":"docs/coverage/iac/#scanner","text":"Trivy scans Infrastructure as Code (IaC) files for Misconfigurations Secrets","title":"Scanner"},{"location":"docs/coverage/iac/#supported-configurations","text":"Config type File patterns Kubernetes .yml, .yaml, *.json Docker Dockerfile, Containerfile Terraform .tf, .tf.json, *.tfvars, CloudFormation .yml, .yaml, *.json Azure ARM Template *.json Helm .yaml, .tpl, *.tar.gz, etc.","title":"Supported configurations"},{"location":"docs/coverage/iac/azure-arm/","text":"Azure ARM Template Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following configurations: Format Supported ARM template \u2713 Bicep \u2713 1 To scan Bicep codes, you need to convert them into ARM templates first. az bicep build -f main.bicep or bicep build main.bicep Misconfiguration Trivy recursively searches directories and scans all found Azure ARM templates. Secret The secret scan is performed on plain text files, with no special treatment for Azure ARM templates. Bicep is not natively supported. It needs to be converted into Azure ARM templates. \u21a9","title":"Azure ARM Template"},{"location":"docs/coverage/iac/azure-arm/#azure-arm-template","text":"Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following configurations: Format Supported ARM template \u2713 Bicep \u2713 1 To scan Bicep codes, you need to convert them into ARM templates first. az bicep build -f main.bicep or bicep build main.bicep","title":"Azure ARM Template"},{"location":"docs/coverage/iac/azure-arm/#misconfiguration","text":"Trivy recursively searches directories and scans all found Azure ARM templates.","title":"Misconfiguration"},{"location":"docs/coverage/iac/azure-arm/#secret","text":"The secret scan is performed on plain text files, with no special treatment for Azure ARM templates. Bicep is not natively supported. It needs to be converted into Azure ARM templates. \u21a9","title":"Secret"},{"location":"docs/coverage/iac/cloudformation/","text":"CloudFormation Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following formats. Format Supported JSON \u2713 YAML \u2713 Misconfiguration Trivy recursively searches directories and scans all found CloudFormation files. It evaluates properties, functions, and other elements within CloudFormation files to detect misconfigurations. Secret The secret scan is performed on plain text files, with no special treatment for CloudFormation.","title":"CloudFormation"},{"location":"docs/coverage/iac/cloudformation/#cloudformation","text":"Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following formats. Format Supported JSON \u2713 YAML \u2713","title":"CloudFormation"},{"location":"docs/coverage/iac/cloudformation/#misconfiguration","text":"Trivy recursively searches directories and scans all found CloudFormation files. It evaluates properties, functions, and other elements within CloudFormation files to detect misconfigurations.","title":"Misconfiguration"},{"location":"docs/coverage/iac/cloudformation/#secret","text":"The secret scan is performed on plain text files, with no special treatment for CloudFormation.","title":"Secret"},{"location":"docs/coverage/iac/docker/","text":"Docker Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following configurations. Config Supported Dockerfile \u2713 Containerfile \u2713 Compose - Misconfiguration Trivy recursively searches directories and scans all found Docker files. Secret The secret scan is performed on plain text files, with no special treatment for Dockerfile.","title":"Docker"},{"location":"docs/coverage/iac/docker/#docker","text":"Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following configurations. Config Supported Dockerfile \u2713 Containerfile \u2713 Compose -","title":"Docker"},{"location":"docs/coverage/iac/docker/#misconfiguration","text":"Trivy recursively searches directories and scans all found Docker files.","title":"Misconfiguration"},{"location":"docs/coverage/iac/docker/#secret","text":"The secret scan is performed on plain text files, with no special treatment for Dockerfile.","title":"Secret"},{"location":"docs/coverage/iac/helm/","text":"Helm Trivy supports two types of Helm scanning, templates and packaged charts. The following scanners are supported. Format Misconfiguration Secret Template \u2713 \u2713 Chart \u2713 - Misconfiguration Trivy recursively searches directories and scans all found Helm files. It evaluates variables, functions, and other elements within Helm templates and resolve the chart to Kubernetes manifests then run the Kubernetes checks. See here for more details on the built-in policies. Value overrides There are a number of options for overriding values in Helm charts. When override values are passed to the Helm scanner, the values will be used during the Manifest rendering process and will become part of the scanned artifact. Setting inline value overrides Overrides can be set inline on the command line trivy conf --helm-set securityContext.runAsUser = 0 ./charts/mySql Setting value file overrides Overrides can be in a file that has the key=value set. # Example override file (overrides.yaml) securityContext : runAsUser : 0 trivy conf --helm-values overrides.yaml ./charts/mySql Setting value as explicit string the --helm-set-string is the same as --helm-set but explicitly retains the value as a string trivy config --helm-set-string name = false ./infrastructure/tf Setting specific values from files Specific override values can come from specific files trivy conf --helm-set-file environment = dev.values.yaml ./charts/mySql Secret The secret scan is performed on plain text files, with no special treatment for Helm. Secret scanning is not conducted on the contents of packaged Charts, such as tar or tar.gz.","title":"Helm"},{"location":"docs/coverage/iac/helm/#helm","text":"Trivy supports two types of Helm scanning, templates and packaged charts. The following scanners are supported. Format Misconfiguration Secret Template \u2713 \u2713 Chart \u2713 -","title":"Helm"},{"location":"docs/coverage/iac/helm/#misconfiguration","text":"Trivy recursively searches directories and scans all found Helm files. It evaluates variables, functions, and other elements within Helm templates and resolve the chart to Kubernetes manifests then run the Kubernetes checks. See here for more details on the built-in policies.","title":"Misconfiguration"},{"location":"docs/coverage/iac/helm/#value-overrides","text":"There are a number of options for overriding values in Helm charts. When override values are passed to the Helm scanner, the values will be used during the Manifest rendering process and will become part of the scanned artifact.","title":"Value overrides"},{"location":"docs/coverage/iac/helm/#setting-inline-value-overrides","text":"Overrides can be set inline on the command line trivy conf --helm-set securityContext.runAsUser = 0 ./charts/mySql","title":"Setting inline value overrides"},{"location":"docs/coverage/iac/helm/#setting-value-file-overrides","text":"Overrides can be in a file that has the key=value set. # Example override file (overrides.yaml) securityContext : runAsUser : 0 trivy conf --helm-values overrides.yaml ./charts/mySql","title":"Setting value file overrides"},{"location":"docs/coverage/iac/helm/#setting-value-as-explicit-string","text":"the --helm-set-string is the same as --helm-set but explicitly retains the value as a string trivy config --helm-set-string name = false ./infrastructure/tf","title":"Setting value as explicit string"},{"location":"docs/coverage/iac/helm/#setting-specific-values-from-files","text":"Specific override values can come from specific files trivy conf --helm-set-file environment = dev.values.yaml ./charts/mySql","title":"Setting specific values from files"},{"location":"docs/coverage/iac/helm/#secret","text":"The secret scan is performed on plain text files, with no special treatment for Helm. Secret scanning is not conducted on the contents of packaged Charts, such as tar or tar.gz.","title":"Secret"},{"location":"docs/coverage/iac/kubernetes/","text":"Kubernetes Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 In addition to raw YAML and JSON, it supports the following templates: Template Supported Helm \u2713 Kustomize \u2713 1 Note Trivy does not support Kustomize overlays, so it scans files defined in the base. Or, you can scan the output of kustomize build . Misconfiguration Trivy recursively searches directories and scans all found Kubernetes files. Secret The secret scan is performed on plain text files, with no special treatment for Kubernetes. This means that Base64 encoded secrets are not scanned, and only secrets written in plain text are detected. Kustomize is not natively supported. \u21a9","title":"Kubernetes"},{"location":"docs/coverage/iac/kubernetes/#kubernetes","text":"Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 In addition to raw YAML and JSON, it supports the following templates: Template Supported Helm \u2713 Kustomize \u2713 1 Note Trivy does not support Kustomize overlays, so it scans files defined in the base. Or, you can scan the output of kustomize build .","title":"Kubernetes"},{"location":"docs/coverage/iac/kubernetes/#misconfiguration","text":"Trivy recursively searches directories and scans all found Kubernetes files.","title":"Misconfiguration"},{"location":"docs/coverage/iac/kubernetes/#secret","text":"The secret scan is performed on plain text files, with no special treatment for Kubernetes. This means that Base64 encoded secrets are not scanned, and only secrets written in plain text are detected. Kustomize is not natively supported. \u21a9","title":"Secret"},{"location":"docs/coverage/iac/terraform/","text":"Terraform Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following formats: Format Supported JSON \u2713 HCL \u2713 Plan JSON \u2713 Trivy can scan the results of terraform plan . You can scan by passing the file generated as shown below to Trivy: $ terraform plan --out tfplan.binary $ terraform show -json tfplan.binary > tfplan.json Misconfiguration Trivy recursively searches directories and scans all found Terraform files. It also evaluates variables, imports, and other elements within Terraform files to detect misconfigurations. Value Overrides You can provide tf-vars files to Trivy to override default values specified in the Terraform HCL code. trivy conf --tf-vars dev.terraform.tfvars ./infrastructure/tf Exclude Downloaded Terraform Modules By default, downloaded modules are also scanned. If you don't want to scan modules downloaded into the .terraform directory, you can use the --tf-exclude-downloaded-modules flag. trivy conf --tf-exclude-downloaded-modules ./configs Secret The secret scan is performed on plain text files, with no special treatment for Terraform.","title":"Terraform"},{"location":"docs/coverage/iac/terraform/#terraform","text":"Trivy supports the scanners listed in the table below. Scanner Supported Misconfiguration \u2713 Secret \u2713 It supports the following formats: Format Supported JSON \u2713 HCL \u2713 Plan JSON \u2713 Trivy can scan the results of terraform plan . You can scan by passing the file generated as shown below to Trivy: $ terraform plan --out tfplan.binary $ terraform show -json tfplan.binary > tfplan.json","title":"Terraform"},{"location":"docs/coverage/iac/terraform/#misconfiguration","text":"Trivy recursively searches directories and scans all found Terraform files. It also evaluates variables, imports, and other elements within Terraform files to detect misconfigurations.","title":"Misconfiguration"},{"location":"docs/coverage/iac/terraform/#value-overrides","text":"You can provide tf-vars files to Trivy to override default values specified in the Terraform HCL code. trivy conf --tf-vars dev.terraform.tfvars ./infrastructure/tf","title":"Value Overrides"},{"location":"docs/coverage/iac/terraform/#exclude-downloaded-terraform-modules","text":"By default, downloaded modules are also scanned. If you don't want to scan modules downloaded into the .terraform directory, you can use the --tf-exclude-downloaded-modules flag. trivy conf --tf-exclude-downloaded-modules ./configs","title":"Exclude Downloaded Terraform Modules"},{"location":"docs/coverage/iac/terraform/#secret","text":"The secret scan is performed on plain text files, with no special treatment for Terraform.","title":"Secret"},{"location":"docs/coverage/language/","text":"Programming Language Trivy supports programming languages for SBOM Vulnerabilities Licenses Supported languages The files analyzed vary depending on the target. This is because Trivy primarily categorizes targets into two groups: Pre-build Post-build If the target is a pre-build project, like a code repository, Trivy will analyze files used for building, such as lock files. On the other hand, when the target is a post-build artifact, like a container image, Trivy will analyze installed package metadata like .gemspec , binary files, and so on. Language File Image 5 Rootfs 6 Filesystem 7 Repository 8 Ruby Gemfile.lock - - \u2705 \u2705 gemspec \u2705 \u2705 - - Python Pipfile.lock - - \u2705 \u2705 poetry.lock - - \u2705 \u2705 requirements.txt - - \u2705 \u2705 egg package 1 \u2705 \u2705 - - wheel package 2 \u2705 \u2705 - - conda package 3 \u2705 \u2705 - - PHP composer.lock \u2705 \u2705 \u2705 \u2705 Node.js package-lock.json - - \u2705 \u2705 yarn.lock - - \u2705 \u2705 pnpm-lock.yaml - - \u2705 \u2705 package.json \u2705 \u2705 - - .NET packages.lock.json \u2705 \u2705 \u2705 \u2705 packages.config \u2705 \u2705 \u2705 \u2705 .deps.json \u2705 \u2705 \u2705 \u2705 Java JAR/WAR/PAR/EAR 4 \u2705 \u2705 - - pom.xml - - \u2705 \u2705 *gradle.lockfile - - \u2705 \u2705 Go Binaries built by Go \u2705 \u2705 - - go.mod - - \u2705 \u2705 Rust Cargo.lock \u2705 \u2705 \u2705 \u2705 Binaries built with cargo-auditable \u2705 \u2705 - - C/C++ conan.lock - - \u2705 \u2705 Elixir mix.lock 10 - - \u2705 \u2705 Dart pubspec.lock - - \u2705 \u2705 Swift Podfile.lock - - \u2705 \u2705 Package.resolved - - \u2705 \u2705 The path of these files does not matter. Example: Dockerfile *.egg-info , *.egg-info/PKG-INFO , *.egg and EGG-INFO/PKG-INFO \u21a9 .dist-info/META-DATA \u21a9 envs/*/conda-meta/*.json \u21a9 *.jar , *.war , *.par and *.ear \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the image scanning \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the rootfs scanning \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the filesystem scanning \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the git repository scanning \u21a9 \u2705 means that Trivy detects line numbers where each dependency is declared in the scanned file. Only supported in json and sarif formats. SARIF uses startline == 1 and endline == 1 for unsupported file types \u21a9 To scan a filename other than the default filename use file-patterns \u21a9","title":"Overview"},{"location":"docs/coverage/language/#programming-language","text":"Trivy supports programming languages for SBOM Vulnerabilities Licenses","title":"Programming Language"},{"location":"docs/coverage/language/#supported-languages","text":"The files analyzed vary depending on the target. This is because Trivy primarily categorizes targets into two groups: Pre-build Post-build If the target is a pre-build project, like a code repository, Trivy will analyze files used for building, such as lock files. On the other hand, when the target is a post-build artifact, like a container image, Trivy will analyze installed package metadata like .gemspec , binary files, and so on. Language File Image 5 Rootfs 6 Filesystem 7 Repository 8 Ruby Gemfile.lock - - \u2705 \u2705 gemspec \u2705 \u2705 - - Python Pipfile.lock - - \u2705 \u2705 poetry.lock - - \u2705 \u2705 requirements.txt - - \u2705 \u2705 egg package 1 \u2705 \u2705 - - wheel package 2 \u2705 \u2705 - - conda package 3 \u2705 \u2705 - - PHP composer.lock \u2705 \u2705 \u2705 \u2705 Node.js package-lock.json - - \u2705 \u2705 yarn.lock - - \u2705 \u2705 pnpm-lock.yaml - - \u2705 \u2705 package.json \u2705 \u2705 - - .NET packages.lock.json \u2705 \u2705 \u2705 \u2705 packages.config \u2705 \u2705 \u2705 \u2705 .deps.json \u2705 \u2705 \u2705 \u2705 Java JAR/WAR/PAR/EAR 4 \u2705 \u2705 - - pom.xml - - \u2705 \u2705 *gradle.lockfile - - \u2705 \u2705 Go Binaries built by Go \u2705 \u2705 - - go.mod - - \u2705 \u2705 Rust Cargo.lock \u2705 \u2705 \u2705 \u2705 Binaries built with cargo-auditable \u2705 \u2705 - - C/C++ conan.lock - - \u2705 \u2705 Elixir mix.lock 10 - - \u2705 \u2705 Dart pubspec.lock - - \u2705 \u2705 Swift Podfile.lock - - \u2705 \u2705 Package.resolved - - \u2705 \u2705 The path of these files does not matter. Example: Dockerfile *.egg-info , *.egg-info/PKG-INFO , *.egg and EGG-INFO/PKG-INFO \u21a9 .dist-info/META-DATA \u21a9 envs/*/conda-meta/*.json \u21a9 *.jar , *.war , *.par and *.ear \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the image scanning \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the rootfs scanning \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the filesystem scanning \u21a9 \u2705 means \"enabled\" and - means \"disabled\" in the git repository scanning \u21a9 \u2705 means that Trivy detects line numbers where each dependency is declared in the scanned file. Only supported in json and sarif formats. SARIF uses startline == 1 and endline == 1 for unsupported file types \u21a9 To scan a filename other than the default filename use file-patterns \u21a9","title":"Supported languages"},{"location":"docs/coverage/language/c/","text":"C/C++ Trivy supports Conan C/C++ Package Manager. The following scanners are supported. Package manager SBOM Vulnerability License Conan \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Conan conan.lock 1 \u2713 Excluded \u2713 \u2713 Conan In order to detect dependencies, Trivy searches for conan.lock 1 . conan.lock is default name. To scan a custom filename use file-patterns \u21a9 \u21a9","title":"C/C++"},{"location":"docs/coverage/language/c/#cc","text":"Trivy supports Conan C/C++ Package Manager. The following scanners are supported. Package manager SBOM Vulnerability License Conan \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Conan conan.lock 1 \u2713 Excluded \u2713 \u2713","title":"C/C++"},{"location":"docs/coverage/language/c/#conan","text":"In order to detect dependencies, Trivy searches for conan.lock 1 . conan.lock is default name. To scan a custom filename use file-patterns \u21a9 \u21a9","title":"Conan"},{"location":"docs/coverage/language/dart/","text":"Dart Trivy supports Dart . The following scanners are supported. Package manager SBOM Vulnerability License Dart \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Dart pubspec.lock \u2713 Included - - Dart In order to detect dependencies, Trivy searches for pubspec.lock . Trivy marks indirect dependencies, but pubspec.lock file doesn't have options to separate root and dev transitive dependencies. So Trivy includes all dependencies in report.","title":"Dart"},{"location":"docs/coverage/language/dart/#dart","text":"Trivy supports Dart . The following scanners are supported. Package manager SBOM Vulnerability License Dart \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Dart pubspec.lock \u2713 Included - -","title":"Dart"},{"location":"docs/coverage/language/dart/#dart_1","text":"In order to detect dependencies, Trivy searches for pubspec.lock . Trivy marks indirect dependencies, but pubspec.lock file doesn't have options to separate root and dev transitive dependencies. So Trivy includes all dependencies in report.","title":"Dart"},{"location":"docs/coverage/language/dotnet/","text":".NET Trivy supports .NET core and NuGet package managers. The following scanners are supported. Artifact SBOM Vulnerability License .Net Core \u2713 \u2713 - NuGet \u2713 \u2713 \u2713 The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position .Net Core *.deps.json \u2713 Excluded - \u2713 NuGet packages.config \u2713 Excluded - - NuGet packages.lock.json \u2713 Included \u2713 \u2713 *.deps.json Trivy parses *.deps.json files. Trivy currently excludes dev dependencies from the report. packages.config Trivy only finds dependency names and versions from packages.config files. To build dependency graph, it is better to use packages.lock.json files. license detection packages.config files don't have information about the licenses used. Trivy uses *.nuspec files from global packages folder to detect licenses. Note The licenseUrl field is deprecated . Trivy doesn't parse this field and only checks the license field (license expression type only). Currently only the default path and NUGET_PACKAGES environment variable are supported. packages.lock.json Don't forgot to enable lock files in your project. Tip Please make sure your lock file is up-to-date after modifying dependencies. license detection Same as packages.config","title":".NET"},{"location":"docs/coverage/language/dotnet/#net","text":"Trivy supports .NET core and NuGet package managers. The following scanners are supported. Artifact SBOM Vulnerability License .Net Core \u2713 \u2713 - NuGet \u2713 \u2713 \u2713 The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position .Net Core *.deps.json \u2713 Excluded - \u2713 NuGet packages.config \u2713 Excluded - - NuGet packages.lock.json \u2713 Included \u2713 \u2713","title":".NET"},{"location":"docs/coverage/language/dotnet/#depsjson","text":"Trivy parses *.deps.json files. Trivy currently excludes dev dependencies from the report.","title":"*.deps.json"},{"location":"docs/coverage/language/dotnet/#packagesconfig","text":"Trivy only finds dependency names and versions from packages.config files. To build dependency graph, it is better to use packages.lock.json files.","title":"packages.config"},{"location":"docs/coverage/language/dotnet/#license-detection","text":"packages.config files don't have information about the licenses used. Trivy uses *.nuspec files from global packages folder to detect licenses. Note The licenseUrl field is deprecated . Trivy doesn't parse this field and only checks the license field (license expression type only). Currently only the default path and NUGET_PACKAGES environment variable are supported.","title":"license detection"},{"location":"docs/coverage/language/dotnet/#packageslockjson","text":"Don't forgot to enable lock files in your project. Tip Please make sure your lock file is up-to-date after modifying dependencies.","title":"packages.lock.json"},{"location":"docs/coverage/language/dotnet/#license-detection_1","text":"Same as packages.config","title":"license detection"},{"location":"docs/coverage/language/elixir/","text":"Elixir Trivy supports Hex repository for Elixir . The following scanners are supported. Package manager SBOM Vulnerability License hex \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position hex mix.lock 1 \u2713 Excluded - \u2713 Hex In order to detect dependencies, Trivy searches for mix.lock 1 . Configure your project to use mix.lock 1 file. mix.lock is default name. To scan a custom filename use file-patterns \u21a9 \u21a9 \u21a9","title":"Elixir"},{"location":"docs/coverage/language/elixir/#elixir","text":"Trivy supports Hex repository for Elixir . The following scanners are supported. Package manager SBOM Vulnerability License hex \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position hex mix.lock 1 \u2713 Excluded - \u2713","title":"Elixir"},{"location":"docs/coverage/language/elixir/#hex","text":"In order to detect dependencies, Trivy searches for mix.lock 1 . Configure your project to use mix.lock 1 file. mix.lock is default name. To scan a custom filename use file-patterns \u21a9 \u21a9 \u21a9","title":"Hex"},{"location":"docs/coverage/language/golang/","text":"Go Features Trivy supports two types of Go scanning, Go Modules and binaries built by Go. The following scanners are supported. Artifact SBOM Vulnerability License Modules \u2713 \u2713 \u2713 2 Binaries \u2713 \u2713 - The table below provides an outline of the features Trivy offers. Artifact Offline 1 Dev dependencies Dependency graph Modules \u2705 Include \u2705 2 Binaries \u2705 Exclude - Note Trivy scans only dependencies of the Go project. Let's say you scan the Docker binary, Trivy doesn't detect vulnerabilities of Docker itself. Also, when you scan go.mod in Kubernetes, the Kubernetes vulnerabilities will not be found. Go Modules Depending on Go versions, the required files are different. Version Required files Offline >=1.17 go.mod \u2705 <1.17 go.mod, go.sum \u2705 In Go 1.17+ projects, Trivy uses go.mod for direct/indirect dependencies. On the other hand, it uses go.mod for direct dependencies and go.sum for indirect dependencies in Go 1.16 or less. Go 1.17+ holds actually needed indirect dependencies in go.mod , and it reduces false detection. go.sum in Go 1.16 or less contains all indirect dependencies that are even not needed for compiling. If you want to have better detection, please consider updating the Go version in your project. Note The Go version doesn't mean your CLI version, but the Go version in your go.mod. module github.com/aquasecurity/trivy go 1.18 require ( github.com/CycloneDX/cyclonedx-go v0.5.0 ... ) To update the Go version in your project, you need to run the following command. $ go mod tidy -go=1.18 To identify licenses and dependency relationships, you need to download modules to local cache beforehand, such as go mod download , go mod tidy , etc. Trivy traverses $GOPATH/pkg/mod and collects those extra information. Go binaries Trivy scans binaries built by Go. If there is a Go binary in your container image, Trivy automatically finds and scans it. Also, you can scan your local binaries. $ trivy fs ./your_binary Note It doesn't work with UPX-compressed binaries. It doesn't require the Internet access. \u21a9 Need to download modules to local cache beforehand \u21a9 \u21a9","title":"Go"},{"location":"docs/coverage/language/golang/#go","text":"","title":"Go"},{"location":"docs/coverage/language/golang/#features","text":"Trivy supports two types of Go scanning, Go Modules and binaries built by Go. The following scanners are supported. Artifact SBOM Vulnerability License Modules \u2713 \u2713 \u2713 2 Binaries \u2713 \u2713 - The table below provides an outline of the features Trivy offers. Artifact Offline 1 Dev dependencies Dependency graph Modules \u2705 Include \u2705 2 Binaries \u2705 Exclude - Note Trivy scans only dependencies of the Go project. Let's say you scan the Docker binary, Trivy doesn't detect vulnerabilities of Docker itself. Also, when you scan go.mod in Kubernetes, the Kubernetes vulnerabilities will not be found.","title":"Features"},{"location":"docs/coverage/language/golang/#go-modules","text":"Depending on Go versions, the required files are different. Version Required files Offline >=1.17 go.mod \u2705 <1.17 go.mod, go.sum \u2705 In Go 1.17+ projects, Trivy uses go.mod for direct/indirect dependencies. On the other hand, it uses go.mod for direct dependencies and go.sum for indirect dependencies in Go 1.16 or less. Go 1.17+ holds actually needed indirect dependencies in go.mod , and it reduces false detection. go.sum in Go 1.16 or less contains all indirect dependencies that are even not needed for compiling. If you want to have better detection, please consider updating the Go version in your project. Note The Go version doesn't mean your CLI version, but the Go version in your go.mod. module github.com/aquasecurity/trivy go 1.18 require ( github.com/CycloneDX/cyclonedx-go v0.5.0 ... ) To update the Go version in your project, you need to run the following command. $ go mod tidy -go=1.18 To identify licenses and dependency relationships, you need to download modules to local cache beforehand, such as go mod download , go mod tidy , etc. Trivy traverses $GOPATH/pkg/mod and collects those extra information.","title":"Go Modules"},{"location":"docs/coverage/language/golang/#go-binaries","text":"Trivy scans binaries built by Go. If there is a Go binary in your container image, Trivy automatically finds and scans it. Also, you can scan your local binaries. $ trivy fs ./your_binary Note It doesn't work with UPX-compressed binaries. It doesn't require the Internet access. \u21a9 Need to download modules to local cache beforehand \u21a9 \u21a9","title":"Go binaries"},{"location":"docs/coverage/language/java/","text":"Java Trivy supports three types of Java scanning: JAR/WAR/PAR/EAR , pom.xml and *gradle.lockfile files. Each artifact supports the following scanners: Artifact SBOM Vulnerability License JAR/WAR/PAR/EAR \u2713 \u2713 - pom.xml \u2713 \u2713 \u2713 *gradle.lockfile \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Artifact Internet access Dev dependencies Dependency graph JAR/WAR/PAR/EAR Trivy Java DB Include - pom.xml Maven repository 1 Exclude \u2713 *gradle.lockfile - Exclude - These may be enabled or disabled depending on the target. See here for the detail. JAR/WAR/PAR/EAR To find information about your JAR 2 file, Trivy parses pom.properties and MANIFEST.MF files in your JAR 2 file and takes required properties 3 . If those files don't exist or don't contain enough information - Trivy will try to find this JAR 2 file in trivy-java-db . The Java DB will be automatically downloaded/updated when any JAR 2 file is found. It is stored in the cache directory . EXPERIMENTAL Finding JARs in trivy-java-db is an experimental function. Base JAR 2 may contain inner JARs 2 within itself. To find information about these JARs 2 , the same logic is used as for the base JAR 2 . table format only contains the name of root JAR 2 . To get the full path to inner JARs 2 use the json format. pom.xml Trivy parses your pom.xml file and tries to find files with dependencies from these local locations. project directory 4 relativePath field 5 local repository directory 6 . If your machine doesn't have the necessary files - Trivy tries to find the information about these dependencies in the maven repository . Note Trivy only takes information about packages. We don't take a list of vulnerabilities for packages from the maven repository . Information about data sources for Java you can see here . You can disable connecting to the maven repository with the --offline-scan flag. The --offline-scan flag does not affect the Trivy database. The vulnerability database will be downloaded anyway. Warning Trivy may skip some dependencies (that were not found on your local machine) when the --offline-scan flag is passed. Gradle.lock gradle.lock files contain all necessary information about used dependencies. Trivy simply parses the file, extract dependencies, and finds vulnerabilities for them. It doesn't require the internet access. Uses maven repository to get information about dependencies. Internet access required. \u21a9 It means *.jar , *.war , *.par and *.ear file \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 ArtifactID , GroupID and Version \u21a9 e.g. when parent pom.xml file has ../pom.xml path \u21a9 When you use dependency path in relativePath field in pom.xml file \u21a9 /Users/<username>/.m2/repository (for Linux and Mac) and C:/Users/<username>/.m2/repository (for Windows) by default \u21a9","title":"Java"},{"location":"docs/coverage/language/java/#java","text":"Trivy supports three types of Java scanning: JAR/WAR/PAR/EAR , pom.xml and *gradle.lockfile files. Each artifact supports the following scanners: Artifact SBOM Vulnerability License JAR/WAR/PAR/EAR \u2713 \u2713 - pom.xml \u2713 \u2713 \u2713 *gradle.lockfile \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Artifact Internet access Dev dependencies Dependency graph JAR/WAR/PAR/EAR Trivy Java DB Include - pom.xml Maven repository 1 Exclude \u2713 *gradle.lockfile - Exclude - These may be enabled or disabled depending on the target. See here for the detail.","title":"Java"},{"location":"docs/coverage/language/java/#jarwarparear","text":"To find information about your JAR 2 file, Trivy parses pom.properties and MANIFEST.MF files in your JAR 2 file and takes required properties 3 . If those files don't exist or don't contain enough information - Trivy will try to find this JAR 2 file in trivy-java-db . The Java DB will be automatically downloaded/updated when any JAR 2 file is found. It is stored in the cache directory . EXPERIMENTAL Finding JARs in trivy-java-db is an experimental function. Base JAR 2 may contain inner JARs 2 within itself. To find information about these JARs 2 , the same logic is used as for the base JAR 2 . table format only contains the name of root JAR 2 . To get the full path to inner JARs 2 use the json format.","title":"JAR/WAR/PAR/EAR"},{"location":"docs/coverage/language/java/#pomxml","text":"Trivy parses your pom.xml file and tries to find files with dependencies from these local locations. project directory 4 relativePath field 5 local repository directory 6 . If your machine doesn't have the necessary files - Trivy tries to find the information about these dependencies in the maven repository . Note Trivy only takes information about packages. We don't take a list of vulnerabilities for packages from the maven repository . Information about data sources for Java you can see here . You can disable connecting to the maven repository with the --offline-scan flag. The --offline-scan flag does not affect the Trivy database. The vulnerability database will be downloaded anyway. Warning Trivy may skip some dependencies (that were not found on your local machine) when the --offline-scan flag is passed.","title":"pom.xml"},{"location":"docs/coverage/language/java/#gradlelock","text":"gradle.lock files contain all necessary information about used dependencies. Trivy simply parses the file, extract dependencies, and finds vulnerabilities for them. It doesn't require the internet access. Uses maven repository to get information about dependencies. Internet access required. \u21a9 It means *.jar , *.war , *.par and *.ear file \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 \u21a9 ArtifactID , GroupID and Version \u21a9 e.g. when parent pom.xml file has ../pom.xml path \u21a9 When you use dependency path in relativePath field in pom.xml file \u21a9 /Users/<username>/.m2/repository (for Linux and Mac) and C:/Users/<username>/.m2/repository (for Windows) by default \u21a9","title":"Gradle.lock"},{"location":"docs/coverage/language/nodejs/","text":"Node.js Trivy supports three types of Node.js package managers: npm , Yarn and pnpm . The following scanners are supported. Artifact SBOM Vulnerability License npm \u2713 \u2713 \u2713 Yarn \u2713 \u2713 \u2713 pnpm \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position npm package-lock.json \u2713 Excluded \u2713 \u2713 Yarn yarn.lock \u2713 Excluded \u2713 \u2713 pnpm pnpm-lock.yaml \u2713 Excluded \u2713 - In addition, Trivy scans installed packages with package.json . File Dependency graph Position License package.json - - \u2705 These may be enabled or disabled depending on the target. See here for the detail. Package managers Trivy parses your files generated by package managers in filesystem/repository scanning. Tip Please make sure your lock file is up-to-date after modifying package.json . npm Trivy parses package-lock.json . To identify licenses, you need to download dependencies to node_modules beforehand. Trivy analyzes node_modules for licenses. By default, Trivy doesn't report development dependencies. Use the --include-dev-deps flag to include them. Yarn Trivy parses yarn.lock , which doesn't contain information about development dependencies. To exclude devDependencies, package.json also needs to be present next to yarn.lock . Trivy analyzes .yarn (Yarn 2+) or node_modules (Yarn Classic) folder next to the yarn.lock file to detect licenses. By default, Trivy doesn't report development dependencies. Use the --include-dev-deps flag to include them. pnpm Trivy parses pnpm-lock.yaml , then finds production dependencies and builds a tree of dependencies with vulnerabilities. Packages Trivy parses the manifest files of installed packages in container image scanning and so on. package.json Trivy searches for package.json files under node_modules and identifies installed packages. It only extracts package names, versions and licenses for those packages.","title":"Node.js"},{"location":"docs/coverage/language/nodejs/#nodejs","text":"Trivy supports three types of Node.js package managers: npm , Yarn and pnpm . The following scanners are supported. Artifact SBOM Vulnerability License npm \u2713 \u2713 \u2713 Yarn \u2713 \u2713 \u2713 pnpm \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position npm package-lock.json \u2713 Excluded \u2713 \u2713 Yarn yarn.lock \u2713 Excluded \u2713 \u2713 pnpm pnpm-lock.yaml \u2713 Excluded \u2713 - In addition, Trivy scans installed packages with package.json . File Dependency graph Position License package.json - - \u2705 These may be enabled or disabled depending on the target. See here for the detail.","title":"Node.js"},{"location":"docs/coverage/language/nodejs/#package-managers","text":"Trivy parses your files generated by package managers in filesystem/repository scanning. Tip Please make sure your lock file is up-to-date after modifying package.json .","title":"Package managers"},{"location":"docs/coverage/language/nodejs/#npm","text":"Trivy parses package-lock.json . To identify licenses, you need to download dependencies to node_modules beforehand. Trivy analyzes node_modules for licenses. By default, Trivy doesn't report development dependencies. Use the --include-dev-deps flag to include them.","title":"npm"},{"location":"docs/coverage/language/nodejs/#yarn","text":"Trivy parses yarn.lock , which doesn't contain information about development dependencies. To exclude devDependencies, package.json also needs to be present next to yarn.lock . Trivy analyzes .yarn (Yarn 2+) or node_modules (Yarn Classic) folder next to the yarn.lock file to detect licenses. By default, Trivy doesn't report development dependencies. Use the --include-dev-deps flag to include them.","title":"Yarn"},{"location":"docs/coverage/language/nodejs/#pnpm","text":"Trivy parses pnpm-lock.yaml , then finds production dependencies and builds a tree of dependencies with vulnerabilities.","title":"pnpm"},{"location":"docs/coverage/language/nodejs/#packages","text":"Trivy parses the manifest files of installed packages in container image scanning and so on.","title":"Packages"},{"location":"docs/coverage/language/nodejs/#packagejson","text":"Trivy searches for package.json files under node_modules and identifies installed packages. It only extracts package names, versions and licenses for those packages.","title":"package.json"},{"location":"docs/coverage/language/php/","text":"PHP Trivy supports Composer , which is a tool for dependency management in PHP. The following scanners are supported. Package manager SBOM Vulnerability License Composer \u2713 \u2713 \u2713 The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Composer composer.lock \u2713 Excluded \u2713 \u2713 Composer In order to detect dependencies, Trivy searches for composer.lock . Trivy also supports dependency trees; however, to display an accurate tree, it needs to know whether each package is a direct dependency of the project. Since this information is not included in composer.lock , Trivy parses composer.json , which should be located next to composer.lock . If you want to see the dependency tree, please ensure that composer.json is present.","title":"PHP"},{"location":"docs/coverage/language/php/#php","text":"Trivy supports Composer , which is a tool for dependency management in PHP. The following scanners are supported. Package manager SBOM Vulnerability License Composer \u2713 \u2713 \u2713 The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Composer composer.lock \u2713 Excluded \u2713 \u2713","title":"PHP"},{"location":"docs/coverage/language/php/#composer","text":"In order to detect dependencies, Trivy searches for composer.lock . Trivy also supports dependency trees; however, to display an accurate tree, it needs to know whether each package is a direct dependency of the project. Since this information is not included in composer.lock , Trivy parses composer.json , which should be located next to composer.lock . If you want to see the dependency tree, please ensure that composer.json is present.","title":"Composer"},{"location":"docs/coverage/language/python/","text":"Python Trivy supports three types of Python package managers: pip , Pipenv and Poetry . The following scanners are supported for package managers. Package manager SBOM Vulnerability License pip \u2713 \u2713 - Pipenv \u2713 \u2713 - Poetry \u2713 \u2713 - In addition, Trivy supports three formats of Python packages: egg , wheel and conda . The following scanners are supported for Python packages. Packaging SBOM Vulnerability License Egg \u2713 \u2713 \u2713 Wheel \u2713 \u2713 \u2713 Conda \u2713 - - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position pip requirements.txt - Include - - Pipenv Pipfile.lock \u2713 Include - \u2713 Poetry poetry.lock \u2713 Exclude \u2713 Packaging Dependency graph Egg \u2713 Wheel \u2713 These may be enabled or disabled depending on the target. See here for the detail. Package managers Trivy parses your files generated by package managers in filesystem/repository scanning. pip requirements.txt files usually contain only the direct dependencies and not contain the transitive dependencies. Therefore, Trivy scans only for the direct dependencies with requirements.txt . To detect transitive dependencies as well, you need to generate requirements.txt with pip freeze . $ cat requirements.txt # it will only find `requests@2.28.2`. requests == 2 .28.2 $ pip install -r requirements.txt ... $ pip freeze > requirements.txt $ cat requirements.txt # it will also find the transitive dependencies of `requests@2.28.2`. certifi == 2022 .12.7 charset-normalizer == 3 .1.0 idna == 3 .4 PyJWT == 2 .1.0 requests == 2 .28.2 urllib3 == 1 .26.15 pip freeze also helps to resolve extras (optional) dependencies (like package[extras]=0.0.0 ). requirements.txt files don't contain information about dependencies used for development. Trivy could detect vulnerabilities on the development packages, which not affect your production environment. License detection is not supported for pip . Pipenv Trivy parses Pipfile.lock . Pipfile.lock files don't contain information about dependencies used for development. Trivy could detect vulnerabilities on the development packages, which not affect your production environment. License detection is not supported for Pipenv . Poetry Trivy uses poetry.lock to identify dependencies and find vulnerabilities. To build the correct dependency graph, pyproject.toml also needs to be present next to poetry.lock . License detection is not supported for Poetry . Packaging Trivy parses the manifest files of installed packages in container image scanning and so on. See here for the detail. Egg Trivy looks for *.egg-info , *.egg-info/PKG-INFO , *.egg and EGG-INFO/PKG-INFO to identify Python packages. Wheel Trivy looks for .dist-info/META-DATA to identify Python packages.","title":"Python"},{"location":"docs/coverage/language/python/#python","text":"Trivy supports three types of Python package managers: pip , Pipenv and Poetry . The following scanners are supported for package managers. Package manager SBOM Vulnerability License pip \u2713 \u2713 - Pipenv \u2713 \u2713 - Poetry \u2713 \u2713 - In addition, Trivy supports three formats of Python packages: egg , wheel and conda . The following scanners are supported for Python packages. Packaging SBOM Vulnerability License Egg \u2713 \u2713 \u2713 Wheel \u2713 \u2713 \u2713 Conda \u2713 - - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position pip requirements.txt - Include - - Pipenv Pipfile.lock \u2713 Include - \u2713 Poetry poetry.lock \u2713 Exclude \u2713 Packaging Dependency graph Egg \u2713 Wheel \u2713 These may be enabled or disabled depending on the target. See here for the detail.","title":"Python"},{"location":"docs/coverage/language/python/#package-managers","text":"Trivy parses your files generated by package managers in filesystem/repository scanning.","title":"Package managers"},{"location":"docs/coverage/language/python/#pip","text":"requirements.txt files usually contain only the direct dependencies and not contain the transitive dependencies. Therefore, Trivy scans only for the direct dependencies with requirements.txt . To detect transitive dependencies as well, you need to generate requirements.txt with pip freeze . $ cat requirements.txt # it will only find `requests@2.28.2`. requests == 2 .28.2 $ pip install -r requirements.txt ... $ pip freeze > requirements.txt $ cat requirements.txt # it will also find the transitive dependencies of `requests@2.28.2`. certifi == 2022 .12.7 charset-normalizer == 3 .1.0 idna == 3 .4 PyJWT == 2 .1.0 requests == 2 .28.2 urllib3 == 1 .26.15 pip freeze also helps to resolve extras (optional) dependencies (like package[extras]=0.0.0 ). requirements.txt files don't contain information about dependencies used for development. Trivy could detect vulnerabilities on the development packages, which not affect your production environment. License detection is not supported for pip .","title":"pip"},{"location":"docs/coverage/language/python/#pipenv","text":"Trivy parses Pipfile.lock . Pipfile.lock files don't contain information about dependencies used for development. Trivy could detect vulnerabilities on the development packages, which not affect your production environment. License detection is not supported for Pipenv .","title":"Pipenv"},{"location":"docs/coverage/language/python/#poetry","text":"Trivy uses poetry.lock to identify dependencies and find vulnerabilities. To build the correct dependency graph, pyproject.toml also needs to be present next to poetry.lock . License detection is not supported for Poetry .","title":"Poetry"},{"location":"docs/coverage/language/python/#packaging","text":"Trivy parses the manifest files of installed packages in container image scanning and so on. See here for the detail.","title":"Packaging"},{"location":"docs/coverage/language/python/#egg","text":"Trivy looks for *.egg-info , *.egg-info/PKG-INFO , *.egg and EGG-INFO/PKG-INFO to identify Python packages.","title":"Egg"},{"location":"docs/coverage/language/python/#wheel","text":"Trivy looks for .dist-info/META-DATA to identify Python packages.","title":"Wheel"},{"location":"docs/coverage/language/ruby/","text":"Ruby Trivy supports Bundler and RubyGems . The following scanners are supported for Cargo. Package manager SBOM Vulnerability License Bundler \u2713 \u2713 - RubyGems \u2713 \u2713 \u2713 The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Bundler Gemfile.lock \u2713 Included \u2713 \u2713 RubyGems .gemspec - Included - - Bundler Trivy searches for Gemfile.lock to detect dependencies. RubyGems .gemspec files doesn't contains transitive dependencies. You need to scan each .gemspec file separately.","title":"Ruby"},{"location":"docs/coverage/language/ruby/#ruby","text":"Trivy supports Bundler and RubyGems . The following scanners are supported for Cargo. Package manager SBOM Vulnerability License Bundler \u2713 \u2713 - RubyGems \u2713 \u2713 \u2713 The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Bundler Gemfile.lock \u2713 Included \u2713 \u2713 RubyGems .gemspec - Included - -","title":"Ruby"},{"location":"docs/coverage/language/ruby/#bundler","text":"Trivy searches for Gemfile.lock to detect dependencies.","title":"Bundler"},{"location":"docs/coverage/language/ruby/#rubygems","text":".gemspec files doesn't contains transitive dependencies. You need to scan each .gemspec file separately.","title":"RubyGems"},{"location":"docs/coverage/language/rust/","text":"Rust Trivy supports Cargo , which is the Rust package manager. The following scanners are supported for Cargo. Package manager SBOM Vulnerability License Cargo \u2713 \u2713 - In addition, it supports binaries built with cargo-auditable . Artifact SBOM Vulnerability License Binaries \u2713 \u2713 - Features The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Cargo Cargo.lock \u2713 Excluded 1 \u2713 \u2713 Artifact Transitive dependencies Dev dependencies Dependency graph Position Binaries \u2713 Excluded - - Cargo Trivy searches for Cargo.lock to detect dependencies. Trivy also supports dependency trees; however, to display an accurate tree, it needs to know whether each package is a direct dependency of the project. Since this information is not included in Cargo.lock , Trivy parses Cargo.toml , which should be located next to Cargo.lock . If you want to see the dependency tree, please ensure that Cargo.toml is present. Scan Cargo.lock and Cargo.toml together also removes developer dependencies. Binaries Trivy scans binaries built with cargo-auditable . If such a binary exists, Trivy will identify it as being built with cargo-audit and scan it. When you scan Cargo.lock and Cargo.toml together. \u21a9","title":"Rust"},{"location":"docs/coverage/language/rust/#rust","text":"Trivy supports Cargo , which is the Rust package manager. The following scanners are supported for Cargo. Package manager SBOM Vulnerability License Cargo \u2713 \u2713 - In addition, it supports binaries built with cargo-auditable . Artifact SBOM Vulnerability License Binaries \u2713 \u2713 -","title":"Rust"},{"location":"docs/coverage/language/rust/#features","text":"The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Cargo Cargo.lock \u2713 Excluded 1 \u2713 \u2713 Artifact Transitive dependencies Dev dependencies Dependency graph Position Binaries \u2713 Excluded - -","title":"Features"},{"location":"docs/coverage/language/rust/#cargo","text":"Trivy searches for Cargo.lock to detect dependencies. Trivy also supports dependency trees; however, to display an accurate tree, it needs to know whether each package is a direct dependency of the project. Since this information is not included in Cargo.lock , Trivy parses Cargo.toml , which should be located next to Cargo.lock . If you want to see the dependency tree, please ensure that Cargo.toml is present. Scan Cargo.lock and Cargo.toml together also removes developer dependencies.","title":"Cargo"},{"location":"docs/coverage/language/rust/#binaries","text":"Trivy scans binaries built with cargo-auditable . If such a binary exists, Trivy will identify it as being built with cargo-audit and scan it. When you scan Cargo.lock and Cargo.toml together. \u21a9","title":"Binaries"},{"location":"docs/coverage/language/swift/","text":"Swift Trivy supports CocoaPods and Swift package managers. The following scanners are supported. Package manager SBOM Vulnerability License Swift \u2713 \u2713 - CocoaPods \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Swift Package.resolved \u2713 Included - \u2713 CocoaPods Podfile.lock \u2713 Included \u2713 - These may be enabled or disabled depending on the target. See here for the detail. Swift Trivy parses Package.resolved file to find dependencies. Don't forget to update ( swift package update command) this file before scanning. CocoaPods CocoaPods uses package names in PodFile.lock , but GitHub Advisory Database (GHSA) Trivy relies on uses Git URLs. We parse the CocoaPods Specs to match package names and links. Limitation Since GHSA holds only Git URLs, such as github.com/apple/swift-nio, Trivy can't identify affected submodules, and detect all submodules maintained by the same URL. For example, SwiftNIOHTTP1 and SwiftNIOWebSocket both are maintained under github.com/apple/swift-nio , and Trivy detect CVE-2022-3215 for both of them, even though only SwiftNIOHTTP1 is actually affected.","title":"Swift"},{"location":"docs/coverage/language/swift/#swift","text":"Trivy supports CocoaPods and Swift package managers. The following scanners are supported. Package manager SBOM Vulnerability License Swift \u2713 \u2713 - CocoaPods \u2713 \u2713 - The following table provides an outline of the features Trivy offers. Package manager File Transitive dependencies Dev dependencies Dependency graph Position Swift Package.resolved \u2713 Included - \u2713 CocoaPods Podfile.lock \u2713 Included \u2713 - These may be enabled or disabled depending on the target. See here for the detail.","title":"Swift"},{"location":"docs/coverage/language/swift/#swift_1","text":"Trivy parses Package.resolved file to find dependencies. Don't forget to update ( swift package update command) this file before scanning.","title":"Swift"},{"location":"docs/coverage/language/swift/#cocoapods","text":"CocoaPods uses package names in PodFile.lock , but GitHub Advisory Database (GHSA) Trivy relies on uses Git URLs. We parse the CocoaPods Specs to match package names and links. Limitation Since GHSA holds only Git URLs, such as github.com/apple/swift-nio, Trivy can't identify affected submodules, and detect all submodules maintained by the same URL. For example, SwiftNIOHTTP1 and SwiftNIOWebSocket both are maintained under github.com/apple/swift-nio , and Trivy detect CVE-2022-3215 for both of them, even though only SwiftNIOHTTP1 is actually affected.","title":"CocoaPods"},{"location":"docs/coverage/os/","text":"OS Scanner Trivy supports operating systems for SBOM Vulnerabilities Licenses Supported OS OS Supported Versions Package Managers Alpine Linux 2.2 - 2.7, 3.0 - 3.18, edge apk Wolfi Linux (n/a) apk Chainguard (n/a) apk Red Hat Enterprise Linux 6, 7, 8 dnf/yum/rpm CentOS 1 6, 7, 8 dnf/yum/rpm AlmaLinux 8, 9 dnf/yum/rpm Rocky Linux 8, 9 dnf/yum/rpm Oracle Linux 5, 6, 7, 8 dnf/yum/rpm CBL-Mariner 1.0, 2.0 dnf/yum/rpm Amazon Linux 1, 2, 2023 dnf/yum/rpm openSUSE Leap 42, 15 zypper/rpm SUSE Enterprise Linux 11, 12, 15 zypper/rpm Photon OS 1.0, 2.0, 3.0, 4.0 tndf/yum/rpm Debian GNU/Linux 7, 8, 9, 10, 11, 12 apt/dpkg Ubuntu All versions supported by Canonical apt/dpkg Supported container images Container image Supported Versions Package Managers Google Distroless 2 Any apt/dpkg Bitnami Any - Each page gives more details. CentOS Stream is not supported \u21a9 https://github.com/GoogleContainerTools/distroless \u21a9","title":"Overview"},{"location":"docs/coverage/os/#os","text":"","title":"OS"},{"location":"docs/coverage/os/#scanner","text":"Trivy supports operating systems for SBOM Vulnerabilities Licenses","title":"Scanner"},{"location":"docs/coverage/os/#supported-os","text":"OS Supported Versions Package Managers Alpine Linux 2.2 - 2.7, 3.0 - 3.18, edge apk Wolfi Linux (n/a) apk Chainguard (n/a) apk Red Hat Enterprise Linux 6, 7, 8 dnf/yum/rpm CentOS 1 6, 7, 8 dnf/yum/rpm AlmaLinux 8, 9 dnf/yum/rpm Rocky Linux 8, 9 dnf/yum/rpm Oracle Linux 5, 6, 7, 8 dnf/yum/rpm CBL-Mariner 1.0, 2.0 dnf/yum/rpm Amazon Linux 1, 2, 2023 dnf/yum/rpm openSUSE Leap 42, 15 zypper/rpm SUSE Enterprise Linux 11, 12, 15 zypper/rpm Photon OS 1.0, 2.0, 3.0, 4.0 tndf/yum/rpm Debian GNU/Linux 7, 8, 9, 10, 11, 12 apt/dpkg Ubuntu All versions supported by Canonical apt/dpkg","title":"Supported OS"},{"location":"docs/coverage/os/#supported-container-images","text":"Container image Supported Versions Package Managers Google Distroless 2 Any apt/dpkg Bitnami Any - Each page gives more details. CentOS Stream is not supported \u21a9 https://github.com/GoogleContainerTools/distroless \u21a9","title":"Supported container images"},{"location":"docs/coverage/os/alma/","text":"AlmaLinux Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as dnf and yum . Vulnerability AlmaLinux offers its own security advisories, and these are utilized when scanning AlmaLinux for vulnerabilities. Data Source See here . Fixed Version When looking at fixed versions, it's crucial to consider the patches supplied by AlmaLinux. For example, for CVE-2023-0464, the fixed version for AlmaLinux 9 is listed as 3.0.7-16.el9_2 in their advisory . Note that this is different from the upstream fixed version, which is 3.0.9 , 3.1.1 , and son on. Typically, only the upstream information gets listed on NVD , so it's important not to get confused. Severity Trivy calculates the severity of an issue based on the severity provided by AlmaLinux. If the severity is not provided or defined yet by AlmaLinux, the severity from the NVD is taken into account. Using CVE-2023-0464 as an example, while it is rated as \"High\" in NVD, AlmaLinux has marked as \"moderate\" . As a result, Trivy will display it as \"Medium\". The table below is the mapping of AlmaLinux's severity to Trivy's severity levels. AlmaLinux Trivy Low Low Moderate Medium Important High Critical Critical Status Trivy supports the following vulnerability statuses for AlmaLinux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Trivy identifies licenses by examining the metadata of RPM packages.","title":"AlmaLinux"},{"location":"docs/coverage/os/alma/#almalinux","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"AlmaLinux"},{"location":"docs/coverage/os/alma/#sbom","text":"Trivy detects packages that have been installed through package managers such as dnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/alma/#vulnerability","text":"AlmaLinux offers its own security advisories, and these are utilized when scanning AlmaLinux for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/alma/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/alma/#fixed-version","text":"When looking at fixed versions, it's crucial to consider the patches supplied by AlmaLinux. For example, for CVE-2023-0464, the fixed version for AlmaLinux 9 is listed as 3.0.7-16.el9_2 in their advisory . Note that this is different from the upstream fixed version, which is 3.0.9 , 3.1.1 , and son on. Typically, only the upstream information gets listed on NVD , so it's important not to get confused.","title":"Fixed Version"},{"location":"docs/coverage/os/alma/#severity","text":"Trivy calculates the severity of an issue based on the severity provided by AlmaLinux. If the severity is not provided or defined yet by AlmaLinux, the severity from the NVD is taken into account. Using CVE-2023-0464 as an example, while it is rated as \"High\" in NVD, AlmaLinux has marked as \"moderate\" . As a result, Trivy will display it as \"Medium\". The table below is the mapping of AlmaLinux's severity to Trivy's severity levels. AlmaLinux Trivy Low Low Moderate Medium Important High Critical Critical","title":"Severity"},{"location":"docs/coverage/os/alma/#status","text":"Trivy supports the following vulnerability statuses for AlmaLinux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/alma/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages.","title":"License"},{"location":"docs/coverage/os/alpine/","text":"Alpine Linux Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages that have been installed through apk . Vulnerability Alpine Linux offers its own security advisories, and these are utilized when scanning Alpine for vulnerabilities. Data Source See here . Fixed Version When looking at fixed versions, it's crucial to consider the patches supplied by Alpine. For example, for CVE-2023-0464, the fixed version for Alpine Linux is listed as 3.1.0-r1 in the secfixes . Note that this is different from the upstream fixed version, which is 3.1.1 . Typically, only the upstream information gets listed on NVD , so it's important not to get confused. Severity For Alpine vulnerabilities, the severity is determined using the values set by NVD. Status Trivy supports the following vulnerability statuses for Alpine. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Trivy identifies licenses by examining the metadata of APK packages.","title":"Alpine Linux"},{"location":"docs/coverage/os/alpine/#alpine-linux","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"Alpine Linux"},{"location":"docs/coverage/os/alpine/#sbom","text":"Trivy detects packages that have been installed through apk .","title":"SBOM"},{"location":"docs/coverage/os/alpine/#vulnerability","text":"Alpine Linux offers its own security advisories, and these are utilized when scanning Alpine for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/alpine/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/alpine/#fixed-version","text":"When looking at fixed versions, it's crucial to consider the patches supplied by Alpine. For example, for CVE-2023-0464, the fixed version for Alpine Linux is listed as 3.1.0-r1 in the secfixes . Note that this is different from the upstream fixed version, which is 3.1.1 . Typically, only the upstream information gets listed on NVD , so it's important not to get confused.","title":"Fixed Version"},{"location":"docs/coverage/os/alpine/#severity","text":"For Alpine vulnerabilities, the severity is determined using the values set by NVD.","title":"Severity"},{"location":"docs/coverage/os/alpine/#status","text":"Trivy supports the following vulnerability statuses for Alpine. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/alpine/#license","text":"Trivy identifies licenses by examining the metadata of APK packages.","title":"License"},{"location":"docs/coverage/os/amazon/","text":"Amazon Linux Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as dnf and yum . Vulnerability Amazon Linux offers its own security advisories, and these are utilized when scanning Amazon Linux for vulnerabilities. Data Source See here . Fixed Version When looking at fixed versions, it's crucial to consider the patches supplied by Amazon. For example, for CVE-2023-0464, the fixed version for Amazon Linux 2023 is listed as 3.0.8-1.amzn2023.0.2 in ALAS2023-2023-181 . Note that this is different from the upstream fixed version, which is 3.0.9 , 3.1.1 , and so on. Typically, only the upstream information gets listed on NVD , so it's important not to get confused. Severity Trivy determines vulnerability severity based on the severity metric provided by Amazon. For example, the security patch for CVE-2023-0464 in Amazon Linux 2023 is provided as ALAS2023-2023-181 . Its severity is rated as \"Medium\". Thus, even though it's evaluated as \"HIGH\" in the NVD, Trivy displays it with a severity of \"MEDIUM\". The table below is the mapping of Amazon's severity to Trivy's severity levels. Amazon Trivy Low Low Medium Medium Important High Critical Critical Status Trivy supports the following vulnerability statuses for Amazon Linux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Trivy identifies licenses by examining the metadata of RPM packages.","title":"Amazon Linux"},{"location":"docs/coverage/os/amazon/#amazon-linux","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"Amazon Linux"},{"location":"docs/coverage/os/amazon/#sbom","text":"Trivy detects packages that have been installed through package managers such as dnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/amazon/#vulnerability","text":"Amazon Linux offers its own security advisories, and these are utilized when scanning Amazon Linux for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/amazon/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/amazon/#fixed-version","text":"When looking at fixed versions, it's crucial to consider the patches supplied by Amazon. For example, for CVE-2023-0464, the fixed version for Amazon Linux 2023 is listed as 3.0.8-1.amzn2023.0.2 in ALAS2023-2023-181 . Note that this is different from the upstream fixed version, which is 3.0.9 , 3.1.1 , and so on. Typically, only the upstream information gets listed on NVD , so it's important not to get confused.","title":"Fixed Version"},{"location":"docs/coverage/os/amazon/#severity","text":"Trivy determines vulnerability severity based on the severity metric provided by Amazon. For example, the security patch for CVE-2023-0464 in Amazon Linux 2023 is provided as ALAS2023-2023-181 . Its severity is rated as \"Medium\". Thus, even though it's evaluated as \"HIGH\" in the NVD, Trivy displays it with a severity of \"MEDIUM\". The table below is the mapping of Amazon's severity to Trivy's severity levels. Amazon Trivy Low Low Medium Medium Important High Critical Critical","title":"Severity"},{"location":"docs/coverage/os/amazon/#status","text":"Trivy supports the following vulnerability statuses for Amazon Linux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/amazon/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages.","title":"License"},{"location":"docs/coverage/os/bitnami/","text":"Bitnami Images EXPERIMENTAL Scanning results may be inaccurate. While it is not an OS, this page describes the details of the container images provided by Bitnami . Bitnami images are based on Debian . Please see the Debian page for OS packages. Trivy supports the following scanners for Bitnami packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph - SBOM Trivy analyzes the SBOM information contained within the container images provided by Bitnami. The SBOM files are located at /opt/bitnami/<component>/.spdx-<component>.spdx . Vulnerability Since Bitnami has its own vulnerability database , it uses these for vulnerability detection of applications and packages distributed by Bitnami. Note Trivy does not support vulnerability detection of independently compiled binaries, so even if you scan container images like nginx:1.15.2 , vulnerabilities in Nginx cannot be detected. This is because main applications like Nginx are not installed by the package manager . However, in the case of Bitnami images, since these SBOMs are stored within the image, scanning bitnami/nginx:1.15.2 allows for the detection of vulnerabilities in Nginx. Fixed Version Trivy refers to the Bitnami database . Please note that these may differ from the upstream fixed versions. Severity Similar to Fixed versions, it follows Bitnami's vulnerability database. Status Trivy supports the following vulnerability statuses for Bitnami packages. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License If licenses are included in the SBOM distributed by Bitnami, they will be used for scanning.","title":"Bitnami (Images)"},{"location":"docs/coverage/os/bitnami/#bitnami-images","text":"EXPERIMENTAL Scanning results may be inaccurate. While it is not an OS, this page describes the details of the container images provided by Bitnami . Bitnami images are based on Debian . Please see the Debian page for OS packages. Trivy supports the following scanners for Bitnami packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph -","title":"Bitnami Images"},{"location":"docs/coverage/os/bitnami/#sbom","text":"Trivy analyzes the SBOM information contained within the container images provided by Bitnami. The SBOM files are located at /opt/bitnami/<component>/.spdx-<component>.spdx .","title":"SBOM"},{"location":"docs/coverage/os/bitnami/#vulnerability","text":"Since Bitnami has its own vulnerability database , it uses these for vulnerability detection of applications and packages distributed by Bitnami. Note Trivy does not support vulnerability detection of independently compiled binaries, so even if you scan container images like nginx:1.15.2 , vulnerabilities in Nginx cannot be detected. This is because main applications like Nginx are not installed by the package manager . However, in the case of Bitnami images, since these SBOMs are stored within the image, scanning bitnami/nginx:1.15.2 allows for the detection of vulnerabilities in Nginx.","title":"Vulnerability"},{"location":"docs/coverage/os/bitnami/#fixed-version","text":"Trivy refers to the Bitnami database . Please note that these may differ from the upstream fixed versions.","title":"Fixed Version"},{"location":"docs/coverage/os/bitnami/#severity","text":"Similar to Fixed versions, it follows Bitnami's vulnerability database.","title":"Severity"},{"location":"docs/coverage/os/bitnami/#status","text":"Trivy supports the following vulnerability statuses for Bitnami packages. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/bitnami/#license","text":"If licenses are included in the SBOM distributed by Bitnami, they will be used for scanning.","title":"License"},{"location":"docs/coverage/os/cbl-mariner/","text":"CBL-Mariner Trivy supports the following scanners for OS packages. Version SBOM Vulnerability License 1.0 \u2714 \u2714 \u2714 1.0 (Distroless) \u2714 \u2714 2.0 \u2714 \u2714 \u2714 2.0 (Distroless) \u2714 \u2714 The following table provides an outline of the targets Trivy supports. Version Container image Virtual machine Arch 1.0 \u2714 \u2714 amd64, arm64 2.0 \u2714 \u2714 amd64, arm64 The table below outlines the features offered by Trivy. Feature Supported Detect unfixed vulnerabilities \u2713 Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as dnf and yum . Vulnerability CBL-Mariner offers its own security advisories, and these are utilized when scanning CBL-Mariner for vulnerabilities. Data Source See here . Fixed Version Trivy takes fixed versions from CBL-Mariner OVAL . Severity Trivy calculates the severity of an issue based on the severity provided in CBL-Mariner OVAL . Status Trivy supports the following vulnerability statuses for CBL-Mariner. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Trivy identifies licenses by examining the metadata of RPM packages. Note License detection is not supported for CBL-Mariner Distroless.","title":"CBL-Mariner"},{"location":"docs/coverage/os/cbl-mariner/#cbl-mariner","text":"Trivy supports the following scanners for OS packages. Version SBOM Vulnerability License 1.0 \u2714 \u2714 \u2714 1.0 (Distroless) \u2714 \u2714 2.0 \u2714 \u2714 \u2714 2.0 (Distroless) \u2714 \u2714 The following table provides an outline of the targets Trivy supports. Version Container image Virtual machine Arch 1.0 \u2714 \u2714 amd64, arm64 2.0 \u2714 \u2714 amd64, arm64 The table below outlines the features offered by Trivy. Feature Supported Detect unfixed vulnerabilities \u2713 Dependency graph \u2713","title":"CBL-Mariner"},{"location":"docs/coverage/os/cbl-mariner/#sbom","text":"Trivy detects packages that have been installed through package managers such as dnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/cbl-mariner/#vulnerability","text":"CBL-Mariner offers its own security advisories, and these are utilized when scanning CBL-Mariner for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/cbl-mariner/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/cbl-mariner/#fixed-version","text":"Trivy takes fixed versions from CBL-Mariner OVAL .","title":"Fixed Version"},{"location":"docs/coverage/os/cbl-mariner/#severity","text":"Trivy calculates the severity of an issue based on the severity provided in CBL-Mariner OVAL .","title":"Severity"},{"location":"docs/coverage/os/cbl-mariner/#status","text":"Trivy supports the following vulnerability statuses for CBL-Mariner. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/cbl-mariner/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages. Note License detection is not supported for CBL-Mariner Distroless.","title":"License"},{"location":"docs/coverage/os/centos/","text":"CentOS Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities \u2713 Dependency graph \u2713 SBOM Same as RHEL . Vulnerability CentOS does not provide straightforward machine-readable security advisories. As a result, Trivy utilizes the security advisories from Red Hat Enterprise Linux (RHEL) for detecting vulnerabilities in CentOS. This approach might lead to situations where, even though Trivy displays a fixed version, CentOS might not have the patch available yet. Since patches released for RHEL often become available in CentOS after some time, it's usually just a matter of waiting. Note The case for CentOS Stream, which is not supported by Trivy, is entirely different from CentOS. As Trivy relies on Red Hat's advisories, please refer to Red Hat for details regarding vulnerability severity and status. License Same as RHEL .","title":"CentOS"},{"location":"docs/coverage/os/centos/#centos","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities \u2713 Dependency graph \u2713","title":"CentOS"},{"location":"docs/coverage/os/centos/#sbom","text":"Same as RHEL .","title":"SBOM"},{"location":"docs/coverage/os/centos/#vulnerability","text":"CentOS does not provide straightforward machine-readable security advisories. As a result, Trivy utilizes the security advisories from Red Hat Enterprise Linux (RHEL) for detecting vulnerabilities in CentOS. This approach might lead to situations where, even though Trivy displays a fixed version, CentOS might not have the patch available yet. Since patches released for RHEL often become available in CentOS after some time, it's usually just a matter of waiting. Note The case for CentOS Stream, which is not supported by Trivy, is entirely different from CentOS. As Trivy relies on Red Hat's advisories, please refer to Red Hat for details regarding vulnerability severity and status.","title":"Vulnerability"},{"location":"docs/coverage/os/centos/#license","text":"Same as RHEL .","title":"License"},{"location":"docs/coverage/os/chainguard/","text":"Chainguard Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Detect unfixed vulnerabilities - Dependency graph \u2713 SBOM Same as Alpine Linux . Vulnerability Chainguard offers its own security advisories, and these are utilized when scanning Chainguard for vulnerabilities. Everything else is the same as Alpine Linux . Data Source See here . License Same as Alpine Linux .","title":"Chainguard"},{"location":"docs/coverage/os/chainguard/#chainguard","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Detect unfixed vulnerabilities - Dependency graph \u2713","title":"Chainguard"},{"location":"docs/coverage/os/chainguard/#sbom","text":"Same as Alpine Linux .","title":"SBOM"},{"location":"docs/coverage/os/chainguard/#vulnerability","text":"Chainguard offers its own security advisories, and these are utilized when scanning Chainguard for vulnerabilities. Everything else is the same as Alpine Linux .","title":"Vulnerability"},{"location":"docs/coverage/os/chainguard/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/chainguard/#license","text":"Same as Alpine Linux .","title":"License"},{"location":"docs/coverage/os/debian/","text":"Debian Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities \u2713 Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as apt and dpkg . While there are some exceptions, like Go binaries and JAR files, it's important to note that binaries that have been custom-built using make or tools installed via curl are generally not detected. Vulnerability Debian offers its own security advisories, and these are utilized when scanning Debian for vulnerabilities. Data Source See here . Fixed Version When looking at fixed versions, it's crucial to consider the patches supplied by Debian. For example, for CVE-2023-3269, the fixed version for Debian 12 (bookworm) is listed as 6.1.37-1 in the Security Tracker . This patch is provided in DSA-5448-1 . Note that this is different from the upstream fixed version, which is 6.5 . Typically, only the upstream information gets listed on NVD , so it's important not to get confused. Severity Trivy calculates the severity of an issue based on the 'Urgency' metric found in the Security Tracker. If 'Urgency' isn't provided by Debian, the severity from the NVD is taken into account. Using CVE-2019-15052 as an example, while it is rated as \"Critical\" in NVD, Debian has marked its \"Urgency\" as \"Low\" . As a result, Trivy will display it as \"Low\". Status Trivy supports the following vulnerability statuses for Debian. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred \u2713 End of Life \u2713 License To identify the license of a package, Trivy checks the copyright file located at /usr/share/doc/*/copyright . However, this method has its limitations as the file isn't machine-readable, leading to situations where the license isn't detected. In such scenarios, the --license-full flag can be passed. It compares the contents of known licenses with the copyright file to discern the license in question. Please be aware that using this flag can increase memory usage, so it's disabled by default for efficiency.","title":"Debian"},{"location":"docs/coverage/os/debian/#debian","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities \u2713 Dependency graph \u2713","title":"Debian"},{"location":"docs/coverage/os/debian/#sbom","text":"Trivy detects packages that have been installed through package managers such as apt and dpkg . While there are some exceptions, like Go binaries and JAR files, it's important to note that binaries that have been custom-built using make or tools installed via curl are generally not detected.","title":"SBOM"},{"location":"docs/coverage/os/debian/#vulnerability","text":"Debian offers its own security advisories, and these are utilized when scanning Debian for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/debian/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/debian/#fixed-version","text":"When looking at fixed versions, it's crucial to consider the patches supplied by Debian. For example, for CVE-2023-3269, the fixed version for Debian 12 (bookworm) is listed as 6.1.37-1 in the Security Tracker . This patch is provided in DSA-5448-1 . Note that this is different from the upstream fixed version, which is 6.5 . Typically, only the upstream information gets listed on NVD , so it's important not to get confused.","title":"Fixed Version"},{"location":"docs/coverage/os/debian/#severity","text":"Trivy calculates the severity of an issue based on the 'Urgency' metric found in the Security Tracker. If 'Urgency' isn't provided by Debian, the severity from the NVD is taken into account. Using CVE-2019-15052 as an example, while it is rated as \"Critical\" in NVD, Debian has marked its \"Urgency\" as \"Low\" . As a result, Trivy will display it as \"Low\".","title":"Severity"},{"location":"docs/coverage/os/debian/#status","text":"Trivy supports the following vulnerability statuses for Debian. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred \u2713 End of Life \u2713","title":"Status"},{"location":"docs/coverage/os/debian/#license","text":"To identify the license of a package, Trivy checks the copyright file located at /usr/share/doc/*/copyright . However, this method has its limitations as the file isn't machine-readable, leading to situations where the license isn't detected. In such scenarios, the --license-full flag can be passed. It compares the contents of known licenses with the copyright file to discern the license in question. Please be aware that using this flag can increase memory usage, so it's disabled by default for efficiency.","title":"License"},{"location":"docs/coverage/os/google-distroless/","text":"Google Distroless Images Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages pre-installed in distroless images. Vulnerability Google Distroless is based on Debian ; see there for details. License Google Distroless is based on Debian ; see there for details.","title":"Google Distroless (Images)"},{"location":"docs/coverage/os/google-distroless/#google-distroless-images","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"Google Distroless Images"},{"location":"docs/coverage/os/google-distroless/#sbom","text":"Trivy detects packages pre-installed in distroless images.","title":"SBOM"},{"location":"docs/coverage/os/google-distroless/#vulnerability","text":"Google Distroless is based on Debian ; see there for details.","title":"Vulnerability"},{"location":"docs/coverage/os/google-distroless/#license","text":"Google Distroless is based on Debian ; see there for details.","title":"License"},{"location":"docs/coverage/os/oracle/","text":"Oracle Linux Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as dnf and yum . Vulnerability Oracle Linux offers its own security advisories, and these are utilized when scanning Oracle Linux for vulnerabilities. Data Source See here . Fixed Version Trivy takes fixed versions from Oracle security advisories . Severity Trivy determines vulnerability severity based on the severity metric provided in Oracle security advisories . For example, the security patch for CVE-2023-0464 is provided as ELSA-2023-2645 . Its severity is rated as \"MODERATE\". Thus, even though it's evaluated as \"HIGH\" in the NVD, Trivy displays it with a severity of \"MEDIUM\". The table below is the mapping of Oracle's threat to Trivy's severity levels. Oracle Trivy Low Low Moderate Medium Important High Critical Critical Status Trivy supports the following vulnerability statuses for Oracle Linux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Trivy identifies licenses by examining the metadata of RPM packages.","title":"Oracle Linux"},{"location":"docs/coverage/os/oracle/#oracle-linux","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"Oracle Linux"},{"location":"docs/coverage/os/oracle/#sbom","text":"Trivy detects packages that have been installed through package managers such as dnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/oracle/#vulnerability","text":"Oracle Linux offers its own security advisories, and these are utilized when scanning Oracle Linux for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/oracle/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/oracle/#fixed-version","text":"Trivy takes fixed versions from Oracle security advisories .","title":"Fixed Version"},{"location":"docs/coverage/os/oracle/#severity","text":"Trivy determines vulnerability severity based on the severity metric provided in Oracle security advisories . For example, the security patch for CVE-2023-0464 is provided as ELSA-2023-2645 . Its severity is rated as \"MODERATE\". Thus, even though it's evaluated as \"HIGH\" in the NVD, Trivy displays it with a severity of \"MEDIUM\". The table below is the mapping of Oracle's threat to Trivy's severity levels. Oracle Trivy Low Low Moderate Medium Important High Critical Critical","title":"Severity"},{"location":"docs/coverage/os/oracle/#status","text":"Trivy supports the following vulnerability statuses for Oracle Linux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/oracle/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages.","title":"License"},{"location":"docs/coverage/os/photon/","text":"Photon OS Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as tdnf and yum . Vulnerability Photon OS offers its own security advisories, and these are utilized when scanning Photon OS for vulnerabilities. Data Source See here . Fixed Version Trivy takes fixed versions from Photon CVE metadata . Severity Trivy determines the severity of vulnerabilities based on the CVSSv3 score provided by Photon OS. See here for the conversion table from CVSS score to severity. Status Trivy supports the following vulnerability statuses for Photon OS. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Trivy identifies licenses by examining the metadata of RPM packages.","title":"Photon OS"},{"location":"docs/coverage/os/photon/#photon-os","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"Photon OS"},{"location":"docs/coverage/os/photon/#sbom","text":"Trivy detects packages that have been installed through package managers such as tdnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/photon/#vulnerability","text":"Photon OS offers its own security advisories, and these are utilized when scanning Photon OS for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/photon/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/photon/#fixed-version","text":"Trivy takes fixed versions from Photon CVE metadata .","title":"Fixed Version"},{"location":"docs/coverage/os/photon/#severity","text":"Trivy determines the severity of vulnerabilities based on the CVSSv3 score provided by Photon OS. See here for the conversion table from CVSS score to severity.","title":"Severity"},{"location":"docs/coverage/os/photon/#status","text":"Trivy supports the following vulnerability statuses for Photon OS. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/photon/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages.","title":"License"},{"location":"docs/coverage/os/rhel/","text":"Red Hat Enterprise Linux Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities \u2713 Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as dnf and yum . Vulnerability Red Hat offers its own security advisories, and these are utilized when scanning Red Hat Enterprise Linux (RHEL) for vulnerabilities. Data Source See here . Fixed Version When looking at fixed versions, it's crucial to consider the patches supplied by Red Hat. For example, for CVE-2023-0464, the fixed version for RHEL 9 is listed as 3.0.7-16.el9_2 in their advisory . This patch is provided in RHSA-2023:3722 . Note that this is different from the upstream fixed version, which is 3.0.9 , 3.1.1 , and so on. Typically, only the upstream information gets listed on NVD , so it's important not to get confused. Severity Trivy calculates the severity of a vulnerability based on the 'Impact' metric provided by Red Hat. If the impact is not provided or defined yet by Red Hat, the severity from the NVD is taken into account. Using CVE-2023-0464 as an example, while it is rated as \"HIGH\" in NVD, Red Hat has marked its 'Impact' as \"Low\" . As a result, Trivy will display it as \"Low\". The table below is the mapping of Red Hat's impact to Trivy's severity levels. Red Hat Trivy Low Low Moderate Medium Important High Critical Critical Status Trivy supports the following vulnerability statuses for RHEL. Status Supported Fixed \u2713 Affected \u2713 Under Investigation \u2713 Will Not Fix \u2713 Fix Deferred \u2713 End of Life \u2713 When a vulnerability status is listed as \"End of Life\", it means a vulnerability with the impact level assigned to this CVE is no longer covered by its current support lifecycle phase. The product has been identified to contain the impacted component, but analysis to determine whether it is affected or not by this vulnerability was not performed. Red Hat advises that the product should be assumed to be affected. Therefore, Trivy detects vulnerabilities with this status as \"End of Life\". On the other hand, for those marked \"Under Investigation,\" the impact is unclear as they are still being examined, so Trivy does not detect them. Once the investigation is completed, the status should be updated. Abstract Vulnerabilities with a status of \"End of Life\", where the presence or absence of impact is unclear, are detected by Trivy. However, those with a status of \"Under Investigation\" are not detected. License Trivy identifies licenses by examining the metadata of RPM packages.","title":"Red Hat"},{"location":"docs/coverage/os/rhel/#red-hat-enterprise-linux","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities \u2713 Dependency graph \u2713","title":"Red Hat Enterprise Linux"},{"location":"docs/coverage/os/rhel/#sbom","text":"Trivy detects packages that have been installed through package managers such as dnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/rhel/#vulnerability","text":"Red Hat offers its own security advisories, and these are utilized when scanning Red Hat Enterprise Linux (RHEL) for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/rhel/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/rhel/#fixed-version","text":"When looking at fixed versions, it's crucial to consider the patches supplied by Red Hat. For example, for CVE-2023-0464, the fixed version for RHEL 9 is listed as 3.0.7-16.el9_2 in their advisory . This patch is provided in RHSA-2023:3722 . Note that this is different from the upstream fixed version, which is 3.0.9 , 3.1.1 , and so on. Typically, only the upstream information gets listed on NVD , so it's important not to get confused.","title":"Fixed Version"},{"location":"docs/coverage/os/rhel/#severity","text":"Trivy calculates the severity of a vulnerability based on the 'Impact' metric provided by Red Hat. If the impact is not provided or defined yet by Red Hat, the severity from the NVD is taken into account. Using CVE-2023-0464 as an example, while it is rated as \"HIGH\" in NVD, Red Hat has marked its 'Impact' as \"Low\" . As a result, Trivy will display it as \"Low\". The table below is the mapping of Red Hat's impact to Trivy's severity levels. Red Hat Trivy Low Low Moderate Medium Important High Critical Critical","title":"Severity"},{"location":"docs/coverage/os/rhel/#status","text":"Trivy supports the following vulnerability statuses for RHEL. Status Supported Fixed \u2713 Affected \u2713 Under Investigation \u2713 Will Not Fix \u2713 Fix Deferred \u2713 End of Life \u2713 When a vulnerability status is listed as \"End of Life\", it means a vulnerability with the impact level assigned to this CVE is no longer covered by its current support lifecycle phase. The product has been identified to contain the impacted component, but analysis to determine whether it is affected or not by this vulnerability was not performed. Red Hat advises that the product should be assumed to be affected. Therefore, Trivy detects vulnerabilities with this status as \"End of Life\". On the other hand, for those marked \"Under Investigation,\" the impact is unclear as they are still being examined, so Trivy does not detect them. Once the investigation is completed, the status should be updated. Abstract Vulnerabilities with a status of \"End of Life\", where the presence or absence of impact is unclear, are detected by Trivy. However, those with a status of \"Under Investigation\" are not detected.","title":"Status"},{"location":"docs/coverage/os/rhel/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages.","title":"License"},{"location":"docs/coverage/os/rocky/","text":"Rocky Linux Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as dnf and yum . Vulnerability Rocky Linux offers its own security advisories, and these are utilized when scanning Rocky Linux for vulnerabilities. Data Source See here . Fixed Version Trivy takes fixed versions from Rocky Linux Errata , not NVD or somewhere else. See here for more details. Architectures There are cases when the vulnerability affects packages of not all architectures. For example, vulnerable packages for CVE-2023-0361 are only aarch64 packages. Trivy only detects vulnerabilities for packages of your architecture. Severity Trivy calculates the severity of an issue based on the severity provided in Rocky Linux Errata . The table below is the mapping of Rocky Linux's severity to Trivy's severity levels. Rocky Linux Trivy Low Low Moderate Medium Important High Critical Critical Status Trivy supports the following vulnerability statuses for Rocky Linux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Trivy identifies licenses by examining the metadata of RPM packages.","title":"Rocky Linux"},{"location":"docs/coverage/os/rocky/#rocky-linux","text":"Trivy supports the following scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"Rocky Linux"},{"location":"docs/coverage/os/rocky/#sbom","text":"Trivy detects packages that have been installed through package managers such as dnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/rocky/#vulnerability","text":"Rocky Linux offers its own security advisories, and these are utilized when scanning Rocky Linux for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/rocky/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/rocky/#fixed-version","text":"Trivy takes fixed versions from Rocky Linux Errata , not NVD or somewhere else. See here for more details. Architectures There are cases when the vulnerability affects packages of not all architectures. For example, vulnerable packages for CVE-2023-0361 are only aarch64 packages. Trivy only detects vulnerabilities for packages of your architecture.","title":"Fixed Version"},{"location":"docs/coverage/os/rocky/#severity","text":"Trivy calculates the severity of an issue based on the severity provided in Rocky Linux Errata . The table below is the mapping of Rocky Linux's severity to Trivy's severity levels. Rocky Linux Trivy Low Low Moderate Medium Important High Critical Critical","title":"Severity"},{"location":"docs/coverage/os/rocky/#status","text":"Trivy supports the following vulnerability statuses for Rocky Linux. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/rocky/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages.","title":"License"},{"location":"docs/coverage/os/suse/","text":"SUSE Trivy supports the following distributions: openSUSE Leap SUSE Enterprise Linux (SLE) Please see here for supported versions. Trivy supports these scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713 SBOM Trivy detects packages that have been installed through package managers such as dnf and yum . Vulnerability SUSE offers its own security advisories , and these are utilized when scanning openSUSE/SLE for vulnerabilities. Data Source See here . License Trivy identifies licenses by examining the metadata of RPM packages.","title":"SUSE"},{"location":"docs/coverage/os/suse/#suse","text":"Trivy supports the following distributions: openSUSE Leap SUSE Enterprise Linux (SLE) Please see here for supported versions. Trivy supports these scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Unfixed vulnerabilities - Dependency graph \u2713","title":"SUSE"},{"location":"docs/coverage/os/suse/#sbom","text":"Trivy detects packages that have been installed through package managers such as dnf and yum .","title":"SBOM"},{"location":"docs/coverage/os/suse/#vulnerability","text":"SUSE offers its own security advisories , and these are utilized when scanning openSUSE/SLE for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/suse/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/suse/#license","text":"Trivy identifies licenses by examining the metadata of RPM packages.","title":"License"},{"location":"docs/coverage/os/ubuntu/","text":"Ubuntu Trivy supports these scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The following table provides an outline of the features Trivy offers. Feature Supported Detect unfixed vulnerabilities \u2713 Dependency graph \u2713 SBOM Same as Debian . Vulnerability Ubuntu offers its own security advisories, and these are utilized when scanning Ubuntu for vulnerabilities. Data Source See here . Fixed Version When looking at fixed versions, it's crucial to consider the patches supplied by Ubuntu. As an illustration, for CVE-2023-3269, the fixed version for Ubuntu 23.04 (lunar) is listed as 6.2.0-26.26 in the Security Tracker . It's essential to recognize that this differs from the upstream fixed version, which stands at 6.5 . Typically, only the upstream information gets listed on NVD , so it's important not to get confused. Severity Trivy calculates the severity of an issue based on the 'Priority' metric found in the Security Tracker. If 'Priority' isn't provided by Ubuntu, the severity from the NVD is taken into account. Using CVE-2019-15052 as an example, while it is rated as \"Critical\" in NVD , Ubuntu has marked its \"Priority\" as \"Medium\" . As a result, Trivy will display it as \"Medium\". Status Trivy supports the following vulnerability statuses for Ubuntu. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life License Same as Debian .","title":"Ubuntu"},{"location":"docs/coverage/os/ubuntu/#ubuntu","text":"Trivy supports these scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 Please see here for supported versions. The following table provides an outline of the features Trivy offers. Feature Supported Detect unfixed vulnerabilities \u2713 Dependency graph \u2713","title":"Ubuntu"},{"location":"docs/coverage/os/ubuntu/#sbom","text":"Same as Debian .","title":"SBOM"},{"location":"docs/coverage/os/ubuntu/#vulnerability","text":"Ubuntu offers its own security advisories, and these are utilized when scanning Ubuntu for vulnerabilities.","title":"Vulnerability"},{"location":"docs/coverage/os/ubuntu/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/ubuntu/#fixed-version","text":"When looking at fixed versions, it's crucial to consider the patches supplied by Ubuntu. As an illustration, for CVE-2023-3269, the fixed version for Ubuntu 23.04 (lunar) is listed as 6.2.0-26.26 in the Security Tracker . It's essential to recognize that this differs from the upstream fixed version, which stands at 6.5 . Typically, only the upstream information gets listed on NVD , so it's important not to get confused.","title":"Fixed Version"},{"location":"docs/coverage/os/ubuntu/#severity","text":"Trivy calculates the severity of an issue based on the 'Priority' metric found in the Security Tracker. If 'Priority' isn't provided by Ubuntu, the severity from the NVD is taken into account. Using CVE-2019-15052 as an example, while it is rated as \"Critical\" in NVD , Ubuntu has marked its \"Priority\" as \"Medium\" . As a result, Trivy will display it as \"Medium\".","title":"Severity"},{"location":"docs/coverage/os/ubuntu/#status","text":"Trivy supports the following vulnerability statuses for Ubuntu. Status Supported Fixed \u2713 Affected \u2713 Under Investigation Will Not Fix Fix Deferred End of Life","title":"Status"},{"location":"docs/coverage/os/ubuntu/#license","text":"Same as Debian .","title":"License"},{"location":"docs/coverage/os/wolfi/","text":"Wolfi Linux Trivy supports these scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Detect unfixed vulnerabilities - Dependency graph \u2713 SBOM Same as Alpine Linux . Vulnerability Wolfi Linux offers its own security advisories, and these are utilized when scanning Wolfi for vulnerabilities. Everything else is the same as Alpine Linux . Data Source See here . License Same as Alpine Linux .","title":"Wolfi"},{"location":"docs/coverage/os/wolfi/#wolfi-linux","text":"Trivy supports these scanners for OS packages. Scanner Supported SBOM \u2713 Vulnerability \u2713 License \u2713 The table below outlines the features offered by Trivy. Feature Supported Detect unfixed vulnerabilities - Dependency graph \u2713","title":"Wolfi Linux"},{"location":"docs/coverage/os/wolfi/#sbom","text":"Same as Alpine Linux .","title":"SBOM"},{"location":"docs/coverage/os/wolfi/#vulnerability","text":"Wolfi Linux offers its own security advisories, and these are utilized when scanning Wolfi for vulnerabilities. Everything else is the same as Alpine Linux .","title":"Vulnerability"},{"location":"docs/coverage/os/wolfi/#data-source","text":"See here .","title":"Data Source"},{"location":"docs/coverage/os/wolfi/#license","text":"Same as Alpine Linux .","title":"License"},{"location":"docs/references/troubleshooting/","text":"Troubleshooting Scan Timeout Error $ trivy image ... ... analyze error: timeout: context deadline exceeded Your scan may time out. Java takes a particularly long time to scan. Try increasing the value of the ---timeout option such as --timeout 15m . Certification Error Error: x509: certificate signed by unknown authority TRIVY_INSECURE can be used to allow insecure connections to a container registry when using SSL. $ TRIVY_INSECURE=true trivy image [YOUR_IMAGE] GitHub Rate limiting Error $ trivy image ... ... API rate limit exceeded for xxx.xxx.xxx.xxx. Specify GITHUB_TOKEN for authentication https://developer.github.com/v3/#rate-limiting $ GITHUB_TOKEN=XXXXXXXXXX trivy alpine:3.10 Unable to open JAR files Error $ trivy image ... ... failed to analyze file: failed to analyze usr/lib/jvm/java-1.8-openjdk/lib/tools.jar: unable to open usr/lib/jvm/java-1.8-openjdk/lib/tools.jar: failed to open: unable to read the file: stream error: stream ID 9 ; PROTOCOL_ERROR ; received from peer Currently, we're investigating this issue. As a temporary mitigation, you may be able to avoid this issue by downloading the Java DB in advance. $ trivy image --download-java-db-only 2023 -02-01T16:57:04.322+0900 INFO Downloading the Java DB... $ trivy image [ YOUR_JAVA_IMAGE ] Running in parallel takes same time as series run When running trivy on multiple images simultaneously, it will take same time as running trivy in series. This is because of a limitation of boltdb. Bolt obtains a file lock on the data file so multiple processes cannot open the same database at the same time. Opening an already open Bolt database will cause it to hang until the other process closes it. Reference : boltdb: Opening a database . Multiple Trivy servers Error $ trivy image --server http://xxx.com:xxxx test-image ... - twirp error internal: failed scan, test-image: failed to apply layers: layer cache missing: sha256:***** To run multiple Trivy servers, you need to use Redis as the cache backend so that those servers can share the cache. Follow this instruction to do so. Problems with /tmp on remote Git repository scans Error FATAL repository scan error: scan error: unable to initialize a scanner: unable to initialize a filesystem scanner: git clone error: write /tmp/fanal-remote... Trivy clones remote Git repositories under the /tmp directory before scanning them. If /tmp doesn't work for you, you can change it by setting the TMPDIR environment variable. Try: $ TMPDIR=/my/custom/path trivy repo ... Running out of space during image scans Error image scan failed: failed to copy the image: write /tmp/fanal-3323732142: no space left on device Trivy uses the /tmp directory during image scan, if the image is large or /tmp is of insufficient size then the scan fails You can set the TMPDIR environment variable to use redirect trivy to use a directory with adequate storage. Try: $ TMPDIR=/my/custom/path trivy image ... DB Old DB schema Error --skip-update cannot be specified with the old DB schema. Trivy v0.23.0 or later requires Trivy DB v2. Please update your local database or follow the instruction of air-gapped environment . Error downloading vulnerability DB Error FATAL failed to download vulnerability DB If trivy is running behind corporate firewall, you have to add the following urls to your allowlist. ghcr.io pkg-containers.githubusercontent.com Denied Error GET https://ghcr.io/token?scope=repository%3Aaquasecurity%2Ftrivy-db%3Apull&service=ghcr.io: DENIED: denied Your local GHCR (GitHub Container Registry) token might be expired. Please remove the token and try downloading the DB again. docker logout ghcr.io Homebrew Scope error Error Error: Your macOS keychain GitHub credentials do not have sufficient scope! $ brew tap aquasecurity/trivy Error: Your macOS keychain GitHub credentials do not have sufficient scope! Scopes they need: none Scopes they have: Create a personal access token: https://github.com/settings/tokens/new?scopes=gist,public_repo&description=Homebrew echo 'export HOMEBREW_GITHUB_API_TOKEN=your_token_here' >> ~/.zshrc Try: $ printf \"protocol=https\\nhost=github.com\\n\" | git credential-osxkeychain erase Already installed Error Error: aquasecurity/trivy/trivy 64 already installed $ brew upgrade ... Error: aquasecurity/trivy/trivy 64 already installed Try: $ brew unlink trivy && brew uninstall trivy ($ rm -rf /usr/local/Cellar/trivy/64) $ brew install aquasecurity/trivy/trivy Others Unknown error Try again with --reset option: $ trivy image --reset","title":"Troubleshooting"},{"location":"docs/references/troubleshooting/#troubleshooting","text":"","title":"Troubleshooting"},{"location":"docs/references/troubleshooting/#scan","text":"","title":"Scan"},{"location":"docs/references/troubleshooting/#timeout","text":"Error $ trivy image ... ... analyze error: timeout: context deadline exceeded Your scan may time out. Java takes a particularly long time to scan. Try increasing the value of the ---timeout option such as --timeout 15m .","title":"Timeout"},{"location":"docs/references/troubleshooting/#certification","text":"Error Error: x509: certificate signed by unknown authority TRIVY_INSECURE can be used to allow insecure connections to a container registry when using SSL. $ TRIVY_INSECURE=true trivy image [YOUR_IMAGE]","title":"Certification"},{"location":"docs/references/troubleshooting/#github-rate-limiting","text":"Error $ trivy image ... ... API rate limit exceeded for xxx.xxx.xxx.xxx. Specify GITHUB_TOKEN for authentication https://developer.github.com/v3/#rate-limiting $ GITHUB_TOKEN=XXXXXXXXXX trivy alpine:3.10","title":"GitHub Rate limiting"},{"location":"docs/references/troubleshooting/#unable-to-open-jar-files","text":"Error $ trivy image ... ... failed to analyze file: failed to analyze usr/lib/jvm/java-1.8-openjdk/lib/tools.jar: unable to open usr/lib/jvm/java-1.8-openjdk/lib/tools.jar: failed to open: unable to read the file: stream error: stream ID 9 ; PROTOCOL_ERROR ; received from peer Currently, we're investigating this issue. As a temporary mitigation, you may be able to avoid this issue by downloading the Java DB in advance. $ trivy image --download-java-db-only 2023 -02-01T16:57:04.322+0900 INFO Downloading the Java DB... $ trivy image [ YOUR_JAVA_IMAGE ]","title":"Unable to open JAR files"},{"location":"docs/references/troubleshooting/#running-in-parallel-takes-same-time-as-series-run","text":"When running trivy on multiple images simultaneously, it will take same time as running trivy in series. This is because of a limitation of boltdb. Bolt obtains a file lock on the data file so multiple processes cannot open the same database at the same time. Opening an already open Bolt database will cause it to hang until the other process closes it. Reference : boltdb: Opening a database .","title":"Running in parallel takes same time as series run"},{"location":"docs/references/troubleshooting/#multiple-trivy-servers","text":"Error $ trivy image --server http://xxx.com:xxxx test-image ... - twirp error internal: failed scan, test-image: failed to apply layers: layer cache missing: sha256:***** To run multiple Trivy servers, you need to use Redis as the cache backend so that those servers can share the cache. Follow this instruction to do so.","title":"Multiple Trivy servers"},{"location":"docs/references/troubleshooting/#problems-with-tmp-on-remote-git-repository-scans","text":"Error FATAL repository scan error: scan error: unable to initialize a scanner: unable to initialize a filesystem scanner: git clone error: write /tmp/fanal-remote... Trivy clones remote Git repositories under the /tmp directory before scanning them. If /tmp doesn't work for you, you can change it by setting the TMPDIR environment variable. Try: $ TMPDIR=/my/custom/path trivy repo ...","title":"Problems with /tmp on remote Git repository scans"},{"location":"docs/references/troubleshooting/#running-out-of-space-during-image-scans","text":"Error image scan failed: failed to copy the image: write /tmp/fanal-3323732142: no space left on device Trivy uses the /tmp directory during image scan, if the image is large or /tmp is of insufficient size then the scan fails You can set the TMPDIR environment variable to use redirect trivy to use a directory with adequate storage. Try: $ TMPDIR=/my/custom/path trivy image ...","title":"Running out of space during image scans"},{"location":"docs/references/troubleshooting/#db","text":"","title":"DB"},{"location":"docs/references/troubleshooting/#old-db-schema","text":"Error --skip-update cannot be specified with the old DB schema. Trivy v0.23.0 or later requires Trivy DB v2. Please update your local database or follow the instruction of air-gapped environment .","title":"Old DB schema"},{"location":"docs/references/troubleshooting/#error-downloading-vulnerability-db","text":"Error FATAL failed to download vulnerability DB If trivy is running behind corporate firewall, you have to add the following urls to your allowlist. ghcr.io pkg-containers.githubusercontent.com","title":"Error downloading vulnerability DB"},{"location":"docs/references/troubleshooting/#denied","text":"Error GET https://ghcr.io/token?scope=repository%3Aaquasecurity%2Ftrivy-db%3Apull&service=ghcr.io: DENIED: denied Your local GHCR (GitHub Container Registry) token might be expired. Please remove the token and try downloading the DB again. docker logout ghcr.io","title":"Denied"},{"location":"docs/references/troubleshooting/#homebrew","text":"","title":"Homebrew"},{"location":"docs/references/troubleshooting/#scope-error","text":"Error Error: Your macOS keychain GitHub credentials do not have sufficient scope! $ brew tap aquasecurity/trivy Error: Your macOS keychain GitHub credentials do not have sufficient scope! Scopes they need: none Scopes they have: Create a personal access token: https://github.com/settings/tokens/new?scopes=gist,public_repo&description=Homebrew echo 'export HOMEBREW_GITHUB_API_TOKEN=your_token_here' >> ~/.zshrc Try: $ printf \"protocol=https\\nhost=github.com\\n\" | git credential-osxkeychain erase","title":"Scope error"},{"location":"docs/references/troubleshooting/#already-installed","text":"Error Error: aquasecurity/trivy/trivy 64 already installed $ brew upgrade ... Error: aquasecurity/trivy/trivy 64 already installed Try: $ brew unlink trivy && brew uninstall trivy ($ rm -rf /usr/local/Cellar/trivy/64) $ brew install aquasecurity/trivy/trivy","title":"Already installed"},{"location":"docs/references/troubleshooting/#others","text":"","title":"Others"},{"location":"docs/references/troubleshooting/#unknown-error","text":"Try again with --reset option: $ trivy image --reset","title":"Unknown error"},{"location":"docs/references/configuration/config-file/","text":"Config file Trivy can be customized by tweaking a trivy.yaml file. The config path can be overridden by the --config flag. An example is here . Global Options # Same as '--quiet' # Default is false quiet : false # Same as '--debug' # Default is false debug : false # Same as '--insecure' # Default is false insecure : false # Same as '--timeout' # Default is '5m' timeout : 10m # Same as '--cache-dir' # Default is your system cache dir cache : dir : $HOME/.cache/trivy Report Options # Same as '--format' # Default is 'table' format : table # Same as '--report' (available with 'trivy k8s') # Default is all report : all # Same as '--template' # Default is empty template : # Same as '--dependency-tree' # Default is false dependency-tree : false # Same as '--list-all-pkgs' # Default is false list-all-pkgs : false # Same as '--ignorefile' # Default is '.trivyignore' ignorefile : .trivyignore # Same as '--ignore-policy' # Default is empty ignore-policy : # Same as '--exit-code' # Default is 0 exit-code : 0 # Same as '--exit-on-eol' # Default is 0 exit-on-eol : 0 # Same as '--output' # Default is empty (stdout) output : # Same as '--severity' # Default is all severities severity : - UNKNOWN - LOW - MEDIUM - HIGH - CRITICAL Scan Options Available in client/server mode scan : # Same as '--file-patterns' # Default is empty file-patterns : - # Same as '--skip-dirs' # Default is empty skip-dirs : - usr/local/ - etc/ # Same as '--skip-files' # Default is empty skip-files : - package-dev.json # Same as '--offline-scan' # Default is false offline-scan : false # Same as '--scanners' # Default depends on subcommand scanners : - vuln - config - secret Cache Options cache : # Same as '--cache-backend' # Default is 'fs' backend : 'fs' # Same as '--cache-ttl' # Default is 0 (no ttl) ttl : 0 # Redis options redis : # Same as '--redis-ca' # Default is empty ca : # Same as '--redis-cert' # Default is empty cert : # Same as '--redis-key' # Default is empty key : DB Options db : # Same as '--skip-db-update' # Default is false skip-update : false # Same as '--no-progress' # Default is false no-progress : false # Same as '--db-repository' # Default is 'ghcr.io/aquasecurity/trivy-db' repository : ghcr.io/aquasecurity/trivy-db # Same as '--java-db-repository' # Default is 'ghcr.io/aquasecurity/trivy-java-db' java-repository : ghcr.io/aquasecurity/trivy-java-db Registry Options registry : # Same as '--username' # Default is empty username : # Same as '--password' # Default is empty password : # Same as '--registry-token' # Default is empty registry-token : Image Options Available with container image scanning image : # Same as '--input' (available with 'trivy image') # Default is empty input : # Same as '--removed-pkgs' # Default is false removed-pkgs : false # Same as '--platform' # Default is empty platform : docker : # Same as '--docker-host' # Default is empty host : Vulnerability Options Available with vulnerability scanning vulnerability : # Same as '--vuln-type' # Default is 'os,library' type : - os - library # Same as '--ignore-unfixed' # Default is false ignore-unfixed : false Secret Options Available with secret scanning secret : # Same as '--secret-config' # Default is 'trivy-secret.yaml' config : config/trivy/secret.yaml Rego Options rego # Same as '--trace' # Default is false trace : false # Same as '--config-policy' # Default is empty policy : - policy/repository - policy/custom - policy/some-policy.rego # Same as '--config-data' # Default is empty data : - data/ # Same as '--policy-namespaces' # Default is empty namespaces : - opa.examples - users Misconfiguration Options Available with misconfiguration scanning misconfiguration : # Same as '--include-non-failures' # Default is false include-non-failures : false # helm value override configurations # set individual values helm : set : - securityContext.runAsUser=10001 # set values with file helm : values : - overrides.yaml # set specific values from specific files helm : set-file : - image=dev-overrides.yaml # set as string and preserve type helm : set-string : - name=true # terraform tfvars overrrides terraform : vars : - dev-terraform.tfvars - common-terraform.tfvars # Same as '--tf-exclude-downloaded-modules' # Default is false terraform : exclude-downloaded-modules : false Kubernetes Options Available with Kubernetes scanning kubernetes : # Same as '--context' # Default is empty context : # Same as '--namespace' # Default is empty namespace : Repository Options Available with git repository scanning ( trivy repo ) repository : # Same as '--branch' # Default is empty branch : # Same as '--commit' # Default is empty commit : # Same as '--tag' # Default is empty tag : Client/Server Options Available in client/server mode server : # Same as '--server' (available in client mode) # Default is empty addr : http://localhost:4954 # Same as '--token' # Default is empty token : \"something-secret\" # Same as '--token-header' # Default is 'Trivy-Token' token-header : 'My-Token-Header' # Same as '--custom-headers' # Default is empty custom-headers : - scanner : trivy - x-api-token : xxx # Same as '--listen' (available in server mode) # Default is 'localhost:4954' listen : 0.0.0.0:10000 Cloud Options Available for cloud scanning (currently only trivy aws ) cloud : # whether to force a cache update for every scan update-cache : false # how old cached results can be before being invalidated max-cache-age : 24h # aws-specific cloud settings aws : # the aws region to use region : us-east-1 # the aws endpoint to use (not required for general use) endpoint : https://my.custom.aws.endpoint # the aws account to use (this will be determined from your environment when not set) account : 123456789012","title":"Config file"},{"location":"docs/references/configuration/config-file/#config-file","text":"Trivy can be customized by tweaking a trivy.yaml file. The config path can be overridden by the --config flag. An example is here .","title":"Config file"},{"location":"docs/references/configuration/config-file/#global-options","text":"# Same as '--quiet' # Default is false quiet : false # Same as '--debug' # Default is false debug : false # Same as '--insecure' # Default is false insecure : false # Same as '--timeout' # Default is '5m' timeout : 10m # Same as '--cache-dir' # Default is your system cache dir cache : dir : $HOME/.cache/trivy","title":"Global Options"},{"location":"docs/references/configuration/config-file/#report-options","text":"# Same as '--format' # Default is 'table' format : table # Same as '--report' (available with 'trivy k8s') # Default is all report : all # Same as '--template' # Default is empty template : # Same as '--dependency-tree' # Default is false dependency-tree : false # Same as '--list-all-pkgs' # Default is false list-all-pkgs : false # Same as '--ignorefile' # Default is '.trivyignore' ignorefile : .trivyignore # Same as '--ignore-policy' # Default is empty ignore-policy : # Same as '--exit-code' # Default is 0 exit-code : 0 # Same as '--exit-on-eol' # Default is 0 exit-on-eol : 0 # Same as '--output' # Default is empty (stdout) output : # Same as '--severity' # Default is all severities severity : - UNKNOWN - LOW - MEDIUM - HIGH - CRITICAL","title":"Report Options"},{"location":"docs/references/configuration/config-file/#scan-options","text":"Available in client/server mode scan : # Same as '--file-patterns' # Default is empty file-patterns : - # Same as '--skip-dirs' # Default is empty skip-dirs : - usr/local/ - etc/ # Same as '--skip-files' # Default is empty skip-files : - package-dev.json # Same as '--offline-scan' # Default is false offline-scan : false # Same as '--scanners' # Default depends on subcommand scanners : - vuln - config - secret","title":"Scan Options"},{"location":"docs/references/configuration/config-file/#cache-options","text":"cache : # Same as '--cache-backend' # Default is 'fs' backend : 'fs' # Same as '--cache-ttl' # Default is 0 (no ttl) ttl : 0 # Redis options redis : # Same as '--redis-ca' # Default is empty ca : # Same as '--redis-cert' # Default is empty cert : # Same as '--redis-key' # Default is empty key :","title":"Cache Options"},{"location":"docs/references/configuration/config-file/#db-options","text":"db : # Same as '--skip-db-update' # Default is false skip-update : false # Same as '--no-progress' # Default is false no-progress : false # Same as '--db-repository' # Default is 'ghcr.io/aquasecurity/trivy-db' repository : ghcr.io/aquasecurity/trivy-db # Same as '--java-db-repository' # Default is 'ghcr.io/aquasecurity/trivy-java-db' java-repository : ghcr.io/aquasecurity/trivy-java-db","title":"DB Options"},{"location":"docs/references/configuration/config-file/#registry-options","text":"registry : # Same as '--username' # Default is empty username : # Same as '--password' # Default is empty password : # Same as '--registry-token' # Default is empty registry-token :","title":"Registry Options"},{"location":"docs/references/configuration/config-file/#image-options","text":"Available with container image scanning image : # Same as '--input' (available with 'trivy image') # Default is empty input : # Same as '--removed-pkgs' # Default is false removed-pkgs : false # Same as '--platform' # Default is empty platform : docker : # Same as '--docker-host' # Default is empty host :","title":"Image Options"},{"location":"docs/references/configuration/config-file/#vulnerability-options","text":"Available with vulnerability scanning vulnerability : # Same as '--vuln-type' # Default is 'os,library' type : - os - library # Same as '--ignore-unfixed' # Default is false ignore-unfixed : false","title":"Vulnerability Options"},{"location":"docs/references/configuration/config-file/#secret-options","text":"Available with secret scanning secret : # Same as '--secret-config' # Default is 'trivy-secret.yaml' config : config/trivy/secret.yaml","title":"Secret Options"},{"location":"docs/references/configuration/config-file/#rego-options","text":"rego # Same as '--trace' # Default is false trace : false # Same as '--config-policy' # Default is empty policy : - policy/repository - policy/custom - policy/some-policy.rego # Same as '--config-data' # Default is empty data : - data/ # Same as '--policy-namespaces' # Default is empty namespaces : - opa.examples - users","title":"Rego Options"},{"location":"docs/references/configuration/config-file/#misconfiguration-options","text":"Available with misconfiguration scanning misconfiguration : # Same as '--include-non-failures' # Default is false include-non-failures : false # helm value override configurations # set individual values helm : set : - securityContext.runAsUser=10001 # set values with file helm : values : - overrides.yaml # set specific values from specific files helm : set-file : - image=dev-overrides.yaml # set as string and preserve type helm : set-string : - name=true # terraform tfvars overrrides terraform : vars : - dev-terraform.tfvars - common-terraform.tfvars # Same as '--tf-exclude-downloaded-modules' # Default is false terraform : exclude-downloaded-modules : false","title":"Misconfiguration Options"},{"location":"docs/references/configuration/config-file/#kubernetes-options","text":"Available with Kubernetes scanning kubernetes : # Same as '--context' # Default is empty context : # Same as '--namespace' # Default is empty namespace :","title":"Kubernetes Options"},{"location":"docs/references/configuration/config-file/#repository-options","text":"Available with git repository scanning ( trivy repo ) repository : # Same as '--branch' # Default is empty branch : # Same as '--commit' # Default is empty commit : # Same as '--tag' # Default is empty tag :","title":"Repository Options"},{"location":"docs/references/configuration/config-file/#clientserver-options","text":"Available in client/server mode server : # Same as '--server' (available in client mode) # Default is empty addr : http://localhost:4954 # Same as '--token' # Default is empty token : \"something-secret\" # Same as '--token-header' # Default is 'Trivy-Token' token-header : 'My-Token-Header' # Same as '--custom-headers' # Default is empty custom-headers : - scanner : trivy - x-api-token : xxx # Same as '--listen' (available in server mode) # Default is 'localhost:4954' listen : 0.0.0.0:10000","title":"Client/Server Options"},{"location":"docs/references/configuration/config-file/#cloud-options","text":"Available for cloud scanning (currently only trivy aws ) cloud : # whether to force a cache update for every scan update-cache : false # how old cached results can be before being invalidated max-cache-age : 24h # aws-specific cloud settings aws : # the aws region to use region : us-east-1 # the aws endpoint to use (not required for general use) endpoint : https://my.custom.aws.endpoint # the aws account to use (this will be determined from your environment when not set) account : 123456789012","title":"Cloud Options"},{"location":"docs/references/configuration/cli/trivy/","text":"trivy Unified security scanner Synopsis Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues and hard-coded secrets trivy [global flags] command [flags] target Examples # Scan a container image $ trivy image python:3.4-alpine # Scan a container image from a tar archive $ trivy image --input ruby-3.1.tar # Scan local filesystem $ trivy fs . # Run in server mode $ trivy server Options --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode -f, --format string version format (json) --generate-default-config write the default config to trivy-default.yaml -h, --help help for trivy --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy aws - [EXPERIMENTAL] Scan AWS account trivy config - Scan config files for misconfigurations trivy convert - Convert Trivy JSON report into a different format trivy filesystem - Scan local filesystem trivy image - Scan a container image trivy kubernetes - [EXPERIMENTAL] Scan kubernetes cluster trivy module - Manage modules trivy plugin - Manage plugins trivy repository - Scan a repository trivy rootfs - Scan rootfs trivy sbom - Scan SBOM for vulnerabilities trivy server - Server mode trivy version - Print the version trivy vm - [EXPERIMENTAL] Scan a virtual machine image","title":"Overview"},{"location":"docs/references/configuration/cli/trivy/#trivy","text":"Unified security scanner","title":"trivy"},{"location":"docs/references/configuration/cli/trivy/#synopsis","text":"Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues and hard-coded secrets trivy [global flags] command [flags] target","title":"Synopsis"},{"location":"docs/references/configuration/cli/trivy/#examples","text":"# Scan a container image $ trivy image python:3.4-alpine # Scan a container image from a tar archive $ trivy image --input ruby-3.1.tar # Scan local filesystem $ trivy fs . # Run in server mode $ trivy server","title":"Examples"},{"location":"docs/references/configuration/cli/trivy/#options","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode -f, --format string version format (json) --generate-default-config write the default config to trivy-default.yaml -h, --help help for trivy --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options"},{"location":"docs/references/configuration/cli/trivy/#see-also","text":"trivy aws - [EXPERIMENTAL] Scan AWS account trivy config - Scan config files for misconfigurations trivy convert - Convert Trivy JSON report into a different format trivy filesystem - Scan local filesystem trivy image - Scan a container image trivy kubernetes - [EXPERIMENTAL] Scan kubernetes cluster trivy module - Manage modules trivy plugin - Manage plugins trivy repository - Scan a repository trivy rootfs - Scan rootfs trivy sbom - Scan SBOM for vulnerabilities trivy server - Server mode trivy version - Print the version trivy vm - [EXPERIMENTAL] Scan a virtual machine image","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_aws/","text":"trivy aws [EXPERIMENTAL] Scan AWS account Synopsis Scan an AWS account for misconfigurations. Trivy uses the same authentication methods as the AWS CLI. See https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html The following services are supported: - accessanalyzer - api-gateway - athena - cloudfront - cloudtrail - cloudwatch - codebuild - documentdb - dynamodb - ec2 - ecr - ecs - efs - eks - elasticache - elasticsearch - elb - emr - iam - kinesis - kms - lambda - mq - msk - neptune - rds - redshift - s3 - sns - sqs - ssm - workspaces trivy aws [flags] Examples # basic scanning $ trivy aws --region us-east-1 # limit scan to a single service: $ trivy aws --region us-east-1 --service s3 # limit scan to multiple services: $ trivy aws --region us-east-1 --service s3 --service ec2 # force refresh of cache for fresh results $ trivy aws --region us-east-1 --update-cache Options --account string The AWS account to scan. It's useful to specify this when reviewing cached results for multiple accounts. --arn string The AWS ARN to show results for. Useful to filter results once a scan is cached. --compliance string compliance report to generate (aws-cis-1.2,aws-cis-1.4) --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --endpoint string AWS Endpoint override --exit-code int specify exit code when any security issues are found -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for aws --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --list-all-pkgs enabling the option will output all packages regardless of vulnerability --max-cache-age duration The maximum age of the cloud cache. Cached data will be requeried from the cloud provider if it is older than this. (default 24h0m0s) -o, --output string output file name --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --region string AWS Region to scan --report string specify a report format for the output (all,summary) (default \"all\") --reset-policy-bundle remove policy bundle --service strings Only scan AWS Service(s) specified with this flag. Can specify multiple services using --service A --service B etc. -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-policy-update skip fetching rego policy updates --skip-service strings Skip selected AWS Service(s) specified with this flag. Can specify multiple services using --skip-service A --skip-service B etc. -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --trace enable more verbose trace output for custom queries --update-cache Update the cache for the applicable cloud provider instead of using cached results. Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"AWS"},{"location":"docs/references/configuration/cli/trivy_aws/#trivy-aws","text":"[EXPERIMENTAL] Scan AWS account","title":"trivy aws"},{"location":"docs/references/configuration/cli/trivy_aws/#synopsis","text":"Scan an AWS account for misconfigurations. Trivy uses the same authentication methods as the AWS CLI. See https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html The following services are supported: - accessanalyzer - api-gateway - athena - cloudfront - cloudtrail - cloudwatch - codebuild - documentdb - dynamodb - ec2 - ecr - ecs - efs - eks - elasticache - elasticsearch - elb - emr - iam - kinesis - kms - lambda - mq - msk - neptune - rds - redshift - s3 - sns - sqs - ssm - workspaces trivy aws [flags]","title":"Synopsis"},{"location":"docs/references/configuration/cli/trivy_aws/#examples","text":"# basic scanning $ trivy aws --region us-east-1 # limit scan to a single service: $ trivy aws --region us-east-1 --service s3 # limit scan to multiple services: $ trivy aws --region us-east-1 --service s3 --service ec2 # force refresh of cache for fresh results $ trivy aws --region us-east-1 --update-cache","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_aws/#options","text":"--account string The AWS account to scan. It's useful to specify this when reviewing cached results for multiple accounts. --arn string The AWS ARN to show results for. Useful to filter results once a scan is cached. --compliance string compliance report to generate (aws-cis-1.2,aws-cis-1.4) --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --endpoint string AWS Endpoint override --exit-code int specify exit code when any security issues are found -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for aws --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --list-all-pkgs enabling the option will output all packages regardless of vulnerability --max-cache-age duration The maximum age of the cloud cache. Cached data will be requeried from the cloud provider if it is older than this. (default 24h0m0s) -o, --output string output file name --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --region string AWS Region to scan --report string specify a report format for the output (all,summary) (default \"all\") --reset-policy-bundle remove policy bundle --service strings Only scan AWS Service(s) specified with this flag. Can specify multiple services using --service A --service B etc. -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-policy-update skip fetching rego policy updates --skip-service strings Skip selected AWS Service(s) specified with this flag. Can specify multiple services using --skip-service A --skip-service B etc. -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --trace enable more verbose trace output for custom queries --update-cache Update the cache for the applicable cloud provider instead of using cached results.","title":"Options"},{"location":"docs/references/configuration/cli/trivy_aws/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_aws/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_config/","text":"trivy config Scan config files for misconfigurations trivy config [flags] DIR Options --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for config --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --k8s-version string specify k8s version to validate outdated api by it (example: 1.21.0) --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --report string specify a compliance report format for the output (all,summary) (default \"all\") --reset-policy-bundle remove policy bundle -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-policy-update skip fetching rego policy updates -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Config"},{"location":"docs/references/configuration/cli/trivy_config/#trivy-config","text":"Scan config files for misconfigurations trivy config [flags] DIR","title":"trivy config"},{"location":"docs/references/configuration/cli/trivy_config/#options","text":"--cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for config --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --k8s-version string specify k8s version to validate outdated api by it (example: 1.21.0) --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --report string specify a compliance report format for the output (all,summary) (default \"all\") --reset-policy-bundle remove policy bundle -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-policy-update skip fetching rego policy updates -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed.","title":"Options"},{"location":"docs/references/configuration/cli/trivy_config/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_config/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_convert/","text":"trivy convert Convert Trivy JSON report into a different format trivy convert [flags] RESULT_JSON Examples # report conversion $ trivy image --format json --output result.json --list-all-pkgs debian:11 $ trivy convert --format cyclonedx --output result.cdx result.json Options --compliance string compliance report to generate --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") -h, --help help for convert --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignorefile string specify .trivyignore file (default \".trivyignore\") --list-all-pkgs enabling the option will output all packages regardless of vulnerability -o, --output string output file name --report string specify a report format for the output (all,summary) (default \"all\") -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) -t, --template string output template Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Convert"},{"location":"docs/references/configuration/cli/trivy_convert/#trivy-convert","text":"Convert Trivy JSON report into a different format trivy convert [flags] RESULT_JSON","title":"trivy convert"},{"location":"docs/references/configuration/cli/trivy_convert/#examples","text":"# report conversion $ trivy image --format json --output result.json --list-all-pkgs debian:11 $ trivy convert --format cyclonedx --output result.cdx result.json","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_convert/#options","text":"--compliance string compliance report to generate --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") -h, --help help for convert --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignorefile string specify .trivyignore file (default \".trivyignore\") --list-all-pkgs enabling the option will output all packages regardless of vulnerability -o, --output string output file name --report string specify a report format for the output (all,summary) (default \"all\") -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) -t, --template string output template","title":"Options"},{"location":"docs/references/configuration/cli/trivy_convert/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_convert/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_filesystem/","text":"trivy filesystem Scan local filesystem trivy filesystem [flags] PATH Examples # Scan a local project including language-specific files $ trivy fs /path/to/your_project # Scan a single file $ trivy fs ./trivy-ci-test/Pipfile.lock Options --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for filesystem --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-dev-deps include development dependencies in the report (supported: npm, yarn) --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --report string specify a compliance report format for the output (all,summary) (default \"all\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library]) Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Filesystem"},{"location":"docs/references/configuration/cli/trivy_filesystem/#trivy-filesystem","text":"Scan local filesystem trivy filesystem [flags] PATH","title":"trivy filesystem"},{"location":"docs/references/configuration/cli/trivy_filesystem/#examples","text":"# Scan a local project including language-specific files $ trivy fs /path/to/your_project # Scan a single file $ trivy fs ./trivy-ci-test/Pipfile.lock","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_filesystem/#options","text":"--cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for filesystem --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-dev-deps include development dependencies in the report (supported: npm, yarn) --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --report string specify a compliance report format for the output (all,summary) (default \"all\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])","title":"Options"},{"location":"docs/references/configuration/cli/trivy_filesystem/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_filesystem/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_image/","text":"trivy image Scan a container image trivy image [flags] IMAGE_NAME Examples # Scan a container image $ trivy image python:3.4-alpine # Scan a container image from a tar archive $ trivy image --input ruby-3.1.tar # Filter by severities $ trivy image --severity HIGH,CRITICAL alpine:3.15 # Ignore unfixed/unpatched vulnerabilities $ trivy image --ignore-unfixed alpine:3.15 # Scan a container image in client mode $ trivy image --server http://127.0.0.1:4954 alpine:latest # Generate json result $ trivy image --format json --output result.json alpine:3.15 # Generate a report in the CycloneDX format $ trivy image --format cyclonedx --output result.cdx alpine:3.15 Options --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate (docker-cis) --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --docker-host string unix domain socket path to use for docker scanning --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for image --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --image-config-scanners strings comma-separated list of what security issues to detect on container image configurations (config,secret) --image-src strings image source(s) to use, in priority order (docker,containerd,podman,remote) (default [docker,containerd,podman,remote]) --include-non-failures include successes and exceptions, available with '--scanners config' --input string input file path instead of image name --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --platform string set platform in the form os/arch if image is multi-platform capable --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --removed-pkgs detect vulnerabilities of removed packages (only for Alpine) --report string specify a format for the compliance report. (all,summary) (default \"summary\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library]) Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Image"},{"location":"docs/references/configuration/cli/trivy_image/#trivy-image","text":"Scan a container image trivy image [flags] IMAGE_NAME","title":"trivy image"},{"location":"docs/references/configuration/cli/trivy_image/#examples","text":"# Scan a container image $ trivy image python:3.4-alpine # Scan a container image from a tar archive $ trivy image --input ruby-3.1.tar # Filter by severities $ trivy image --severity HIGH,CRITICAL alpine:3.15 # Ignore unfixed/unpatched vulnerabilities $ trivy image --ignore-unfixed alpine:3.15 # Scan a container image in client mode $ trivy image --server http://127.0.0.1:4954 alpine:latest # Generate json result $ trivy image --format json --output result.json alpine:3.15 # Generate a report in the CycloneDX format $ trivy image --format cyclonedx --output result.cdx alpine:3.15","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_image/#options","text":"--cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate (docker-cis) --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --docker-host string unix domain socket path to use for docker scanning --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for image --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --image-config-scanners strings comma-separated list of what security issues to detect on container image configurations (config,secret) --image-src strings image source(s) to use, in priority order (docker,containerd,podman,remote) (default [docker,containerd,podman,remote]) --include-non-failures include successes and exceptions, available with '--scanners config' --input string input file path instead of image name --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --platform string set platform in the form os/arch if image is multi-platform capable --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --removed-pkgs detect vulnerabilities of removed packages (only for Alpine) --report string specify a format for the compliance report. (all,summary) (default \"summary\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])","title":"Options"},{"location":"docs/references/configuration/cli/trivy_image/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_image/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_kubernetes/","text":"trivy kubernetes [EXPERIMENTAL] Scan kubernetes cluster trivy kubernetes [flags] { cluster | all | specific resources like kubectl. eg: pods, pod/NAME } Examples # cluster scanning $ trivy k8s --report summary cluster # namespace scanning: $ trivy k8s -n kube-system --report summary all # resources scanning: $ trivy k8s --report=summary deploy $ trivy k8s --namespace=kube-system --report=summary deploy,configmaps # resource scanning: $ trivy k8s deployment/orion Options -A, --all-namespaces fetch resources from all cluster namespaces --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate (k8s-nsa,k8s-cis,k8s-pss-baseline,k8s-pss-restricted) --components strings specify which components to scan (workload,infra) (default [workload,infra]) --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --context string specify a context to scan --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --exclude-nodes strings indicate the node labels that the node-collector job should exclude from scanning (example: kubernetes.io/arch:arm64,team:dev) --exclude-owned exclude resources that have an owner reference --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,cyclonedx) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for kubernetes --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignorefile string specify .trivyignore file (default \".trivyignore\") --image-src strings image source(s) to use, in priority order (docker,containerd,podman,remote) (default [docker,containerd,podman,remote]) --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --k8s-version string specify k8s version to validate outdated api by it (example: 1.21.0) --kubeconfig string specify the kubeconfig file path to use --list-all-pkgs enabling the option will output all packages regardless of vulnerability -n, --namespace string specify a namespace to scan --no-progress suppress progress bar --node-collector-namespace string specify the namespace in which the node-collector job should be deployed (default \"trivy-temp\") --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --parallel int number (between 1-20) of goroutines enabled for parallel scanning (default 5) --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --report string specify a report format for the output (all,summary) (default \"all\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners string comma-separated list of what security issues to detect (vuln,config,secret,license) (default \"vuln,config,secret,rbac\") --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --tolerations strings specify node-collector job tolerations (example: key1=value1:NoExecute,key2=value2:NoSchedule) --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library]) Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Kubernetes"},{"location":"docs/references/configuration/cli/trivy_kubernetes/#trivy-kubernetes","text":"[EXPERIMENTAL] Scan kubernetes cluster trivy kubernetes [flags] { cluster | all | specific resources like kubectl. eg: pods, pod/NAME }","title":"trivy kubernetes"},{"location":"docs/references/configuration/cli/trivy_kubernetes/#examples","text":"# cluster scanning $ trivy k8s --report summary cluster # namespace scanning: $ trivy k8s -n kube-system --report summary all # resources scanning: $ trivy k8s --report=summary deploy $ trivy k8s --namespace=kube-system --report=summary deploy,configmaps # resource scanning: $ trivy k8s deployment/orion","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_kubernetes/#options","text":"-A, --all-namespaces fetch resources from all cluster namespaces --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate (k8s-nsa,k8s-cis,k8s-pss-baseline,k8s-pss-restricted) --components strings specify which components to scan (workload,infra) (default [workload,infra]) --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --context string specify a context to scan --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --exclude-nodes strings indicate the node labels that the node-collector job should exclude from scanning (example: kubernetes.io/arch:arm64,team:dev) --exclude-owned exclude resources that have an owner reference --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,cyclonedx) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for kubernetes --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignorefile string specify .trivyignore file (default \".trivyignore\") --image-src strings image source(s) to use, in priority order (docker,containerd,podman,remote) (default [docker,containerd,podman,remote]) --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --k8s-version string specify k8s version to validate outdated api by it (example: 1.21.0) --kubeconfig string specify the kubeconfig file path to use --list-all-pkgs enabling the option will output all packages regardless of vulnerability -n, --namespace string specify a namespace to scan --no-progress suppress progress bar --node-collector-namespace string specify the namespace in which the node-collector job should be deployed (default \"trivy-temp\") --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --parallel int number (between 1-20) of goroutines enabled for parallel scanning (default 5) --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --report string specify a report format for the output (all,summary) (default \"all\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners string comma-separated list of what security issues to detect (vuln,config,secret,license) (default \"vuln,config,secret,rbac\") --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --tolerations strings specify node-collector job tolerations (example: key1=value1:NoExecute,key2=value2:NoSchedule) --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])","title":"Options"},{"location":"docs/references/configuration/cli/trivy_kubernetes/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_kubernetes/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_module/","text":"trivy module Manage modules Options --enable-modules strings [EXPERIMENTAL] module names to enable -h, --help help for module --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner trivy module install - Install a module trivy module uninstall - Uninstall a module","title":"Module"},{"location":"docs/references/configuration/cli/trivy_module/#trivy-module","text":"Manage modules","title":"trivy module"},{"location":"docs/references/configuration/cli/trivy_module/#options","text":"--enable-modules strings [EXPERIMENTAL] module names to enable -h, --help help for module --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\")","title":"Options"},{"location":"docs/references/configuration/cli/trivy_module/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_module/#see-also","text":"trivy - Unified security scanner trivy module install - Install a module trivy module uninstall - Uninstall a module","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_module_install/","text":"trivy module install Install a module trivy module install [flags] REPOSITORY Options -h, --help help for install Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --enable-modules strings [EXPERIMENTAL] module names to enable --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy module - Manage modules","title":"Module Install"},{"location":"docs/references/configuration/cli/trivy_module_install/#trivy-module-install","text":"Install a module trivy module install [flags] REPOSITORY","title":"trivy module install"},{"location":"docs/references/configuration/cli/trivy_module_install/#options","text":"-h, --help help for install","title":"Options"},{"location":"docs/references/configuration/cli/trivy_module_install/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --enable-modules strings [EXPERIMENTAL] module names to enable --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_module_install/#see-also","text":"trivy module - Manage modules","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_module_uninstall/","text":"trivy module uninstall Uninstall a module trivy module uninstall [flags] REPOSITORY Options -h, --help help for uninstall Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --enable-modules strings [EXPERIMENTAL] module names to enable --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy module - Manage modules","title":"Module Uninstall"},{"location":"docs/references/configuration/cli/trivy_module_uninstall/#trivy-module-uninstall","text":"Uninstall a module trivy module uninstall [flags] REPOSITORY","title":"trivy module uninstall"},{"location":"docs/references/configuration/cli/trivy_module_uninstall/#options","text":"-h, --help help for uninstall","title":"Options"},{"location":"docs/references/configuration/cli/trivy_module_uninstall/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --enable-modules strings [EXPERIMENTAL] module names to enable --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_module_uninstall/#see-also","text":"trivy module - Manage modules","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_plugin/","text":"trivy plugin Manage plugins Options -h, --help help for plugin Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner trivy plugin info - Show information about the specified plugin trivy plugin install - Install a plugin trivy plugin list - List installed plugin trivy plugin run - Run a plugin on the fly trivy plugin uninstall - Uninstall a plugin trivy plugin update - Update an existing plugin","title":"Plugin"},{"location":"docs/references/configuration/cli/trivy_plugin/#trivy-plugin","text":"Manage plugins","title":"trivy plugin"},{"location":"docs/references/configuration/cli/trivy_plugin/#options","text":"-h, --help help for plugin","title":"Options"},{"location":"docs/references/configuration/cli/trivy_plugin/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_plugin/#see-also","text":"trivy - Unified security scanner trivy plugin info - Show information about the specified plugin trivy plugin install - Install a plugin trivy plugin list - List installed plugin trivy plugin run - Run a plugin on the fly trivy plugin uninstall - Uninstall a plugin trivy plugin update - Update an existing plugin","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_plugin_info/","text":"trivy plugin info Show information about the specified plugin trivy plugin info PLUGIN_NAME Options -h, --help help for info Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy plugin - Manage plugins","title":"Plugin Info"},{"location":"docs/references/configuration/cli/trivy_plugin_info/#trivy-plugin-info","text":"Show information about the specified plugin trivy plugin info PLUGIN_NAME","title":"trivy plugin info"},{"location":"docs/references/configuration/cli/trivy_plugin_info/#options","text":"-h, --help help for info","title":"Options"},{"location":"docs/references/configuration/cli/trivy_plugin_info/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_plugin_info/#see-also","text":"trivy plugin - Manage plugins","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_plugin_install/","text":"trivy plugin install Install a plugin trivy plugin install URL | FILE_PATH Options -h, --help help for install Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy plugin - Manage plugins","title":"Plugin Install"},{"location":"docs/references/configuration/cli/trivy_plugin_install/#trivy-plugin-install","text":"Install a plugin trivy plugin install URL | FILE_PATH","title":"trivy plugin install"},{"location":"docs/references/configuration/cli/trivy_plugin_install/#options","text":"-h, --help help for install","title":"Options"},{"location":"docs/references/configuration/cli/trivy_plugin_install/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_plugin_install/#see-also","text":"trivy plugin - Manage plugins","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_plugin_list/","text":"trivy plugin list List installed plugin trivy plugin list Options -h, --help help for list Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy plugin - Manage plugins","title":"Plugin List"},{"location":"docs/references/configuration/cli/trivy_plugin_list/#trivy-plugin-list","text":"List installed plugin trivy plugin list","title":"trivy plugin list"},{"location":"docs/references/configuration/cli/trivy_plugin_list/#options","text":"-h, --help help for list","title":"Options"},{"location":"docs/references/configuration/cli/trivy_plugin_list/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_plugin_list/#see-also","text":"trivy plugin - Manage plugins","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_plugin_run/","text":"trivy plugin run Run a plugin on the fly trivy plugin run URL | FILE_PATH Options -h, --help help for run Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy plugin - Manage plugins","title":"Plugin Run"},{"location":"docs/references/configuration/cli/trivy_plugin_run/#trivy-plugin-run","text":"Run a plugin on the fly trivy plugin run URL | FILE_PATH","title":"trivy plugin run"},{"location":"docs/references/configuration/cli/trivy_plugin_run/#options","text":"-h, --help help for run","title":"Options"},{"location":"docs/references/configuration/cli/trivy_plugin_run/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_plugin_run/#see-also","text":"trivy plugin - Manage plugins","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_plugin_uninstall/","text":"trivy plugin uninstall Uninstall a plugin trivy plugin uninstall PLUGIN_NAME Options -h, --help help for uninstall Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy plugin - Manage plugins","title":"Plugin Uninstall"},{"location":"docs/references/configuration/cli/trivy_plugin_uninstall/#trivy-plugin-uninstall","text":"Uninstall a plugin trivy plugin uninstall PLUGIN_NAME","title":"trivy plugin uninstall"},{"location":"docs/references/configuration/cli/trivy_plugin_uninstall/#options","text":"-h, --help help for uninstall","title":"Options"},{"location":"docs/references/configuration/cli/trivy_plugin_uninstall/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_plugin_uninstall/#see-also","text":"trivy plugin - Manage plugins","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_plugin_update/","text":"trivy plugin update Update an existing plugin trivy plugin update PLUGIN_NAME Options -h, --help help for update Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy plugin - Manage plugins","title":"Plugin Update"},{"location":"docs/references/configuration/cli/trivy_plugin_update/#trivy-plugin-update","text":"Update an existing plugin trivy plugin update PLUGIN_NAME","title":"trivy plugin update"},{"location":"docs/references/configuration/cli/trivy_plugin_update/#options","text":"-h, --help help for update","title":"Options"},{"location":"docs/references/configuration/cli/trivy_plugin_update/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_plugin_update/#see-also","text":"trivy plugin - Manage plugins","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_repository/","text":"trivy repository Scan a repository trivy repository [flags] (REPO_PATH | REPO_URL) Examples # Scan your remote git repository $ trivy repo https://github.com/knqyf263/trivy-ci-test # Scan your local git repository $ trivy repo /path/to/your/repository Options --branch string pass the branch name to be scanned --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --commit string pass the commit hash to be scanned --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for repository --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-dev-deps include development dependencies in the report (supported: npm, yarn) --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization --tag string pass the tag name to be scanned -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library]) Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Repository"},{"location":"docs/references/configuration/cli/trivy_repository/#trivy-repository","text":"Scan a repository trivy repository [flags] (REPO_PATH | REPO_URL)","title":"trivy repository"},{"location":"docs/references/configuration/cli/trivy_repository/#examples","text":"# Scan your remote git repository $ trivy repo https://github.com/knqyf263/trivy-ci-test # Scan your local git repository $ trivy repo /path/to/your/repository","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_repository/#options","text":"--branch string pass the branch name to be scanned --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --commit string pass the commit hash to be scanned --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for repository --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-dev-deps include development dependencies in the report (supported: npm, yarn) --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization --tag string pass the tag name to be scanned -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])","title":"Options"},{"location":"docs/references/configuration/cli/trivy_repository/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_repository/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_rootfs/","text":"trivy rootfs Scan rootfs trivy rootfs [flags] ROOTDIR Examples # Scan unpacked filesystem $ docker export $(docker create alpine:3.10.2) | tar -C /tmp/rootfs -xvf - $ trivy rootfs /tmp/rootfs # Scan from inside a container $ docker run --rm -it alpine:3.11 / # curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin / # trivy rootfs / Options --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for rootfs --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library]) Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Rootfs"},{"location":"docs/references/configuration/cli/trivy_rootfs/#trivy-rootfs","text":"Scan rootfs trivy rootfs [flags] ROOTDIR","title":"trivy rootfs"},{"location":"docs/references/configuration/cli/trivy_rootfs/#examples","text":"# Scan unpacked filesystem $ docker export $(docker create alpine:3.10.2) | tar -C /tmp/rootfs -xvf - $ trivy rootfs /tmp/rootfs # Scan from inside a container $ docker run --rm -it alpine:3.11 / # curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin / # trivy rootfs /","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_rootfs/#options","text":"--cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for rootfs --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignored-licenses strings specify a list of license to ignore --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --license-confidence-level float specify license classifier's confidence level (default 0.9) --license-full eagerly look for licenses in source code headers and license files --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --policy-namespaces strings Rego namespaces --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --skip-policy-update skip fetching rego policy updates --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --trace enable more verbose trace output for custom queries --username strings username. Comma-separated usernames allowed. --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])","title":"Options"},{"location":"docs/references/configuration/cli/trivy_rootfs/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_rootfs/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_sbom/","text":"trivy sbom Scan SBOM for vulnerabilities trivy sbom [flags] SBOM_PATH Examples # Scan CycloneDX and show the result in tables $ trivy sbom /path/to/report.cdx # Scan CycloneDX-type attestation and show the result in tables $ trivy sbom /path/to/report.cdx.intoto.jsonl Options --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") -h, --help help for sbom --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignorefile string specify .trivyignore file (default \".trivyignore\") --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --list-all-pkgs enabling the option will output all packages regardless of vulnerability --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --slow scan over time with lower CPU and memory utilization -t, --template string output template --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --vex string [EXPERIMENTAL] file path to VEX --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library]) Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"SBOM"},{"location":"docs/references/configuration/cli/trivy_sbom/#trivy-sbom","text":"Scan SBOM for vulnerabilities trivy sbom [flags] SBOM_PATH","title":"trivy sbom"},{"location":"docs/references/configuration/cli/trivy_sbom/#examples","text":"# Scan CycloneDX and show the result in tables $ trivy sbom /path/to/report.cdx # Scan CycloneDX-type attestation and show the result in tables $ trivy sbom /path/to/report.cdx.intoto.jsonl","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_sbom/#options","text":"--cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") -h, --help help for sbom --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignorefile string specify .trivyignore file (default \".trivyignore\") --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --list-all-pkgs enabling the option will output all packages regardless of vulnerability --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --slow scan over time with lower CPU and memory utilization -t, --template string output template --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --vex string [EXPERIMENTAL] file path to VEX --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])","title":"Options"},{"location":"docs/references/configuration/cli/trivy_sbom/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_sbom/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_server/","text":"trivy server Server mode trivy server [flags] Examples # Run a server $ trivy server # Listen on 0.0.0.0:10000 $ trivy server --listen 0.0.0.0:10000 Options --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --download-db-only download/update vulnerability database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable -h, --help help for server --listen string listen address in server mode (default \"localhost:4954\") --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --reset remove all caches and database --skip-db-update skip updating vulnerability database --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --username strings username. Comma-separated usernames allowed. Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Server"},{"location":"docs/references/configuration/cli/trivy_server/#trivy-server","text":"Server mode trivy server [flags]","title":"trivy server"},{"location":"docs/references/configuration/cli/trivy_server/#examples","text":"# Run a server $ trivy server # Listen on 0.0.0.0:10000 $ trivy server --listen 0.0.0.0:10000","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_server/#options","text":"--cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --download-db-only download/update vulnerability database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable -h, --help help for server --listen string listen address in server mode (default \"localhost:4954\") --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --reset remove all caches and database --skip-db-update skip updating vulnerability database --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --username strings username. Comma-separated usernames allowed.","title":"Options"},{"location":"docs/references/configuration/cli/trivy_server/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_server/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_version/","text":"trivy version Print the version trivy version [flags] Options -f, --format string version format (json) -h, --help help for version Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"Version"},{"location":"docs/references/configuration/cli/trivy_version/#trivy-version","text":"Print the version trivy version [flags]","title":"trivy version"},{"location":"docs/references/configuration/cli/trivy_version/#options","text":"-f, --format string version format (json) -h, --help help for version","title":"Options"},{"location":"docs/references/configuration/cli/trivy_version/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_version/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/configuration/cli/trivy_vm/","text":"trivy vm [EXPERIMENTAL] Scan a virtual machine image trivy vm [flags] VM_IMAGE Examples # Scan your AWS AMI $ trivy vm --scanners vuln ami:${your_ami_id} # Scan your AWS EBS snapshot $ trivy vm ebs:${your_ebs_snapshot_id} Options --aws-region string AWS region to scan --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for vm --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library]) Options inherited from parent commands --cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version SEE ALSO trivy - Unified security scanner","title":"VM"},{"location":"docs/references/configuration/cli/trivy_vm/#trivy-vm","text":"[EXPERIMENTAL] Scan a virtual machine image trivy vm [flags] VM_IMAGE","title":"trivy vm"},{"location":"docs/references/configuration/cli/trivy_vm/#examples","text":"# Scan your AWS AMI $ trivy vm --scanners vuln ami:${your_ami_id} # Scan your AWS EBS snapshot $ trivy vm ebs:${your_ebs_snapshot_id}","title":"Examples"},{"location":"docs/references/configuration/cli/trivy_vm/#options","text":"--aws-region string AWS region to scan --cache-backend string cache backend (e.g. redis://localhost:6379) (default \"fs\") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --compliance string compliance report to generate --custom-headers strings custom headers in client mode --db-repository string OCI repository to retrieve trivy-db from (default \"ghcr.io/aquasecurity/trivy-db\") --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --download-db-only download/update vulnerability database but don't run a scan --download-java-db-only download/update Java index database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable --exit-code int specify exit code when any security issues are found --exit-on-eol int exit with the specified code when the OS reaches end of service/life --file-patterns strings specify config file patterns -f, --format string format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default \"table\") --helm-set strings specify Helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-set-file strings specify Helm values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) --helm-set-string strings specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2) --helm-values strings specify paths to override the Helm values.yaml files -h, --help help for vm --ignore-policy string specify the Rego file path to evaluate each vulnerability --ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life) --ignore-unfixed display only fixed vulnerabilities --ignorefile string specify .trivyignore file (default \".trivyignore\") --include-non-failures include successes and exceptions, available with '--scanners config' --java-db-repository string OCI repository to retrieve trivy-java-db from (default \"ghcr.io/aquasecurity/trivy-java-db\") --list-all-pkgs enabling the option will output all packages regardless of vulnerability --module-dir string specify directory to the wasm modules that will be loaded (default \"$HOME/.trivy/modules\") --no-progress suppress progress bar --offline-scan do not issue API requests to identify dependencies -o, --output string output file name --policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default \"ghcr.io/aquasecurity/defsec:0\") --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --rekor-url string [EXPERIMENTAL] address of rekor STL server (default \"https://rekor.sigstore.dev\") --reset remove all caches and database --reset-policy-bundle remove policy bundle --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --scanners strings comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret]) --secret-config string specify a path to config file for secret scanning (default \"trivy-secret.yaml\") --server string server address in client mode -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) --skip-db-update skip updating vulnerability database --skip-dirs strings specify the directories or glob patterns to skip --skip-files strings specify the files or glob patterns to skip --skip-java-db-update skip updating Java index database --slow scan over time with lower CPU and memory utilization -t, --template string output template --tf-exclude-downloaded-modules remove results for downloaded modules in .terraform folder --tf-vars strings specify paths to override the Terraform tfvars files --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default \"Trivy-Token\") --vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])","title":"Options"},{"location":"docs/references/configuration/cli/trivy_vm/#options-inherited-from-parent-commands","text":"--cache-dir string cache directory (default \"/path/to/cache\") -c, --config string config path (default \"trivy.yaml\") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version","title":"Options inherited from parent commands"},{"location":"docs/references/configuration/cli/trivy_vm/#see-also","text":"trivy - Unified security scanner","title":"SEE ALSO"},{"location":"docs/references/modes/client-server/","text":"Client/Server Trivy has client/server mode. Trivy server has vulnerability database and Trivy client doesn't have to download vulnerability database. It is useful if you want to scan images or files at multiple locations and do not want to download the database at every location. Server At first, you need to launch Trivy server. It downloads vulnerability database automatically and continue to fetch the latest DB in the background. $ trivy server --listen localhost:8080 2019-12-12T15:17:06.551+0200 INFO Need to update DB 2019-12-12T15:17:56.706+0200 INFO Reopening DB... 2019-12-12T15:17:56.707+0200 INFO Listening localhost:8080... If you want to accept a connection from outside, you have to specify 0.0.0.0 or your ip address, not localhost . $ trivy server --listen 0.0.0.0:8080 Remote image scan Then, specify the server address for image command. $ trivy image --server http://localhost:8080 alpine:3.10 Note : It's important to specify the protocol (http or https). Result alpine:3.10 (alpine 3.10.2) =========================== Total: 3 (UNKNOWN: 0, LOW: 1, MEDIUM: 2, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | +---------+------------------+----------+-------------------+---------------+ | openssl | CVE-2019-1549 | MEDIUM | 1.1.1c-r0 | 1.1.1d-r0 | + +------------------+ + + + | | CVE-2019-1563 | | | | + +------------------+----------+ + + | | CVE-2019-1547 | LOW | | | +---------+------------------+----------+-------------------+---------------+ Remote scan of local filesystem Also, there is a way to scan local file system: $ trivy fs --server http://localhost:8080 --severity CRITICAL ./integration/testdata/fixtures/fs/pom/ Note : It's important to specify the protocol (http or https). Result pom.xml (pom) ============= Total: 24 (CRITICAL: 24) +---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+ | com.fasterxml.jackson.core:jackson-databind | CVE-2017-17485 | CRITICAL | 2.9.1 | 2.8.11, 2.9.4 | jackson-databind: Unsafe | | | | | | | deserialization due to | | | | | | | incomplete black list (incomplete | | | | | | | fix for CVE-2017-15095)... | | | | | | | -->avd.aquasec.com/nvd/cve-2017-17485 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-11307 | | | 2.7.9.4, 2.8.11.2, 2.9.6 | jackson-databind: Potential | | | | | | | information exfiltration with | | | | | | | default typing, serialization | | | | | | | gadget from MyBatis | | | | | | | -->avd.aquasec.com/nvd/cve-2018-11307 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-14718 | | | 2.6.7.2, 2.9.7 | jackson-databind: arbitrary code | | | | | | | execution in slf4j-ext class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14718 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-14719 | | | | jackson-databind: arbitrary | | | | | | | code execution in blaze-ds-opt | | | | | | | and blaze-ds-core classes | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14719 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-14720 | | | | jackson-databind: exfiltration/XXE | | | | | | | in some JDK classes | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14720 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-14721 | | | | jackson-databind: server-side request | | | | | | | forgery (SSRF) in axis2-jaxws class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14721 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-19360 | | | 2.6.7.3, 2.7.9.5, 2.8.11.3, | jackson-databind: improper | | | | | | 2.9.8 | polymorphic deserialization | | | | | | | in axis2-transport-jms class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-19360 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-19361 | | | | jackson-databind: improper | | | | | | | polymorphic deserialization | | | | | | | in openjpa class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-19361 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-19362 | | | | jackson-databind: improper | | | | | | | polymorphic deserialization | | | | | | | in jboss-common-core class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-19362 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-7489 | | | 2.7.9.3, 2.8.11.1, 2.9.5 | jackson-databind: incomplete fix | | | | | | | for CVE-2017-7525 permits unsafe | | | | | | | serialization via c3p0 libraries | | | | | | | -->avd.aquasec.com/nvd/cve-2018-7489 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14379 | | | 2.7.9.6, 2.8.11.4, 2.9.9.2 | jackson-databind: default | | | | | | | typing mishandling leading | | | | | | | to remote code execution | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14379 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14540 | | | 2.9.10 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | com.zaxxer.hikari.HikariConfig | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14540 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14892 | | | 2.6.7.3, 2.8.11.5, 2.9.10 | jackson-databind: Serialization | | | | | | | gadgets in classes of the | | | | | | | commons-configuration package | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14892 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14893 | | | 2.8.11.5, 2.9.10 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | classes of the xalan package | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14893 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-16335 | | | 2.9.10 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | com.zaxxer.hikari.HikariDataSource | | | | | | | -->avd.aquasec.com/nvd/cve-2019-16335 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-16942 | | | 2.9.10.1 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | org.apache.commons.dbcp.datasources.* | | | | | | | -->avd.aquasec.com/nvd/cve-2019-16942 | + +------------------+ + + +---------------------------------------+ | | CVE-2019-16943 | | | | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | com.p6spy.engine.spy.P6DataSource | | | | | | | -->avd.aquasec.com/nvd/cve-2019-16943 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-17267 | | | 2.9.10 | jackson-databind: Serialization | | | | | | | gadgets in classes of | | | | | | | the ehcache package | | | | | | | -->avd.aquasec.com/nvd/cve-2019-17267 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-17531 | | | 2.9.10.1 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | org.apache.log4j.receivers.db.* | | | | | | | -->avd.aquasec.com/nvd/cve-2019-17531 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-20330 | | | 2.8.11.5, 2.9.10.2 | jackson-databind: lacks | | | | | | | certain net.sf.ehcache blocking | | | | | | | -->avd.aquasec.com/nvd/cve-2019-20330 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2020-8840 | | | 2.7.9.7, 2.8.11.5, 2.9.10.3 | jackson-databind: Lacks certain | | | | | | | xbean-reflect/JNDI blocking | | | | | | | -->avd.aquasec.com/nvd/cve-2020-8840 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2020-9546 | | | 2.7.9.7, 2.8.11.6, 2.9.10.4 | jackson-databind: Serialization | | | | | | | gadgets in shaded-hikari-config | | | | | | | -->avd.aquasec.com/nvd/cve-2020-9546 | + +------------------+ + + +---------------------------------------+ | | CVE-2020-9547 | | | | jackson-databind: Serialization | | | | | | | gadgets in ibatis-sqlmap | | | | | | | -->avd.aquasec.com/nvd/cve-2020-9547 | + +------------------+ + + +---------------------------------------+ | | CVE-2020-9548 | | | | jackson-databind: Serialization | | | | | | | gadgets in anteros-core | | | | | | | -->avd.aquasec.com/nvd/cve-2020-9548 | +---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+ Remote scan of root filesystem Also, there is a way to scan root file system: $ trivy rootfs --server http://localhost:8080 --severity CRITICAL /tmp/rootfs Note : It's important to specify the protocol (http or https). Result /tmp/rootfs (alpine 3.10.2) Total: 1 (CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 apk-tools \u2502 CVE-2021-36159 \u2502 CRITICAL \u2502 2.10.4-r2 \u2502 2.10.7-r0 \u2502 libfetch before 2021-07-26, as used in apk-tools, xbps, and \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 other products, mishandles... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-36159 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Remote scan of git repository Also, there is a way to scan remote git repository: $ trivy repo https://github.com/knqyf263/trivy-ci-test --server http://localhost:8080 Note : It's important to specify the protocol (http or https). Result Cargo.lock (cargo) ================== Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 2, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 ammonia \u2502 CVE-2019-15542 \u2502 HIGH \u2502 1.9.0 \u2502 2.1.0 \u2502 Uncontrolled recursion in ammonia \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-15542 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-38193 \u2502 MEDIUM \u2502 \u2502 2.1.3, 3.1.0 \u2502 An issue was discovered in the ammonia crate before 3.1.0 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for Rust.... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-38193 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 smallvec \u2502 CVE-2019-15551 \u2502 \u2502 0.6.9 \u2502 0.6.10 \u2502 An issue was discovered in the smallvec crate before 0.6.10 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for Rust.... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-15551 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2018-25023 \u2502 HIGH \u2502 \u2502 0.6.13 \u2502 An issue was discovered in the smallvec crate before 0.6.13 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for Rust.... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2018-25023 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 GHSA-66p5-j55p-32r9 \u2502 MEDIUM \u2502 \u2502 \u2502 smallvec creates uninitialized value of any type \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://github.com/advisories/GHSA-66p5-j55p-32r9 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Pipfile.lock (pipenv) ===================== Total: 8 (UNKNOWN: 0, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 celery \u2502 CVE-2021-23727 \u2502 HIGH \u2502 4.3.0 \u2502 5.2.2 \u2502 celery: stored command injection vulnerability may allow \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 privileges escalation \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-23727 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 django \u2502 CVE-2019-6975 \u2502 \u2502 2.0.9 \u2502 1.11.19, 2.0.12, 2.1.7 \u2502 python-django: memory exhaustion in \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 django.utils.numberformat.format() \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-6975 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2019-3498 \u2502 MEDIUM \u2502 \u2502 1.11.18, 2.0.10, 2.1.5 \u2502 python-django: Content spoofing via URL path in default 404 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 page \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-3498 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-33203 \u2502 \u2502 \u2502 2.2.24, 3.1.12, 3.2.4 \u2502 django: Potential directory traversal via ``admindocs`` \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-33203 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 urllib3 \u2502 CVE-2019-11324 \u2502 \u2502 1.24.1 \u2502 1.24.2 \u2502 python-urllib3: Certification mishandle when error should be \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 thrown \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-11324 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-33503 \u2502 \u2502 \u2502 1.26.5 \u2502 python-urllib3: ReDoS in the parsing of authority part of \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 URL \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-33503 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2019-11236 \u2502 MEDIUM \u2502 \u2502 1.24.3 \u2502 python-urllib3: CRLF injection due to not encoding the \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 '\\r\\n' sequence leading to... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-11236 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2020-26137 \u2502 \u2502 \u2502 1.25.9 \u2502 python-urllib3: CRLF injection via HTTP request method \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2020-26137 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Authentication $ trivy server --listen localhost:8080 --token dummy $ trivy image --server http://localhost:8080 --token dummy alpine:3.10 Endpoints Health Checks whether the Trivy server is running. Authentication is not required. Example request: curl -s 0 .0.0.0:8080/healthz ok Returns the 200 OK status if the request was successful. Version Returns the version of the Trivy and all components (db, policy). Authentication is not required. Example request: curl -s 0 .0.0.0:8080/version | jq { \"Version\" : \"dev\" , \"VulnerabilityDB\" : { \"Version\" : 2 , \"NextUpdate\" : \"2023-07-25T14:15:29.876639806Z\" , \"UpdatedAt\" : \"2023-07-25T08:15:29.876640206Z\" , \"DownloadedAt\" : \"2023-07-25T09:36:25.599004Z\" } , \"JavaDB\" : { \"Version\" : 1 , \"NextUpdate\" : \"2023-07-28T01:03:52.169192565Z\" , \"UpdatedAt\" : \"2023-07-25T01:03:52.169192765Z\" , \"DownloadedAt\" : \"2023-07-25T09:37:48.906152Z\" } , \"PolicyBundle\" : { \"Digest\" : \"sha256:829832357626da2677955e3b427191212978ba20012b6eaa03229ca28569ae43\" , \"DownloadedAt\" : \"2023-07-23T11:40:33.122462Z\" } } Returns the 200 OK status if the request was successful. Architecture","title":"Client/Server"},{"location":"docs/references/modes/client-server/#clientserver","text":"Trivy has client/server mode. Trivy server has vulnerability database and Trivy client doesn't have to download vulnerability database. It is useful if you want to scan images or files at multiple locations and do not want to download the database at every location.","title":"Client/Server"},{"location":"docs/references/modes/client-server/#server","text":"At first, you need to launch Trivy server. It downloads vulnerability database automatically and continue to fetch the latest DB in the background. $ trivy server --listen localhost:8080 2019-12-12T15:17:06.551+0200 INFO Need to update DB 2019-12-12T15:17:56.706+0200 INFO Reopening DB... 2019-12-12T15:17:56.707+0200 INFO Listening localhost:8080... If you want to accept a connection from outside, you have to specify 0.0.0.0 or your ip address, not localhost . $ trivy server --listen 0.0.0.0:8080","title":"Server"},{"location":"docs/references/modes/client-server/#remote-image-scan","text":"Then, specify the server address for image command. $ trivy image --server http://localhost:8080 alpine:3.10 Note : It's important to specify the protocol (http or https). Result alpine:3.10 (alpine 3.10.2) =========================== Total: 3 (UNKNOWN: 0, LOW: 1, MEDIUM: 2, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | +---------+------------------+----------+-------------------+---------------+ | openssl | CVE-2019-1549 | MEDIUM | 1.1.1c-r0 | 1.1.1d-r0 | + +------------------+ + + + | | CVE-2019-1563 | | | | + +------------------+----------+ + + | | CVE-2019-1547 | LOW | | | +---------+------------------+----------+-------------------+---------------+","title":"Remote image scan"},{"location":"docs/references/modes/client-server/#remote-scan-of-local-filesystem","text":"Also, there is a way to scan local file system: $ trivy fs --server http://localhost:8080 --severity CRITICAL ./integration/testdata/fixtures/fs/pom/ Note : It's important to specify the protocol (http or https). Result pom.xml (pom) ============= Total: 24 (CRITICAL: 24) +---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+ | com.fasterxml.jackson.core:jackson-databind | CVE-2017-17485 | CRITICAL | 2.9.1 | 2.8.11, 2.9.4 | jackson-databind: Unsafe | | | | | | | deserialization due to | | | | | | | incomplete black list (incomplete | | | | | | | fix for CVE-2017-15095)... | | | | | | | -->avd.aquasec.com/nvd/cve-2017-17485 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-11307 | | | 2.7.9.4, 2.8.11.2, 2.9.6 | jackson-databind: Potential | | | | | | | information exfiltration with | | | | | | | default typing, serialization | | | | | | | gadget from MyBatis | | | | | | | -->avd.aquasec.com/nvd/cve-2018-11307 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-14718 | | | 2.6.7.2, 2.9.7 | jackson-databind: arbitrary code | | | | | | | execution in slf4j-ext class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14718 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-14719 | | | | jackson-databind: arbitrary | | | | | | | code execution in blaze-ds-opt | | | | | | | and blaze-ds-core classes | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14719 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-14720 | | | | jackson-databind: exfiltration/XXE | | | | | | | in some JDK classes | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14720 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-14721 | | | | jackson-databind: server-side request | | | | | | | forgery (SSRF) in axis2-jaxws class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-14721 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-19360 | | | 2.6.7.3, 2.7.9.5, 2.8.11.3, | jackson-databind: improper | | | | | | 2.9.8 | polymorphic deserialization | | | | | | | in axis2-transport-jms class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-19360 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-19361 | | | | jackson-databind: improper | | | | | | | polymorphic deserialization | | | | | | | in openjpa class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-19361 | + +------------------+ + + +---------------------------------------+ | | CVE-2018-19362 | | | | jackson-databind: improper | | | | | | | polymorphic deserialization | | | | | | | in jboss-common-core class | | | | | | | -->avd.aquasec.com/nvd/cve-2018-19362 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2018-7489 | | | 2.7.9.3, 2.8.11.1, 2.9.5 | jackson-databind: incomplete fix | | | | | | | for CVE-2017-7525 permits unsafe | | | | | | | serialization via c3p0 libraries | | | | | | | -->avd.aquasec.com/nvd/cve-2018-7489 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14379 | | | 2.7.9.6, 2.8.11.4, 2.9.9.2 | jackson-databind: default | | | | | | | typing mishandling leading | | | | | | | to remote code execution | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14379 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14540 | | | 2.9.10 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | com.zaxxer.hikari.HikariConfig | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14540 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14892 | | | 2.6.7.3, 2.8.11.5, 2.9.10 | jackson-databind: Serialization | | | | | | | gadgets in classes of the | | | | | | | commons-configuration package | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14892 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-14893 | | | 2.8.11.5, 2.9.10 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | classes of the xalan package | | | | | | | -->avd.aquasec.com/nvd/cve-2019-14893 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-16335 | | | 2.9.10 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | com.zaxxer.hikari.HikariDataSource | | | | | | | -->avd.aquasec.com/nvd/cve-2019-16335 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-16942 | | | 2.9.10.1 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | org.apache.commons.dbcp.datasources.* | | | | | | | -->avd.aquasec.com/nvd/cve-2019-16942 | + +------------------+ + + +---------------------------------------+ | | CVE-2019-16943 | | | | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | com.p6spy.engine.spy.P6DataSource | | | | | | | -->avd.aquasec.com/nvd/cve-2019-16943 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-17267 | | | 2.9.10 | jackson-databind: Serialization | | | | | | | gadgets in classes of | | | | | | | the ehcache package | | | | | | | -->avd.aquasec.com/nvd/cve-2019-17267 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-17531 | | | 2.9.10.1 | jackson-databind: | | | | | | | Serialization gadgets in | | | | | | | org.apache.log4j.receivers.db.* | | | | | | | -->avd.aquasec.com/nvd/cve-2019-17531 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2019-20330 | | | 2.8.11.5, 2.9.10.2 | jackson-databind: lacks | | | | | | | certain net.sf.ehcache blocking | | | | | | | -->avd.aquasec.com/nvd/cve-2019-20330 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2020-8840 | | | 2.7.9.7, 2.8.11.5, 2.9.10.3 | jackson-databind: Lacks certain | | | | | | | xbean-reflect/JNDI blocking | | | | | | | -->avd.aquasec.com/nvd/cve-2020-8840 | + +------------------+ + +--------------------------------+---------------------------------------+ | | CVE-2020-9546 | | | 2.7.9.7, 2.8.11.6, 2.9.10.4 | jackson-databind: Serialization | | | | | | | gadgets in shaded-hikari-config | | | | | | | -->avd.aquasec.com/nvd/cve-2020-9546 | + +------------------+ + + +---------------------------------------+ | | CVE-2020-9547 | | | | jackson-databind: Serialization | | | | | | | gadgets in ibatis-sqlmap | | | | | | | -->avd.aquasec.com/nvd/cve-2020-9547 | + +------------------+ + + +---------------------------------------+ | | CVE-2020-9548 | | | | jackson-databind: Serialization | | | | | | | gadgets in anteros-core | | | | | | | -->avd.aquasec.com/nvd/cve-2020-9548 | +---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+","title":"Remote scan of local filesystem"},{"location":"docs/references/modes/client-server/#remote-scan-of-root-filesystem","text":"Also, there is a way to scan root file system: $ trivy rootfs --server http://localhost:8080 --severity CRITICAL /tmp/rootfs Note : It's important to specify the protocol (http or https). Result /tmp/rootfs (alpine 3.10.2) Total: 1 (CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 apk-tools \u2502 CVE-2021-36159 \u2502 CRITICAL \u2502 2.10.4-r2 \u2502 2.10.7-r0 \u2502 libfetch before 2021-07-26, as used in apk-tools, xbps, and \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 other products, mishandles... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-36159 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"Remote scan of root filesystem"},{"location":"docs/references/modes/client-server/#remote-scan-of-git-repository","text":"Also, there is a way to scan remote git repository: $ trivy repo https://github.com/knqyf263/trivy-ci-test --server http://localhost:8080 Note : It's important to specify the protocol (http or https). Result Cargo.lock (cargo) ================== Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 2, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 ammonia \u2502 CVE-2019-15542 \u2502 HIGH \u2502 1.9.0 \u2502 2.1.0 \u2502 Uncontrolled recursion in ammonia \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-15542 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-38193 \u2502 MEDIUM \u2502 \u2502 2.1.3, 3.1.0 \u2502 An issue was discovered in the ammonia crate before 3.1.0 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for Rust.... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-38193 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 smallvec \u2502 CVE-2019-15551 \u2502 \u2502 0.6.9 \u2502 0.6.10 \u2502 An issue was discovered in the smallvec crate before 0.6.10 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for Rust.... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-15551 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2018-25023 \u2502 HIGH \u2502 \u2502 0.6.13 \u2502 An issue was discovered in the smallvec crate before 0.6.13 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for Rust.... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2018-25023 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 GHSA-66p5-j55p-32r9 \u2502 MEDIUM \u2502 \u2502 \u2502 smallvec creates uninitialized value of any type \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://github.com/advisories/GHSA-66p5-j55p-32r9 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Pipfile.lock (pipenv) ===================== Total: 8 (UNKNOWN: 0, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 celery \u2502 CVE-2021-23727 \u2502 HIGH \u2502 4.3.0 \u2502 5.2.2 \u2502 celery: stored command injection vulnerability may allow \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 privileges escalation \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-23727 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 django \u2502 CVE-2019-6975 \u2502 \u2502 2.0.9 \u2502 1.11.19, 2.0.12, 2.1.7 \u2502 python-django: memory exhaustion in \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 django.utils.numberformat.format() \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-6975 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2019-3498 \u2502 MEDIUM \u2502 \u2502 1.11.18, 2.0.10, 2.1.5 \u2502 python-django: Content spoofing via URL path in default 404 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 page \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-3498 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-33203 \u2502 \u2502 \u2502 2.2.24, 3.1.12, 3.2.4 \u2502 django: Potential directory traversal via ``admindocs`` \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-33203 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 urllib3 \u2502 CVE-2019-11324 \u2502 \u2502 1.24.1 \u2502 1.24.2 \u2502 python-urllib3: Certification mishandle when error should be \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 thrown \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-11324 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-33503 \u2502 \u2502 \u2502 1.26.5 \u2502 python-urllib3: ReDoS in the parsing of authority part of \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 URL \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-33503 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2019-11236 \u2502 MEDIUM \u2502 \u2502 1.24.3 \u2502 python-urllib3: CRLF injection due to not encoding the \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 '\\r\\n' sequence leading to... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-11236 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2020-26137 \u2502 \u2502 \u2502 1.25.9 \u2502 python-urllib3: CRLF injection via HTTP request method \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2020-26137 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"Remote scan of git repository"},{"location":"docs/references/modes/client-server/#authentication","text":"$ trivy server --listen localhost:8080 --token dummy $ trivy image --server http://localhost:8080 --token dummy alpine:3.10","title":"Authentication"},{"location":"docs/references/modes/client-server/#endpoints","text":"","title":"Endpoints"},{"location":"docs/references/modes/client-server/#health","text":"Checks whether the Trivy server is running. Authentication is not required. Example request: curl -s 0 .0.0.0:8080/healthz ok Returns the 200 OK status if the request was successful.","title":"Health"},{"location":"docs/references/modes/client-server/#version","text":"Returns the version of the Trivy and all components (db, policy). Authentication is not required. Example request: curl -s 0 .0.0.0:8080/version | jq { \"Version\" : \"dev\" , \"VulnerabilityDB\" : { \"Version\" : 2 , \"NextUpdate\" : \"2023-07-25T14:15:29.876639806Z\" , \"UpdatedAt\" : \"2023-07-25T08:15:29.876640206Z\" , \"DownloadedAt\" : \"2023-07-25T09:36:25.599004Z\" } , \"JavaDB\" : { \"Version\" : 1 , \"NextUpdate\" : \"2023-07-28T01:03:52.169192565Z\" , \"UpdatedAt\" : \"2023-07-25T01:03:52.169192765Z\" , \"DownloadedAt\" : \"2023-07-25T09:37:48.906152Z\" } , \"PolicyBundle\" : { \"Digest\" : \"sha256:829832357626da2677955e3b427191212978ba20012b6eaa03229ca28569ae43\" , \"DownloadedAt\" : \"2023-07-23T11:40:33.122462Z\" } } Returns the 200 OK status if the request was successful.","title":"Version"},{"location":"docs/references/modes/client-server/#architecture","text":"","title":"Architecture"},{"location":"docs/references/modes/standalone/","text":"Standalone trivy image , trivy filesystem , and trivy repo works as standalone mode. Image Filesystem Git Repository","title":"Standalone"},{"location":"docs/references/modes/standalone/#standalone","text":"trivy image , trivy filesystem , and trivy repo works as standalone mode.","title":"Standalone"},{"location":"docs/references/modes/standalone/#image","text":"","title":"Image"},{"location":"docs/references/modes/standalone/#filesystem","text":"","title":"Filesystem"},{"location":"docs/references/modes/standalone/#git-repository","text":"","title":"Git Repository"},{"location":"docs/scanner/license/","text":"License Scanning Trivy scans any container image for license files and offers an opinionated view on the risk associated with the license. License are classified using the Google License Classification - Forbidden Restricted Reciprocal Notice Permissive Unencumbered Unknown Tip Licenses that Trivy fails to recognize are classified as UNKNOWN. As those licenses may be in violation, it is recommended to check those unknown licenses as well. By default, Trivy scans licenses for packages installed by apk , apt-get , dnf , npm , pip , gem , etc. Check out the coverage document for details. To enable extended license scanning, you can use --license-full . In addition to package licenses, Trivy scans source code files, Markdown documents, text files and LICENSE documents to identify license usage within the image or filesystem. By default, Trivy only classifies licenses that are matched with a confidence level of 0.9 or more by the classifer. To configure the confidence level, you can use --license-confidence-level . This enables us to classify licenses that might be matched with a lower confidence level by the classifer. Note The full license scanning is expensive. It takes a while. Currently, the standard license scanning doesn't support filesystem and repository scanning. License scanning Image Rootfs Filesystem Repository Standard \u2705 \u2705 - - Full (--license-full) \u2705 \u2705 \u2705 \u2705 License checking classifies the identified licenses and map the classification to severity. Classification Severity Forbidden CRITICAL Restricted HIGH Reciprocal MEDIUM Notice LOW Permissive LOW Unencumbered LOW Unknown UNKNOWN Quick start This section shows how to scan license in container image and filesystem. Standard scanning Specify an image name with --scanners license . $ trivy image --scanners license --severity UNKNOWN,HIGH,CRITICAL alpine:3.15 2022 -07-13T17:28:39.526+0300 INFO License scanning is enabled OS Packages ( license ) ===================== Total: 6 ( UNKNOWN: 0 , HIGH: 6 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Package \u2502 License \u2502 Classification \u2502 Severity \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 alpine-baselayout \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 apk-tools \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 busybox \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 scanelf \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 ssl_client \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Full scanning Specify --license-full $ trivy image --scanners license --severity UNKNOWN,HIGH,CRITICAL --license-full grafana/grafana 2022 -07-13T17:48:40.905+0300 INFO Full license scanning is enabled OS Packages ( license ) ===================== Total: 20 ( UNKNOWN: 9 , HIGH: 11 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Package \u2502 License \u2502 Classification \u2502 Severity \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 alpine-baselayout \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 apk-tools \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 bash \u2502 GPL-3.0 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 keyutils-libs \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 LGPL-2.0-or-later \u2502 Non Standard \u2502 UNKNOWN \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 libaio \u2502 LGPL-2.1-or-later \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 libcom_err \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 LGPL-2.0-or-later \u2502 Non Standard \u2502 UNKNOWN \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 tzdata \u2502 Public-Domain \u2502 Non Standard \u2502 UNKNOWN \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Loose File License ( s ) ( license ) =============================== Total: 6 ( UNKNOWN: 4 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Classification \u2502 Severity \u2502 License \u2502 File Location \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 Forbidden \u2502 CRITICAL \u2502 AGPL-3.0 \u2502 /usr/share/grafana/LICENSE \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 Non Standard \u2502 UNKNOWN \u2502 BSD-0-Clause \u2502 /usr/share/grafana/public/build/5069.d6aae9dd11d49c741a80.j- \u2502 \u2502 \u2502 \u2502 \u2502 s.LICENSE.txt \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 /usr/share/grafana/public/build/6444.d6aae9dd11d49c741a80.j- \u2502 \u2502 \u2502 \u2502 \u2502 s.LICENSE.txt \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 /usr/share/grafana/public/build/7889.d6aae9dd11d49c741a80.j- \u2502 \u2502 \u2502 \u2502 \u2502 s.LICENSE.txt \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 /usr/share/grafana/public/build/canvasPanel.d6aae9dd11d49c7- \u2502 \u2502 \u2502 \u2502 \u2502 41a80.js.LICENSE.txt \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Configuration Trivy has number of configuration flags for use with license scanning; Ignored Licenses Trivy license scanning can ignore licenses that are identified to explicitly remove them from the results using the --ignored-licenses flag; $ trivy image --scanners license --ignored-licenses MPL-2.0,MIT --severity HIGH grafana/grafana:latest 2022 -07-13T18:15:28.605Z INFO License scanning is enabled OS Packages ( license ) ===================== Total: 2 ( HIGH: 2 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Package \u2502 License \u2502 Classification \u2502 Severity \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 alpine-baselayout \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 ssl_client \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Configuring Classifier Confidence Level You can use the --license-confidence-level flag to adjust the confidence level between 0.0 to 1.0 (default 0.9). For example, when you run the scanner with the default confidence level on SPDX license list data , it is able to detect only 258 licenses. $ trivy fs --scanners license --license-full <path/to/spdx/list/data> 2023 -04-18T10:05:13.601-0700 INFO Full license scanning is enabled Loose File License ( s ) ( license ) =============================== Total: 258 ( UNKNOWN: 70 , LOW: 90 , MEDIUM: 18 , HIGH: 58 , CRITICAL: 22 ) However, by configuring the confidence level to 0.8, the scanner is now able to detect 282 licenses. $ trivy fs --scanners license --license-full --license-confidence-level 0 .8 <path/to/spdx/list/data> 2023 -04-18T10:21:39.637-0700 INFO Full license scanning is enabled Loose File License ( s ) ( license ) =============================== Total: 282 ( UNKNOWN: 81 , LOW: 97 , MEDIUM: 24 , HIGH: 58 , CRITICAL: 22 ) Custom Classification You can generate the default config by the --generate-default-config flag and customize the license classification. For example, if you want to forbid only AGPL-3.0, you can leave it under forbidden and move other licenses to another classification. $ trivy image --generate-default-config $ vim trivy.yaml license: forbidden: - AGPL-3.0 restricted: - AGPL-1.0 - CC-BY-NC-1.0 - CC-BY-NC-2.0 - CC-BY-NC-2.5 - CC-BY-NC-3.0 - CC-BY-NC-4.0 - CC-BY-NC-ND-1.0 - CC-BY-NC-ND-2.0 - CC-BY-NC-ND-2.5 - CC-BY-NC-ND-3.0 - CC-BY-NC-ND-4.0 - CC-BY-NC-SA-1.0 - CC-BY-NC-SA-2.0 - CC-BY-NC-SA-2.5 - CC-BY-NC-SA-3.0 - CC-BY-NC-SA-4.0 - Commons-Clause - Facebook-2-Clause - Facebook-3-Clause - Facebook-Examples - WTFPL - BCL - CC-BY-ND-1.0 - CC-BY-ND-2.0 - CC-BY-ND-2.5 - CC-BY-ND-3.0 - CC-BY-ND-4.0 - CC-BY-SA-1.0 - CC-BY-SA-2.0 - CC-BY-SA-2.5 - CC-BY-SA-3.0 - CC-BY-SA-4.0 - GPL-1.0 - GPL-2.0 - GPL-2.0-with-autoconf-exception - GPL-2.0-with-bison-exception - GPL-2.0-with-classpath-exception - GPL-2.0-with-font-exception - GPL-2.0-with-GCC-exception - GPL-3.0 - GPL-3.0-with-autoconf-exception - GPL-3.0-with-GCC-exception - LGPL-2.0 - LGPL-2.1 - LGPL-3.0 - NPL-1.0 - NPL-1.1 - OSL-1.0 - OSL-1.1 - OSL-2.0 - OSL-2.1 - OSL-3.0 - QPL-1.0 - Sleepycat reciprocal: - APSL-1.0 - APSL-1.1 - APSL-1.2 - APSL-2.0 - CDDL-1.0 - CDDL-1.1 - CPL-1.0 - EPL-1.0 - EPL-2.0 - FreeImage - IPL-1.0 - MPL-1.0 - MPL-1.1 - MPL-2.0 - Ruby notice: - AFL-1.1 - AFL-1.2 - AFL-2.0 - AFL-2.1 - AFL-3.0 - Apache-1.0 - Apache-1.1 - Apache-2.0 - Artistic-1.0-cl8 - Artistic-1.0-Perl - Artistic-1.0 - Artistic-2.0 - BSL-1.0 - BSD-2-Clause-FreeBSD - BSD-2-Clause-NetBSD - BSD-2-Clause - BSD-3-Clause-Attribution - BSD-3-Clause-Clear - BSD-3-Clause-LBNL - BSD-3-Clause - BSD-4-Clause - BSD-4-Clause-UC - BSD-Protection - CC-BY-1.0 - CC-BY-2.0 - CC-BY-2.5 - CC-BY-3.0 - CC-BY-4.0 - FTL - ISC - ImageMagick - Libpng - Lil-1.0 - Linux-OpenIB - LPL-1.02 - LPL-1.0 - MS-PL - MIT - NCSA - OpenSSL - PHP-3.01 - PHP-3.0 - PIL - Python-2.0 - Python-2.0-complete - PostgreSQL - SGI-B-1.0 - SGI-B-1.1 - SGI-B-2.0 - Unicode-DFS-2015 - Unicode-DFS-2016 - Unicode-TOU - UPL-1.0 - W3C-19980720 - W3C-20150513 - W3C - X11 - Xnet - Zend-2.0 - zlib-acknowledgement - Zlib - ZPL-1.1 - ZPL-2.0 - ZPL-2.1 unencumbered: - CC0-1.0 - Unlicense - 0BSD permissive: []","title":"License"},{"location":"docs/scanner/license/#license-scanning","text":"Trivy scans any container image for license files and offers an opinionated view on the risk associated with the license. License are classified using the Google License Classification - Forbidden Restricted Reciprocal Notice Permissive Unencumbered Unknown Tip Licenses that Trivy fails to recognize are classified as UNKNOWN. As those licenses may be in violation, it is recommended to check those unknown licenses as well. By default, Trivy scans licenses for packages installed by apk , apt-get , dnf , npm , pip , gem , etc. Check out the coverage document for details. To enable extended license scanning, you can use --license-full . In addition to package licenses, Trivy scans source code files, Markdown documents, text files and LICENSE documents to identify license usage within the image or filesystem. By default, Trivy only classifies licenses that are matched with a confidence level of 0.9 or more by the classifer. To configure the confidence level, you can use --license-confidence-level . This enables us to classify licenses that might be matched with a lower confidence level by the classifer. Note The full license scanning is expensive. It takes a while. Currently, the standard license scanning doesn't support filesystem and repository scanning. License scanning Image Rootfs Filesystem Repository Standard \u2705 \u2705 - - Full (--license-full) \u2705 \u2705 \u2705 \u2705 License checking classifies the identified licenses and map the classification to severity. Classification Severity Forbidden CRITICAL Restricted HIGH Reciprocal MEDIUM Notice LOW Permissive LOW Unencumbered LOW Unknown UNKNOWN","title":"License Scanning"},{"location":"docs/scanner/license/#quick-start","text":"This section shows how to scan license in container image and filesystem.","title":"Quick start"},{"location":"docs/scanner/license/#standard-scanning","text":"Specify an image name with --scanners license . $ trivy image --scanners license --severity UNKNOWN,HIGH,CRITICAL alpine:3.15 2022 -07-13T17:28:39.526+0300 INFO License scanning is enabled OS Packages ( license ) ===================== Total: 6 ( UNKNOWN: 0 , HIGH: 6 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Package \u2502 License \u2502 Classification \u2502 Severity \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 alpine-baselayout \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 apk-tools \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 busybox \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 scanelf \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 ssl_client \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"Standard scanning"},{"location":"docs/scanner/license/#full-scanning","text":"Specify --license-full $ trivy image --scanners license --severity UNKNOWN,HIGH,CRITICAL --license-full grafana/grafana 2022 -07-13T17:48:40.905+0300 INFO Full license scanning is enabled OS Packages ( license ) ===================== Total: 20 ( UNKNOWN: 9 , HIGH: 11 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Package \u2502 License \u2502 Classification \u2502 Severity \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 alpine-baselayout \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 apk-tools \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 bash \u2502 GPL-3.0 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 keyutils-libs \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 LGPL-2.0-or-later \u2502 Non Standard \u2502 UNKNOWN \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 libaio \u2502 LGPL-2.1-or-later \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 libcom_err \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 LGPL-2.0-or-later \u2502 Non Standard \u2502 UNKNOWN \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 tzdata \u2502 Public-Domain \u2502 Non Standard \u2502 UNKNOWN \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Loose File License ( s ) ( license ) =============================== Total: 6 ( UNKNOWN: 4 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Classification \u2502 Severity \u2502 License \u2502 File Location \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 Forbidden \u2502 CRITICAL \u2502 AGPL-3.0 \u2502 /usr/share/grafana/LICENSE \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 Non Standard \u2502 UNKNOWN \u2502 BSD-0-Clause \u2502 /usr/share/grafana/public/build/5069.d6aae9dd11d49c741a80.j- \u2502 \u2502 \u2502 \u2502 \u2502 s.LICENSE.txt \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 /usr/share/grafana/public/build/6444.d6aae9dd11d49c741a80.j- \u2502 \u2502 \u2502 \u2502 \u2502 s.LICENSE.txt \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 /usr/share/grafana/public/build/7889.d6aae9dd11d49c741a80.j- \u2502 \u2502 \u2502 \u2502 \u2502 s.LICENSE.txt \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 /usr/share/grafana/public/build/canvasPanel.d6aae9dd11d49c7- \u2502 \u2502 \u2502 \u2502 \u2502 41a80.js.LICENSE.txt \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"Full scanning"},{"location":"docs/scanner/license/#configuration","text":"Trivy has number of configuration flags for use with license scanning;","title":"Configuration"},{"location":"docs/scanner/license/#ignored-licenses","text":"Trivy license scanning can ignore licenses that are identified to explicitly remove them from the results using the --ignored-licenses flag; $ trivy image --scanners license --ignored-licenses MPL-2.0,MIT --severity HIGH grafana/grafana:latest 2022 -07-13T18:15:28.605Z INFO License scanning is enabled OS Packages ( license ) ===================== Total: 2 ( HIGH: 2 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Package \u2502 License \u2502 Classification \u2502 Severity \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 alpine-baselayout \u2502 GPL-2.0 \u2502 Restricted \u2502 HIGH \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 ssl_client \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"Ignored Licenses"},{"location":"docs/scanner/license/#configuring-classifier-confidence-level","text":"You can use the --license-confidence-level flag to adjust the confidence level between 0.0 to 1.0 (default 0.9). For example, when you run the scanner with the default confidence level on SPDX license list data , it is able to detect only 258 licenses. $ trivy fs --scanners license --license-full <path/to/spdx/list/data> 2023 -04-18T10:05:13.601-0700 INFO Full license scanning is enabled Loose File License ( s ) ( license ) =============================== Total: 258 ( UNKNOWN: 70 , LOW: 90 , MEDIUM: 18 , HIGH: 58 , CRITICAL: 22 ) However, by configuring the confidence level to 0.8, the scanner is now able to detect 282 licenses. $ trivy fs --scanners license --license-full --license-confidence-level 0 .8 <path/to/spdx/list/data> 2023 -04-18T10:21:39.637-0700 INFO Full license scanning is enabled Loose File License ( s ) ( license ) =============================== Total: 282 ( UNKNOWN: 81 , LOW: 97 , MEDIUM: 24 , HIGH: 58 , CRITICAL: 22 )","title":"Configuring Classifier Confidence Level"},{"location":"docs/scanner/license/#custom-classification","text":"You can generate the default config by the --generate-default-config flag and customize the license classification. For example, if you want to forbid only AGPL-3.0, you can leave it under forbidden and move other licenses to another classification. $ trivy image --generate-default-config $ vim trivy.yaml license: forbidden: - AGPL-3.0 restricted: - AGPL-1.0 - CC-BY-NC-1.0 - CC-BY-NC-2.0 - CC-BY-NC-2.5 - CC-BY-NC-3.0 - CC-BY-NC-4.0 - CC-BY-NC-ND-1.0 - CC-BY-NC-ND-2.0 - CC-BY-NC-ND-2.5 - CC-BY-NC-ND-3.0 - CC-BY-NC-ND-4.0 - CC-BY-NC-SA-1.0 - CC-BY-NC-SA-2.0 - CC-BY-NC-SA-2.5 - CC-BY-NC-SA-3.0 - CC-BY-NC-SA-4.0 - Commons-Clause - Facebook-2-Clause - Facebook-3-Clause - Facebook-Examples - WTFPL - BCL - CC-BY-ND-1.0 - CC-BY-ND-2.0 - CC-BY-ND-2.5 - CC-BY-ND-3.0 - CC-BY-ND-4.0 - CC-BY-SA-1.0 - CC-BY-SA-2.0 - CC-BY-SA-2.5 - CC-BY-SA-3.0 - CC-BY-SA-4.0 - GPL-1.0 - GPL-2.0 - GPL-2.0-with-autoconf-exception - GPL-2.0-with-bison-exception - GPL-2.0-with-classpath-exception - GPL-2.0-with-font-exception - GPL-2.0-with-GCC-exception - GPL-3.0 - GPL-3.0-with-autoconf-exception - GPL-3.0-with-GCC-exception - LGPL-2.0 - LGPL-2.1 - LGPL-3.0 - NPL-1.0 - NPL-1.1 - OSL-1.0 - OSL-1.1 - OSL-2.0 - OSL-2.1 - OSL-3.0 - QPL-1.0 - Sleepycat reciprocal: - APSL-1.0 - APSL-1.1 - APSL-1.2 - APSL-2.0 - CDDL-1.0 - CDDL-1.1 - CPL-1.0 - EPL-1.0 - EPL-2.0 - FreeImage - IPL-1.0 - MPL-1.0 - MPL-1.1 - MPL-2.0 - Ruby notice: - AFL-1.1 - AFL-1.2 - AFL-2.0 - AFL-2.1 - AFL-3.0 - Apache-1.0 - Apache-1.1 - Apache-2.0 - Artistic-1.0-cl8 - Artistic-1.0-Perl - Artistic-1.0 - Artistic-2.0 - BSL-1.0 - BSD-2-Clause-FreeBSD - BSD-2-Clause-NetBSD - BSD-2-Clause - BSD-3-Clause-Attribution - BSD-3-Clause-Clear - BSD-3-Clause-LBNL - BSD-3-Clause - BSD-4-Clause - BSD-4-Clause-UC - BSD-Protection - CC-BY-1.0 - CC-BY-2.0 - CC-BY-2.5 - CC-BY-3.0 - CC-BY-4.0 - FTL - ISC - ImageMagick - Libpng - Lil-1.0 - Linux-OpenIB - LPL-1.02 - LPL-1.0 - MS-PL - MIT - NCSA - OpenSSL - PHP-3.01 - PHP-3.0 - PIL - Python-2.0 - Python-2.0-complete - PostgreSQL - SGI-B-1.0 - SGI-B-1.1 - SGI-B-2.0 - Unicode-DFS-2015 - Unicode-DFS-2016 - Unicode-TOU - UPL-1.0 - W3C-19980720 - W3C-20150513 - W3C - X11 - Xnet - Zend-2.0 - zlib-acknowledgement - Zlib - ZPL-1.1 - ZPL-2.0 - ZPL-2.1 unencumbered: - CC0-1.0 - Unlicense - 0BSD permissive: []","title":"Custom Classification"},{"location":"docs/scanner/secret/","text":"Secret Scanning Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens. Secret scanning is enabled by default. Trivy will scan every plaintext file, according to builtin rules or configuration. There are plenty of builtin rules: AWS access key GCP service account GitHub personal access token GitLab personal access token Slack access token etc. You can see a full list of built-in rules and built-in allow rules . Tip If your secret is not detected properly, please make sure that your file including the secret is not in the allowed paths . You can disable allow rules via disable-allow-rules . Quick start This section shows how to scan secrets in container image and filesystem. Other subcommands should be the same. Container image Specify an image name. $ trivy image myimage:1.0.0 2022 -04-21T18:56:44.099+0300 INFO Detected OS: alpine 2022 -04-21T18:56:44.099+0300 INFO Detecting Alpine vulnerabilities... 2022 -04-21T18:56:44.101+0300 INFO Number of language-specific files: 0 myimage:1.0.0 ( alpine 3 .15.0 ) ============================= Total: 6 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | busybox | CVE-2022-28391 | CRITICAL | 1 .34.1-r3 | 1 .34.1-r5 | CVE-2022-28391 affecting | | | | | | | package busybox 1 .35.0 | | | | | | | -->avd.aquasec.com/nvd/cve-2022-28391 | +--------------+------------------ | | -------------------+---------------+---------------------------------------+ | ssl_client | CVE-2022-28391 | | 1 .34.1-r3 | 1 .34.1-r5 | CVE-2022-28391 affecting | | | | | | | package busybox 1 .35.0 | | | | | | | -->avd.aquasec.com/nvd/cve-2022-28391 | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ app/secret.sh ( secrets ) ======================= Total: 1 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 1 ) +----------+-------------------+----------+---------+--------------------------------+ | CATEGORY | DESCRIPTION | SEVERITY | LINE NO | MATCH | +----------+-------------------+----------+---------+--------------------------------+ | AWS | AWS Access Key ID | CRITICAL | 10 | export AWS_ACCESS_KEY_ID = ***** | +----------+-------------------+----------+---------+--------------------------------+ Tip Trivy tries to detect a base image and skip those layers for secret scanning. A base image usually contains a lot of files and makes secret scanning much slower. If a secret is not detected properly, you can see base layers with the --debug flag. Filesystem $ trivy fs /path/to/your_project ... ( snip ) ... certs/key.pem ( secrets ) ======================== Total: 1 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 1 , CRITICAL: 0 ) +----------------------+------------------------+----------+---------+---------------------------------+ | CATEGORY | DESCRIPTION | SEVERITY | LINE NO | MATCH | +----------------------+------------------------+----------+---------+---------------------------------+ | AsymmetricPrivateKey | Asymmetric Private Key | HIGH | 1 | -----BEGIN RSA PRIVATE KEY----- | +----------------------+------------------------+----------+---------+---------------------------------+ Tip Your project may have some secrets for testing. You can skip them with --skip-dirs or --skip-files . We would recommend specifying these options so that the secret scanning can be faster if those files don't need to be scanned. Also, you can specify paths to be allowed in a configuration file. See the detail here . Configuration This section describes secret-specific configuration. Other common options are documented here . Trivy has a set of builtin rules for secret scanning, which can be extended or modified by a configuration file. Trivy tries to load trivy-secret.yaml in the current directory by default. If the file doesn't exist, only built-in rules are used. You can customize the config file path via the --secret-config flag. Warning Trivy uses Golang regexp package . To use ^ and $ as symbols of begin and end of line use multi-line mode - (?m) . Custom Rules Trivy allows defining custom rules. rules : - id : rule1 category : general title : Generic Rule severity : HIGH path : .*\\.sh keywords : - secret regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] secret-group-name : secret allow-rules : - id : skip-text description : skip text files path : .*\\.txt id (required) Unique identifier for this rule. category (required) String used for metadata and reporting purposes. title (required) Short human-readable title of the rule. severity (required) How critical this rule is. Allowed values: CRITICAL HIGH MEDIUM LOW regex (required) Golang regular expression used to detect secrets. path (optional) Golang regular expression used to match paths. keywords (optional, recommended) Keywords are used for pre-regex check filtering. Rules that contain keywords will perform a quick string compare check to make sure the keyword(s) are in the content being scanned. Ideally these values should either be part of the identifier or unique strings specific to the rule's regex. It is recommended to define for better performance. allow-rules (optional) Allow rules for a single rule to reduce false positives with known secrets. The details are below. Allow Rules If the detected secret is matched with the specified regex , then that secret will be skipped and not detected. The same logic applies for path . allow-rules can be defined globally and per each rule. The fields are the same. rules : - id : rule1 category : general title : Generic Rule severity : HIGH regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] allow-rules : - id : skip-text description : skip text files path : .*\\.txt allow-rules : - id : social-security-number description : skip social security number regex : 219-09-9999 id (required) Unique identifier for this allow rule. description (optional) Short human-readable description of this allow rule. regex (optional) Golang regular expression used to allow detected secrets. regex or path must be specified. path (optional) Golang regular expression used to allow matched paths. regex or path must be specified. Enable Rules Trivy provides plenty of out-of-box rules and allow rules, but you may not need all of them. In that case, enable-builtin-rules will be helpful. If you just need AWS secret detection, you can enable only relevant rules as shown below. It specifies AWS-related rule IDs in enable-builtin-rules . All other rules are disabled, so the scanning will be much faster. We would strongly recommend using this option if you don't need all rules. You can see a full list of built-in rule IDs and built-in allow rule IDs . enable-builtin-rules : - aws-access-key-id - aws-account-id - aws-secret-access-key Disable Rules Trivy offers built-in rules and allow rules, but you may want to disable some of them. For example, you don't use Slack, so Slack doesn't have to be scanned. You can specify the Slack rule IDs, slack-access-token and slack-web-hook in disable-rules so that those rules will be disabled for less false positives. You should specify either enable-builtin-rules or disable-rules . If they both are specified, disable-rules takes precedence. In case github-pat is specified in enable-builtin-rules and disable-rules , it will be disabled. In addition, there are some allow rules. Markdown files are ignored by default, but you may want to scan markdown files as well. You can disable the allow rule by adding markdown to disable-allow-rules . You can see a full list of built-in rule IDs and built-in allow rule IDs . disable-rules : - slack-access-token - slack-web-hook disable-allow-rules : - markdown Recommendation We would recommend specifying --skip-dirs for faster secret scanning. In container image scanning, Trivy walks the file tree rooted / and scans all the files other than built-in allowed paths . It will take a while if your image contains a lot of files even though Trivy tries to avoid scanning layers from a base image. If you want to make scanning faster, --skip-dirs and --skip-files helps so that Trivy will skip scanning those files and directories. You can see more options here . allow-rules is also helpful. See the allow-rules section. In addition, all the built-in rules are enabled by default, so it takes some time to scan all of them. If you don't need all those rules, you can use enable-builtin-rules or disable-rules in the configuration file. You should use enable-builtin-rules if you need only AWS secret detection, for example. All rules are disabled except for the ones you specify, so it runs very fast. On the other hand, you should use disable-rules if you just want to disable some built-in rules. See the enable-rules and disable-rules sections for the detail. If you don't need secret scanning, you can disable it via the --scanners flag. $ trivy image --scanners vuln alpine:3.15 Example trivy-secret.yaml in the working directory is loaded by default. $ cat trivy-secret.yaml rules : - id : rule1 category : general title : Generic Rule severity : HIGH regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] allow-rules : - id : social-security-number description : skip social security number regex : 219-09-9999 - id : log-dir description : skip log directory path : ^\\/var\\/log\\/ disable-rules : - slack-access-token - slack-web-hook disable-allow-rules : - markdown # The following command automatically loads the above configuration. $ trivy image YOUR_IMAGE Also, you can customize the config file path via --secret-config . $ cat ./secret-config/trivy.yaml rules : - id : rule1 category : general title : Generic Rule severity : HIGH regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] allow-rules : - id : skip-text description : skip text files path : .*\\.txt enable-builtin-rules : - aws-access-key-id - aws-account-id - aws-secret-access-key disable-allow-rules : - usr-dirs # Pass the above config with `--secret-config`. $ trivy fs --secret-config ./secret-config/trivy.yaml /path/to/your_project Credit This feature is inspired by gitleaks .","title":"Secret"},{"location":"docs/scanner/secret/#secret-scanning","text":"Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens. Secret scanning is enabled by default. Trivy will scan every plaintext file, according to builtin rules or configuration. There are plenty of builtin rules: AWS access key GCP service account GitHub personal access token GitLab personal access token Slack access token etc. You can see a full list of built-in rules and built-in allow rules . Tip If your secret is not detected properly, please make sure that your file including the secret is not in the allowed paths . You can disable allow rules via disable-allow-rules .","title":"Secret Scanning"},{"location":"docs/scanner/secret/#quick-start","text":"This section shows how to scan secrets in container image and filesystem. Other subcommands should be the same.","title":"Quick start"},{"location":"docs/scanner/secret/#container-image","text":"Specify an image name. $ trivy image myimage:1.0.0 2022 -04-21T18:56:44.099+0300 INFO Detected OS: alpine 2022 -04-21T18:56:44.099+0300 INFO Detecting Alpine vulnerabilities... 2022 -04-21T18:56:44.101+0300 INFO Number of language-specific files: 0 myimage:1.0.0 ( alpine 3 .15.0 ) ============================= Total: 6 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | busybox | CVE-2022-28391 | CRITICAL | 1 .34.1-r3 | 1 .34.1-r5 | CVE-2022-28391 affecting | | | | | | | package busybox 1 .35.0 | | | | | | | -->avd.aquasec.com/nvd/cve-2022-28391 | +--------------+------------------ | | -------------------+---------------+---------------------------------------+ | ssl_client | CVE-2022-28391 | | 1 .34.1-r3 | 1 .34.1-r5 | CVE-2022-28391 affecting | | | | | | | package busybox 1 .35.0 | | | | | | | -->avd.aquasec.com/nvd/cve-2022-28391 | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ app/secret.sh ( secrets ) ======================= Total: 1 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 1 ) +----------+-------------------+----------+---------+--------------------------------+ | CATEGORY | DESCRIPTION | SEVERITY | LINE NO | MATCH | +----------+-------------------+----------+---------+--------------------------------+ | AWS | AWS Access Key ID | CRITICAL | 10 | export AWS_ACCESS_KEY_ID = ***** | +----------+-------------------+----------+---------+--------------------------------+ Tip Trivy tries to detect a base image and skip those layers for secret scanning. A base image usually contains a lot of files and makes secret scanning much slower. If a secret is not detected properly, you can see base layers with the --debug flag.","title":"Container image"},{"location":"docs/scanner/secret/#filesystem","text":"$ trivy fs /path/to/your_project ... ( snip ) ... certs/key.pem ( secrets ) ======================== Total: 1 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 1 , CRITICAL: 0 ) +----------------------+------------------------+----------+---------+---------------------------------+ | CATEGORY | DESCRIPTION | SEVERITY | LINE NO | MATCH | +----------------------+------------------------+----------+---------+---------------------------------+ | AsymmetricPrivateKey | Asymmetric Private Key | HIGH | 1 | -----BEGIN RSA PRIVATE KEY----- | +----------------------+------------------------+----------+---------+---------------------------------+ Tip Your project may have some secrets for testing. You can skip them with --skip-dirs or --skip-files . We would recommend specifying these options so that the secret scanning can be faster if those files don't need to be scanned. Also, you can specify paths to be allowed in a configuration file. See the detail here .","title":"Filesystem"},{"location":"docs/scanner/secret/#configuration","text":"This section describes secret-specific configuration. Other common options are documented here . Trivy has a set of builtin rules for secret scanning, which can be extended or modified by a configuration file. Trivy tries to load trivy-secret.yaml in the current directory by default. If the file doesn't exist, only built-in rules are used. You can customize the config file path via the --secret-config flag. Warning Trivy uses Golang regexp package . To use ^ and $ as symbols of begin and end of line use multi-line mode - (?m) .","title":"Configuration"},{"location":"docs/scanner/secret/#custom-rules","text":"Trivy allows defining custom rules. rules : - id : rule1 category : general title : Generic Rule severity : HIGH path : .*\\.sh keywords : - secret regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] secret-group-name : secret allow-rules : - id : skip-text description : skip text files path : .*\\.txt id (required) Unique identifier for this rule. category (required) String used for metadata and reporting purposes. title (required) Short human-readable title of the rule. severity (required) How critical this rule is. Allowed values: CRITICAL HIGH MEDIUM LOW regex (required) Golang regular expression used to detect secrets. path (optional) Golang regular expression used to match paths. keywords (optional, recommended) Keywords are used for pre-regex check filtering. Rules that contain keywords will perform a quick string compare check to make sure the keyword(s) are in the content being scanned. Ideally these values should either be part of the identifier or unique strings specific to the rule's regex. It is recommended to define for better performance. allow-rules (optional) Allow rules for a single rule to reduce false positives with known secrets. The details are below.","title":"Custom Rules"},{"location":"docs/scanner/secret/#allow-rules","text":"If the detected secret is matched with the specified regex , then that secret will be skipped and not detected. The same logic applies for path . allow-rules can be defined globally and per each rule. The fields are the same. rules : - id : rule1 category : general title : Generic Rule severity : HIGH regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] allow-rules : - id : skip-text description : skip text files path : .*\\.txt allow-rules : - id : social-security-number description : skip social security number regex : 219-09-9999 id (required) Unique identifier for this allow rule. description (optional) Short human-readable description of this allow rule. regex (optional) Golang regular expression used to allow detected secrets. regex or path must be specified. path (optional) Golang regular expression used to allow matched paths. regex or path must be specified.","title":"Allow Rules"},{"location":"docs/scanner/secret/#enable-rules","text":"Trivy provides plenty of out-of-box rules and allow rules, but you may not need all of them. In that case, enable-builtin-rules will be helpful. If you just need AWS secret detection, you can enable only relevant rules as shown below. It specifies AWS-related rule IDs in enable-builtin-rules . All other rules are disabled, so the scanning will be much faster. We would strongly recommend using this option if you don't need all rules. You can see a full list of built-in rule IDs and built-in allow rule IDs . enable-builtin-rules : - aws-access-key-id - aws-account-id - aws-secret-access-key","title":"Enable Rules"},{"location":"docs/scanner/secret/#disable-rules","text":"Trivy offers built-in rules and allow rules, but you may want to disable some of them. For example, you don't use Slack, so Slack doesn't have to be scanned. You can specify the Slack rule IDs, slack-access-token and slack-web-hook in disable-rules so that those rules will be disabled for less false positives. You should specify either enable-builtin-rules or disable-rules . If they both are specified, disable-rules takes precedence. In case github-pat is specified in enable-builtin-rules and disable-rules , it will be disabled. In addition, there are some allow rules. Markdown files are ignored by default, but you may want to scan markdown files as well. You can disable the allow rule by adding markdown to disable-allow-rules . You can see a full list of built-in rule IDs and built-in allow rule IDs . disable-rules : - slack-access-token - slack-web-hook disable-allow-rules : - markdown","title":"Disable Rules"},{"location":"docs/scanner/secret/#recommendation","text":"We would recommend specifying --skip-dirs for faster secret scanning. In container image scanning, Trivy walks the file tree rooted / and scans all the files other than built-in allowed paths . It will take a while if your image contains a lot of files even though Trivy tries to avoid scanning layers from a base image. If you want to make scanning faster, --skip-dirs and --skip-files helps so that Trivy will skip scanning those files and directories. You can see more options here . allow-rules is also helpful. See the allow-rules section. In addition, all the built-in rules are enabled by default, so it takes some time to scan all of them. If you don't need all those rules, you can use enable-builtin-rules or disable-rules in the configuration file. You should use enable-builtin-rules if you need only AWS secret detection, for example. All rules are disabled except for the ones you specify, so it runs very fast. On the other hand, you should use disable-rules if you just want to disable some built-in rules. See the enable-rules and disable-rules sections for the detail. If you don't need secret scanning, you can disable it via the --scanners flag. $ trivy image --scanners vuln alpine:3.15","title":"Recommendation"},{"location":"docs/scanner/secret/#example","text":"trivy-secret.yaml in the working directory is loaded by default. $ cat trivy-secret.yaml rules : - id : rule1 category : general title : Generic Rule severity : HIGH regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] allow-rules : - id : social-security-number description : skip social security number regex : 219-09-9999 - id : log-dir description : skip log directory path : ^\\/var\\/log\\/ disable-rules : - slack-access-token - slack-web-hook disable-allow-rules : - markdown # The following command automatically loads the above configuration. $ trivy image YOUR_IMAGE Also, you can customize the config file path via --secret-config . $ cat ./secret-config/trivy.yaml rules : - id : rule1 category : general title : Generic Rule severity : HIGH regex : (?i)(?P<key>(secret))(=|:).{0,5}['\"](?P<secret>[0-9a-zA-Z\\-_=]{8,64})['\"] allow-rules : - id : skip-text description : skip text files path : .*\\.txt enable-builtin-rules : - aws-access-key-id - aws-account-id - aws-secret-access-key disable-allow-rules : - usr-dirs # Pass the above config with `--secret-config`. $ trivy fs --secret-config ./secret-config/trivy.yaml /path/to/your_project","title":"Example"},{"location":"docs/scanner/secret/#credit","text":"This feature is inspired by gitleaks .","title":"Credit"},{"location":"docs/scanner/vulnerability/","text":"Vulnerability Scanning Trivy detects known vulnerabilities according to the versions of installed packages. The following packages are supported. OS packages Language-specific packages Kubernetes components (control plane, node and addons) Trivy also detects known vulnerabilities in Kubernetes components using KBOM (Kubernetes bill of Material) scanning. To learn more, see the documentation for Kubernetes scanning . OS Packages Trivy is capable of automatically detecting installed OS packages when scanning container images, VM images and running hosts. Note Trivy doesn't support third-party/self-compiled packages/binaries, but official packages provided by vendors such as Red Hat and Debian. Supported OS See here for the supported OSes. Data Sources OS Source Arch Linux Vulnerable Issues Alpine Linux secdb Wolfi Linux secdb Chainguard secdb Amazon Linux Amazon Linux Security Center Debian Security Bug Tracker / OVAL Ubuntu Ubuntu CVE Tracker RHEL/CentOS OVAL / Security Data AlmaLinux AlmaLinux Product Errata Rocky Linux Rocky Linux UpdateInfo Oracle Linux OVAL CBL-Mariner OVAL OpenSUSE/SLES CVRF Photon OS Photon Security Advisory Data Source Selection Trivy only consumes security advisories from the sources listed in the above table. As for packages installed from OS package managers ( dpkg , yum , apk , etc.), Trivy uses the advisory database from the appropriate OS vendor . For example: for a python package installed from yum (Amazon linux), Trivy will only get advisories from ALAS . But for a python package installed from another source (e.g. pip ), Trivy will get advisories from the GitLab and GitHub databases. This advisory selection is essential to avoid getting false positives because OS vendors usually backport upstream fixes, and the fixed version can be different from the upstream fixed version. Severity Selection The severity is taken from the selected data source since the severity from vendors is more accurate. Using CVE-2023-0464 as an example, while it is rated as \"HIGH\" in NVD , Red Hat has marked its 'Impact' as \"Low\" . As a result, Trivy will display it as \"Low\". The severity depends on the compile option, the default configuration, etc. NVD doesn't know how the vendor distributes the software. Red Hat evaluates the severity more accurately. That's why Trivy prefers vendor scores over NVD. If the data source does not provide a severity, the severity is determined based on the CVSS score as follows: Base Score Range Severity 0.1-3.9 Low 4.0-6.9 Medium 7.0-8.9 High 9.0-10.0 Critical If the CVSS score is also not provided, it falls back to NVD , and if NVD does not have severity, it will be UNKNOWN. Unfixed Vulnerabilities The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution. To hide unfixed/unfixable vulnerabilities, you can use the --ignore-unfixed flag. Language-specific Packages Supported Languages See here for the supported languages. Data Sources Language Source Commercial Use Delay 1 PHP PHP Security Advisories Database \u2705 - GitHub Advisory Database (Composer) \u2705 - Python GitHub Advisory Database (pip) \u2705 - Open Source Vulnerabilities (PyPI) \u2705 - Ruby Ruby Advisory Database \u2705 - GitHub Advisory Database (RubyGems) \u2705 - Node.js Ecosystem Security Working Group \u2705 - GitHub Advisory Database (npm) \u2705 - Java GitLab Advisories Community \u2705 1 month GitHub Advisory Database (Maven) \u2705 - Go GitHub Advisory Database (Go) \u2705 - Rust Open Source Vulnerabilities (crates.io) \u2705 - .NET GitHub Advisory Database (NuGet) \u2705 - C/C++ GitLab Advisories Community \u2705 1 month Dart GitHub Advisory Database (Pub) \u2705 - Elixir GitHub Advisory Database (Erlang) \u2705 - Swift GitHub Advisory Database (Swift) \u2705 - Kubernetes Trivy can detect vulnerabilities in Kubernetes clusters and components. Data Sources Vendor Source Kubernetes Kubernetes Official CVE feed 1 Database Trivy downloads the vulnerability database every 6 hours. Trivy uses two types of databases for vulnerability detection: Vulnerability Database Java Index Database This page provides detailed information about these databases. Vulnerability Database Trivy utilizes a database containing vulnerability information. This database is built every six hours on GitHub and is distributed via GitHub Container registry (GHCR) . The database is cached and updated as needed. As Trivy updates the database automatically during execution, users don't need to be concerned about it. For CLI flags related to the database, please refer to this page . Private Hosting If you host the database on your own OCI registry, you can specify a different repository with the --db-repository flag. The default is ghcr.io/aquasecurity/trivy-db . $ trivy image --db-repository YOUR_REPO YOUR_IMAGE If authentication is required, it can be configured in the same way as for private images. Please refer to the documentation for more details. Java Index Database This database is only downloaded when scanning JAR files so that Trivy can identify the groupId, artifactId, and version of JAR files. It is built once a day on GitHub and distributed via GitHub Container registry (GHCR) . Like the vulnerability database, it is automatically downloaded and updated when needed, so users don't need to worry about it. Private Hosting If you host the database on your own OCI registry, you can specify a different repository with the --java-db-repository flag. The default is ghcr.io/aquasecurity/trivy-java-db . If authentication is required, you need to run docker login YOUR_REGISTRY . Currently, specifying a username and password is not supported. https://github.com/GoogleContainerTools/distroless \u21a9 \u21a9","title":"Vulnerability"},{"location":"docs/scanner/vulnerability/#vulnerability-scanning","text":"Trivy detects known vulnerabilities according to the versions of installed packages. The following packages are supported. OS packages Language-specific packages Kubernetes components (control plane, node and addons) Trivy also detects known vulnerabilities in Kubernetes components using KBOM (Kubernetes bill of Material) scanning. To learn more, see the documentation for Kubernetes scanning .","title":"Vulnerability Scanning"},{"location":"docs/scanner/vulnerability/#os-packages","text":"Trivy is capable of automatically detecting installed OS packages when scanning container images, VM images and running hosts. Note Trivy doesn't support third-party/self-compiled packages/binaries, but official packages provided by vendors such as Red Hat and Debian.","title":"OS Packages"},{"location":"docs/scanner/vulnerability/#supported-os","text":"See here for the supported OSes.","title":"Supported OS"},{"location":"docs/scanner/vulnerability/#data-sources","text":"OS Source Arch Linux Vulnerable Issues Alpine Linux secdb Wolfi Linux secdb Chainguard secdb Amazon Linux Amazon Linux Security Center Debian Security Bug Tracker / OVAL Ubuntu Ubuntu CVE Tracker RHEL/CentOS OVAL / Security Data AlmaLinux AlmaLinux Product Errata Rocky Linux Rocky Linux UpdateInfo Oracle Linux OVAL CBL-Mariner OVAL OpenSUSE/SLES CVRF Photon OS Photon Security Advisory","title":"Data Sources"},{"location":"docs/scanner/vulnerability/#data-source-selection","text":"Trivy only consumes security advisories from the sources listed in the above table. As for packages installed from OS package managers ( dpkg , yum , apk , etc.), Trivy uses the advisory database from the appropriate OS vendor . For example: for a python package installed from yum (Amazon linux), Trivy will only get advisories from ALAS . But for a python package installed from another source (e.g. pip ), Trivy will get advisories from the GitLab and GitHub databases. This advisory selection is essential to avoid getting false positives because OS vendors usually backport upstream fixes, and the fixed version can be different from the upstream fixed version.","title":"Data Source Selection"},{"location":"docs/scanner/vulnerability/#severity-selection","text":"The severity is taken from the selected data source since the severity from vendors is more accurate. Using CVE-2023-0464 as an example, while it is rated as \"HIGH\" in NVD , Red Hat has marked its 'Impact' as \"Low\" . As a result, Trivy will display it as \"Low\". The severity depends on the compile option, the default configuration, etc. NVD doesn't know how the vendor distributes the software. Red Hat evaluates the severity more accurately. That's why Trivy prefers vendor scores over NVD. If the data source does not provide a severity, the severity is determined based on the CVSS score as follows: Base Score Range Severity 0.1-3.9 Low 4.0-6.9 Medium 7.0-8.9 High 9.0-10.0 Critical If the CVSS score is also not provided, it falls back to NVD , and if NVD does not have severity, it will be UNKNOWN.","title":"Severity Selection"},{"location":"docs/scanner/vulnerability/#unfixed-vulnerabilities","text":"The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution. To hide unfixed/unfixable vulnerabilities, you can use the --ignore-unfixed flag.","title":"Unfixed Vulnerabilities"},{"location":"docs/scanner/vulnerability/#language-specific-packages","text":"","title":"Language-specific Packages"},{"location":"docs/scanner/vulnerability/#supported-languages","text":"See here for the supported languages.","title":"Supported Languages"},{"location":"docs/scanner/vulnerability/#data-sources_1","text":"Language Source Commercial Use Delay 1 PHP PHP Security Advisories Database \u2705 - GitHub Advisory Database (Composer) \u2705 - Python GitHub Advisory Database (pip) \u2705 - Open Source Vulnerabilities (PyPI) \u2705 - Ruby Ruby Advisory Database \u2705 - GitHub Advisory Database (RubyGems) \u2705 - Node.js Ecosystem Security Working Group \u2705 - GitHub Advisory Database (npm) \u2705 - Java GitLab Advisories Community \u2705 1 month GitHub Advisory Database (Maven) \u2705 - Go GitHub Advisory Database (Go) \u2705 - Rust Open Source Vulnerabilities (crates.io) \u2705 - .NET GitHub Advisory Database (NuGet) \u2705 - C/C++ GitLab Advisories Community \u2705 1 month Dart GitHub Advisory Database (Pub) \u2705 - Elixir GitHub Advisory Database (Erlang) \u2705 - Swift GitHub Advisory Database (Swift) \u2705 -","title":"Data Sources"},{"location":"docs/scanner/vulnerability/#kubernetes","text":"Trivy can detect vulnerabilities in Kubernetes clusters and components.","title":"Kubernetes"},{"location":"docs/scanner/vulnerability/#data-sources_2","text":"Vendor Source Kubernetes Kubernetes Official CVE feed 1","title":"Data Sources"},{"location":"docs/scanner/vulnerability/#database","text":"Trivy downloads the vulnerability database every 6 hours. Trivy uses two types of databases for vulnerability detection: Vulnerability Database Java Index Database This page provides detailed information about these databases.","title":"Database"},{"location":"docs/scanner/vulnerability/#vulnerability-database","text":"Trivy utilizes a database containing vulnerability information. This database is built every six hours on GitHub and is distributed via GitHub Container registry (GHCR) . The database is cached and updated as needed. As Trivy updates the database automatically during execution, users don't need to be concerned about it. For CLI flags related to the database, please refer to this page .","title":"Vulnerability Database"},{"location":"docs/scanner/vulnerability/#private-hosting","text":"If you host the database on your own OCI registry, you can specify a different repository with the --db-repository flag. The default is ghcr.io/aquasecurity/trivy-db . $ trivy image --db-repository YOUR_REPO YOUR_IMAGE If authentication is required, it can be configured in the same way as for private images. Please refer to the documentation for more details.","title":"Private Hosting"},{"location":"docs/scanner/vulnerability/#java-index-database","text":"This database is only downloaded when scanning JAR files so that Trivy can identify the groupId, artifactId, and version of JAR files. It is built once a day on GitHub and distributed via GitHub Container registry (GHCR) . Like the vulnerability database, it is automatically downloaded and updated when needed, so users don't need to worry about it.","title":"Java Index Database"},{"location":"docs/scanner/vulnerability/#private-hosting_1","text":"If you host the database on your own OCI registry, you can specify a different repository with the --java-db-repository flag. The default is ghcr.io/aquasecurity/trivy-java-db . If authentication is required, you need to run docker login YOUR_REGISTRY . Currently, specifying a username and password is not supported. https://github.com/GoogleContainerTools/distroless \u21a9 \u21a9","title":"Private Hosting"},{"location":"docs/scanner/misconfiguration/","text":"Misconfiguration Scanning Trivy provides built-in policies to detect configuration issues in popular Infrastructure as Code files, such as: Docker, Kubernetes, Terraform, CloudFormation, and more. In addition to built-in policies, you can write your own custom policies, as you can see here . Quick start Simply specify a directory containing IaC files such as Terraform, CloudFormation, Azure ARM templates, Helm Charts and Dockerfile. $ trivy config [ YOUR_IaC_DIRECTORY ] Example $ ls build/ Dockerfile $ trivy config ./build 2022-05-16T13:29:29.952+0100 INFO Detected config files: 1 Dockerfile (dockerfile) ======================= Tests: 23 (SUCCESSES: 22, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) MEDIUM: Specify a tag in the 'FROM' statement for image 'alpine' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated. See https://avd.aquasec.com/misconfig/ds001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:1 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 [ FROM alpine:latest \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 You can also enable misconfiguration detection in container image, filesystem and git repository scanning via --scanners config . $ trivy image --scanners config IMAGE_NAME $ trivy fs --scanners config /path/to/dir Note Misconfiguration detection is not enabled by default in image , fs and repo subcommands. Unlike the config subcommand, image , fs and repo subcommands can also scan for vulnerabilities and secrets at the same time. You can specify --scanners vuln,config,secret to enable vulnerability and secret detection as well as misconfiguration detection. Example $ ls myapp/ Dockerfile Pipfile.lock $ trivy fs --scanners vuln,config,secret --severity HIGH,CRITICAL myapp/ 2022 -05-16T13:42:21.440+0100 INFO Number of language-specific files: 1 2022 -05-16T13:42:21.440+0100 INFO Detecting pipenv vulnerabilities... 2022 -05-16T13:42:21.440+0100 INFO Detected config files: 1 Pipfile.lock ( pipenv ) ===================== Total: 1 ( HIGH: 1 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 httplib2 \u2502 CVE-2021-21240 \u2502 HIGH \u2502 0 .12.1 \u2502 0 .19.0 \u2502 python-httplib2: Regular expression denial of service via \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 malicious header \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-21240 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Dockerfile ( dockerfile ) ======================= Tests: 17 ( SUCCESSES: 16 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 1 , CRITICAL: 0 ) HIGH: Last USER command in Dockerfile should not be 'root' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:3 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 3 [ USER root \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 In the above example, Trivy detected vulnerabilities of Python dependencies and misconfigurations in Dockerfile. Type detection The specified directory can contain mixed types of IaC files. Trivy automatically detects config types and applies relevant policies. For example, the following example holds IaC files for Terraform, CloudFormation, Kubernetes, Helm Charts, and Dockerfile in the same directory. $ ls iac/ Dockerfile deployment.yaml main.tf mysql-8.8.26.tar $ trivy conf --severity HIGH,CRITICAL ./iac Result 2022-06-06T11:01:21.142+0100 INFO Detected config files: 8 Dockerfile (dockerfile) Tests: 21 (SUCCESSES: 20, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (MEDIUM: 0, HIGH: 1, CRITICAL: 0) HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml (kubernetes) Tests: 20 (SUCCESSES: 15, FAILURES: 5, EXCEPTIONS: 0) Failures: 5 (MEDIUM: 4, HIGH: 1, CRITICAL: 0) MEDIUM: Container 'hello-kubernetes' of Deployment 'hello-kubernetes' should set 'securityContext.allowPrivilegeEscalation' to false \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node. See https://avd.aquasec.com/misconfig/ksv001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:16-19 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 16 \u250c - name: hello-kubernetes 17 \u2502 image: hello-kubernetes:1.5 18 \u2502 ports: 19 \u2514 - containerPort: 8080 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 HIGH: Deployment 'hello-kubernetes' should not specify '/var/run/docker.socker' in 'spec.template.volumes.hostPath.path' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Mounting docker.sock from the host can give the container full root access to the host. See https://avd.aquasec.com/misconfig/ksv006 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:6-29 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 6 \u250c replicas: 3 7 \u2502 selector: 8 \u2502 matchLabels: 9 \u2502 app: hello-kubernetes 10 \u2502 template: 11 \u2502 metadata: 12 \u2502 labels: 13 \u2502 app: hello-kubernetes 14 \u2514 spec: .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Container 'hello-kubernetes' of Deployment 'hello-kubernetes' should set 'securityContext.runAsNonRoot' to true \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges. See https://avd.aquasec.com/misconfig/ksv012 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:16-19 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 16 \u250c - name: hello-kubernetes 17 \u2502 image: hello-kubernetes:1.5 18 \u2502 ports: 19 \u2514 - containerPort: 8080 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Deployment 'hello-kubernetes' should not set 'spec.template.volumes.hostPath' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 HostPath volumes must be forbidden. See https://avd.aquasec.com/misconfig/ksv023 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:6-29 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 6 \u250c replicas: 3 7 \u2502 selector: 8 \u2502 matchLabels: 9 \u2502 app: hello-kubernetes 10 \u2502 template: 11 \u2502 metadata: 12 \u2502 labels: 13 \u2502 app: hello-kubernetes 14 \u2514 spec: .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Deployment 'hello-kubernetes' should set 'securityContext.sysctl' to the allowed values \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed 'safe' subset. A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated from other Pods or processes on the same Node. See https://avd.aquasec.com/misconfig/ksv026 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:6-29 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 6 \u250c replicas: 3 7 \u2502 selector: 8 \u2502 matchLabels: 9 \u2502 app: hello-kubernetes 10 \u2502 template: 11 \u2502 metadata: 12 \u2502 labels: 13 \u2502 app: hello-kubernetes 14 \u2514 spec: .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 mysql-8.8.26.tar:templates/primary/statefulset.yaml (helm) Tests: 20 (SUCCESSES: 18, FAILURES: 2, EXCEPTIONS: 0) Failures: 2 (MEDIUM: 2, HIGH: 0, CRITICAL: 0) MEDIUM: Container 'mysql' of StatefulSet 'mysql' should set 'securityContext.allowPrivilegeEscalation' to false \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node. See https://avd.aquasec.com/misconfig/ksv001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 mysql-8.8.26.tar:templates/primary/statefulset.yaml:56-130 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 56 \u250c - name: mysql 57 \u2502 image: docker.io/bitnami/mysql:8.0.28-debian-10-r23 58 \u2502 imagePullPolicy: \"IfNotPresent\" 59 \u2502 securityContext: 60 \u2502 runAsUser: 1001 61 \u2502 env: 62 \u2502 - name: BITNAMI_DEBUG 63 \u2502 value: \"false\" 64 \u2514 - name: MYSQL_ROOT_PASSWORD .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Container 'mysql' of StatefulSet 'mysql' should set 'securityContext.runAsNonRoot' to true \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges. See https://avd.aquasec.com/misconfig/ksv012 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 mysql-8.8.26.tar:templates/primary/statefulset.yaml:56-130 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 56 \u250c - name: mysql 57 \u2502 image: docker.io/bitnami/mysql:8.0.28-debian-10-r23 58 \u2502 imagePullPolicy: \"IfNotPresent\" 59 \u2502 securityContext: 60 \u2502 runAsUser: 1001 61 \u2502 env: 62 \u2502 - name: BITNAMI_DEBUG 63 \u2502 value: \"false\" 64 \u2514 - name: MYSQL_ROOT_PASSWORD .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 You can see the config type next to each file name. Example Dockerfile ( dockerfile ) ======================= Tests: 23 ( SUCCESSES: 22 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 1 , CRITICAL: 0 ) ... deployment.yaml ( kubernetes ) ============================ Tests: 28 ( SUCCESSES: 15 , FAILURES: 13 , EXCEPTIONS: 0 ) Failures: 13 ( MEDIUM: 4 , HIGH: 1 , CRITICAL: 0 ) ... main.tf ( terraform ) =================== Tests: 23 ( SUCCESSES: 14 , FAILURES: 9 , EXCEPTIONS: 0 ) Failures: 9 ( HIGH: 6 , CRITICAL: 1 ) ... bucket.yaml ( cloudformation ) ============================ Tests: 9 ( SUCCESSES: 3 , FAILURES: 6 , EXCEPTIONS: 0 ) Failures: 6 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 2 , HIGH: 4 , CRITICAL: 0 ) ... mysql-8.8.26.tar:templates/primary/statefulset.yaml ( helm ) ========================================================== Tests: 20 ( SUCCESSES: 18 , FAILURES: 2 , EXCEPTIONS: 0 ) Failures: 2 ( MEDIUM: 2 , HIGH: 0 , CRITICAL: 0 ) Configuration This section describes misconfiguration-specific configuration. Other common options are documented here . Pass custom policies You can pass policy files or directories including your custom policies through --policy option. This can be repeated for specifying multiple files or directories. cd examplex/misconf/ trivy conf --policy custom-policy/policy --policy combine/policy --policy policy.rego --namespaces user misconf/mixed For more details, see Custom Policies . Tip You also need to specify --namespaces option. Pass custom data You can pass directories including your custom data through --data option. This can be repeated for specifying multiple directories. cd examples/misconf/custom-data trivy conf --policy ./policy --data ./data --namespaces user ./configs For more details, see Custom Data . Pass namespaces By default, Trivy evaluates policies defined in builtin.* . If you want to evaluate custom policies in other packages, you have to specify package prefixes through --namespaces option. This can be repeated for specifying multiple packages. trivy conf --policy ./policy --namespaces main --namespaces user ./configs","title":"Overview"},{"location":"docs/scanner/misconfiguration/#misconfiguration-scanning","text":"Trivy provides built-in policies to detect configuration issues in popular Infrastructure as Code files, such as: Docker, Kubernetes, Terraform, CloudFormation, and more. In addition to built-in policies, you can write your own custom policies, as you can see here .","title":"Misconfiguration Scanning"},{"location":"docs/scanner/misconfiguration/#quick-start","text":"Simply specify a directory containing IaC files such as Terraform, CloudFormation, Azure ARM templates, Helm Charts and Dockerfile. $ trivy config [ YOUR_IaC_DIRECTORY ] Example $ ls build/ Dockerfile $ trivy config ./build 2022-05-16T13:29:29.952+0100 INFO Detected config files: 1 Dockerfile (dockerfile) ======================= Tests: 23 (SUCCESSES: 22, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) MEDIUM: Specify a tag in the 'FROM' statement for image 'alpine' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated. See https://avd.aquasec.com/misconfig/ds001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:1 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 [ FROM alpine:latest \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 You can also enable misconfiguration detection in container image, filesystem and git repository scanning via --scanners config . $ trivy image --scanners config IMAGE_NAME $ trivy fs --scanners config /path/to/dir Note Misconfiguration detection is not enabled by default in image , fs and repo subcommands. Unlike the config subcommand, image , fs and repo subcommands can also scan for vulnerabilities and secrets at the same time. You can specify --scanners vuln,config,secret to enable vulnerability and secret detection as well as misconfiguration detection. Example $ ls myapp/ Dockerfile Pipfile.lock $ trivy fs --scanners vuln,config,secret --severity HIGH,CRITICAL myapp/ 2022 -05-16T13:42:21.440+0100 INFO Number of language-specific files: 1 2022 -05-16T13:42:21.440+0100 INFO Detecting pipenv vulnerabilities... 2022 -05-16T13:42:21.440+0100 INFO Detected config files: 1 Pipfile.lock ( pipenv ) ===================== Total: 1 ( HIGH: 1 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 httplib2 \u2502 CVE-2021-21240 \u2502 HIGH \u2502 0 .12.1 \u2502 0 .19.0 \u2502 python-httplib2: Regular expression denial of service via \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 malicious header \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-21240 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Dockerfile ( dockerfile ) ======================= Tests: 17 ( SUCCESSES: 16 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 1 , CRITICAL: 0 ) HIGH: Last USER command in Dockerfile should not be 'root' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:3 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 3 [ USER root \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 In the above example, Trivy detected vulnerabilities of Python dependencies and misconfigurations in Dockerfile.","title":"Quick start"},{"location":"docs/scanner/misconfiguration/#type-detection","text":"The specified directory can contain mixed types of IaC files. Trivy automatically detects config types and applies relevant policies. For example, the following example holds IaC files for Terraform, CloudFormation, Kubernetes, Helm Charts, and Dockerfile in the same directory. $ ls iac/ Dockerfile deployment.yaml main.tf mysql-8.8.26.tar $ trivy conf --severity HIGH,CRITICAL ./iac Result 2022-06-06T11:01:21.142+0100 INFO Detected config files: 8 Dockerfile (dockerfile) Tests: 21 (SUCCESSES: 20, FAILURES: 1, EXCEPTIONS: 0) Failures: 1 (MEDIUM: 0, HIGH: 1, CRITICAL: 0) HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml (kubernetes) Tests: 20 (SUCCESSES: 15, FAILURES: 5, EXCEPTIONS: 0) Failures: 5 (MEDIUM: 4, HIGH: 1, CRITICAL: 0) MEDIUM: Container 'hello-kubernetes' of Deployment 'hello-kubernetes' should set 'securityContext.allowPrivilegeEscalation' to false \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node. See https://avd.aquasec.com/misconfig/ksv001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:16-19 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 16 \u250c - name: hello-kubernetes 17 \u2502 image: hello-kubernetes:1.5 18 \u2502 ports: 19 \u2514 - containerPort: 8080 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 HIGH: Deployment 'hello-kubernetes' should not specify '/var/run/docker.socker' in 'spec.template.volumes.hostPath.path' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Mounting docker.sock from the host can give the container full root access to the host. See https://avd.aquasec.com/misconfig/ksv006 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:6-29 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 6 \u250c replicas: 3 7 \u2502 selector: 8 \u2502 matchLabels: 9 \u2502 app: hello-kubernetes 10 \u2502 template: 11 \u2502 metadata: 12 \u2502 labels: 13 \u2502 app: hello-kubernetes 14 \u2514 spec: .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Container 'hello-kubernetes' of Deployment 'hello-kubernetes' should set 'securityContext.runAsNonRoot' to true \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges. See https://avd.aquasec.com/misconfig/ksv012 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:16-19 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 16 \u250c - name: hello-kubernetes 17 \u2502 image: hello-kubernetes:1.5 18 \u2502 ports: 19 \u2514 - containerPort: 8080 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Deployment 'hello-kubernetes' should not set 'spec.template.volumes.hostPath' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 HostPath volumes must be forbidden. See https://avd.aquasec.com/misconfig/ksv023 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:6-29 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 6 \u250c replicas: 3 7 \u2502 selector: 8 \u2502 matchLabels: 9 \u2502 app: hello-kubernetes 10 \u2502 template: 11 \u2502 metadata: 12 \u2502 labels: 13 \u2502 app: hello-kubernetes 14 \u2514 spec: .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Deployment 'hello-kubernetes' should set 'securityContext.sysctl' to the allowed values \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed 'safe' subset. A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated from other Pods or processes on the same Node. See https://avd.aquasec.com/misconfig/ksv026 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 deployment.yaml:6-29 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 6 \u250c replicas: 3 7 \u2502 selector: 8 \u2502 matchLabels: 9 \u2502 app: hello-kubernetes 10 \u2502 template: 11 \u2502 metadata: 12 \u2502 labels: 13 \u2502 app: hello-kubernetes 14 \u2514 spec: .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 mysql-8.8.26.tar:templates/primary/statefulset.yaml (helm) Tests: 20 (SUCCESSES: 18, FAILURES: 2, EXCEPTIONS: 0) Failures: 2 (MEDIUM: 2, HIGH: 0, CRITICAL: 0) MEDIUM: Container 'mysql' of StatefulSet 'mysql' should set 'securityContext.allowPrivilegeEscalation' to false \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node. See https://avd.aquasec.com/misconfig/ksv001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 mysql-8.8.26.tar:templates/primary/statefulset.yaml:56-130 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 56 \u250c - name: mysql 57 \u2502 image: docker.io/bitnami/mysql:8.0.28-debian-10-r23 58 \u2502 imagePullPolicy: \"IfNotPresent\" 59 \u2502 securityContext: 60 \u2502 runAsUser: 1001 61 \u2502 env: 62 \u2502 - name: BITNAMI_DEBUG 63 \u2502 value: \"false\" 64 \u2514 - name: MYSQL_ROOT_PASSWORD .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 MEDIUM: Container 'mysql' of StatefulSet 'mysql' should set 'securityContext.runAsNonRoot' to true \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges. See https://avd.aquasec.com/misconfig/ksv012 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 mysql-8.8.26.tar:templates/primary/statefulset.yaml:56-130 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 56 \u250c - name: mysql 57 \u2502 image: docker.io/bitnami/mysql:8.0.28-debian-10-r23 58 \u2502 imagePullPolicy: \"IfNotPresent\" 59 \u2502 securityContext: 60 \u2502 runAsUser: 1001 61 \u2502 env: 62 \u2502 - name: BITNAMI_DEBUG 63 \u2502 value: \"false\" 64 \u2514 - name: MYSQL_ROOT_PASSWORD .. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 You can see the config type next to each file name. Example Dockerfile ( dockerfile ) ======================= Tests: 23 ( SUCCESSES: 22 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( HIGH: 1 , CRITICAL: 0 ) ... deployment.yaml ( kubernetes ) ============================ Tests: 28 ( SUCCESSES: 15 , FAILURES: 13 , EXCEPTIONS: 0 ) Failures: 13 ( MEDIUM: 4 , HIGH: 1 , CRITICAL: 0 ) ... main.tf ( terraform ) =================== Tests: 23 ( SUCCESSES: 14 , FAILURES: 9 , EXCEPTIONS: 0 ) Failures: 9 ( HIGH: 6 , CRITICAL: 1 ) ... bucket.yaml ( cloudformation ) ============================ Tests: 9 ( SUCCESSES: 3 , FAILURES: 6 , EXCEPTIONS: 0 ) Failures: 6 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 2 , HIGH: 4 , CRITICAL: 0 ) ... mysql-8.8.26.tar:templates/primary/statefulset.yaml ( helm ) ========================================================== Tests: 20 ( SUCCESSES: 18 , FAILURES: 2 , EXCEPTIONS: 0 ) Failures: 2 ( MEDIUM: 2 , HIGH: 0 , CRITICAL: 0 )","title":"Type detection"},{"location":"docs/scanner/misconfiguration/#configuration","text":"This section describes misconfiguration-specific configuration. Other common options are documented here .","title":"Configuration"},{"location":"docs/scanner/misconfiguration/#pass-custom-policies","text":"You can pass policy files or directories including your custom policies through --policy option. This can be repeated for specifying multiple files or directories. cd examplex/misconf/ trivy conf --policy custom-policy/policy --policy combine/policy --policy policy.rego --namespaces user misconf/mixed For more details, see Custom Policies . Tip You also need to specify --namespaces option.","title":"Pass custom policies"},{"location":"docs/scanner/misconfiguration/#pass-custom-data","text":"You can pass directories including your custom data through --data option. This can be repeated for specifying multiple directories. cd examples/misconf/custom-data trivy conf --policy ./policy --data ./data --namespaces user ./configs For more details, see Custom Data .","title":"Pass custom data"},{"location":"docs/scanner/misconfiguration/#pass-namespaces","text":"By default, Trivy evaluates policies defined in builtin.* . If you want to evaluate custom policies in other packages, you have to specify package prefixes through --namespaces option. This can be repeated for specifying multiple packages. trivy conf --policy ./policy --namespaces main --namespaces user ./configs","title":"Pass namespaces"},{"location":"docs/scanner/misconfiguration/custom/","text":"Custom Policies Overview You can write custom policies in Rego . Once you finish writing custom policies, you can pass the policy files or the directory where those policies are stored with --policy option. trivy conf --policy /path/to/policy.rego --policy /path/to/custom_policies --namespaces user /path/to/config_dir As for --namespaces option, the detail is described as below. File formats If a file name matches the following file patterns, Trivy will parse the file and pass it as input to your Rego policy. File format File pattern JSON *.json YAML *.yaml and *.yml Dockerfile Dockerfile , Dockerfile.* , and *.Dockerfile Containerfile Containerfile , Containerfile.* , and *.Containerfile Terraform *.tf and *.tf.json Configuration languages In the above general file formats, Trivy automatically identifies the following types of configuration files: CloudFormation (JSON/YAML) Kubernetes (JSON/YAML) Helm (YAML) Terraform Plan (JSON) This is useful for filtering inputs, as described below. Rego format A single package must contain only one policy. Example # METADATA # title: Deployment not allowed # description: Deployments are not allowed because of some reasons. # schemas: # - input: schema[\"kubernetes\"] # custom: # id: ID001 # severity: LOW # input: # selector: # - type: kubernetes package user.kubernetes.ID001 deny[res] { input.kind == \"Deployment\" msg := sprintf(\"Found deployment '%s' but deployments are not allowed\", [input.metadata.name]) res := result.new(msg, input.kind) } In this example, ID001 \"Deployment not allowed\" is defined under user.kubernetes.ID001 . If you add a new custom policy, it must be defined under a new package like user.kubernetes.ID002 . Policy structure # METADATA (optional) SHOULD be defined for clarity since these values will be displayed in the scan results custom.input SHOULD be set to indicate the input type the policy should be applied to. See list of available types package (required) MUST follow the Rego's specification MUST be unique per policy SHOULD include policy id for uniqueness MAY include the group name such as kubernetes for clarity Group name has no effect on policy evaluation deny (required) SHOULD be deny or start with deny_ Although warn , warn_* , violation , violation_ also work for compatibility, deny is recommended as severity can be defined in __rego_metadata__ . SHOULD return ONE OF: The result of a call to result.new(msg, cause) . The msg is a string describing the issue occurrence, and the cause is the property/object where the issue occurred. Providing this allows Trivy to ascertain line numbers and highlight code in the output. A string denoting the detected issue Although object with msg field is accepted, other fields are dropped and string is recommended if result.new() is not utilised. e.g. {\"msg\": \"deny message\", \"details\": \"something\"} Package A package name must be unique per policy. Example package user.kubernetes.ID001 By default, only builtin.* packages will be evaluated. If you define custom packages, you have to specify the package prefix via --namespaces option. trivy conf --policy /path/to/custom_policies --namespaces user /path/to/config_dir In this case, user.* will be evaluated. Any package prefixes such as main and user are allowed. Metadata Metadata helps enrich Trivy's scan results with useful information. The annotation format is described in the OPA documentation . Trivy supports extra fields in the custom section as described below. Example # METADATA # title: Deployment not allowed # description: Deployments are not allowed because of some reasons. # custom: # id: ID001 # severity: LOW # input: # selector: # - type: kubernetes All fields are optional. The schemas field should be used to enable policy validation using a built-in schema. The schema that will be used is based on the input document type. It is recommended to use this to ensure your policies are correct and do not reference incorrect properties/values. Field name Allowed values Default value In table In JSON title Any characters N/A description Any characters schemas.input schema[\"kubernetes\"] , schema[\"dockerfile\"] , schema[\"cloud\"] (applied to all input types) custom.id Any characters N/A custom.severity LOW , MEDIUM , HIGH , CRITICAL UNKNOWN custom.recommended_actions Any characters custom.input.selector.type Any item(s) in this list url Any characters Some fields are displayed in scan results. k.yaml ( kubernetes ) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Tests: 32 ( SUCCESSES: 31 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( UNKNOWN: 0 , LOW: 1 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 ) LOW: Found deployment 'my-deployment' but deployments are not allowed \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Deployments are not allowed because of some reasons. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 k.yaml:1-2 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 \u250c apiVersion: v1 2 \u2514 kind: Deployment \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Input You can specify input format via the custom.input annotation. Example # METADATA # custom: # input: # combine: false # selector: # - type: kubernetes combine (boolean) The details are here . selector (array) This option filters the input by file format or configuration language. In the above example, Trivy passes only Kubernetes files to this policy. Even if a Dockerfile exists in the specified directory, it will not be passed to the policy as input. Possible values for input types are: dockerfile (Dockerfile) kubernetes (Kubernetes YAML/JSON) rbac (Kubernetes RBAC YAML/JSON) cloud (Cloud format, as defined by defsec - this is used for Terraform, CloudFormation, and Cloud/AWS scanning) yaml (Generic YAML) json (Generic JSON) toml (Generic TOML) When configuration languages such as Kubernetes are not identified, file formats such as JSON will be used as type . When a configuration language is identified, it will overwrite type . Example pod.yaml including Kubernetes Pod will be handled as kubernetes , not yaml . type is overwritten by kubernetes from yaml . type accepts kubernetes , dockerfile , cloudformation , terraform , terraformplan , json , or yaml . Schemas See here for the detail.","title":"Overview"},{"location":"docs/scanner/misconfiguration/custom/#custom-policies","text":"","title":"Custom Policies"},{"location":"docs/scanner/misconfiguration/custom/#overview","text":"You can write custom policies in Rego . Once you finish writing custom policies, you can pass the policy files or the directory where those policies are stored with --policy option. trivy conf --policy /path/to/policy.rego --policy /path/to/custom_policies --namespaces user /path/to/config_dir As for --namespaces option, the detail is described as below.","title":"Overview"},{"location":"docs/scanner/misconfiguration/custom/#file-formats","text":"If a file name matches the following file patterns, Trivy will parse the file and pass it as input to your Rego policy. File format File pattern JSON *.json YAML *.yaml and *.yml Dockerfile Dockerfile , Dockerfile.* , and *.Dockerfile Containerfile Containerfile , Containerfile.* , and *.Containerfile Terraform *.tf and *.tf.json","title":"File formats"},{"location":"docs/scanner/misconfiguration/custom/#configuration-languages","text":"In the above general file formats, Trivy automatically identifies the following types of configuration files: CloudFormation (JSON/YAML) Kubernetes (JSON/YAML) Helm (YAML) Terraform Plan (JSON) This is useful for filtering inputs, as described below.","title":"Configuration languages"},{"location":"docs/scanner/misconfiguration/custom/#rego-format","text":"A single package must contain only one policy. Example # METADATA # title: Deployment not allowed # description: Deployments are not allowed because of some reasons. # schemas: # - input: schema[\"kubernetes\"] # custom: # id: ID001 # severity: LOW # input: # selector: # - type: kubernetes package user.kubernetes.ID001 deny[res] { input.kind == \"Deployment\" msg := sprintf(\"Found deployment '%s' but deployments are not allowed\", [input.metadata.name]) res := result.new(msg, input.kind) } In this example, ID001 \"Deployment not allowed\" is defined under user.kubernetes.ID001 . If you add a new custom policy, it must be defined under a new package like user.kubernetes.ID002 .","title":"Rego format"},{"location":"docs/scanner/misconfiguration/custom/#policy-structure","text":"# METADATA (optional) SHOULD be defined for clarity since these values will be displayed in the scan results custom.input SHOULD be set to indicate the input type the policy should be applied to. See list of available types package (required) MUST follow the Rego's specification MUST be unique per policy SHOULD include policy id for uniqueness MAY include the group name such as kubernetes for clarity Group name has no effect on policy evaluation deny (required) SHOULD be deny or start with deny_ Although warn , warn_* , violation , violation_ also work for compatibility, deny is recommended as severity can be defined in __rego_metadata__ . SHOULD return ONE OF: The result of a call to result.new(msg, cause) . The msg is a string describing the issue occurrence, and the cause is the property/object where the issue occurred. Providing this allows Trivy to ascertain line numbers and highlight code in the output. A string denoting the detected issue Although object with msg field is accepted, other fields are dropped and string is recommended if result.new() is not utilised. e.g. {\"msg\": \"deny message\", \"details\": \"something\"}","title":"Policy structure"},{"location":"docs/scanner/misconfiguration/custom/#package","text":"A package name must be unique per policy. Example package user.kubernetes.ID001 By default, only builtin.* packages will be evaluated. If you define custom packages, you have to specify the package prefix via --namespaces option. trivy conf --policy /path/to/custom_policies --namespaces user /path/to/config_dir In this case, user.* will be evaluated. Any package prefixes such as main and user are allowed.","title":"Package"},{"location":"docs/scanner/misconfiguration/custom/#metadata","text":"Metadata helps enrich Trivy's scan results with useful information. The annotation format is described in the OPA documentation . Trivy supports extra fields in the custom section as described below. Example # METADATA # title: Deployment not allowed # description: Deployments are not allowed because of some reasons. # custom: # id: ID001 # severity: LOW # input: # selector: # - type: kubernetes All fields are optional. The schemas field should be used to enable policy validation using a built-in schema. The schema that will be used is based on the input document type. It is recommended to use this to ensure your policies are correct and do not reference incorrect properties/values. Field name Allowed values Default value In table In JSON title Any characters N/A description Any characters schemas.input schema[\"kubernetes\"] , schema[\"dockerfile\"] , schema[\"cloud\"] (applied to all input types) custom.id Any characters N/A custom.severity LOW , MEDIUM , HIGH , CRITICAL UNKNOWN custom.recommended_actions Any characters custom.input.selector.type Any item(s) in this list url Any characters Some fields are displayed in scan results. k.yaml ( kubernetes ) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Tests: 32 ( SUCCESSES: 31 , FAILURES: 1 , EXCEPTIONS: 0 ) Failures: 1 ( UNKNOWN: 0 , LOW: 1 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 ) LOW: Found deployment 'my-deployment' but deployments are not allowed \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Deployments are not allowed because of some reasons. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 k.yaml:1-2 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 \u250c apiVersion: v1 2 \u2514 kind: Deployment \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500","title":"Metadata"},{"location":"docs/scanner/misconfiguration/custom/#input","text":"You can specify input format via the custom.input annotation. Example # METADATA # custom: # input: # combine: false # selector: # - type: kubernetes combine (boolean) The details are here . selector (array) This option filters the input by file format or configuration language. In the above example, Trivy passes only Kubernetes files to this policy. Even if a Dockerfile exists in the specified directory, it will not be passed to the policy as input. Possible values for input types are: dockerfile (Dockerfile) kubernetes (Kubernetes YAML/JSON) rbac (Kubernetes RBAC YAML/JSON) cloud (Cloud format, as defined by defsec - this is used for Terraform, CloudFormation, and Cloud/AWS scanning) yaml (Generic YAML) json (Generic JSON) toml (Generic TOML) When configuration languages such as Kubernetes are not identified, file formats such as JSON will be used as type . When a configuration language is identified, it will overwrite type . Example pod.yaml including Kubernetes Pod will be handled as kubernetes , not yaml . type is overwritten by kubernetes from yaml . type accepts kubernetes , dockerfile , cloudformation , terraform , terraformplan , json , or yaml .","title":"Input"},{"location":"docs/scanner/misconfiguration/custom/#schemas","text":"See here for the detail.","title":"Schemas"},{"location":"docs/scanner/misconfiguration/custom/combine/","text":"Combined input Overview Trivy usually scans each configuration file individually. Sometimes it might be useful to compare values from different configuration files simultaneously. When combine is set to true, all config files under the specified directory are combined into one input data structure. Example __rego_input__ := { \"combine\": false, } In \"combine\" mode, the input document becomes an array, where each element is an object with two fields: \"path\": \"path/to/file\" : the relative file path of the respective file \"contents\": ... : the parsed content of the respective file Now you can ensure that duplicate values match across the entirety of your configuration files. Return value In \"combine\" mode, the deny entrypoint must return an object with two keys filepath (required) the relative file path of the file being evaluated msg (required) the message describing an issue Example deny[res] { resource := input[i].contents ... some logic ... res := { \"filepath\": input[i].path, \"msg\": \"something bad\", } }","title":"Combine"},{"location":"docs/scanner/misconfiguration/custom/combine/#combined-input","text":"","title":"Combined input"},{"location":"docs/scanner/misconfiguration/custom/combine/#overview","text":"Trivy usually scans each configuration file individually. Sometimes it might be useful to compare values from different configuration files simultaneously. When combine is set to true, all config files under the specified directory are combined into one input data structure. Example __rego_input__ := { \"combine\": false, } In \"combine\" mode, the input document becomes an array, where each element is an object with two fields: \"path\": \"path/to/file\" : the relative file path of the respective file \"contents\": ... : the parsed content of the respective file Now you can ensure that duplicate values match across the entirety of your configuration files.","title":"Overview"},{"location":"docs/scanner/misconfiguration/custom/combine/#return-value","text":"In \"combine\" mode, the deny entrypoint must return an object with two keys filepath (required) the relative file path of the file being evaluated msg (required) the message describing an issue Example deny[res] { resource := input[i].contents ... some logic ... res := { \"filepath\": input[i].path, \"msg\": \"something bad\", } }","title":"Return value"},{"location":"docs/scanner/misconfiguration/custom/data/","text":"Custom Data Custom policies may require additional data in order to determine an answer. For example, an allowed list of resources that can be created. Instead of hardcoding this information inside your policy, Trivy allows passing paths to data files with the --data flag. Given the following yaml file: $ cd examples/misconf/custom-data $ cat data/ports.yaml [ ~/src/github.com/aquasecurity/trivy/examples/misconf/custom-data ] services: ports: - \"20\" - \"20/tcp\" - \"20/udp\" - \"23\" - \"23/tcp\" This can be imported into your policy: import data.services ports := services.ports Then, you need to pass data paths through --data option. Trivy recursively searches the specified paths for JSON ( *.json ) and YAML ( *.yaml ) files. $ trivy conf --policy ./policy --data data --namespaces user ./configs","title":"Data"},{"location":"docs/scanner/misconfiguration/custom/data/#custom-data","text":"Custom policies may require additional data in order to determine an answer. For example, an allowed list of resources that can be created. Instead of hardcoding this information inside your policy, Trivy allows passing paths to data files with the --data flag. Given the following yaml file: $ cd examples/misconf/custom-data $ cat data/ports.yaml [ ~/src/github.com/aquasecurity/trivy/examples/misconf/custom-data ] services: ports: - \"20\" - \"20/tcp\" - \"20/udp\" - \"23\" - \"23/tcp\" This can be imported into your policy: import data.services ports := services.ports Then, you need to pass data paths through --data option. Trivy recursively searches the specified paths for JSON ( *.json ) and YAML ( *.yaml ) files. $ trivy conf --policy ./policy --data data --namespaces user ./configs","title":"Custom Data"},{"location":"docs/scanner/misconfiguration/custom/debug/","text":"Debugging policies When working on more complex queries (or when learning Rego), it's useful to see exactly how the policy is applied. For this purpose you can use the --trace flag. This will output a large trace from Open Policy Agent like the following: Tip Only failed policies show traces. If you want to debug a passed policy, you need to make it fail on purpose. $ trivy conf --trace configs/ 2022 -05-16T13:47:58.853+0100 INFO Detected config files: 1 Dockerfile ( dockerfile ) ======================= Tests: 23 ( SUCCESSES: 21 , FAILURES: 2 , EXCEPTIONS: 0 ) Failures: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 1 , HIGH: 1 , CRITICAL: 0 ) MEDIUM: Specify a tag in the 'FROM' statement for image 'alpine' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated. See https://avd.aquasec.com/misconfig/ds001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:1 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 [ FROM alpine:latest \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 HIGH: Last USER command in Dockerfile should not be 'root' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:3 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 3 [ USER root \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 ID: DS001 File: Dockerfile Namespace: builtin.dockerfile.DS001 Query: data.builtin.dockerfile.DS001.deny Message: Specify a tag in the 'FROM' statement for image 'alpine' TRACE Enter data.builtin.dockerfile.DS001.deny = _ TRACE | Eval data.builtin.dockerfile.DS001.deny = _ TRACE | Index data.builtin.dockerfile.DS001.deny ( matched 1 rule ) TRACE | Enter data.builtin.dockerfile.DS001.deny TRACE | | Eval output = data.builtin.dockerfile.DS001.fail_latest [ _ ] TRACE | | Index data.builtin.dockerfile.DS001.fail_latest ( matched 1 rule ) TRACE | | Enter data.builtin.dockerfile.DS001.fail_latest TRACE | | | Eval output = data.builtin.dockerfile.DS001.image_tags [ _ ] TRACE | | | Index data.builtin.dockerfile.DS001.image_tags ( matched 2 rules ) TRACE | | | Enter data.builtin.dockerfile.DS001.image_tags TRACE | | | | Eval from = data.lib.docker.from [ _ ] TRACE | | | | Index data.lib.docker.from ( matched 1 rule ) TRACE | | | | Enter data.lib.docker.from TRACE | | | | | Eval instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"from\" TRACE | | | | | Exit data.lib.docker.from TRACE | | | | Redo data.lib.docker.from TRACE | | | | | Redo instruction.Cmd = \"from\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"from\" TRACE | | | | | Fail instruction.Cmd = \"from\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"from\" TRACE | | | | | Fail instruction.Cmd = \"from\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | Eval name = from.Value [ 0 ] TRACE | | | | Eval not startswith ( name, \" $ \" ) TRACE | | | | Enter startswith ( name, \" $ \" ) TRACE | | | | | Eval startswith ( name, \" $ \" ) TRACE | | | | | Fail startswith ( name, \" $ \" ) TRACE | | | | Eval data.builtin.dockerfile.DS001.parse_tag ( name, __local505__ ) TRACE | | | | Index data.builtin.dockerfile.DS001.parse_tag ( matched 2 rules ) TRACE | | | | Enter data.builtin.dockerfile.DS001.parse_tag TRACE | | | | | Eval split ( name, \":\" , __local504__ ) TRACE | | | | | Eval [ img, tag ] = __local504__ TRACE | | | | | Exit data.builtin.dockerfile.DS001.parse_tag TRACE | | | | Eval [ img, tag ] = __local505__ TRACE | | | | Eval output = { \"cmd\" : from, \"img\" : img, \"tag\" : tag } TRACE | | | | Exit data.builtin.dockerfile.DS001.image_tags TRACE | | | Redo data.builtin.dockerfile.DS001.image_tags TRACE | | | | Redo output = { \"cmd\" : from, \"img\" : img, \"tag\" : tag } TRACE | | | | Redo [ img, tag ] = __local505__ TRACE | | | | Redo data.builtin.dockerfile.DS001.parse_tag ( name, __local505__ ) TRACE | | | | Redo data.builtin.dockerfile.DS001.parse_tag TRACE | | | | | Redo [ img, tag ] = __local504__ TRACE | | | | | Redo split ( name, \":\" , __local504__ ) TRACE | | | | Enter data.builtin.dockerfile.DS001.parse_tag TRACE | | | | | Eval tag = \"latest\" TRACE | | | | | Eval not contains ( img, \":\" ) TRACE | | | | | Enter contains ( img, \":\" ) TRACE | | | | | | Eval contains ( img, \":\" ) TRACE | | | | | | Exit contains ( img, \":\" ) TRACE | | | | | Redo contains ( img, \":\" ) TRACE | | | | | | Redo contains ( img, \":\" ) TRACE | | | | | Fail not contains ( img, \":\" ) TRACE | | | | | Redo tag = \"latest\" TRACE | | | | Redo name = from.Value [ 0 ] TRACE | | | | Redo from = data.lib.docker.from [ _ ] TRACE | | | Enter data.builtin.dockerfile.DS001.image_tags TRACE | | | | Eval from = data.lib.docker.from [ i ] TRACE | | | | Index data.lib.docker.from ( matched 1 rule ) TRACE | | | | Eval name = from.Value [ 0 ] TRACE | | | | Eval cmd_obj = input.stages [ j ][ k ] TRACE | | | | Eval possibilities = { \"arg\" , \"env\" } TRACE | | | | Eval cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Fail cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Redo possibilities = { \"arg\" , \"env\" } TRACE | | | | Redo cmd_obj = input.stages [ j ][ k ] TRACE | | | | Eval possibilities = { \"arg\" , \"env\" } TRACE | | | | Eval cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Fail cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Redo possibilities = { \"arg\" , \"env\" } TRACE | | | | Redo cmd_obj = input.stages [ j ][ k ] TRACE | | | | Eval possibilities = { \"arg\" , \"env\" } TRACE | | | | Eval cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Fail cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Redo possibilities = { \"arg\" , \"env\" } TRACE | | | | Redo cmd_obj = input.stages [ j ][ k ] TRACE | | | | Redo name = from.Value [ 0 ] TRACE | | | | Redo from = data.lib.docker.from [ i ] TRACE | | | Eval __local752__ = output.img TRACE | | | Eval neq ( __local752__, \"scratch\" ) TRACE | | | Eval __local753__ = output.img TRACE | | | Eval not data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | Enter data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | | Eval data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | | Index data.builtin.dockerfile.DS001.is_alias ( matched 1 rule, early exit ) TRACE | | | | Enter data.builtin.dockerfile.DS001.is_alias TRACE | | | | | Eval img = data.builtin.dockerfile.DS001.get_aliases [ _ ] TRACE | | | | | Index data.builtin.dockerfile.DS001.get_aliases ( matched 1 rule ) TRACE | | | | | Enter data.builtin.dockerfile.DS001.get_aliases TRACE | | | | | | Eval from_cmd = data.lib.docker.from [ _ ] TRACE | | | | | | Index data.lib.docker.from ( matched 1 rule ) TRACE | | | | | | Eval __local749__ = from_cmd.Value TRACE | | | | | | Eval data.builtin.dockerfile.DS001.get_alias ( __local749__, __local503__ ) TRACE | | | | | | Index data.builtin.dockerfile.DS001.get_alias ( matched 1 rule ) TRACE | | | | | | Enter data.builtin.dockerfile.DS001.get_alias TRACE | | | | | | | Eval __local748__ = values [ i ] TRACE | | | | | | | Eval lower ( __local748__, __local501__ ) TRACE | | | | | | | Eval \"as\" = __local501__ TRACE | | | | | | | Fail \"as\" = __local501__ TRACE | | | | | | | Redo lower ( __local748__, __local501__ ) TRACE | | | | | | | Redo __local748__ = values [ i ] TRACE | | | | | | Fail data.builtin.dockerfile.DS001.get_alias ( __local749__, __local503__ ) TRACE | | | | | | Redo __local749__ = from_cmd.Value TRACE | | | | | | Redo from_cmd = data.lib.docker.from [ _ ] TRACE | | | | | Fail img = data.builtin.dockerfile.DS001.get_aliases [ _ ] TRACE | | | | Fail data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | Eval output.tag = \"latest\" TRACE | | | Exit data.builtin.dockerfile.DS001.fail_latest TRACE | | Redo data.builtin.dockerfile.DS001.fail_latest TRACE | | | Redo output.tag = \"latest\" TRACE | | | Redo __local753__ = output.img TRACE | | | Redo neq ( __local752__, \"scratch\" ) TRACE | | | Redo __local752__ = output.img TRACE | | | Redo output = data.builtin.dockerfile.DS001.image_tags [ _ ] TRACE | | Eval __local754__ = output.img TRACE | | Eval sprintf ( \"Specify a tag in the 'FROM' statement for image '%s'\" , [ __local754__ ] , __local509__ ) TRACE | | Eval msg = __local509__ TRACE | | Eval __local755__ = output.cmd TRACE | | Eval data.lib.docker.result ( msg, __local755__, __local510__ ) TRACE | | Index data.lib.docker.result ( matched 1 rule ) TRACE | | Enter data.lib.docker.result TRACE | | | Eval object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | | Eval object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Eval object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Eval result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Exit data.lib.docker.result TRACE | | Eval res = __local510__ TRACE | | Exit data.builtin.dockerfile.DS001.deny TRACE | Redo data.builtin.dockerfile.DS001.deny TRACE | | Redo res = __local510__ TRACE | | Redo data.lib.docker.result ( msg, __local755__, __local510__ ) TRACE | | Redo data.lib.docker.result TRACE | | | Redo result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Redo object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Redo object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Redo object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | Redo __local755__ = output.cmd TRACE | | Redo msg = __local509__ TRACE | | Redo sprintf ( \"Specify a tag in the 'FROM' statement for image '%s'\" , [ __local754__ ] , __local509__ ) TRACE | | Redo __local754__ = output.img TRACE | | Redo output = data.builtin.dockerfile.DS001.fail_latest [ _ ] TRACE | Exit data.builtin.dockerfile.DS001.deny = _ TRACE Redo data.builtin.dockerfile.DS001.deny = _ TRACE | Redo data.builtin.dockerfile.DS001.deny = _ TRACE ID: DS002 File: Dockerfile Namespace: builtin.dockerfile.DS002 Query: data.builtin.dockerfile.DS002.deny Message: Last USER command in Dockerfile should not be 'root' TRACE Enter data.builtin.dockerfile.DS002.deny = _ TRACE | Eval data.builtin.dockerfile.DS002.deny = _ TRACE | Index data.builtin.dockerfile.DS002.deny ( matched 2 rules ) TRACE | Enter data.builtin.dockerfile.DS002.deny TRACE | | Eval data.builtin.dockerfile.DS002.fail_user_count TRACE | | Index data.builtin.dockerfile.DS002.fail_user_count ( matched 1 rule, early exit ) TRACE | | Enter data.builtin.dockerfile.DS002.fail_user_count TRACE | | | Eval __local771__ = data.builtin.dockerfile.DS002.get_user TRACE | | | Index data.builtin.dockerfile.DS002.get_user ( matched 1 rule ) TRACE | | | Enter data.builtin.dockerfile.DS002.get_user TRACE | | | | Eval user = data.lib.docker.user [ _ ] TRACE | | | | Index data.lib.docker.user ( matched 1 rule ) TRACE | | | | Enter data.lib.docker.user TRACE | | | | | Eval instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"user\" TRACE | | | | | Fail instruction.Cmd = \"user\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"user\" TRACE | | | | | Exit data.lib.docker.user TRACE | | | | Redo data.lib.docker.user TRACE | | | | | Redo instruction.Cmd = \"user\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"user\" TRACE | | | | | Fail instruction.Cmd = \"user\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | Eval username = user.Value [ _ ] TRACE | | | | Exit data.builtin.dockerfile.DS002.get_user TRACE | | | Redo data.builtin.dockerfile.DS002.get_user TRACE | | | | Redo username = user.Value [ _ ] TRACE | | | | Redo user = data.lib.docker.user [ _ ] TRACE | | | Eval count ( __local771__, __local536__ ) TRACE | | | Eval lt ( __local536__, 1 ) TRACE | | | Fail lt ( __local536__, 1 ) TRACE | | | Redo count ( __local771__, __local536__ ) TRACE | | | Redo __local771__ = data.builtin.dockerfile.DS002.get_user TRACE | | Fail data.builtin.dockerfile.DS002.fail_user_count TRACE | Enter data.builtin.dockerfile.DS002.deny TRACE | | Eval cmd = data.builtin.dockerfile.DS002.fail_last_user_root [ _ ] TRACE | | Index data.builtin.dockerfile.DS002.fail_last_user_root ( matched 1 rule ) TRACE | | Enter data.builtin.dockerfile.DS002.fail_last_user_root TRACE | | | Eval stage_users = data.lib.docker.stage_user [ _ ] TRACE | | | Index data.lib.docker.stage_user ( matched 1 rule ) TRACE | | | Enter data.lib.docker.stage_user TRACE | | | | Eval stage = input.stages [ stage_name ] TRACE | | | | Eval users = [ cmd | cmd = stage [ _ ] ; cmd.Cmd = \"user\" ] TRACE | | | | Enter cmd = stage [ _ ] ; cmd.Cmd = \"user\" TRACE | | | | | Eval cmd = stage [ _ ] TRACE | | | | | Eval cmd.Cmd = \"user\" TRACE | | | | | Fail cmd.Cmd = \"user\" TRACE | | | | | Redo cmd = stage [ _ ] TRACE | | | | | Eval cmd.Cmd = \"user\" TRACE | | | | | Exit cmd = stage [ _ ] ; cmd.Cmd = \"user\" TRACE | | | | Redo cmd = stage [ _ ] ; cmd.Cmd = \"user\" TRACE | | | | | Redo cmd.Cmd = \"user\" TRACE | | | | | Redo cmd = stage [ _ ] TRACE | | | | | Eval cmd.Cmd = \"user\" TRACE | | | | | Fail cmd.Cmd = \"user\" TRACE | | | | | Redo cmd = stage [ _ ] TRACE | | | | Exit data.lib.docker.stage_user TRACE | | | Redo data.lib.docker.stage_user TRACE | | | | Redo users = [ cmd | cmd = stage [ _ ] ; cmd.Cmd = \"user\" ] TRACE | | | | Redo stage = input.stages [ stage_name ] TRACE | | | Eval count ( stage_users, __local537__ ) TRACE | | | Eval len = __local537__ TRACE | | | Eval minus ( len, 1 , __local538__ ) TRACE | | | Eval last = stage_users [ __local538__ ] TRACE | | | Eval user = last.Value [ 0 ] TRACE | | | Eval user = \"root\" TRACE | | | Exit data.builtin.dockerfile.DS002.fail_last_user_root TRACE | | Redo data.builtin.dockerfile.DS002.fail_last_user_root TRACE | | | Redo user = \"root\" TRACE | | | Redo user = last.Value [ 0 ] TRACE | | | Redo last = stage_users [ __local538__ ] TRACE | | | Redo minus ( len, 1 , __local538__ ) TRACE | | | Redo len = __local537__ TRACE | | | Redo count ( stage_users, __local537__ ) TRACE | | | Redo stage_users = data.lib.docker.stage_user [ _ ] TRACE | | Eval msg = \"Last USER command in Dockerfile should not be 'root'\" TRACE | | Eval data.lib.docker.result ( msg, cmd, __local540__ ) TRACE | | Index data.lib.docker.result ( matched 1 rule ) TRACE | | Enter data.lib.docker.result TRACE | | | Eval object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | | Eval object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Eval object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Eval result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Exit data.lib.docker.result TRACE | | Eval res = __local540__ TRACE | | Exit data.builtin.dockerfile.DS002.deny TRACE | Redo data.builtin.dockerfile.DS002.deny TRACE | | Redo res = __local540__ TRACE | | Redo data.lib.docker.result ( msg, cmd, __local540__ ) TRACE | | Redo data.lib.docker.result TRACE | | | Redo result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Redo object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Redo object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Redo object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | Redo msg = \"Last USER command in Dockerfile should not be 'root'\" TRACE | | Redo cmd = data.builtin.dockerfile.DS002.fail_last_user_root [ _ ] TRACE | Exit data.builtin.dockerfile.DS002.deny = _ TRACE Redo data.builtin.dockerfile.DS002.deny = _ TRACE | Redo data.builtin.dockerfile.DS002.deny = _ TRACE","title":"Debugging Policies"},{"location":"docs/scanner/misconfiguration/custom/debug/#debugging-policies","text":"When working on more complex queries (or when learning Rego), it's useful to see exactly how the policy is applied. For this purpose you can use the --trace flag. This will output a large trace from Open Policy Agent like the following: Tip Only failed policies show traces. If you want to debug a passed policy, you need to make it fail on purpose. $ trivy conf --trace configs/ 2022 -05-16T13:47:58.853+0100 INFO Detected config files: 1 Dockerfile ( dockerfile ) ======================= Tests: 23 ( SUCCESSES: 21 , FAILURES: 2 , EXCEPTIONS: 0 ) Failures: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 1 , HIGH: 1 , CRITICAL: 0 ) MEDIUM: Specify a tag in the 'FROM' statement for image 'alpine' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated. See https://avd.aquasec.com/misconfig/ds001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:1 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 [ FROM alpine:latest \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 HIGH: Last USER command in Dockerfile should not be 'root' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Dockerfile:3 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 3 [ USER root \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 ID: DS001 File: Dockerfile Namespace: builtin.dockerfile.DS001 Query: data.builtin.dockerfile.DS001.deny Message: Specify a tag in the 'FROM' statement for image 'alpine' TRACE Enter data.builtin.dockerfile.DS001.deny = _ TRACE | Eval data.builtin.dockerfile.DS001.deny = _ TRACE | Index data.builtin.dockerfile.DS001.deny ( matched 1 rule ) TRACE | Enter data.builtin.dockerfile.DS001.deny TRACE | | Eval output = data.builtin.dockerfile.DS001.fail_latest [ _ ] TRACE | | Index data.builtin.dockerfile.DS001.fail_latest ( matched 1 rule ) TRACE | | Enter data.builtin.dockerfile.DS001.fail_latest TRACE | | | Eval output = data.builtin.dockerfile.DS001.image_tags [ _ ] TRACE | | | Index data.builtin.dockerfile.DS001.image_tags ( matched 2 rules ) TRACE | | | Enter data.builtin.dockerfile.DS001.image_tags TRACE | | | | Eval from = data.lib.docker.from [ _ ] TRACE | | | | Index data.lib.docker.from ( matched 1 rule ) TRACE | | | | Enter data.lib.docker.from TRACE | | | | | Eval instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"from\" TRACE | | | | | Exit data.lib.docker.from TRACE | | | | Redo data.lib.docker.from TRACE | | | | | Redo instruction.Cmd = \"from\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"from\" TRACE | | | | | Fail instruction.Cmd = \"from\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"from\" TRACE | | | | | Fail instruction.Cmd = \"from\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | Eval name = from.Value [ 0 ] TRACE | | | | Eval not startswith ( name, \" $ \" ) TRACE | | | | Enter startswith ( name, \" $ \" ) TRACE | | | | | Eval startswith ( name, \" $ \" ) TRACE | | | | | Fail startswith ( name, \" $ \" ) TRACE | | | | Eval data.builtin.dockerfile.DS001.parse_tag ( name, __local505__ ) TRACE | | | | Index data.builtin.dockerfile.DS001.parse_tag ( matched 2 rules ) TRACE | | | | Enter data.builtin.dockerfile.DS001.parse_tag TRACE | | | | | Eval split ( name, \":\" , __local504__ ) TRACE | | | | | Eval [ img, tag ] = __local504__ TRACE | | | | | Exit data.builtin.dockerfile.DS001.parse_tag TRACE | | | | Eval [ img, tag ] = __local505__ TRACE | | | | Eval output = { \"cmd\" : from, \"img\" : img, \"tag\" : tag } TRACE | | | | Exit data.builtin.dockerfile.DS001.image_tags TRACE | | | Redo data.builtin.dockerfile.DS001.image_tags TRACE | | | | Redo output = { \"cmd\" : from, \"img\" : img, \"tag\" : tag } TRACE | | | | Redo [ img, tag ] = __local505__ TRACE | | | | Redo data.builtin.dockerfile.DS001.parse_tag ( name, __local505__ ) TRACE | | | | Redo data.builtin.dockerfile.DS001.parse_tag TRACE | | | | | Redo [ img, tag ] = __local504__ TRACE | | | | | Redo split ( name, \":\" , __local504__ ) TRACE | | | | Enter data.builtin.dockerfile.DS001.parse_tag TRACE | | | | | Eval tag = \"latest\" TRACE | | | | | Eval not contains ( img, \":\" ) TRACE | | | | | Enter contains ( img, \":\" ) TRACE | | | | | | Eval contains ( img, \":\" ) TRACE | | | | | | Exit contains ( img, \":\" ) TRACE | | | | | Redo contains ( img, \":\" ) TRACE | | | | | | Redo contains ( img, \":\" ) TRACE | | | | | Fail not contains ( img, \":\" ) TRACE | | | | | Redo tag = \"latest\" TRACE | | | | Redo name = from.Value [ 0 ] TRACE | | | | Redo from = data.lib.docker.from [ _ ] TRACE | | | Enter data.builtin.dockerfile.DS001.image_tags TRACE | | | | Eval from = data.lib.docker.from [ i ] TRACE | | | | Index data.lib.docker.from ( matched 1 rule ) TRACE | | | | Eval name = from.Value [ 0 ] TRACE | | | | Eval cmd_obj = input.stages [ j ][ k ] TRACE | | | | Eval possibilities = { \"arg\" , \"env\" } TRACE | | | | Eval cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Fail cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Redo possibilities = { \"arg\" , \"env\" } TRACE | | | | Redo cmd_obj = input.stages [ j ][ k ] TRACE | | | | Eval possibilities = { \"arg\" , \"env\" } TRACE | | | | Eval cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Fail cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Redo possibilities = { \"arg\" , \"env\" } TRACE | | | | Redo cmd_obj = input.stages [ j ][ k ] TRACE | | | | Eval possibilities = { \"arg\" , \"env\" } TRACE | | | | Eval cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Fail cmd_obj.Cmd = possibilities [ l ] TRACE | | | | Redo possibilities = { \"arg\" , \"env\" } TRACE | | | | Redo cmd_obj = input.stages [ j ][ k ] TRACE | | | | Redo name = from.Value [ 0 ] TRACE | | | | Redo from = data.lib.docker.from [ i ] TRACE | | | Eval __local752__ = output.img TRACE | | | Eval neq ( __local752__, \"scratch\" ) TRACE | | | Eval __local753__ = output.img TRACE | | | Eval not data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | Enter data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | | Eval data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | | Index data.builtin.dockerfile.DS001.is_alias ( matched 1 rule, early exit ) TRACE | | | | Enter data.builtin.dockerfile.DS001.is_alias TRACE | | | | | Eval img = data.builtin.dockerfile.DS001.get_aliases [ _ ] TRACE | | | | | Index data.builtin.dockerfile.DS001.get_aliases ( matched 1 rule ) TRACE | | | | | Enter data.builtin.dockerfile.DS001.get_aliases TRACE | | | | | | Eval from_cmd = data.lib.docker.from [ _ ] TRACE | | | | | | Index data.lib.docker.from ( matched 1 rule ) TRACE | | | | | | Eval __local749__ = from_cmd.Value TRACE | | | | | | Eval data.builtin.dockerfile.DS001.get_alias ( __local749__, __local503__ ) TRACE | | | | | | Index data.builtin.dockerfile.DS001.get_alias ( matched 1 rule ) TRACE | | | | | | Enter data.builtin.dockerfile.DS001.get_alias TRACE | | | | | | | Eval __local748__ = values [ i ] TRACE | | | | | | | Eval lower ( __local748__, __local501__ ) TRACE | | | | | | | Eval \"as\" = __local501__ TRACE | | | | | | | Fail \"as\" = __local501__ TRACE | | | | | | | Redo lower ( __local748__, __local501__ ) TRACE | | | | | | | Redo __local748__ = values [ i ] TRACE | | | | | | Fail data.builtin.dockerfile.DS001.get_alias ( __local749__, __local503__ ) TRACE | | | | | | Redo __local749__ = from_cmd.Value TRACE | | | | | | Redo from_cmd = data.lib.docker.from [ _ ] TRACE | | | | | Fail img = data.builtin.dockerfile.DS001.get_aliases [ _ ] TRACE | | | | Fail data.builtin.dockerfile.DS001.is_alias ( __local753__ ) TRACE | | | Eval output.tag = \"latest\" TRACE | | | Exit data.builtin.dockerfile.DS001.fail_latest TRACE | | Redo data.builtin.dockerfile.DS001.fail_latest TRACE | | | Redo output.tag = \"latest\" TRACE | | | Redo __local753__ = output.img TRACE | | | Redo neq ( __local752__, \"scratch\" ) TRACE | | | Redo __local752__ = output.img TRACE | | | Redo output = data.builtin.dockerfile.DS001.image_tags [ _ ] TRACE | | Eval __local754__ = output.img TRACE | | Eval sprintf ( \"Specify a tag in the 'FROM' statement for image '%s'\" , [ __local754__ ] , __local509__ ) TRACE | | Eval msg = __local509__ TRACE | | Eval __local755__ = output.cmd TRACE | | Eval data.lib.docker.result ( msg, __local755__, __local510__ ) TRACE | | Index data.lib.docker.result ( matched 1 rule ) TRACE | | Enter data.lib.docker.result TRACE | | | Eval object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | | Eval object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Eval object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Eval result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Exit data.lib.docker.result TRACE | | Eval res = __local510__ TRACE | | Exit data.builtin.dockerfile.DS001.deny TRACE | Redo data.builtin.dockerfile.DS001.deny TRACE | | Redo res = __local510__ TRACE | | Redo data.lib.docker.result ( msg, __local755__, __local510__ ) TRACE | | Redo data.lib.docker.result TRACE | | | Redo result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Redo object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Redo object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Redo object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | Redo __local755__ = output.cmd TRACE | | Redo msg = __local509__ TRACE | | Redo sprintf ( \"Specify a tag in the 'FROM' statement for image '%s'\" , [ __local754__ ] , __local509__ ) TRACE | | Redo __local754__ = output.img TRACE | | Redo output = data.builtin.dockerfile.DS001.fail_latest [ _ ] TRACE | Exit data.builtin.dockerfile.DS001.deny = _ TRACE Redo data.builtin.dockerfile.DS001.deny = _ TRACE | Redo data.builtin.dockerfile.DS001.deny = _ TRACE ID: DS002 File: Dockerfile Namespace: builtin.dockerfile.DS002 Query: data.builtin.dockerfile.DS002.deny Message: Last USER command in Dockerfile should not be 'root' TRACE Enter data.builtin.dockerfile.DS002.deny = _ TRACE | Eval data.builtin.dockerfile.DS002.deny = _ TRACE | Index data.builtin.dockerfile.DS002.deny ( matched 2 rules ) TRACE | Enter data.builtin.dockerfile.DS002.deny TRACE | | Eval data.builtin.dockerfile.DS002.fail_user_count TRACE | | Index data.builtin.dockerfile.DS002.fail_user_count ( matched 1 rule, early exit ) TRACE | | Enter data.builtin.dockerfile.DS002.fail_user_count TRACE | | | Eval __local771__ = data.builtin.dockerfile.DS002.get_user TRACE | | | Index data.builtin.dockerfile.DS002.get_user ( matched 1 rule ) TRACE | | | Enter data.builtin.dockerfile.DS002.get_user TRACE | | | | Eval user = data.lib.docker.user [ _ ] TRACE | | | | Index data.lib.docker.user ( matched 1 rule ) TRACE | | | | Enter data.lib.docker.user TRACE | | | | | Eval instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"user\" TRACE | | | | | Fail instruction.Cmd = \"user\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"user\" TRACE | | | | | Exit data.lib.docker.user TRACE | | | | Redo data.lib.docker.user TRACE | | | | | Redo instruction.Cmd = \"user\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | | Eval instruction.Cmd = \"user\" TRACE | | | | | Fail instruction.Cmd = \"user\" TRACE | | | | | Redo instruction = input.stages [ _ ][ _ ] TRACE | | | | Eval username = user.Value [ _ ] TRACE | | | | Exit data.builtin.dockerfile.DS002.get_user TRACE | | | Redo data.builtin.dockerfile.DS002.get_user TRACE | | | | Redo username = user.Value [ _ ] TRACE | | | | Redo user = data.lib.docker.user [ _ ] TRACE | | | Eval count ( __local771__, __local536__ ) TRACE | | | Eval lt ( __local536__, 1 ) TRACE | | | Fail lt ( __local536__, 1 ) TRACE | | | Redo count ( __local771__, __local536__ ) TRACE | | | Redo __local771__ = data.builtin.dockerfile.DS002.get_user TRACE | | Fail data.builtin.dockerfile.DS002.fail_user_count TRACE | Enter data.builtin.dockerfile.DS002.deny TRACE | | Eval cmd = data.builtin.dockerfile.DS002.fail_last_user_root [ _ ] TRACE | | Index data.builtin.dockerfile.DS002.fail_last_user_root ( matched 1 rule ) TRACE | | Enter data.builtin.dockerfile.DS002.fail_last_user_root TRACE | | | Eval stage_users = data.lib.docker.stage_user [ _ ] TRACE | | | Index data.lib.docker.stage_user ( matched 1 rule ) TRACE | | | Enter data.lib.docker.stage_user TRACE | | | | Eval stage = input.stages [ stage_name ] TRACE | | | | Eval users = [ cmd | cmd = stage [ _ ] ; cmd.Cmd = \"user\" ] TRACE | | | | Enter cmd = stage [ _ ] ; cmd.Cmd = \"user\" TRACE | | | | | Eval cmd = stage [ _ ] TRACE | | | | | Eval cmd.Cmd = \"user\" TRACE | | | | | Fail cmd.Cmd = \"user\" TRACE | | | | | Redo cmd = stage [ _ ] TRACE | | | | | Eval cmd.Cmd = \"user\" TRACE | | | | | Exit cmd = stage [ _ ] ; cmd.Cmd = \"user\" TRACE | | | | Redo cmd = stage [ _ ] ; cmd.Cmd = \"user\" TRACE | | | | | Redo cmd.Cmd = \"user\" TRACE | | | | | Redo cmd = stage [ _ ] TRACE | | | | | Eval cmd.Cmd = \"user\" TRACE | | | | | Fail cmd.Cmd = \"user\" TRACE | | | | | Redo cmd = stage [ _ ] TRACE | | | | Exit data.lib.docker.stage_user TRACE | | | Redo data.lib.docker.stage_user TRACE | | | | Redo users = [ cmd | cmd = stage [ _ ] ; cmd.Cmd = \"user\" ] TRACE | | | | Redo stage = input.stages [ stage_name ] TRACE | | | Eval count ( stage_users, __local537__ ) TRACE | | | Eval len = __local537__ TRACE | | | Eval minus ( len, 1 , __local538__ ) TRACE | | | Eval last = stage_users [ __local538__ ] TRACE | | | Eval user = last.Value [ 0 ] TRACE | | | Eval user = \"root\" TRACE | | | Exit data.builtin.dockerfile.DS002.fail_last_user_root TRACE | | Redo data.builtin.dockerfile.DS002.fail_last_user_root TRACE | | | Redo user = \"root\" TRACE | | | Redo user = last.Value [ 0 ] TRACE | | | Redo last = stage_users [ __local538__ ] TRACE | | | Redo minus ( len, 1 , __local538__ ) TRACE | | | Redo len = __local537__ TRACE | | | Redo count ( stage_users, __local537__ ) TRACE | | | Redo stage_users = data.lib.docker.stage_user [ _ ] TRACE | | Eval msg = \"Last USER command in Dockerfile should not be 'root'\" TRACE | | Eval data.lib.docker.result ( msg, cmd, __local540__ ) TRACE | | Index data.lib.docker.result ( matched 1 rule ) TRACE | | Enter data.lib.docker.result TRACE | | | Eval object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | | Eval object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Eval object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Eval result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Exit data.lib.docker.result TRACE | | Eval res = __local540__ TRACE | | Exit data.builtin.dockerfile.DS002.deny TRACE | Redo data.builtin.dockerfile.DS002.deny TRACE | | Redo res = __local540__ TRACE | | Redo data.lib.docker.result ( msg, cmd, __local540__ ) TRACE | | Redo data.lib.docker.result TRACE | | | Redo result = { \"endline\" : __local470__, \"filepath\" : __local471__, \"msg\" : msg, \"startline\" : __local472__ } TRACE | | | Redo object.get ( cmd, \"StartLine\" , 0 , __local472__ ) TRACE | | | Redo object.get ( cmd, \"Path\" , \"\" , __local471__ ) TRACE | | | Redo object.get ( cmd, \"EndLine\" , 0 , __local470__ ) TRACE | | Redo msg = \"Last USER command in Dockerfile should not be 'root'\" TRACE | | Redo cmd = data.builtin.dockerfile.DS002.fail_last_user_root [ _ ] TRACE | Exit data.builtin.dockerfile.DS002.deny = _ TRACE Redo data.builtin.dockerfile.DS002.deny = _ TRACE | Redo data.builtin.dockerfile.DS002.deny = _ TRACE","title":"Debugging policies"},{"location":"docs/scanner/misconfiguration/custom/schema/","text":"Input Schema Overview Policies can be defined with custom schemas that allow inputs to be verified against them. Adding a policy schema enables Trivy to show more detailed error messages when an invalid input is encountered. In Trivy we have been able to define a schema for a Dockerfile . Without input schemas, a policy would be as follows: Example # METADATA package mypackage deny { input.evil == \"foo bar\" } If this policy is run against offending Dockerfile(s), there will not be any issues as the policy will fail to evaluate. Although the policy's failure to evaluate is legitimate, this should not result in a positive result for the scan. For instance if we have a policy that checks for misconfigurations in a Dockerfile , we could define the schema as such Example # METADATA # schemas: # - input: schema[\"dockerfile\"] package mypackage deny { input.evil == \"foo bar\" } Here input: schema[\"dockerfile\"] points to a schema that expects a valid Dockerfile as input. An example of this can be found here Now if this policy is evaluated against, a more descriptive error will be available to help fix the problem. 1 error occurred: testpolicy.rego:8: rego_type_error: undefined ref: input.evil input.evil ^ have: \"evil\" want ( one of ) : [ \"Stages\" ] Currently, out of the box the following schemas are supported natively: Docker Kubernetes Cloud Custom Policies with Custom Schemas You can also bring a custom policy that defines one or more custom schema. Example # METADATA # schemas: # - input: schema[\"fooschema\"] # - input: schema[\"barschema\"] package mypackage deny { input.evil == \"foo bar\" } The policies can be placed in a structure as follows Example /Users/user/my-custom-policies \u251c\u2500\u2500 my_policy.rego \u2514\u2500\u2500 schemas \u2514\u2500\u2500 fooschema.json \u2514\u2500\u2500 barschema.json To use such a policy with Trivy, use the --config-policy flag that points to the policy file or to the directory where the schemas and policies are contained. $ trivy --config-policy = /Users/user/my-custom-policies <path/to/iac> For more details on how to define schemas within Rego policies, please see the OPA guide that describes it in more detail.","title":"Schemas"},{"location":"docs/scanner/misconfiguration/custom/schema/#input-schema","text":"","title":"Input Schema"},{"location":"docs/scanner/misconfiguration/custom/schema/#overview","text":"Policies can be defined with custom schemas that allow inputs to be verified against them. Adding a policy schema enables Trivy to show more detailed error messages when an invalid input is encountered. In Trivy we have been able to define a schema for a Dockerfile . Without input schemas, a policy would be as follows: Example # METADATA package mypackage deny { input.evil == \"foo bar\" } If this policy is run against offending Dockerfile(s), there will not be any issues as the policy will fail to evaluate. Although the policy's failure to evaluate is legitimate, this should not result in a positive result for the scan. For instance if we have a policy that checks for misconfigurations in a Dockerfile , we could define the schema as such Example # METADATA # schemas: # - input: schema[\"dockerfile\"] package mypackage deny { input.evil == \"foo bar\" } Here input: schema[\"dockerfile\"] points to a schema that expects a valid Dockerfile as input. An example of this can be found here Now if this policy is evaluated against, a more descriptive error will be available to help fix the problem. 1 error occurred: testpolicy.rego:8: rego_type_error: undefined ref: input.evil input.evil ^ have: \"evil\" want ( one of ) : [ \"Stages\" ] Currently, out of the box the following schemas are supported natively: Docker Kubernetes Cloud","title":"Overview"},{"location":"docs/scanner/misconfiguration/custom/schema/#custom-policies-with-custom-schemas","text":"You can also bring a custom policy that defines one or more custom schema. Example # METADATA # schemas: # - input: schema[\"fooschema\"] # - input: schema[\"barschema\"] package mypackage deny { input.evil == \"foo bar\" } The policies can be placed in a structure as follows Example /Users/user/my-custom-policies \u251c\u2500\u2500 my_policy.rego \u2514\u2500\u2500 schemas \u2514\u2500\u2500 fooschema.json \u2514\u2500\u2500 barschema.json To use such a policy with Trivy, use the --config-policy flag that points to the policy file or to the directory where the schemas and policies are contained. $ trivy --config-policy = /Users/user/my-custom-policies <path/to/iac> For more details on how to define schemas within Rego policies, please see the OPA guide that describes it in more detail.","title":"Custom Policies with Custom Schemas"},{"location":"docs/scanner/misconfiguration/custom/selectors/","text":"Input Selectors Overview Sometimes you might want to limit a certain policy to only be run on certain resources. This can be achieved with input selectors. Use case For instance, if you have a custom policy that you only want to be evaluated if a certain resource type is being scanned. In such a case you could utilize input selectors to limit its evaluation on only those resources. Example # METADATA # title: \"RDS Publicly Accessible\" # description: \"Ensures RDS instances are not launched into the public cloud.\" # custom: # input: # selector: # - type: cloud # subtypes: # - provider: aws # service: rds package builtin.aws.rds.aws0999 deny[res] { instance := input.aws.rds.instances[_] instance.publicaccess.value res := result.new(\"Instance has Public Access enabled\", instance.publicaccess) Observe the following subtypes defined: # subtypes: # - provider: aws # service: rds They will ensure that the policy is only run when the input to such a policy contains an RDS instance. Enabling selectors and subtypes Currently, the following are supported: Selector Subtype fields required Example Cloud (AWS, Azure, etc.) provider , service provider: aws , service: rds Kubernetes type: kubernetes Dockerfile type: dockerfile Default behaviour If no subtypes or selectors are specified, the policy will be evaluated regardless of input.","title":"Selectors"},{"location":"docs/scanner/misconfiguration/custom/selectors/#input-selectors","text":"","title":"Input Selectors"},{"location":"docs/scanner/misconfiguration/custom/selectors/#overview","text":"Sometimes you might want to limit a certain policy to only be run on certain resources. This can be achieved with input selectors.","title":"Overview"},{"location":"docs/scanner/misconfiguration/custom/selectors/#use-case","text":"For instance, if you have a custom policy that you only want to be evaluated if a certain resource type is being scanned. In such a case you could utilize input selectors to limit its evaluation on only those resources. Example # METADATA # title: \"RDS Publicly Accessible\" # description: \"Ensures RDS instances are not launched into the public cloud.\" # custom: # input: # selector: # - type: cloud # subtypes: # - provider: aws # service: rds package builtin.aws.rds.aws0999 deny[res] { instance := input.aws.rds.instances[_] instance.publicaccess.value res := result.new(\"Instance has Public Access enabled\", instance.publicaccess) Observe the following subtypes defined: # subtypes: # - provider: aws # service: rds They will ensure that the policy is only run when the input to such a policy contains an RDS instance.","title":"Use case"},{"location":"docs/scanner/misconfiguration/custom/selectors/#enabling-selectors-and-subtypes","text":"Currently, the following are supported: Selector Subtype fields required Example Cloud (AWS, Azure, etc.) provider , service provider: aws , service: rds Kubernetes type: kubernetes Dockerfile type: dockerfile","title":"Enabling selectors and subtypes"},{"location":"docs/scanner/misconfiguration/custom/selectors/#default-behaviour","text":"If no subtypes or selectors are specified, the policy will be evaluated regardless of input.","title":"Default behaviour"},{"location":"docs/scanner/misconfiguration/custom/testing/","text":"Testing It is highly recommended to write tests for your custom policies. Rego testing To help you verify the correctness of your custom policies, OPA gives you a framework that you can use to write tests for your policies. By writing tests for your custom policies you can speed up the development process of new rules and reduce the amount of time it takes to modify rules as requirements evolve. For more details, see Policy Testing . Example package user.dockerfile.ID002 test_add_denied { r := deny with input as {\"stages\": {\"alpine:3.13\": [ {\"Cmd\": \"add\", \"Value\": [\"/target/resources.tar.gz\", \"resources.jar\"]}, {\"Cmd\": \"add\", \"Value\": [\"/target/app.jar\", \"app.jar\"]}, ]}} count(r) == 1 r[_] == \"Consider using 'COPY /target/app.jar app.jar' command instead of 'ADD /target/app.jar app.jar'\" } To write tests for custom policies, you can refer to existing tests under defsec . Go testing Fanal which is a core library of Trivy can be imported as a Go library. You can scan config files in Go and test your custom policies using Go's testing methods, such as table-driven tests . This allows you to use the actual configuration file as input, making it easy to prepare test data and ensure that your custom policies work in practice. In particular, Dockerfile and HCL need to be converted to structural data as input, which may be different from the expected input format. Tip We recommend writing OPA and Go tests both since they have different roles, like unit tests and integration tests. The following example stores allowed and denied configuration files in a directory. Successes contains the result of successes, and Failures contains the result of failures. { name : \"disallowed ports\" , input : \"configs/\" , fields : fields { policyPaths : [] string { \"policy\" }, dataPaths : [] string { \"data\" }, namespaces : [] string { \"user\" }, }, want : [] types . Misconfiguration { { FileType : types . Dockerfile , FilePath : \"Dockerfile.allowed\" , Successes : types . MisconfResults { { Namespace : \"user.dockerfile.ID002\" , PolicyMetadata : types . PolicyMetadata { ID : \"ID002\" , Type : \"Docker Custom Check\" , Title : \"Disallowed ports exposed\" , Severity : \"HIGH\" , }, }, }, }, { FileType : types . Dockerfile , FilePath : \"Dockerfile.denied\" , Failures : types . MisconfResults { { Namespace : \"user.dockerfile.ID002\" , Message : \"Port 23 should not be exposed\" , PolicyMetadata : types . PolicyMetadata { ID : \"ID002\" , Type : \"Docker Custom Check\" , Title : \"Disallowed ports exposed\" , Severity : \"HIGH\" , }, }, }, }, }, }, Dockerfile.allowed has one successful result in Successes , while Dockerfile.denied has one failure result in Failures .","title":"Testing"},{"location":"docs/scanner/misconfiguration/custom/testing/#testing","text":"It is highly recommended to write tests for your custom policies.","title":"Testing"},{"location":"docs/scanner/misconfiguration/custom/testing/#rego-testing","text":"To help you verify the correctness of your custom policies, OPA gives you a framework that you can use to write tests for your policies. By writing tests for your custom policies you can speed up the development process of new rules and reduce the amount of time it takes to modify rules as requirements evolve. For more details, see Policy Testing . Example package user.dockerfile.ID002 test_add_denied { r := deny with input as {\"stages\": {\"alpine:3.13\": [ {\"Cmd\": \"add\", \"Value\": [\"/target/resources.tar.gz\", \"resources.jar\"]}, {\"Cmd\": \"add\", \"Value\": [\"/target/app.jar\", \"app.jar\"]}, ]}} count(r) == 1 r[_] == \"Consider using 'COPY /target/app.jar app.jar' command instead of 'ADD /target/app.jar app.jar'\" } To write tests for custom policies, you can refer to existing tests under defsec .","title":"Rego testing"},{"location":"docs/scanner/misconfiguration/custom/testing/#go-testing","text":"Fanal which is a core library of Trivy can be imported as a Go library. You can scan config files in Go and test your custom policies using Go's testing methods, such as table-driven tests . This allows you to use the actual configuration file as input, making it easy to prepare test data and ensure that your custom policies work in practice. In particular, Dockerfile and HCL need to be converted to structural data as input, which may be different from the expected input format. Tip We recommend writing OPA and Go tests both since they have different roles, like unit tests and integration tests. The following example stores allowed and denied configuration files in a directory. Successes contains the result of successes, and Failures contains the result of failures. { name : \"disallowed ports\" , input : \"configs/\" , fields : fields { policyPaths : [] string { \"policy\" }, dataPaths : [] string { \"data\" }, namespaces : [] string { \"user\" }, }, want : [] types . Misconfiguration { { FileType : types . Dockerfile , FilePath : \"Dockerfile.allowed\" , Successes : types . MisconfResults { { Namespace : \"user.dockerfile.ID002\" , PolicyMetadata : types . PolicyMetadata { ID : \"ID002\" , Type : \"Docker Custom Check\" , Title : \"Disallowed ports exposed\" , Severity : \"HIGH\" , }, }, }, }, { FileType : types . Dockerfile , FilePath : \"Dockerfile.denied\" , Failures : types . MisconfResults { { Namespace : \"user.dockerfile.ID002\" , Message : \"Port 23 should not be exposed\" , PolicyMetadata : types . PolicyMetadata { ID : \"ID002\" , Type : \"Docker Custom Check\" , Title : \"Disallowed ports exposed\" , Severity : \"HIGH\" , }, }, }, }, }, }, Dockerfile.allowed has one successful result in Successes , while Dockerfile.denied has one failure result in Failures .","title":"Go testing"},{"location":"docs/scanner/misconfiguration/policy/builtin/","text":"Built-in Policies Policy Sources Built-in policies are mainly written in Rego and Go. Those policies are managed under defsec repository . See here for the list of supported config types. For suggestions or issues regarding policy content, please open an issue under the defsec repository. Policy Distribution defsec policies are distributed as an OPA bundle on GitHub Container Registry (GHCR). When misconfiguration detection is enabled, Trivy pulls the OPA bundle from GHCR as an OCI artifact and stores it in the cache. Those policies are then loaded into Trivy OPA engine and used for detecting misconfigurations. If Trivy is unable to pull down newer policies, it will use the embedded set of policies as a fallback. This is also the case in air-gap environments where --skip-policy-update might be passed. Update Interval Trivy checks for updates to OPA bundle on GHCR every 24 hours and pulls it if there are any updates.","title":"Built-in Policies"},{"location":"docs/scanner/misconfiguration/policy/builtin/#built-in-policies","text":"","title":"Built-in Policies"},{"location":"docs/scanner/misconfiguration/policy/builtin/#policy-sources","text":"Built-in policies are mainly written in Rego and Go. Those policies are managed under defsec repository . See here for the list of supported config types. For suggestions or issues regarding policy content, please open an issue under the defsec repository.","title":"Policy Sources"},{"location":"docs/scanner/misconfiguration/policy/builtin/#policy-distribution","text":"defsec policies are distributed as an OPA bundle on GitHub Container Registry (GHCR). When misconfiguration detection is enabled, Trivy pulls the OPA bundle from GHCR as an OCI artifact and stores it in the cache. Those policies are then loaded into Trivy OPA engine and used for detecting misconfigurations. If Trivy is unable to pull down newer policies, it will use the embedded set of policies as a fallback. This is also the case in air-gap environments where --skip-policy-update might be passed.","title":"Policy Distribution"},{"location":"docs/scanner/misconfiguration/policy/builtin/#update-interval","text":"Trivy checks for updates to OPA bundle on GHCR every 24 hours and pulls it if there are any updates.","title":"Update Interval"},{"location":"docs/scanner/misconfiguration/policy/exceptions/","text":"Exceptions Exceptions let you specify cases where you allow policy violations. Trivy supports two types of exceptions. Info Exceptions can be applied to built-in policies as well as custom policies. Namespace-based exceptions There are some cases where you need to disable built-in policies partially or fully. Namespace-based exceptions lets you rough choose which individual packages to exempt. To use namespace-based exceptions, create a Rego rule with the name exception that returns the package names to exempt. The exception rule must be defined under namespace.exceptions . data.namespaces includes all package names. Example package namespace.exceptions import data.namespaces exception[ns] { ns := data.namespaces[_] startswith(ns, \"builtin.kubernetes\") } This example exempts all built-in policies for Kubernetes. For more details, see an example . Rule-based exceptions There are some cases where you need more flexibility and granularity in defining which cases to exempt. Rule-based exceptions lets you granularly choose which individual rules to exempt, while also declaring under which conditions to exempt them. To use rule-based exceptions, create a Rego rule with the name exception that returns the rule name suffixes to exempt, prefixed by deny_ (for example, returning foo will exempt deny_foo ). The rule can make any other assertion, for example, on the input or data documents. This is useful to specify the exemption for a specific case. Note that if you specify the empty string, the exception will match all rules named deny . exception[rules] { # Logic rules = [\"foo\",\"bar\"] } The above would provide an exception from deny_foo and deny_bar . Example package user.kubernetes.ID100 __rego_metadata := { \"id\": \"ID100\", \"title\": \"Deployment not allowed\", \"severity\": \"HIGH\", \"type\": \"Kubernetes Custom Check\", } deny_deployment[msg] { input.kind == \"Deployment\" msg = sprintf(\"Found deployment '%s' but deployments are not allowed\", [name]) } exception[rules] { input.kind == \"Deployment\" input.metadata.name == \"allow-deployment\" rules := [\"deployment\"] } If you want to apply rule-based exceptions to built-in policies, you have to define the exception under the same package. Example package builtin.kubernetes.KSV012 exception[rules] { input.metadata.name == \"can-run-as-root\" rules := [\"\"] } This exception is applied to KSV012 in defsec. You can get the package names in the defsec repository or the JSON output from Trivy. For more details, see an example .","title":"Exceptions"},{"location":"docs/scanner/misconfiguration/policy/exceptions/#exceptions","text":"Exceptions let you specify cases where you allow policy violations. Trivy supports two types of exceptions. Info Exceptions can be applied to built-in policies as well as custom policies.","title":"Exceptions"},{"location":"docs/scanner/misconfiguration/policy/exceptions/#namespace-based-exceptions","text":"There are some cases where you need to disable built-in policies partially or fully. Namespace-based exceptions lets you rough choose which individual packages to exempt. To use namespace-based exceptions, create a Rego rule with the name exception that returns the package names to exempt. The exception rule must be defined under namespace.exceptions . data.namespaces includes all package names. Example package namespace.exceptions import data.namespaces exception[ns] { ns := data.namespaces[_] startswith(ns, \"builtin.kubernetes\") } This example exempts all built-in policies for Kubernetes. For more details, see an example .","title":"Namespace-based exceptions"},{"location":"docs/scanner/misconfiguration/policy/exceptions/#rule-based-exceptions","text":"There are some cases where you need more flexibility and granularity in defining which cases to exempt. Rule-based exceptions lets you granularly choose which individual rules to exempt, while also declaring under which conditions to exempt them. To use rule-based exceptions, create a Rego rule with the name exception that returns the rule name suffixes to exempt, prefixed by deny_ (for example, returning foo will exempt deny_foo ). The rule can make any other assertion, for example, on the input or data documents. This is useful to specify the exemption for a specific case. Note that if you specify the empty string, the exception will match all rules named deny . exception[rules] { # Logic rules = [\"foo\",\"bar\"] } The above would provide an exception from deny_foo and deny_bar . Example package user.kubernetes.ID100 __rego_metadata := { \"id\": \"ID100\", \"title\": \"Deployment not allowed\", \"severity\": \"HIGH\", \"type\": \"Kubernetes Custom Check\", } deny_deployment[msg] { input.kind == \"Deployment\" msg = sprintf(\"Found deployment '%s' but deployments are not allowed\", [name]) } exception[rules] { input.kind == \"Deployment\" input.metadata.name == \"allow-deployment\" rules := [\"deployment\"] } If you want to apply rule-based exceptions to built-in policies, you have to define the exception under the same package. Example package builtin.kubernetes.KSV012 exception[rules] { input.metadata.name == \"can-run-as-root\" rules := [\"\"] } This exception is applied to KSV012 in defsec. You can get the package names in the defsec repository or the JSON output from Trivy. For more details, see an example .","title":"Rule-based exceptions"},{"location":"docs/supply-chain/sbom/","text":"SBOM Generating Trivy can generate the following SBOM formats. CycloneDX SPDX CLI commands To generate SBOM, you can use the --format option for each subcommand such as image , fs and vm . $ trivy image --format spdx-json --output result.json alpine:3.15 $ trivy fs --format cyclonedx --output result.json /app/myproject Result { \"bomFormat\": \"CycloneDX\", \"specVersion\": \"1.3\", \"serialNumber\": \"urn:uuid:2be5773d-7cd3-4b4b-90a5-e165474ddace\", \"version\": 1, \"metadata\": { \"timestamp\": \"2022-02-22T15:11:40.270597Z\", \"tools\": [ { \"vendor\": \"aquasecurity\", \"name\": \"trivy\", \"version\": \"dev\" } ], \"component\": { \"bom-ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"type\": \"container\", \"name\": \"alpine:3.15\", \"version\": \"\", \"purl\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SchemaVersion\", \"value\": \"2\" }, { \"name\": \"aquasecurity:trivy:ImageID\", \"value\": \"sha256:c059bfaa849c4d8e4aecaeb3a10c2d9b3d85f5165c66ad3a4d937758128c4d18\" }, { \"name\": \"aquasecurity:trivy:RepoDigest\", \"value\": \"alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300\" }, { \"name\": \"aquasecurity:trivy:DiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" }, { \"name\": \"aquasecurity:trivy:RepoTag\", \"value\": \"alpine:3.15\" } ] } }, \"components\": [ { \"bom-ref\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"type\": \"library\", \"name\": \"alpine-baselayout\", \"version\": \"3.2.0-r18\", \"licenses\": [ { \"expression\": \"GPL-2.0-only\" } ], \"purl\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"alpine-baselayout\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"3.2.0-r18\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, ...(snip)... { \"bom-ref\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"type\": \"library\", \"name\": \"zlib\", \"version\": \"1.2.11-r3\", \"licenses\": [ { \"expression\": \"Zlib\" } ], \"purl\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"zlib\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"1.2.11-r3\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, { \"bom-ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"type\": \"operating-system\", \"name\": \"alpine\", \"version\": \"3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:Type\", \"value\": \"alpine\" }, { \"name\": \"aquasecurity:trivy:Class\", \"value\": \"os-pkgs\" } ] } ], \"dependencies\": [ { \"ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"dependsOn\": [ \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"pkg:apk/alpine/alpine-keys@2.4-r1?distro=3.15.0\", \"pkg:apk/alpine/apk-tools@2.12.7-r3?distro=3.15.0\", \"pkg:apk/alpine/busybox@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/ca-certificates-bundle@20191127-r7?distro=3.15.0\", \"pkg:apk/alpine/libc-utils@0.7.2-r3?distro=3.15.0\", \"pkg:apk/alpine/libcrypto1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/libretls@3.3.4-r2?distro=3.15.0\", \"pkg:apk/alpine/libssl1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/musl@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/musl-utils@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/scanelf@1.3.3-r0?distro=3.15.0\", \"pkg:apk/alpine/ssl_client@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\" ] }, { \"ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"dependsOn\": [ \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\" ] } ] } Supported packages Trivy supports the following packages. OS packages Language-specific packages Formats CycloneDX Trivy can generate SBOM in the CycloneDX format. Note that XML format is not supported at the moment. You can use the regular subcommands (like image , fs and rootfs ) and specify cyclonedx with the --format option. CycloneDX can represent either or both SBOM or BOV. Software Bill of Materials (SBOM) Bill of Vulnerabilities (BOV) By default, --format cyclonedx represents SBOM and doesn't include vulnerabilities in the CycloneDX output. $ trivy image --format cyclonedx --output result.json alpine:3.15 2022-07-19T07:47:27.624Z INFO \"--format cyclonedx\" disables security scanning. Specify \"--scanners vuln\" explicitly if you want to include vulnerabilities in the CycloneDX report. Result $ cat result.json | jq . { \"bomFormat\": \"CycloneDX\", \"specVersion\": \"1.5\", \"serialNumber\": \"urn:uuid:2be5773d-7cd3-4b4b-90a5-e165474ddace\", \"version\": 1, \"metadata\": { \"timestamp\": \"2022-02-22T15:11:40.270597Z\", \"tools\": [ { \"vendor\": \"aquasecurity\", \"name\": \"trivy\", \"version\": \"dev\" } ], \"component\": { \"bom-ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"type\": \"container\", \"name\": \"alpine:3.15\", \"version\": \"\", \"purl\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SchemaVersion\", \"value\": \"2\" }, { \"name\": \"aquasecurity:trivy:ImageID\", \"value\": \"sha256:c059bfaa849c4d8e4aecaeb3a10c2d9b3d85f5165c66ad3a4d937758128c4d18\" }, { \"name\": \"aquasecurity:trivy:RepoDigest\", \"value\": \"alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300\" }, { \"name\": \"aquasecurity:trivy:DiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" }, { \"name\": \"aquasecurity:trivy:RepoTag\", \"value\": \"alpine:3.15\" } ] } }, \"components\": [ { \"bom-ref\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"type\": \"library\", \"name\": \"alpine-baselayout\", \"version\": \"3.2.0-r18\", \"licenses\": [ { \"expression\": \"GPL-2.0-only\" } ], \"purl\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"alpine-baselayout\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"3.2.0-r18\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, ...(snip)... { \"bom-ref\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"type\": \"library\", \"name\": \"zlib\", \"version\": \"1.2.11-r3\", \"licenses\": [ { \"expression\": \"Zlib\" } ], \"purl\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"zlib\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"1.2.11-r3\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, { \"bom-ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"type\": \"operating-system\", \"name\": \"alpine\", \"version\": \"3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:Type\", \"value\": \"alpine\" }, { \"name\": \"aquasecurity:trivy:Class\", \"value\": \"os-pkgs\" } ] } ], \"dependencies\": [ { \"ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"dependsOn\": [ \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"pkg:apk/alpine/alpine-keys@2.4-r1?distro=3.15.0\", \"pkg:apk/alpine/apk-tools@2.12.7-r3?distro=3.15.0\", \"pkg:apk/alpine/busybox@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/ca-certificates-bundle@20191127-r7?distro=3.15.0\", \"pkg:apk/alpine/libc-utils@0.7.2-r3?distro=3.15.0\", \"pkg:apk/alpine/libcrypto1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/libretls@3.3.4-r2?distro=3.15.0\", \"pkg:apk/alpine/libssl1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/musl@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/musl-utils@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/scanelf@1.3.3-r0?distro=3.15.0\", \"pkg:apk/alpine/ssl_client@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\" ] }, { \"ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"dependsOn\": [ \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\" ] } ], \"vulnerabilities\": [ { \"id\": \"CVE-2021-42386\", \"source\": { \"name\": \"alpine\", \"url\": \"https://secdb.alpinelinux.org/\" }, \"ratings\": [ { \"source\": { \"name\": \"nvd\" }, \"score\": 7.2, \"severity\": \"high\", \"method\": \"CVSSv31\", \"vector\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\" }, { \"source\": { \"name\": \"nvd\" }, \"score\": 6.5, \"severity\": \"medium\", \"method\": \"CVSSv2\", \"vector\": \"AV:N/AC:L/Au:S/C:P/I:P/A:P\" }, { \"source\": { \"name\": \"redhat\" }, \"score\": 6.6, \"severity\": \"medium\", \"method\": \"CVSSv31\", \"vector\": \"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\" } ], \"cwes\": [ 416 ], \"description\": \"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function\", \"advisories\": [ { \"url\": \"https://access.redhat.com/security/cve/CVE-2021-42386\" }, { \"url\": \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42386\" } ], \"published\": \"2021-11-15 21:15:00 +0000 UTC\", \"updated\": \"2022-01-04 17:14:00 +0000 UTC\", \"affects\": [ { \"ref\": \"pkg:apk/alpine/busybox@1.33.1-r3?distro=3.14.2\" }, { \"ref\": \"pkg:apk/alpine/ssl_client@1.33.1-r3?distro=3.14.2\" } ] } ] } If you want to include vulnerabilities, you can enable vulnerability scanning via --scanners vuln . $ trivy image --scanners vuln --format cyclonedx --output result.json alpine:3.15 SPDX Trivy can generate SBOM in the SPDX format. You can use the regular subcommands (like image , fs and rootfs ) and specify spdx with the --format option. $ trivy image --format spdx --output result.spdx alpine:3.15 Result $ cat result.spdx SPDXVersion: SPDX-2.2 DataLicense: CC0-1.0 SPDXID: SPDXRef-DOCUMENT DocumentName: alpine:3.15 DocumentNamespace: https://aquasecurity.github.io/trivy/container_image/alpine:3.15-bebf6b19-a94c-4e2c-af44-065f63923f48 Creator: Organization: aquasecurity Creator: Tool: trivy-0.38.1 Created: 2022-04-28T07:32:57.142806Z ##### Package: zlib PackageName: zlib SPDXID: SPDXRef-12bc938ac028a5e1 PackageVersion: 1.2.12-r0 FilesAnalyzed: false PackageLicenseConcluded: Zlib PackageLicenseDeclared: Zlib ##### Package: apk-tools PackageName: apk-tools SPDXID: SPDXRef-26c274652190d87f PackageVersion: 2.12.7-r3 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: libretls PackageName: libretls SPDXID: SPDXRef-2b021966d19a8211 PackageVersion: 3.3.4-r3 FilesAnalyzed: false PackageLicenseConcluded: ISC AND (BSD-3-Clause OR MIT) PackageLicenseDeclared: ISC AND (BSD-3-Clause OR MIT) ##### Package: busybox PackageName: busybox SPDXID: SPDXRef-317ce3476703f20d PackageVersion: 1.34.1-r5 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: libcrypto1.1 PackageName: libcrypto1.1 SPDXID: SPDXRef-34f407fb4dbd67f4 PackageVersion: 1.1.1n-r0 FilesAnalyzed: false PackageLicenseConcluded: OpenSSL PackageLicenseDeclared: OpenSSL ##### Package: libc-utils PackageName: libc-utils SPDXID: SPDXRef-4bbc1cb449d54083 PackageVersion: 0.7.2-r3 FilesAnalyzed: false PackageLicenseConcluded: BSD-2-Clause AND BSD-3-Clause PackageLicenseDeclared: BSD-2-Clause AND BSD-3-Clause ##### Package: alpine-keys PackageName: alpine-keys SPDXID: SPDXRef-a3bdd174be1456b6 PackageVersion: 2.4-r1 FilesAnalyzed: false PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT ##### Package: ca-certificates-bundle PackageName: ca-certificates-bundle SPDXID: SPDXRef-ac6472ba26fb991c PackageVersion: 20211220-r0 FilesAnalyzed: false PackageLicenseConcluded: MPL-2.0 AND MIT PackageLicenseDeclared: MPL-2.0 AND MIT ##### Package: libssl1.1 PackageName: libssl1.1 SPDXID: SPDXRef-b2d1b1d70fe90f7d PackageVersion: 1.1.1n-r0 FilesAnalyzed: false PackageLicenseConcluded: OpenSSL PackageLicenseDeclared: OpenSSL ##### Package: scanelf PackageName: scanelf SPDXID: SPDXRef-c617077ba6649520 PackageVersion: 1.3.3-r0 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: musl PackageName: musl SPDXID: SPDXRef-ca80b810029cde0e PackageVersion: 1.2.2-r7 FilesAnalyzed: false PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT ##### Package: alpine-baselayout PackageName: alpine-baselayout SPDXID: SPDXRef-d782e64751ba9faa PackageVersion: 3.2.0-r18 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: musl-utils PackageName: musl-utils SPDXID: SPDXRef-e5e8a237f6162e22 PackageVersion: 1.2.2-r7 FilesAnalyzed: false PackageLicenseConcluded: MIT BSD GPL2+ PackageLicenseDeclared: MIT BSD GPL2+ ##### Package: ssl_client PackageName: ssl_client SPDXID: SPDXRef-fdf0ce84f6337be4 PackageVersion: 1.34.1-r5 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only SPDX-JSON format is also supported by using spdx-json with the --format option. $ trivy image --format spdx-json --output result.spdx.json alpine:3.15 Result $ cat result.spdx.json | jq . { \"SPDXID\": \"SPDXRef-DOCUMENT\", \"creationInfo\": { \"created\": \"2022-04-28T08:16:55.328255Z\", \"creators\": [ \"Tool: trivy-0.38.1\", \"Organization: aquasecurity\" ] }, \"dataLicense\": \"CC0-1.0\", \"documentNamespace\": \"http://aquasecurity.github.io/trivy/container_image/alpine:3.15-d9549e3a-a4c5-4ee3-8bde-8c78d451fbe7\", \"name\": \"alpine:3.15\", \"packages\": [ { \"SPDXID\": \"SPDXRef-12bc938ac028a5e1\", \"filesAnalyzed\": false, \"licenseConcluded\": \"Zlib\", \"licenseDeclared\": \"Zlib\", \"name\": \"zlib\", \"versionInfo\": \"1.2.12-r0\" }, { \"SPDXID\": \"SPDXRef-26c274652190d87f\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"apk-tools\", \"versionInfo\": \"2.12.7-r3\" }, { \"SPDXID\": \"SPDXRef-2b021966d19a8211\", \"filesAnalyzed\": false, \"licenseConcluded\": \"ISC AND (BSD-3-Clause OR MIT)\", \"licenseDeclared\": \"ISC AND (BSD-3-Clause OR MIT)\", \"name\": \"libretls\", \"versionInfo\": \"3.3.4-r3\" }, { \"SPDXID\": \"SPDXRef-317ce3476703f20d\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"busybox\", \"versionInfo\": \"1.34.1-r5\" }, { \"SPDXID\": \"SPDXRef-34f407fb4dbd67f4\", \"filesAnalyzed\": false, \"licenseConcluded\": \"OpenSSL\", \"licenseDeclared\": \"OpenSSL\", \"name\": \"libcrypto1.1\", \"versionInfo\": \"1.1.1n-r0\" }, { \"SPDXID\": \"SPDXRef-4bbc1cb449d54083\", \"filesAnalyzed\": false, \"licenseConcluded\": \"BSD-2-Clause AND BSD-3-Clause\", \"licenseDeclared\": \"BSD-2-Clause AND BSD-3-Clause\", \"name\": \"libc-utils\", \"versionInfo\": \"0.7.2-r3\" }, { \"SPDXID\": \"SPDXRef-a3bdd174be1456b6\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MIT\", \"licenseDeclared\": \"MIT\", \"name\": \"alpine-keys\", \"versionInfo\": \"2.4-r1\" }, { \"SPDXID\": \"SPDXRef-ac6472ba26fb991c\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MPL-2.0 AND MIT\", \"licenseDeclared\": \"MPL-2.0 AND MIT\", \"name\": \"ca-certificates-bundle\", \"versionInfo\": \"20211220-r0\" }, { \"SPDXID\": \"SPDXRef-b2d1b1d70fe90f7d\", \"filesAnalyzed\": false, \"licenseConcluded\": \"OpenSSL\", \"licenseDeclared\": \"OpenSSL\", \"name\": \"libssl1.1\", \"versionInfo\": \"1.1.1n-r0\" }, { \"SPDXID\": \"SPDXRef-c617077ba6649520\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"scanelf\", \"versionInfo\": \"1.3.3-r0\" }, { \"SPDXID\": \"SPDXRef-ca80b810029cde0e\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MIT\", \"licenseDeclared\": \"MIT\", \"name\": \"musl\", \"versionInfo\": \"1.2.2-r7\" }, { \"SPDXID\": \"SPDXRef-d782e64751ba9faa\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"alpine-baselayout\", \"versionInfo\": \"3.2.0-r18\" }, { \"SPDXID\": \"SPDXRef-e5e8a237f6162e22\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MIT BSD GPL2+\", \"licenseDeclared\": \"MIT BSD GPL2+\", \"name\": \"musl-utils\", \"versionInfo\": \"1.2.2-r7\" }, { \"SPDXID\": \"SPDXRef-fdf0ce84f6337be4\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"ssl_client\", \"versionInfo\": \"1.34.1-r5\" } ], \"spdxVersion\": \"SPDX-2.2\" } Scanning Trivy can take SBOM documents as input for scanning. See here for more details. Also, Trivy searches for SBOM files in container images. $ trivy image bitnami/elasticsearch:8.7.1 For example, Bitnami images contain SBOM files in /opt/bitnami directory. Trivy automatically detects the SBOM files and uses them for scanning. It is enabled in the following targets. Target Enabled Container Image \u2713 Filesystem Rootfs \u2713 Git Repository VM Image \u2713 Kubernetes AWS SBOM","title":"SBOM"},{"location":"docs/supply-chain/sbom/#sbom","text":"","title":"SBOM"},{"location":"docs/supply-chain/sbom/#generating","text":"Trivy can generate the following SBOM formats. CycloneDX SPDX","title":"Generating"},{"location":"docs/supply-chain/sbom/#cli-commands","text":"To generate SBOM, you can use the --format option for each subcommand such as image , fs and vm . $ trivy image --format spdx-json --output result.json alpine:3.15 $ trivy fs --format cyclonedx --output result.json /app/myproject Result { \"bomFormat\": \"CycloneDX\", \"specVersion\": \"1.3\", \"serialNumber\": \"urn:uuid:2be5773d-7cd3-4b4b-90a5-e165474ddace\", \"version\": 1, \"metadata\": { \"timestamp\": \"2022-02-22T15:11:40.270597Z\", \"tools\": [ { \"vendor\": \"aquasecurity\", \"name\": \"trivy\", \"version\": \"dev\" } ], \"component\": { \"bom-ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"type\": \"container\", \"name\": \"alpine:3.15\", \"version\": \"\", \"purl\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SchemaVersion\", \"value\": \"2\" }, { \"name\": \"aquasecurity:trivy:ImageID\", \"value\": \"sha256:c059bfaa849c4d8e4aecaeb3a10c2d9b3d85f5165c66ad3a4d937758128c4d18\" }, { \"name\": \"aquasecurity:trivy:RepoDigest\", \"value\": \"alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300\" }, { \"name\": \"aquasecurity:trivy:DiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" }, { \"name\": \"aquasecurity:trivy:RepoTag\", \"value\": \"alpine:3.15\" } ] } }, \"components\": [ { \"bom-ref\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"type\": \"library\", \"name\": \"alpine-baselayout\", \"version\": \"3.2.0-r18\", \"licenses\": [ { \"expression\": \"GPL-2.0-only\" } ], \"purl\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"alpine-baselayout\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"3.2.0-r18\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, ...(snip)... { \"bom-ref\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"type\": \"library\", \"name\": \"zlib\", \"version\": \"1.2.11-r3\", \"licenses\": [ { \"expression\": \"Zlib\" } ], \"purl\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"zlib\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"1.2.11-r3\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, { \"bom-ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"type\": \"operating-system\", \"name\": \"alpine\", \"version\": \"3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:Type\", \"value\": \"alpine\" }, { \"name\": \"aquasecurity:trivy:Class\", \"value\": \"os-pkgs\" } ] } ], \"dependencies\": [ { \"ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"dependsOn\": [ \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"pkg:apk/alpine/alpine-keys@2.4-r1?distro=3.15.0\", \"pkg:apk/alpine/apk-tools@2.12.7-r3?distro=3.15.0\", \"pkg:apk/alpine/busybox@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/ca-certificates-bundle@20191127-r7?distro=3.15.0\", \"pkg:apk/alpine/libc-utils@0.7.2-r3?distro=3.15.0\", \"pkg:apk/alpine/libcrypto1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/libretls@3.3.4-r2?distro=3.15.0\", \"pkg:apk/alpine/libssl1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/musl@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/musl-utils@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/scanelf@1.3.3-r0?distro=3.15.0\", \"pkg:apk/alpine/ssl_client@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\" ] }, { \"ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"dependsOn\": [ \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\" ] } ] }","title":"CLI commands"},{"location":"docs/supply-chain/sbom/#supported-packages","text":"Trivy supports the following packages. OS packages Language-specific packages","title":"Supported packages"},{"location":"docs/supply-chain/sbom/#formats","text":"","title":"Formats"},{"location":"docs/supply-chain/sbom/#cyclonedx","text":"Trivy can generate SBOM in the CycloneDX format. Note that XML format is not supported at the moment. You can use the regular subcommands (like image , fs and rootfs ) and specify cyclonedx with the --format option. CycloneDX can represent either or both SBOM or BOV. Software Bill of Materials (SBOM) Bill of Vulnerabilities (BOV) By default, --format cyclonedx represents SBOM and doesn't include vulnerabilities in the CycloneDX output. $ trivy image --format cyclonedx --output result.json alpine:3.15 2022-07-19T07:47:27.624Z INFO \"--format cyclonedx\" disables security scanning. Specify \"--scanners vuln\" explicitly if you want to include vulnerabilities in the CycloneDX report. Result $ cat result.json | jq . { \"bomFormat\": \"CycloneDX\", \"specVersion\": \"1.5\", \"serialNumber\": \"urn:uuid:2be5773d-7cd3-4b4b-90a5-e165474ddace\", \"version\": 1, \"metadata\": { \"timestamp\": \"2022-02-22T15:11:40.270597Z\", \"tools\": [ { \"vendor\": \"aquasecurity\", \"name\": \"trivy\", \"version\": \"dev\" } ], \"component\": { \"bom-ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"type\": \"container\", \"name\": \"alpine:3.15\", \"version\": \"\", \"purl\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SchemaVersion\", \"value\": \"2\" }, { \"name\": \"aquasecurity:trivy:ImageID\", \"value\": \"sha256:c059bfaa849c4d8e4aecaeb3a10c2d9b3d85f5165c66ad3a4d937758128c4d18\" }, { \"name\": \"aquasecurity:trivy:RepoDigest\", \"value\": \"alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300\" }, { \"name\": \"aquasecurity:trivy:DiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" }, { \"name\": \"aquasecurity:trivy:RepoTag\", \"value\": \"alpine:3.15\" } ] } }, \"components\": [ { \"bom-ref\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"type\": \"library\", \"name\": \"alpine-baselayout\", \"version\": \"3.2.0-r18\", \"licenses\": [ { \"expression\": \"GPL-2.0-only\" } ], \"purl\": \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"alpine-baselayout\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"3.2.0-r18\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, ...(snip)... { \"bom-ref\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"type\": \"library\", \"name\": \"zlib\", \"version\": \"1.2.11-r3\", \"licenses\": [ { \"expression\": \"Zlib\" } ], \"purl\": \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:SrcName\", \"value\": \"zlib\" }, { \"name\": \"aquasecurity:trivy:SrcVersion\", \"value\": \"1.2.11-r3\" }, { \"name\": \"aquasecurity:trivy:LayerDigest\", \"value\": \"sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3\" }, { \"name\": \"aquasecurity:trivy:LayerDiffID\", \"value\": \"sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759\" } ] }, { \"bom-ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"type\": \"operating-system\", \"name\": \"alpine\", \"version\": \"3.15.0\", \"properties\": [ { \"name\": \"aquasecurity:trivy:Type\", \"value\": \"alpine\" }, { \"name\": \"aquasecurity:trivy:Class\", \"value\": \"os-pkgs\" } ] } ], \"dependencies\": [ { \"ref\": \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\", \"dependsOn\": [ \"pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0\", \"pkg:apk/alpine/alpine-keys@2.4-r1?distro=3.15.0\", \"pkg:apk/alpine/apk-tools@2.12.7-r3?distro=3.15.0\", \"pkg:apk/alpine/busybox@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/ca-certificates-bundle@20191127-r7?distro=3.15.0\", \"pkg:apk/alpine/libc-utils@0.7.2-r3?distro=3.15.0\", \"pkg:apk/alpine/libcrypto1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/libretls@3.3.4-r2?distro=3.15.0\", \"pkg:apk/alpine/libssl1.1@1.1.1l-r7?distro=3.15.0\", \"pkg:apk/alpine/musl@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/musl-utils@1.2.2-r7?distro=3.15.0\", \"pkg:apk/alpine/scanelf@1.3.3-r0?distro=3.15.0\", \"pkg:apk/alpine/ssl_client@1.34.1-r3?distro=3.15.0\", \"pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0\" ] }, { \"ref\": \"pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64\", \"dependsOn\": [ \"3da6a469-964d-4b4e-b67d-e94ec7c88d37\" ] } ], \"vulnerabilities\": [ { \"id\": \"CVE-2021-42386\", \"source\": { \"name\": \"alpine\", \"url\": \"https://secdb.alpinelinux.org/\" }, \"ratings\": [ { \"source\": { \"name\": \"nvd\" }, \"score\": 7.2, \"severity\": \"high\", \"method\": \"CVSSv31\", \"vector\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\" }, { \"source\": { \"name\": \"nvd\" }, \"score\": 6.5, \"severity\": \"medium\", \"method\": \"CVSSv2\", \"vector\": \"AV:N/AC:L/Au:S/C:P/I:P/A:P\" }, { \"source\": { \"name\": \"redhat\" }, \"score\": 6.6, \"severity\": \"medium\", \"method\": \"CVSSv31\", \"vector\": \"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\" } ], \"cwes\": [ 416 ], \"description\": \"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function\", \"advisories\": [ { \"url\": \"https://access.redhat.com/security/cve/CVE-2021-42386\" }, { \"url\": \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42386\" } ], \"published\": \"2021-11-15 21:15:00 +0000 UTC\", \"updated\": \"2022-01-04 17:14:00 +0000 UTC\", \"affects\": [ { \"ref\": \"pkg:apk/alpine/busybox@1.33.1-r3?distro=3.14.2\" }, { \"ref\": \"pkg:apk/alpine/ssl_client@1.33.1-r3?distro=3.14.2\" } ] } ] } If you want to include vulnerabilities, you can enable vulnerability scanning via --scanners vuln . $ trivy image --scanners vuln --format cyclonedx --output result.json alpine:3.15","title":"CycloneDX"},{"location":"docs/supply-chain/sbom/#spdx","text":"Trivy can generate SBOM in the SPDX format. You can use the regular subcommands (like image , fs and rootfs ) and specify spdx with the --format option. $ trivy image --format spdx --output result.spdx alpine:3.15 Result $ cat result.spdx SPDXVersion: SPDX-2.2 DataLicense: CC0-1.0 SPDXID: SPDXRef-DOCUMENT DocumentName: alpine:3.15 DocumentNamespace: https://aquasecurity.github.io/trivy/container_image/alpine:3.15-bebf6b19-a94c-4e2c-af44-065f63923f48 Creator: Organization: aquasecurity Creator: Tool: trivy-0.38.1 Created: 2022-04-28T07:32:57.142806Z ##### Package: zlib PackageName: zlib SPDXID: SPDXRef-12bc938ac028a5e1 PackageVersion: 1.2.12-r0 FilesAnalyzed: false PackageLicenseConcluded: Zlib PackageLicenseDeclared: Zlib ##### Package: apk-tools PackageName: apk-tools SPDXID: SPDXRef-26c274652190d87f PackageVersion: 2.12.7-r3 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: libretls PackageName: libretls SPDXID: SPDXRef-2b021966d19a8211 PackageVersion: 3.3.4-r3 FilesAnalyzed: false PackageLicenseConcluded: ISC AND (BSD-3-Clause OR MIT) PackageLicenseDeclared: ISC AND (BSD-3-Clause OR MIT) ##### Package: busybox PackageName: busybox SPDXID: SPDXRef-317ce3476703f20d PackageVersion: 1.34.1-r5 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: libcrypto1.1 PackageName: libcrypto1.1 SPDXID: SPDXRef-34f407fb4dbd67f4 PackageVersion: 1.1.1n-r0 FilesAnalyzed: false PackageLicenseConcluded: OpenSSL PackageLicenseDeclared: OpenSSL ##### Package: libc-utils PackageName: libc-utils SPDXID: SPDXRef-4bbc1cb449d54083 PackageVersion: 0.7.2-r3 FilesAnalyzed: false PackageLicenseConcluded: BSD-2-Clause AND BSD-3-Clause PackageLicenseDeclared: BSD-2-Clause AND BSD-3-Clause ##### Package: alpine-keys PackageName: alpine-keys SPDXID: SPDXRef-a3bdd174be1456b6 PackageVersion: 2.4-r1 FilesAnalyzed: false PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT ##### Package: ca-certificates-bundle PackageName: ca-certificates-bundle SPDXID: SPDXRef-ac6472ba26fb991c PackageVersion: 20211220-r0 FilesAnalyzed: false PackageLicenseConcluded: MPL-2.0 AND MIT PackageLicenseDeclared: MPL-2.0 AND MIT ##### Package: libssl1.1 PackageName: libssl1.1 SPDXID: SPDXRef-b2d1b1d70fe90f7d PackageVersion: 1.1.1n-r0 FilesAnalyzed: false PackageLicenseConcluded: OpenSSL PackageLicenseDeclared: OpenSSL ##### Package: scanelf PackageName: scanelf SPDXID: SPDXRef-c617077ba6649520 PackageVersion: 1.3.3-r0 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: musl PackageName: musl SPDXID: SPDXRef-ca80b810029cde0e PackageVersion: 1.2.2-r7 FilesAnalyzed: false PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT ##### Package: alpine-baselayout PackageName: alpine-baselayout SPDXID: SPDXRef-d782e64751ba9faa PackageVersion: 3.2.0-r18 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only ##### Package: musl-utils PackageName: musl-utils SPDXID: SPDXRef-e5e8a237f6162e22 PackageVersion: 1.2.2-r7 FilesAnalyzed: false PackageLicenseConcluded: MIT BSD GPL2+ PackageLicenseDeclared: MIT BSD GPL2+ ##### Package: ssl_client PackageName: ssl_client SPDXID: SPDXRef-fdf0ce84f6337be4 PackageVersion: 1.34.1-r5 FilesAnalyzed: false PackageLicenseConcluded: GPL-2.0-only PackageLicenseDeclared: GPL-2.0-only SPDX-JSON format is also supported by using spdx-json with the --format option. $ trivy image --format spdx-json --output result.spdx.json alpine:3.15 Result $ cat result.spdx.json | jq . { \"SPDXID\": \"SPDXRef-DOCUMENT\", \"creationInfo\": { \"created\": \"2022-04-28T08:16:55.328255Z\", \"creators\": [ \"Tool: trivy-0.38.1\", \"Organization: aquasecurity\" ] }, \"dataLicense\": \"CC0-1.0\", \"documentNamespace\": \"http://aquasecurity.github.io/trivy/container_image/alpine:3.15-d9549e3a-a4c5-4ee3-8bde-8c78d451fbe7\", \"name\": \"alpine:3.15\", \"packages\": [ { \"SPDXID\": \"SPDXRef-12bc938ac028a5e1\", \"filesAnalyzed\": false, \"licenseConcluded\": \"Zlib\", \"licenseDeclared\": \"Zlib\", \"name\": \"zlib\", \"versionInfo\": \"1.2.12-r0\" }, { \"SPDXID\": \"SPDXRef-26c274652190d87f\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"apk-tools\", \"versionInfo\": \"2.12.7-r3\" }, { \"SPDXID\": \"SPDXRef-2b021966d19a8211\", \"filesAnalyzed\": false, \"licenseConcluded\": \"ISC AND (BSD-3-Clause OR MIT)\", \"licenseDeclared\": \"ISC AND (BSD-3-Clause OR MIT)\", \"name\": \"libretls\", \"versionInfo\": \"3.3.4-r3\" }, { \"SPDXID\": \"SPDXRef-317ce3476703f20d\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"busybox\", \"versionInfo\": \"1.34.1-r5\" }, { \"SPDXID\": \"SPDXRef-34f407fb4dbd67f4\", \"filesAnalyzed\": false, \"licenseConcluded\": \"OpenSSL\", \"licenseDeclared\": \"OpenSSL\", \"name\": \"libcrypto1.1\", \"versionInfo\": \"1.1.1n-r0\" }, { \"SPDXID\": \"SPDXRef-4bbc1cb449d54083\", \"filesAnalyzed\": false, \"licenseConcluded\": \"BSD-2-Clause AND BSD-3-Clause\", \"licenseDeclared\": \"BSD-2-Clause AND BSD-3-Clause\", \"name\": \"libc-utils\", \"versionInfo\": \"0.7.2-r3\" }, { \"SPDXID\": \"SPDXRef-a3bdd174be1456b6\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MIT\", \"licenseDeclared\": \"MIT\", \"name\": \"alpine-keys\", \"versionInfo\": \"2.4-r1\" }, { \"SPDXID\": \"SPDXRef-ac6472ba26fb991c\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MPL-2.0 AND MIT\", \"licenseDeclared\": \"MPL-2.0 AND MIT\", \"name\": \"ca-certificates-bundle\", \"versionInfo\": \"20211220-r0\" }, { \"SPDXID\": \"SPDXRef-b2d1b1d70fe90f7d\", \"filesAnalyzed\": false, \"licenseConcluded\": \"OpenSSL\", \"licenseDeclared\": \"OpenSSL\", \"name\": \"libssl1.1\", \"versionInfo\": \"1.1.1n-r0\" }, { \"SPDXID\": \"SPDXRef-c617077ba6649520\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"scanelf\", \"versionInfo\": \"1.3.3-r0\" }, { \"SPDXID\": \"SPDXRef-ca80b810029cde0e\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MIT\", \"licenseDeclared\": \"MIT\", \"name\": \"musl\", \"versionInfo\": \"1.2.2-r7\" }, { \"SPDXID\": \"SPDXRef-d782e64751ba9faa\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"alpine-baselayout\", \"versionInfo\": \"3.2.0-r18\" }, { \"SPDXID\": \"SPDXRef-e5e8a237f6162e22\", \"filesAnalyzed\": false, \"licenseConcluded\": \"MIT BSD GPL2+\", \"licenseDeclared\": \"MIT BSD GPL2+\", \"name\": \"musl-utils\", \"versionInfo\": \"1.2.2-r7\" }, { \"SPDXID\": \"SPDXRef-fdf0ce84f6337be4\", \"filesAnalyzed\": false, \"licenseConcluded\": \"GPL-2.0-only\", \"licenseDeclared\": \"GPL-2.0-only\", \"name\": \"ssl_client\", \"versionInfo\": \"1.34.1-r5\" } ], \"spdxVersion\": \"SPDX-2.2\" }","title":"SPDX"},{"location":"docs/supply-chain/sbom/#scanning","text":"Trivy can take SBOM documents as input for scanning. See here for more details. Also, Trivy searches for SBOM files in container images. $ trivy image bitnami/elasticsearch:8.7.1 For example, Bitnami images contain SBOM files in /opt/bitnami directory. Trivy automatically detects the SBOM files and uses them for scanning. It is enabled in the following targets. Target Enabled Container Image \u2713 Filesystem Rootfs \u2713 Git Repository VM Image \u2713 Kubernetes AWS SBOM","title":"Scanning"},{"location":"docs/supply-chain/vex/","text":"Vulnerability Exploitability Exchange (VEX) EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy supports filtering detected vulnerabilities using the Vulnerability Exploitability Exchange (VEX) , a standardized format for sharing and exchanging information about vulnerabilities. By providing VEX alongside the Software Bill of Materials (SBOM) during scanning, it is possible to filter vulnerabilities based on their status. Currently, Trivy supports the following two formats: CycloneDX OpenVEX This is still an experimental implementation, with only minimal functionality added. CycloneDX There are two VEX formats for CycloneDX: Independent BOM and VEX BOM BOM With Embedded VEX Trivy only supports the Independent BOM and VEX BOM format, so you need to provide a separate VEX file alongside the SBOM. The input SBOM format must be in CycloneDX format. The following steps are required: Generate a CycloneDX SBOM Create a VEX based on the SBOM generated in step 1 Provide the VEX when scanning the CycloneDX SBOM Generating the SBOM You can generate a CycloneDX SBOM with Trivy as follows: $ trivy image --format cyclonedx --output debian11.sbom.cdx debian:11 Create the VEX Next, create a VEX based on the generated SBOM. Multiple vulnerability statuses can be defined under vulnerabilities . Take a look at the example below. $ cat <<EOF > trivy.vex.cdx { \"bomFormat\": \"CycloneDX\", \"specVersion\": \"1.5\", \"version\": 1, \"vulnerabilities\": [ { \"id\": \"CVE-2020-8911\", \"analysis\": { \"state\": \"not_affected\", \"justification\": \"code_not_reachable\", \"response\": [\"will_not_fix\", \"update\"], \"detail\": \"The vulnerable function is not called\" }, \"affects\": [ { \"ref\": \"urn:cdx:3e671687-395b-41f5-a30f-a58921a69b79/1#pkg:golang/github.com/aws/aws-sdk-go@1.44.234\" } ] } ] } EOF This is a VEX document in the CycloneDX format. The vulnerability ID, such as a CVE-ID or GHSA-ID, should be placed in vulnerabilities.id . When the analysis.state is set to not_affected , Trivy will not detect the vulnerability. BOM-Links must be placed in affects.ref . The BOM-Link has the following syntax and consists of three elements: urn:cdx:serialNumber/version#bom-ref serialNumber version bom-ref These values must be obtained from the CycloneDX SBOM. Please note that while the serialNumber starts with urn:uuid: , the BOM-Link starts with urn:cdx: . The bom-ref must contain the BOM-Ref of the package affected by the vulnerability. In the example above, since the Go package github.com/aws/aws-sdk-go is affected by CVE-2020-8911, it was necessary to specify the SBOM's BOM-Ref, pkg:golang/github.com/aws/aws-sdk-go@1.44.234 . For more details on CycloneDX VEX and BOM-Link, please refer to the following links: CycloneDX VEX BOM-Link Examples Scan SBOM with VEX Provide the VEX when scanning the CycloneDX SBOM. $ trivy sbom trivy.sbom.cdx --vex trivy.vex.cdx ... 2023-04-13T12:55:44.838+0300 INFO Filtered out the detected vulnerability {\"VEX format\": \"CycloneDX\", \"vulnerability-id\": \"CVE-2020-8911\", \"status\": \"not_affected\", \"justification\": \"code_not_reachable\"} go.mod (gomod) ============== Total: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 github.com/aws/aws-sdk-go \u2502 CVE-2020-8912 \u2502 LOW \u2502 1.44.234 \u2502 \u2502 aws-sdk-go: In-band key negotiation issue in AWS S3 Crypto \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 SDK for golang... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2020-8912 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 CVE-2020-8911 is no longer shown as it is filtered out according to the given CycloneDX VEX document. OpenVEX Trivy also supports OpenVEX that is designed to be minimal, compliant, interoperable, and embeddable. Since OpenVEX aims to be SBOM format agnostic, both CycloneDX and SPDX formats are available for use as input SBOMs in Trivy. The following steps are required: Generate a SBOM (CycloneDX or SPDX) Create a VEX based on the SBOM generated in step 1 Provide the VEX when scanning the SBOM Generating the SBOM You can generate a CycloneDX or SPDX SBOM with Trivy as follows: $ trivy image --format spdx-json --output debian11.spdx.json debian:11 Create the VEX Please see also the example . In Trivy, the Package URL (PURL) is used as the product identifier. $ cat <<EOF > debian11.openvex { \"@context\": \"https://openvex.dev/ns/v0.2.0\", \"@id\": \"https://openvex.dev/docs/public/vex-2e67563e128250cbcb3e98930df948dd053e43271d70dc50cfa22d57e03fe96f\", \"author\": \"Aqua Security\", \"timestamp\": \"2023-08-29T19:07:16.853479631-06:00\", \"version\": 1, \"statements\": [ { \"vulnerability\": {\"name\": \"CVE-2019-8457\"}, \"products\": [ {\"@id\": \"pkg:deb/debian/libdb5.3@5.3.28+dfsg1-0.8\"} ], \"status\": \"not_affected\", \"justification\": \"vulnerable_code_not_in_execute_path\" } ] } EOF In the above example, PURLs, located in packages.externalRefs.referenceLocator in SPDX are used for the product identifier. Note If a qualifier is specified in the PURL used as the product id in the VEX, the qualifier is compared. Other qualifiers are ignored in the comparison. pkg:deb/debian/curl@7.50.3-1 in OpenVEX matches pkg:deb/debian/curl@7.50.3-1?arch=i386 , while pkg:deb/debian/curl@7.50.3-1?arch=amd64 does not match pkg:deb/debian/curl@7.50.3-1?arch=i386 . Scan SBOM with VEX Provide the VEX when scanning the SBOM. $ trivy sbom debian11.spdx.json --vex debian11.openvex ... 2023-04-26T17:56:05.358+0300 INFO Filtered out the detected vulnerability {\"VEX format\": \"OpenVEX\", \"vulnerability-id\": \"CVE-2019-8457\", \"status\": \"not_affected\", \"justification\": \"vulnerable_code_not_in_execute_path\"} debian11.spdx.json (debian 11.6) ================================ Total: 80 (UNKNOWN: 0, LOW: 58, MEDIUM: 6, HIGH: 16, CRITICAL: 0) CVE-2019-8457 is no longer shown as it is filtered out according to the given OpenVEX document.","title":"VEX"},{"location":"docs/supply-chain/vex/#vulnerability-exploitability-exchange-vex","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy supports filtering detected vulnerabilities using the Vulnerability Exploitability Exchange (VEX) , a standardized format for sharing and exchanging information about vulnerabilities. By providing VEX alongside the Software Bill of Materials (SBOM) during scanning, it is possible to filter vulnerabilities based on their status. Currently, Trivy supports the following two formats: CycloneDX OpenVEX This is still an experimental implementation, with only minimal functionality added.","title":"Vulnerability Exploitability Exchange (VEX)"},{"location":"docs/supply-chain/vex/#cyclonedx","text":"There are two VEX formats for CycloneDX: Independent BOM and VEX BOM BOM With Embedded VEX Trivy only supports the Independent BOM and VEX BOM format, so you need to provide a separate VEX file alongside the SBOM. The input SBOM format must be in CycloneDX format. The following steps are required: Generate a CycloneDX SBOM Create a VEX based on the SBOM generated in step 1 Provide the VEX when scanning the CycloneDX SBOM","title":"CycloneDX"},{"location":"docs/supply-chain/vex/#generating-the-sbom","text":"You can generate a CycloneDX SBOM with Trivy as follows: $ trivy image --format cyclonedx --output debian11.sbom.cdx debian:11","title":"Generating the SBOM"},{"location":"docs/supply-chain/vex/#create-the-vex","text":"Next, create a VEX based on the generated SBOM. Multiple vulnerability statuses can be defined under vulnerabilities . Take a look at the example below. $ cat <<EOF > trivy.vex.cdx { \"bomFormat\": \"CycloneDX\", \"specVersion\": \"1.5\", \"version\": 1, \"vulnerabilities\": [ { \"id\": \"CVE-2020-8911\", \"analysis\": { \"state\": \"not_affected\", \"justification\": \"code_not_reachable\", \"response\": [\"will_not_fix\", \"update\"], \"detail\": \"The vulnerable function is not called\" }, \"affects\": [ { \"ref\": \"urn:cdx:3e671687-395b-41f5-a30f-a58921a69b79/1#pkg:golang/github.com/aws/aws-sdk-go@1.44.234\" } ] } ] } EOF This is a VEX document in the CycloneDX format. The vulnerability ID, such as a CVE-ID or GHSA-ID, should be placed in vulnerabilities.id . When the analysis.state is set to not_affected , Trivy will not detect the vulnerability. BOM-Links must be placed in affects.ref . The BOM-Link has the following syntax and consists of three elements: urn:cdx:serialNumber/version#bom-ref serialNumber version bom-ref These values must be obtained from the CycloneDX SBOM. Please note that while the serialNumber starts with urn:uuid: , the BOM-Link starts with urn:cdx: . The bom-ref must contain the BOM-Ref of the package affected by the vulnerability. In the example above, since the Go package github.com/aws/aws-sdk-go is affected by CVE-2020-8911, it was necessary to specify the SBOM's BOM-Ref, pkg:golang/github.com/aws/aws-sdk-go@1.44.234 . For more details on CycloneDX VEX and BOM-Link, please refer to the following links: CycloneDX VEX BOM-Link Examples","title":"Create the VEX"},{"location":"docs/supply-chain/vex/#scan-sbom-with-vex","text":"Provide the VEX when scanning the CycloneDX SBOM. $ trivy sbom trivy.sbom.cdx --vex trivy.vex.cdx ... 2023-04-13T12:55:44.838+0300 INFO Filtered out the detected vulnerability {\"VEX format\": \"CycloneDX\", \"vulnerability-id\": \"CVE-2020-8911\", \"status\": \"not_affected\", \"justification\": \"code_not_reachable\"} go.mod (gomod) ============== Total: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 github.com/aws/aws-sdk-go \u2502 CVE-2020-8912 \u2502 LOW \u2502 1.44.234 \u2502 \u2502 aws-sdk-go: In-band key negotiation issue in AWS S3 Crypto \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 SDK for golang... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2020-8912 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 CVE-2020-8911 is no longer shown as it is filtered out according to the given CycloneDX VEX document.","title":"Scan SBOM with VEX"},{"location":"docs/supply-chain/vex/#openvex","text":"Trivy also supports OpenVEX that is designed to be minimal, compliant, interoperable, and embeddable. Since OpenVEX aims to be SBOM format agnostic, both CycloneDX and SPDX formats are available for use as input SBOMs in Trivy. The following steps are required: Generate a SBOM (CycloneDX or SPDX) Create a VEX based on the SBOM generated in step 1 Provide the VEX when scanning the SBOM","title":"OpenVEX"},{"location":"docs/supply-chain/vex/#generating-the-sbom_1","text":"You can generate a CycloneDX or SPDX SBOM with Trivy as follows: $ trivy image --format spdx-json --output debian11.spdx.json debian:11","title":"Generating the SBOM"},{"location":"docs/supply-chain/vex/#create-the-vex_1","text":"Please see also the example . In Trivy, the Package URL (PURL) is used as the product identifier. $ cat <<EOF > debian11.openvex { \"@context\": \"https://openvex.dev/ns/v0.2.0\", \"@id\": \"https://openvex.dev/docs/public/vex-2e67563e128250cbcb3e98930df948dd053e43271d70dc50cfa22d57e03fe96f\", \"author\": \"Aqua Security\", \"timestamp\": \"2023-08-29T19:07:16.853479631-06:00\", \"version\": 1, \"statements\": [ { \"vulnerability\": {\"name\": \"CVE-2019-8457\"}, \"products\": [ {\"@id\": \"pkg:deb/debian/libdb5.3@5.3.28+dfsg1-0.8\"} ], \"status\": \"not_affected\", \"justification\": \"vulnerable_code_not_in_execute_path\" } ] } EOF In the above example, PURLs, located in packages.externalRefs.referenceLocator in SPDX are used for the product identifier. Note If a qualifier is specified in the PURL used as the product id in the VEX, the qualifier is compared. Other qualifiers are ignored in the comparison. pkg:deb/debian/curl@7.50.3-1 in OpenVEX matches pkg:deb/debian/curl@7.50.3-1?arch=i386 , while pkg:deb/debian/curl@7.50.3-1?arch=amd64 does not match pkg:deb/debian/curl@7.50.3-1?arch=i386 .","title":"Create the VEX"},{"location":"docs/supply-chain/vex/#scan-sbom-with-vex_1","text":"Provide the VEX when scanning the SBOM. $ trivy sbom debian11.spdx.json --vex debian11.openvex ... 2023-04-26T17:56:05.358+0300 INFO Filtered out the detected vulnerability {\"VEX format\": \"OpenVEX\", \"vulnerability-id\": \"CVE-2019-8457\", \"status\": \"not_affected\", \"justification\": \"vulnerable_code_not_in_execute_path\"} debian11.spdx.json (debian 11.6) ================================ Total: 80 (UNKNOWN: 0, LOW: 58, MEDIUM: 6, HIGH: 16, CRITICAL: 0) CVE-2019-8457 is no longer shown as it is filtered out according to the given OpenVEX document.","title":"Scan SBOM with VEX"},{"location":"docs/supply-chain/attestation/rekor/","text":"Scan SBOM attestation in Rekor EXPERIMENTAL This feature might change without preserving backwards compatibility. Container images Trivy can retrieve SBOM attestation of the specified container image in the Rekor instance and scan it for vulnerabilities. Prerequisites SBOM attestation stored in Rekor See the \"Keyless signing\" section if you want to upload your SBOM attestation to Rekor. Scanning You need to pass --sbom-sources rekor so that Trivy will look for SBOM attestation in Rekor. Note --sbom-sources can be used only with trivy image at the moment. $ trivy image --sbom-sources rekor otms61/alpine:3.7.3 [ ~/src/github.com/aquasecurity/trivy ] 2022 -09-16T17:37:13.258+0900 INFO Vulnerability scanning is enabled 2022 -09-16T17:37:13.258+0900 INFO Secret scanning is enabled 2022 -09-16T17:37:13.258+0900 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2022 -09-16T17:37:13.258+0900 INFO Please see also https://aquasecurity.github.io/trivy/dev/docs/secret/scanning/#recommendation for faster secret detection 2022 -09-16T17:37:14.827+0900 INFO Detected SBOM format: cyclonedx-json 2022 -09-16T17:37:14.901+0900 INFO Found SBOM ( cyclonedx ) attestation in Rekor 2022 -09-16T17:37:14.903+0900 INFO Detected OS: alpine 2022 -09-16T17:37:14.903+0900 INFO Detecting Alpine vulnerabilities... 2022 -09-16T17:37:14.907+0900 INFO Number of language-specific files: 0 2022 -09-16T17:37:14.908+0900 WARN This OS version is no longer supported by the distribution: alpine 3 .7.3 2022 -09-16T17:37:14.908+0900 WARN The vulnerability detection may be insufficient because security updates are not provided otms61/alpine:3.7.3 ( alpine 3 .7.3 ) ================================== Total: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 musl \u2502 CVE-2019-14697 \u2502 CRITICAL \u2502 1 .1.18-r3 \u2502 1 .1.18-r4 \u2502 musl libc through 1 .1.23 has an x87 floating-point stack \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 adjustment im ...... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-14697 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 If you have your own Rekor instance, you can specify the URL via --rekor-url . $ trivy image --sbom-sources rekor --rekor-url https://my-rekor.dev otms61/alpine:3.7.3 Non-packaged binaries Trivy can retrieve SBOM attestation of non-packaged binaries in the Rekor instance and scan it for vulnerabilities. Prerequisites SBOM attestation stored in Rekor See the \"Keyless signing\" section if you want to upload your SBOM attestation to Rekor. Cosign currently does not support keyless signing for blob attestation, so use our plugin at the moment. This example uses a cat clone bat written in Rust. You need to generate SBOM from lock files like Cargo.lock at first. $ git clone -b v0.20.0 https://github.com/sharkdp/bat $ trivy fs --format cyclonedx --output bat.cdx ./bat/Cargo.lock Then our attestation plugin allows you to store the SBOM attestation linking to a bat binary in the Rekor instance. $ wget https://github.com/sharkdp/bat/releases/download/v0.20.0/bat-v0.20.0-x86_64-apple-darwin.tar.gz $ tar xvf bat-v0.20.0-x86_64-apple-darwin.tar.gz $ trivy plugin install github.com/aquasecurity/trivy-plugin-attest $ trivy attest --predicate ./bat.cdx --type cyclonedx ./bat-v0.20.0-x86_64-apple-darwin/bat Note The public instance of the Rekor maintained by the Sigstore team limits the attestation size. If you are using the public instance, please make sure that your SBOM is small enough. To get more detail, please refer to the Rekor project's documentation . Scan a non-packaged binary Trivy calculates the digest of the bat binary and searches for the SBOM attestation by the digest in Rekor. If it is found, Trivy uses that for vulnerability scanning. $ trivy fs --sbom-sources rekor ./bat-v0.20.0-x86_64-apple-darwin/bat 2022 -10-25T13:27:25.950+0300 INFO Found SBOM attestation in Rekor: bat 2022 -10-25T13:27:25.993+0300 INFO Number of language-specific files: 1 2022 -10-25T13:27:25.993+0300 INFO Detecting cargo vulnerabilities... bat ( cargo ) =========== Total: 1 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 1 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 regex \u2502 CVE-2022-24713 \u2502 HIGH \u2502 1 .5.4 \u2502 1 .5.5 \u2502 Mozilla: Denial of Service via complex regular expressions \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-24713 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Also, it is applied to non-packaged binaries even in container images. $ trivy image --sbom-sources rekor --scanners vuln alpine-with-bat 2022 -10-25T13:40:14.920+0300 INFO Vulnerability scanning is enabled 2022 -10-25T13:40:18.047+0300 INFO Found SBOM attestation in Rekor: bat 2022 -10-25T13:40:18.186+0300 INFO Detected OS: alpine 2022 -10-25T13:40:18.186+0300 INFO Detecting Alpine vulnerabilities... 2022 -10-25T13:40:18.199+0300 INFO Number of language-specific files: 1 2022 -10-25T13:40:18.199+0300 INFO Detecting cargo vulnerabilities... alpine-with-bat ( alpine 3 .15.6 ) =============================== Total: 0 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 ) bat ( cargo ) =========== Total: 4 ( UNKNOWN: 3 , LOW: 0 , MEDIUM: 0 , HIGH: 1 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 regex \u2502 CVE-2022-24713 \u2502 HIGH \u2502 1 .5.4 \u2502 1 .5.5 \u2502 Mozilla: Denial of Service via complex regular expressions \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-24713 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Note The --sbom-sources rekor flag slows down the scanning as it queries Rekor on the Internet for all non-packaged binaries.","title":"SBOM Attestation in Rekor"},{"location":"docs/supply-chain/attestation/rekor/#scan-sbom-attestation-in-rekor","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility.","title":"Scan SBOM attestation in Rekor"},{"location":"docs/supply-chain/attestation/rekor/#container-images","text":"Trivy can retrieve SBOM attestation of the specified container image in the Rekor instance and scan it for vulnerabilities.","title":"Container images"},{"location":"docs/supply-chain/attestation/rekor/#prerequisites","text":"SBOM attestation stored in Rekor See the \"Keyless signing\" section if you want to upload your SBOM attestation to Rekor.","title":"Prerequisites"},{"location":"docs/supply-chain/attestation/rekor/#scanning","text":"You need to pass --sbom-sources rekor so that Trivy will look for SBOM attestation in Rekor. Note --sbom-sources can be used only with trivy image at the moment. $ trivy image --sbom-sources rekor otms61/alpine:3.7.3 [ ~/src/github.com/aquasecurity/trivy ] 2022 -09-16T17:37:13.258+0900 INFO Vulnerability scanning is enabled 2022 -09-16T17:37:13.258+0900 INFO Secret scanning is enabled 2022 -09-16T17:37:13.258+0900 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2022 -09-16T17:37:13.258+0900 INFO Please see also https://aquasecurity.github.io/trivy/dev/docs/secret/scanning/#recommendation for faster secret detection 2022 -09-16T17:37:14.827+0900 INFO Detected SBOM format: cyclonedx-json 2022 -09-16T17:37:14.901+0900 INFO Found SBOM ( cyclonedx ) attestation in Rekor 2022 -09-16T17:37:14.903+0900 INFO Detected OS: alpine 2022 -09-16T17:37:14.903+0900 INFO Detecting Alpine vulnerabilities... 2022 -09-16T17:37:14.907+0900 INFO Number of language-specific files: 0 2022 -09-16T17:37:14.908+0900 WARN This OS version is no longer supported by the distribution: alpine 3 .7.3 2022 -09-16T17:37:14.908+0900 WARN The vulnerability detection may be insufficient because security updates are not provided otms61/alpine:3.7.3 ( alpine 3 .7.3 ) ================================== Total: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 musl \u2502 CVE-2019-14697 \u2502 CRITICAL \u2502 1 .1.18-r3 \u2502 1 .1.18-r4 \u2502 musl libc through 1 .1.23 has an x87 floating-point stack \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 adjustment im ...... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-14697 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 If you have your own Rekor instance, you can specify the URL via --rekor-url . $ trivy image --sbom-sources rekor --rekor-url https://my-rekor.dev otms61/alpine:3.7.3","title":"Scanning"},{"location":"docs/supply-chain/attestation/rekor/#non-packaged-binaries","text":"Trivy can retrieve SBOM attestation of non-packaged binaries in the Rekor instance and scan it for vulnerabilities.","title":"Non-packaged binaries"},{"location":"docs/supply-chain/attestation/rekor/#prerequisites_1","text":"SBOM attestation stored in Rekor See the \"Keyless signing\" section if you want to upload your SBOM attestation to Rekor. Cosign currently does not support keyless signing for blob attestation, so use our plugin at the moment. This example uses a cat clone bat written in Rust. You need to generate SBOM from lock files like Cargo.lock at first. $ git clone -b v0.20.0 https://github.com/sharkdp/bat $ trivy fs --format cyclonedx --output bat.cdx ./bat/Cargo.lock Then our attestation plugin allows you to store the SBOM attestation linking to a bat binary in the Rekor instance. $ wget https://github.com/sharkdp/bat/releases/download/v0.20.0/bat-v0.20.0-x86_64-apple-darwin.tar.gz $ tar xvf bat-v0.20.0-x86_64-apple-darwin.tar.gz $ trivy plugin install github.com/aquasecurity/trivy-plugin-attest $ trivy attest --predicate ./bat.cdx --type cyclonedx ./bat-v0.20.0-x86_64-apple-darwin/bat Note The public instance of the Rekor maintained by the Sigstore team limits the attestation size. If you are using the public instance, please make sure that your SBOM is small enough. To get more detail, please refer to the Rekor project's documentation .","title":"Prerequisites"},{"location":"docs/supply-chain/attestation/rekor/#scan-a-non-packaged-binary","text":"Trivy calculates the digest of the bat binary and searches for the SBOM attestation by the digest in Rekor. If it is found, Trivy uses that for vulnerability scanning. $ trivy fs --sbom-sources rekor ./bat-v0.20.0-x86_64-apple-darwin/bat 2022 -10-25T13:27:25.950+0300 INFO Found SBOM attestation in Rekor: bat 2022 -10-25T13:27:25.993+0300 INFO Number of language-specific files: 1 2022 -10-25T13:27:25.993+0300 INFO Detecting cargo vulnerabilities... bat ( cargo ) =========== Total: 1 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 1 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 regex \u2502 CVE-2022-24713 \u2502 HIGH \u2502 1 .5.4 \u2502 1 .5.5 \u2502 Mozilla: Denial of Service via complex regular expressions \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-24713 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Also, it is applied to non-packaged binaries even in container images. $ trivy image --sbom-sources rekor --scanners vuln alpine-with-bat 2022 -10-25T13:40:14.920+0300 INFO Vulnerability scanning is enabled 2022 -10-25T13:40:18.047+0300 INFO Found SBOM attestation in Rekor: bat 2022 -10-25T13:40:18.186+0300 INFO Detected OS: alpine 2022 -10-25T13:40:18.186+0300 INFO Detecting Alpine vulnerabilities... 2022 -10-25T13:40:18.199+0300 INFO Number of language-specific files: 1 2022 -10-25T13:40:18.199+0300 INFO Detecting cargo vulnerabilities... alpine-with-bat ( alpine 3 .15.6 ) =============================== Total: 0 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 0 ) bat ( cargo ) =========== Total: 4 ( UNKNOWN: 3 , LOW: 0 , MEDIUM: 0 , HIGH: 1 , CRITICAL: 0 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 regex \u2502 CVE-2022-24713 \u2502 HIGH \u2502 1 .5.4 \u2502 1 .5.5 \u2502 Mozilla: Denial of Service via complex regular expressions \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-24713 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Note The --sbom-sources rekor flag slows down the scanning as it queries Rekor on the Internet for all non-packaged binaries.","title":"Scan a non-packaged binary"},{"location":"docs/supply-chain/attestation/sbom/","text":"SBOM attestation Cosign supports generating and verifying in-toto attestations . This tool enables you to sign and verify SBOM attestation. And, Trivy can take an SBOM attestation as input and scan for vulnerabilities Note In the following examples, the cosign command will write an attestation to a target OCI registry, so you must have permission to write. If you want to avoid writing an OCI registry and only want to see an attestation, add the --no-upload option to the cosign command. Sign with a local key pair Cosign can generate key pairs and use them for signing and verification. After you run the following command, you will get a public and private key pair. Read more about how to generate key pairs . $ cosign generate-key-pair In the following example, Trivy generates an SBOM in the CycloneDX format, and then Cosign attaches an attestation of the SBOM to a container image with a local key pair. # The cyclonedx type is supported in Cosign v1.10.0 or later. $ trivy image --format cyclonedx -o sbom.cdx.json <IMAGE> $ cosign attest --key /path/to/cosign.key --type cyclonedx --predicate sbom.cdx.json <IMAGE> Then, you can verify attestations on the image. $ cosign verify-attestation --key /path/to/cosign.pub --type cyclonedx <IMAGE> You can also create attestations of other formatted SBOM. # spdx $ trivy image --format spdx -o sbom.spdx <IMAGE> $ cosign attest --key /path/to/cosign.key --type spdx --predicate sbom.spdx <IMAGE> # spdx-json $ trivy image --format spdx-json -o sbom.spdx.json <IMAGE> $ cosign attest --key /path/to/cosign.key --type spdx --predicate sbom.spdx.json <IMAGE> Keyless signing You can use Cosign to sign without keys by authenticating with an OpenID Connect protocol supported by sigstore (Google, GitHub, or Microsoft). # The cyclonedx type is supported in Cosign v1.10.0 or later. $ trivy image --format cyclonedx -o sbom.cdx.json <IMAGE> # The following command uploads SBOM attestation to the public Rekor instance. $ COSIGN_EXPERIMENTAL = 1 cosign attest --type cyclonedx --predicate sbom.cdx.json <IMAGE> You can verify attestations. $ COSIGN_EXPERIMENTAL = 1 cosign verify-attestation --type cyclonedx <IMAGE> Scanning Trivy can take an SBOM attestation as input and scan for vulnerabilities. Currently, Trivy supports CycloneDX-type attestation. In the following example, Cosign can get an CycloneDX-type attestation and trivy scan it. You must create CycloneDX-type attestation before trying the example. To learn more about how to create an CycloneDX-Type attestation and attach it to an image, see the Sign with a local key pair section. $ cosign verify-attestation --key /path/to/cosign.pub --type cyclonedx <IMAGE> > sbom.cdx.intoto.jsonl $ trivy sbom ./sbom.cdx.intoto.jsonl sbom.cdx.intoto.jsonl ( alpine 3 .7.3 ) ========================= Total: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 musl \u2502 CVE-2019-14697 \u2502 CRITICAL \u2502 1 .1.18-r3 \u2502 1 .1.18-r4 \u2502 musl libc through 1 .1.23 has an x87 floating-point stack \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 adjustment im ...... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-14697 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"SBOM"},{"location":"docs/supply-chain/attestation/sbom/#sbom-attestation","text":"Cosign supports generating and verifying in-toto attestations . This tool enables you to sign and verify SBOM attestation. And, Trivy can take an SBOM attestation as input and scan for vulnerabilities Note In the following examples, the cosign command will write an attestation to a target OCI registry, so you must have permission to write. If you want to avoid writing an OCI registry and only want to see an attestation, add the --no-upload option to the cosign command.","title":"SBOM attestation"},{"location":"docs/supply-chain/attestation/sbom/#sign-with-a-local-key-pair","text":"Cosign can generate key pairs and use them for signing and verification. After you run the following command, you will get a public and private key pair. Read more about how to generate key pairs . $ cosign generate-key-pair In the following example, Trivy generates an SBOM in the CycloneDX format, and then Cosign attaches an attestation of the SBOM to a container image with a local key pair. # The cyclonedx type is supported in Cosign v1.10.0 or later. $ trivy image --format cyclonedx -o sbom.cdx.json <IMAGE> $ cosign attest --key /path/to/cosign.key --type cyclonedx --predicate sbom.cdx.json <IMAGE> Then, you can verify attestations on the image. $ cosign verify-attestation --key /path/to/cosign.pub --type cyclonedx <IMAGE> You can also create attestations of other formatted SBOM. # spdx $ trivy image --format spdx -o sbom.spdx <IMAGE> $ cosign attest --key /path/to/cosign.key --type spdx --predicate sbom.spdx <IMAGE> # spdx-json $ trivy image --format spdx-json -o sbom.spdx.json <IMAGE> $ cosign attest --key /path/to/cosign.key --type spdx --predicate sbom.spdx.json <IMAGE>","title":"Sign with a local key pair"},{"location":"docs/supply-chain/attestation/sbom/#keyless-signing","text":"You can use Cosign to sign without keys by authenticating with an OpenID Connect protocol supported by sigstore (Google, GitHub, or Microsoft). # The cyclonedx type is supported in Cosign v1.10.0 or later. $ trivy image --format cyclonedx -o sbom.cdx.json <IMAGE> # The following command uploads SBOM attestation to the public Rekor instance. $ COSIGN_EXPERIMENTAL = 1 cosign attest --type cyclonedx --predicate sbom.cdx.json <IMAGE> You can verify attestations. $ COSIGN_EXPERIMENTAL = 1 cosign verify-attestation --type cyclonedx <IMAGE>","title":"Keyless signing"},{"location":"docs/supply-chain/attestation/sbom/#scanning","text":"Trivy can take an SBOM attestation as input and scan for vulnerabilities. Currently, Trivy supports CycloneDX-type attestation. In the following example, Cosign can get an CycloneDX-type attestation and trivy scan it. You must create CycloneDX-type attestation before trying the example. To learn more about how to create an CycloneDX-Type attestation and attach it to an image, see the Sign with a local key pair section. $ cosign verify-attestation --key /path/to/cosign.pub --type cyclonedx <IMAGE> > sbom.cdx.intoto.jsonl $ trivy sbom ./sbom.cdx.intoto.jsonl sbom.cdx.intoto.jsonl ( alpine 3 .7.3 ) ========================= Total: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 musl \u2502 CVE-2019-14697 \u2502 CRITICAL \u2502 1 .1.18-r3 \u2502 1 .1.18-r4 \u2502 musl libc through 1 .1.23 has an x87 floating-point stack \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 adjustment im ...... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-14697 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"Scanning"},{"location":"docs/supply-chain/attestation/vuln/","text":"Cosign Vulnerability Attestation Generate Cosign Vulnerability Scan Record Trivy generates reports in the Cosign vulnerability scan record format . You can use the regular subcommands (like image, fs and rootfs) and specify cosign-vuln with the --format option. $ trivy image --format cosign-vuln --output vuln.json alpine:3.10 Result { \"invocation\" : { \"parameters\" : null , \"uri\" : \"\" , \"event_id\" : \"\" , \"builder.id\" : \"\" }, \"scanner\" : { \"uri\" : \"pkg:github/aquasecurity/trivy@v0.30.1-8-gf9cb8a28\" , \"version\" : \"v0.30.1-8-gf9cb8a28\" , \"db\" : { \"uri\" : \"\" , \"version\" : \"\" }, \"result\" : { \"SchemaVersion\" : 2 , \"ArtifactName\" : \"alpine:3.10\" , \"ArtifactType\" : \"container_image\" , \"Metadata\" : { \"OS\" : { \"Family\" : \"alpine\" , \"Name\" : \"3.10.9\" , \"EOSL\" : true }, \"ImageID\" : \"sha256:e7b300aee9f9bf3433d32bc9305bfdd22183beb59d933b48d77ab56ba53a197a\" , \"DiffIDs\" : [ \"sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635\" ], \"RepoTags\" : [ \"alpine:3.10\" ], \"RepoDigests\" : [ \"alpine@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98\" ], \"ImageConfig\" : { \"architecture\" : \"amd64\" , \"container\" : \"fdb7e80e3339e8d0599282e606c907aa5881ee4c668a68136119e6dfac6ce3a4\" , \"created\" : \"2021-04-14T19:20:05.338397761Z\" , \"docker_version\" : \"19.03.12\" , \"history\" : [ { \"created\" : \"2021-04-14T19:20:04.987219124Z\" , \"created_by\" : \"/bin/sh -c #(nop) ADD file:c5377eaa926bf412dd8d4a08b0a1f2399cfd708743533b0aa03b53d14cb4bb4e in / \" }, { \"created\" : \"2021-04-14T19:20:05.338397761Z\" , \"created_by\" : \"/bin/sh -c #(nop) CMD [\\\"/bin/sh\\\"]\" , \"empty_layer\" : true } ], \"os\" : \"linux\" , \"rootfs\" : { \"type\" : \"layers\" , \"diff_ids\" : [ \"sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635\" ] }, \"config\" : { \"Cmd\" : [ \"/bin/sh\" ], \"Env\" : [ \"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\" ], \"Image\" : \"sha256:eb2080c455e94c22ae35b3aef9e078c492a00795412e026e4d6b41ef64bc7dd8\" } } }, \"Results\" : [ { \"Target\" : \"alpine:3.10 (alpine 3.10.9)\" , \"Class\" : \"os-pkgs\" , \"Type\" : \"alpine\" , \"Vulnerabilities\" : [ { \"VulnerabilityID\" : \"CVE-2021-36159\" , \"PkgName\" : \"apk-tools\" , \"InstalledVersion\" : \"2.10.6-r0\" , \"FixedVersion\" : \"2.10.7-r0\" , \"Layer\" : { \"Digest\" : \"sha256:396c31837116ac290458afcb928f68b6cc1c7bdd6963fc72f52f365a2a89c1b5\" , \"DiffID\" : \"sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635\" }, \"SeveritySource\" : \"nvd\" , \"PrimaryURL\" : \"https://avd.aquasec.com/nvd/cve-2021-36159\" , \"DataSource\" : { \"ID\" : \"alpine\" , \"Name\" : \"Alpine Secdb\" , \"URL\" : \"https://secdb.alpinelinux.org/\" }, \"Description\" : \"libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\\\\0' terminator one byte too late.\" , \"Severity\" : \"CRITICAL\" , \"CweIDs\" : [ \"CWE-125\" ], \"CVSS\" : { \"nvd\" : { \"V2Vector\" : \"AV:N/AC:L/Au:N/C:P/I:N/A:P\" , \"V3Vector\" : \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\" , \"V2Score\" : 6.4 , \"V3Score\" : 9.1 } }, \"References\" : [ \"https://github.com/freebsd/freebsd-src/commits/main/lib/libfetch\" , \"https://gitlab.alpinelinux.org/alpine/apk-tools/-/issues/10749\" , \"https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E\" , \"https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E\" , \"https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E\" , \"https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E\" ], \"PublishedDate\" : \"2021-08-03T14:15:00Z\" , \"LastModifiedDate\" : \"2021-10-18T12:19:00Z\" } ] } ] } }, \"metadata\" : { \"scanStartedOn\" : \"2022-07-24T17:14:04.864682+09:00\" , \"scanFinishedOn\" : \"2022-07-24T17:14:04.864682+09:00\" } } Create Cosign Vulnerability Attestation Cosign supports generating and verifying in-toto attestations . This tool enables you to sign and verify Cosign vulnerability attestation. Note In the following examples, the cosign command will write an attestation to a target OCI registry, so you must have permission to write. If you want to avoid writing an OCI registry and only want to see an attestation, add the --no-upload option to the cosign command. Sign with a local key pair Cosign can generate key pairs and use them for signing and verification. After you run the following command, you will get a public and private key pair. Read more about how to generate key pairs . $ cosign generate-key-pair In the following example, Trivy generates a cosign vulnerability scan record, and then Cosign attaches an attestation of it to a container image with a local key pair. $ trivy image --format cosign-vuln --output vuln.json <IMAGE> $ cosign attest --key /path/to/cosign.key --type vuln --predicate vuln.json <IMAGE> Then, you can verify attestations on the image. $ cosign verify-attestation --key /path/to/cosign.pub --type vuln <IMAGE> Keyless signing You can use Cosign to sign without keys by authenticating with an OpenID Connect protocol supported by sigstore (Google, GitHub, or Microsoft). $ trivy image --format cosign-vuln -o vuln.json <IMAGE> $ COSIGN_EXPERIMENTAL=1 cosign attest --type vuln --predicate vuln.json <IMAGE> You can verify attestations. $ COSIGN_EXPERIMENTAL=1 cosign verify-attestation --type vuln <IMAGE>","title":"Cosign Vulnerability Scan Record"},{"location":"docs/supply-chain/attestation/vuln/#cosign-vulnerability-attestation","text":"","title":"Cosign Vulnerability Attestation"},{"location":"docs/supply-chain/attestation/vuln/#generate-cosign-vulnerability-scan-record","text":"Trivy generates reports in the Cosign vulnerability scan record format . You can use the regular subcommands (like image, fs and rootfs) and specify cosign-vuln with the --format option. $ trivy image --format cosign-vuln --output vuln.json alpine:3.10 Result { \"invocation\" : { \"parameters\" : null , \"uri\" : \"\" , \"event_id\" : \"\" , \"builder.id\" : \"\" }, \"scanner\" : { \"uri\" : \"pkg:github/aquasecurity/trivy@v0.30.1-8-gf9cb8a28\" , \"version\" : \"v0.30.1-8-gf9cb8a28\" , \"db\" : { \"uri\" : \"\" , \"version\" : \"\" }, \"result\" : { \"SchemaVersion\" : 2 , \"ArtifactName\" : \"alpine:3.10\" , \"ArtifactType\" : \"container_image\" , \"Metadata\" : { \"OS\" : { \"Family\" : \"alpine\" , \"Name\" : \"3.10.9\" , \"EOSL\" : true }, \"ImageID\" : \"sha256:e7b300aee9f9bf3433d32bc9305bfdd22183beb59d933b48d77ab56ba53a197a\" , \"DiffIDs\" : [ \"sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635\" ], \"RepoTags\" : [ \"alpine:3.10\" ], \"RepoDigests\" : [ \"alpine@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98\" ], \"ImageConfig\" : { \"architecture\" : \"amd64\" , \"container\" : \"fdb7e80e3339e8d0599282e606c907aa5881ee4c668a68136119e6dfac6ce3a4\" , \"created\" : \"2021-04-14T19:20:05.338397761Z\" , \"docker_version\" : \"19.03.12\" , \"history\" : [ { \"created\" : \"2021-04-14T19:20:04.987219124Z\" , \"created_by\" : \"/bin/sh -c #(nop) ADD file:c5377eaa926bf412dd8d4a08b0a1f2399cfd708743533b0aa03b53d14cb4bb4e in / \" }, { \"created\" : \"2021-04-14T19:20:05.338397761Z\" , \"created_by\" : \"/bin/sh -c #(nop) CMD [\\\"/bin/sh\\\"]\" , \"empty_layer\" : true } ], \"os\" : \"linux\" , \"rootfs\" : { \"type\" : \"layers\" , \"diff_ids\" : [ \"sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635\" ] }, \"config\" : { \"Cmd\" : [ \"/bin/sh\" ], \"Env\" : [ \"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\" ], \"Image\" : \"sha256:eb2080c455e94c22ae35b3aef9e078c492a00795412e026e4d6b41ef64bc7dd8\" } } }, \"Results\" : [ { \"Target\" : \"alpine:3.10 (alpine 3.10.9)\" , \"Class\" : \"os-pkgs\" , \"Type\" : \"alpine\" , \"Vulnerabilities\" : [ { \"VulnerabilityID\" : \"CVE-2021-36159\" , \"PkgName\" : \"apk-tools\" , \"InstalledVersion\" : \"2.10.6-r0\" , \"FixedVersion\" : \"2.10.7-r0\" , \"Layer\" : { \"Digest\" : \"sha256:396c31837116ac290458afcb928f68b6cc1c7bdd6963fc72f52f365a2a89c1b5\" , \"DiffID\" : \"sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635\" }, \"SeveritySource\" : \"nvd\" , \"PrimaryURL\" : \"https://avd.aquasec.com/nvd/cve-2021-36159\" , \"DataSource\" : { \"ID\" : \"alpine\" , \"Name\" : \"Alpine Secdb\" , \"URL\" : \"https://secdb.alpinelinux.org/\" }, \"Description\" : \"libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\\\\0' terminator one byte too late.\" , \"Severity\" : \"CRITICAL\" , \"CweIDs\" : [ \"CWE-125\" ], \"CVSS\" : { \"nvd\" : { \"V2Vector\" : \"AV:N/AC:L/Au:N/C:P/I:N/A:P\" , \"V3Vector\" : \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\" , \"V2Score\" : 6.4 , \"V3Score\" : 9.1 } }, \"References\" : [ \"https://github.com/freebsd/freebsd-src/commits/main/lib/libfetch\" , \"https://gitlab.alpinelinux.org/alpine/apk-tools/-/issues/10749\" , \"https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E\" , \"https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E\" , \"https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E\" , \"https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E\" ], \"PublishedDate\" : \"2021-08-03T14:15:00Z\" , \"LastModifiedDate\" : \"2021-10-18T12:19:00Z\" } ] } ] } }, \"metadata\" : { \"scanStartedOn\" : \"2022-07-24T17:14:04.864682+09:00\" , \"scanFinishedOn\" : \"2022-07-24T17:14:04.864682+09:00\" } }","title":"Generate Cosign Vulnerability Scan Record"},{"location":"docs/supply-chain/attestation/vuln/#create-cosign-vulnerability-attestation","text":"Cosign supports generating and verifying in-toto attestations . This tool enables you to sign and verify Cosign vulnerability attestation. Note In the following examples, the cosign command will write an attestation to a target OCI registry, so you must have permission to write. If you want to avoid writing an OCI registry and only want to see an attestation, add the --no-upload option to the cosign command.","title":"Create Cosign Vulnerability Attestation"},{"location":"docs/supply-chain/attestation/vuln/#sign-with-a-local-key-pair","text":"Cosign can generate key pairs and use them for signing and verification. After you run the following command, you will get a public and private key pair. Read more about how to generate key pairs . $ cosign generate-key-pair In the following example, Trivy generates a cosign vulnerability scan record, and then Cosign attaches an attestation of it to a container image with a local key pair. $ trivy image --format cosign-vuln --output vuln.json <IMAGE> $ cosign attest --key /path/to/cosign.key --type vuln --predicate vuln.json <IMAGE> Then, you can verify attestations on the image. $ cosign verify-attestation --key /path/to/cosign.pub --type vuln <IMAGE>","title":"Sign with a local key pair"},{"location":"docs/supply-chain/attestation/vuln/#keyless-signing","text":"You can use Cosign to sign without keys by authenticating with an OpenID Connect protocol supported by sigstore (Google, GitHub, or Microsoft). $ trivy image --format cosign-vuln -o vuln.json <IMAGE> $ COSIGN_EXPERIMENTAL=1 cosign attest --type vuln --predicate vuln.json <IMAGE> You can verify attestations. $ COSIGN_EXPERIMENTAL=1 cosign verify-attestation --type vuln <IMAGE>","title":"Keyless signing"},{"location":"docs/target/aws/","text":"Amazon Web Services EXPERIMENTAL This feature might change without preserving backwards compatibility. The Trivy AWS CLI allows you to scan your AWS account for misconfigurations. You can either run the CLI locally or integrate it into your CI/CD pipeline. Whilst you can already scan the infrastructure-as-code that defines your AWS resources with trivy config , you can now scan your live AWS account(s) directly too. The included checks cover all of the aspects of the AWS CIS 1.2 automated benchmarks. Trivy uses the same authentication methods as the AWS CLI to configure and authenticate your access to the AWS platform. You will need permissions configured to read all AWS resources - we recommend using a group/role with the ReadOnlyAccess policy attached. Once you've scanned your account, you can run additional commands to filter the results without having to run the entire scan again - infrastructure information is cached locally per AWS account/region. Trivy currently supports the following scanning for AWS accounts. Misconfigurations CLI Commands Scan a full AWS account (all supported services): trivy aws --region us-east-1 You can allow Trivy to determine the AWS region etc. by using the standard AWS configuration files and environment variables. The --region flag overrides these. The summary view is the default when scanning multiple services. Scan a specific service: trivy aws --service s3 Scan multiple services: # --service s3,ec2 works too trivy aws --service s3 --service ec2 Show results for a specific AWS resource: trivy aws --service s3 --arn arn:aws:s3:::example-bucket All ARNs with detected issues will be displayed when showing results for their associated service. Compliance This section describes AWS specific compliance reports. For an overview of Trivy's Compliance feature, including working with custom compliance, check out the Compliance documentation . Built in reports the following reports are available out of the box: Compliance Name for command More info AWS CIS Foundations Benchmark v1.2 aws-cis-1.2 link AWS CIS Foundations Benchmark v1.4 aws-cis-1.4 link Examples Scan a cloud account and generate a compliance summary report: $ trivy aws --compliance=<compliance_id> --report=summary Note : The Issues column represent the total number of failed checks for this control. Get all of the detailed output for checks: $ trivy aws --compliance=<compliance_id> --report all Report result in JSON format: $ trivy aws --compliance=<compliance_id> --report all --format json Cached Results By default, Trivy will cache a representation of each AWS service for 24 hours. This means you can filter and view results for a service without having to wait for the entire scan to run again. If you want to force the cache to be refreshed with the latest data, you can use --update-cache . Or if you'd like to use cached data for a different timeframe, you can specify --max-cache-age (e.g. --max-cache-age 2h .). Regardless of whether the cache is used or not, rules will be evaluated again with each run of trivy aws . Custom Policies You can write custom policies for Trivy to evaluate against your AWS account. These policies are written in Rego , the same language used by Open Policy Agent . See the Custom Policies page for more information on how to write custom policies. Custom policies in cloud scanning also support passing in custom data. This can be useful when you want to selectively enable/disable certain aspects of your cloud policies. See the Custom Data page for more information on how to provide custom data to custom policies.","title":"AWS"},{"location":"docs/target/aws/#amazon-web-services","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. The Trivy AWS CLI allows you to scan your AWS account for misconfigurations. You can either run the CLI locally or integrate it into your CI/CD pipeline. Whilst you can already scan the infrastructure-as-code that defines your AWS resources with trivy config , you can now scan your live AWS account(s) directly too. The included checks cover all of the aspects of the AWS CIS 1.2 automated benchmarks. Trivy uses the same authentication methods as the AWS CLI to configure and authenticate your access to the AWS platform. You will need permissions configured to read all AWS resources - we recommend using a group/role with the ReadOnlyAccess policy attached. Once you've scanned your account, you can run additional commands to filter the results without having to run the entire scan again - infrastructure information is cached locally per AWS account/region. Trivy currently supports the following scanning for AWS accounts. Misconfigurations","title":"Amazon Web Services"},{"location":"docs/target/aws/#cli-commands","text":"Scan a full AWS account (all supported services): trivy aws --region us-east-1 You can allow Trivy to determine the AWS region etc. by using the standard AWS configuration files and environment variables. The --region flag overrides these. The summary view is the default when scanning multiple services. Scan a specific service: trivy aws --service s3 Scan multiple services: # --service s3,ec2 works too trivy aws --service s3 --service ec2 Show results for a specific AWS resource: trivy aws --service s3 --arn arn:aws:s3:::example-bucket All ARNs with detected issues will be displayed when showing results for their associated service.","title":"CLI Commands"},{"location":"docs/target/aws/#compliance","text":"This section describes AWS specific compliance reports. For an overview of Trivy's Compliance feature, including working with custom compliance, check out the Compliance documentation .","title":"Compliance"},{"location":"docs/target/aws/#built-in-reports","text":"the following reports are available out of the box: Compliance Name for command More info AWS CIS Foundations Benchmark v1.2 aws-cis-1.2 link AWS CIS Foundations Benchmark v1.4 aws-cis-1.4 link","title":"Built in reports"},{"location":"docs/target/aws/#examples","text":"Scan a cloud account and generate a compliance summary report: $ trivy aws --compliance=<compliance_id> --report=summary Note : The Issues column represent the total number of failed checks for this control. Get all of the detailed output for checks: $ trivy aws --compliance=<compliance_id> --report all Report result in JSON format: $ trivy aws --compliance=<compliance_id> --report all --format json","title":"Examples"},{"location":"docs/target/aws/#cached-results","text":"By default, Trivy will cache a representation of each AWS service for 24 hours. This means you can filter and view results for a service without having to wait for the entire scan to run again. If you want to force the cache to be refreshed with the latest data, you can use --update-cache . Or if you'd like to use cached data for a different timeframe, you can specify --max-cache-age (e.g. --max-cache-age 2h .). Regardless of whether the cache is used or not, rules will be evaluated again with each run of trivy aws .","title":"Cached Results"},{"location":"docs/target/aws/#custom-policies","text":"You can write custom policies for Trivy to evaluate against your AWS account. These policies are written in Rego , the same language used by Open Policy Agent . See the Custom Policies page for more information on how to write custom policies. Custom policies in cloud scanning also support passing in custom data. This can be useful when you want to selectively enable/disable certain aspects of your cloud policies. See the Custom Data page for more information on how to provide custom data to custom policies.","title":"Custom Policies"},{"location":"docs/target/container_image/","text":"Container Image Trivy supports two targets for container images. Files inside container images Container image metadata Files inside container images Container images consist of files. For instance, new files will be installed if you install a package. Trivy scans the files inside container images for Vulnerabilities Misconfigurations Secrets Licenses By default, vulnerability and secret scanning are enabled, and you can configure that with --scanners . Vulnerabilities It is enabled by default. You can simply specify your image name (and a tag). It detects known vulnerabilities in your container image. See here for the detail. $ trivy image [YOUR_IMAGE_NAME] For example: $ trivy image python:3.4-alpine Result 2019-05-16T01:20:43.180+0900 INFO Updating vulnerability database... 2019-05-16T01:20:53.029+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 (alpine 3.9.2) =================================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+--------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+--------------------------------+ | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 | | | | | | | with long nonces | +---------+------------------+----------+-------------------+---------------+--------------------------------+ To enable only vulnerability scanning, you can specify --scanners vuln . $ trivy image --scanners vuln [ YOUR_IMAGE_NAME ] Misconfigurations It is supported, but it is not useful in most cases. As mentioned here , Trivy mainly supports Infrastructure as Code (IaC) files for misconfigurations. If your container image includes IaC files such as Kubernetes YAML files or Terraform files, you should enable this feature with --scanners config . $ trivy image --scanners config [YOUR_IMAGE_NAME] Secrets It is enabled by default. See here for the detail. $ trivy image [ YOUR_IMAGE_NAME ] Licenses It is disabled by default. See here for the detail. $ trivy image --scanners license [ YOUR_IMAGE_NAME ] Container image metadata Container images have configuration . docker inspect and docker history show the information according to the configuration. Trivy scans the configuration of container images for Misconfigurations Secrets They are disabled by default. You can enable them with --image-config-scanners . Tips The configuration can be exported as the JSON file by docker save . Misconfigurations Trivy detects misconfigurations on the configuration of container images. The image config is converted into Dockerfile and Trivy handles it as Dockerfile. See here for the detail of Dockerfile scanning. It is disabled by default. You can enable it with --image-config-scanners config . $ trivy image --image-config-scanners config [YOUR_IMAGE_NAME] If you just want to scan the image config, you can disable scanners with --scanners none . For example: $ trivy image --scanners none --image-config-scanners config alpine:3.17.0 Result alpine:3.17 (dockerfile) ======================== Tests: 24 (SUCCESSES: 21, FAILURES: 3, EXCEPTIONS: 0) Failures: 3 (UNKNOWN: 0, LOW: 2, MEDIUM: 0, HIGH: 1, CRITICAL: 0) HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 LOW: Consider using 'COPY file:e4d600fc4c9c293efe360be7b30ee96579925d1b4634c94332e2ec73f7d8eca1 in /' command instead of 'ADD file:e4d600fc4c9c293efe360be7b30ee96579925d1b4634c94332e2ec73f7d8eca1 in /' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files. See https://avd.aquasec.com/misconfig/ds005 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 alpine:3.17:1 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 [ ADD file:e4d600fc4c9c293efe360be7b30ee96579925d1b4634c94332e2ec73f7d8eca1 in / \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 LOW: Add HEALTHCHECK instruction in your Dockerfile \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 You shoud add HEALTHCHECK instruction in your docker container images to perform the health check on running containers. See https://avd.aquasec.com/misconfig/ds026 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Tip You can see how each layer is created with docker history . Secrets Trivy detects secrets on the configuration of container images. The image config is converted into JSON and Trivy scans the file for secrets. It is especially useful for environment variables that are likely to have credentials by accident. See here for the detail. $ trivy image --image-config-scanners secret [ YOUR_IMAGE_NAME ] If you just want to scan the image config, you can disable scanners with --scanners none . For example: $ trivy image --scanners none --image-config-scanners secret vuln-image Result vuln-image (alpine 3.17.1) ========================== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) vuln-image (secrets) ==================== Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 2) CRITICAL: GitHub (github-pat) \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 GitHub Personal Access Token \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 test:16 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 14 { 15 \"created\": \"2023-01-09T17:05:20Z\", 16 [ \"created_by\": \"ENV secret=****************************************\", 17 \"comment\": \"buildkit.dockerfile.v0\", \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 CRITICAL: GitHub (github-pat) \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 GitHub Personal Access Token \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 test:34 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 32 \"Env\": [ 33 \"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", 34 [ \"secret=****************************************\" 35 ] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Tip You can see environment variables with docker inspect . Supported Trivy will look for the specified image in a series of locations. By default, it will first look in the local Docker Engine, then Containerd, Podman, and finally container registry. This behavior can be modified with the --image-src flag. For example, the command trivy image --image-src podman,containerd alpine:3.7.3 Will first search in Podman. If the image is found there, it will be scanned and the results returned. If the image is not found in Podman, then Trivy will search in Containerd. If the image is not found there either, the scan will fail and no more image sources will be searched. Docker Engine Trivy tries to looks for the specified image in your local Docker Engine. It will be skipped if Docker Engine is not running locally. If your docker socket is not the default path, you can override it via DOCKER_HOST . containerd EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy tries to looks for the specified image in your local containerd . It will be skipped if containerd is not running locally. Specify your image name in containerd running locally. $ nerdctl images REPOSITORY TAG IMAGE ID CREATED PLATFORM SIZE BLOB SIZE aquasec/nginx latest 2bcabc23b454 3 hours ago linux/amd64 149 .1 MiB 54 .1 MiB $ trivy image aquasec/nginx If your containerd socket is not the default path ( //run/containerd/containerd.sock ), you can override it via CONTAINERD_ADDRESS . $ export CONTAINERD_ADDRESS = /run/k3s/containerd/containerd.sock $ trivy image aquasec/nginx If your scan targets are images in a namespace other than containerd's default namespace ( default ), you can override it via CONTAINERD_NAMESPACE . $ export CONTAINERD_NAMESPACE = k8s.io $ trivy image aquasec/nginx Podman EXPERIMENTAL This feature might change without preserving backwards compatibility. Scan your image in Podman (>=2.0) running locally. The remote Podman is not supported. Before performing Trivy commands, you must enable the podman.sock systemd service on your machine. For more details, see here . $ systemctl --user enable --now podman.socket Then, you can scan your image in Podman. $ cat Dockerfile FROM alpine:3.12 RUN apk add --no-cache bash $ podman build -t test . $ podman images REPOSITORY TAG IMAGE ID CREATED SIZE localhost/test latest efc372d4e0de About a minute ago 7 .94 MB $ trivy image test Container Registry Trivy supports registries that comply with the following specifications. Docker Registry HTTP API V2 OCI Distribution Specification You can configure credentials with docker login . See here for the detail. Tar Files Trivy supports image tar files generated by the following tools. Docker Image Specification Moby Project Buildah Podman img Kaniko $ docker pull ruby:3.1-alpine3.15 $ docker save ruby:3.1-alpine3.15 -o ruby-3.1.tar $ trivy image --input ruby-3.1.tar Result 2022-02-03T10:08:19.127Z INFO Detected OS: alpine 2022-02-03T10:08:19.127Z WARN This OS version is not on the EOL list: alpine 3.15 2022-02-03T10:08:19.127Z INFO Detecting Alpine vulnerabilities... 2022-02-03T10:08:19.127Z INFO Number of language-specific files: 2 2022-02-03T10:08:19.127Z INFO Detecting gemspec vulnerabilities... 2022-02-03T10:08:19.128Z INFO Detecting node-pkg vulnerabilities... 2022-02-03T10:08:19.128Z WARN This OS version is no longer supported by the distribution: alpine 3.15.0 2022-02-03T10:08:19.128Z WARN The vulnerability detection may be insufficient because security updates are not provided ruby-3.1.tar (alpine 3.15.0) ============================ Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 3, CRITICAL: 0) +----------+------------------+----------+-------------------+---------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +----------+------------------+----------+-------------------+---------------+---------------------------------------+ | gmp | CVE-2021-43618 | HIGH | 6.2.1-r0 | 6.2.1-r1 | gmp: Integer overflow and resultant | | | | | | | buffer overflow via crafted input | | | | | | | -->avd.aquasec.com/nvd/cve-2021-43618 | +----------+ + + + + + | gmp-dev | | | | | | | | | | | | | | | | | | | | +----------+ + + + + + | libgmpxx | | | | | | | | | | | | | | | | | | | | +----------+------------------+----------+-------------------+---------------+---------------------------------------+ Node.js (node-pkg) ================== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) Ruby (gemspec) ============== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) OCI Layout Trivy supports image directories compliant with Open Container Image Layout Specification . Buildah: $ buildah push docker.io/library/alpine:3.11 oci:/path/to/alpine $ trivy image --input /path/to/alpine Skopeo: $ skopeo copy docker-daemon:alpine:3.11 oci:/path/to/alpine $ trivy image --input /path/to/alpine Referencing specific images can be done by their tag or by their manifest digest: # Referenced by tag $ trivy image --input /path/to/alpine:3.15 # Referenced by digest $ trivy image --input /path/to/alpine@sha256:82389ea44e50c696aba18393b168a833929506f5b29b9d75eb817acceb6d54ba SBOM Trivy supports the generation of Software Bill of Materials (SBOM) for container images and the search for SBOMs during vulnerability scanning. Generation Trivy can generate SBOM for container images. See here for the detail. Discovery Trivy can search for Software Bill of Materials (SBOMs) that reference container images. If an SBOM is found, the vulnerability scan is performed using the SBOM instead of the container image. By using the SBOM, you can perform a vulnerability scan more quickly, as it allows you to skip pulling the container image and analyzing its layers. To enable this functionality, you need to specify the --sbom-sources flag. The following two sources are supported: OCI Registry ( oci ) Rekor ( rekor ) Example: $ trivy image --sbom-sources oci ghcr.io/knqyf263/oci-referrers 2023 -03-05T17:36:55.278+0200 INFO Vulnerability scanning is enabled 2023 -03-05T17:36:58.103+0200 INFO Detected SBOM format: cyclonedx-json 2023 -03-05T17:36:58.129+0200 INFO Found SBOM ( cyclonedx ) in the OCI referrers ... ghcr.io/knqyf263/oci-referrers ( alpine 3 .16.2 ) ============================================== Total: 17 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 5 , HIGH: 9 , CRITICAL: 3 ) The OCI Registry utilizes the Referrers API . For more information about Rekor, please refer to its documentation . Compliance EXPERIMENTAL This feature might change without preserving backwards compatibility. This section describes container image specific compliance reports. For an overview of Trivy's Compliance feature, including working with custom compliance, check out the Compliance documentation . Built in reports The following reports are available out of the box: Compliance Version Name for command More info CIS Docker Community Edition Benchmark 1.1.0 docker-cis Link Examples Scan a container image configuration and generate a compliance summary report: $ trivy image --compliance docker-cis [YOUR_IMAGE_NAME] Note The Issues column represent the total number of failed checks for this control. Authentication Please reference this page . Options Scan Image on a specific Architecture and OS By default, Trivy loads an image on a \"linux/amd64\" machine. To customise this, pass a --platform argument in the format OS/Architecture for the image: $ trivy image --platform=os/architecture [YOUR_IMAGE_NAME] For example: $ trivy image --platform=linux/arm alpine:3.16.1 Result 2022-10-25T21:00:50.972+0300 INFO Vulnerability scanning is enabled 2022-10-25T21:00:50.972+0300 INFO Secret scanning is enabled 2022-10-25T21:00:50.972+0300 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2022-10-25T21:00:50.972+0300 INFO Please see also https://aquasecurity.github.io/trivy/dev/docs/secret/scanning/#recommendation for faster secret detection 2022-10-25T21:00:56.190+0300 INFO Detected OS: alpine 2022-10-25T21:00:56.190+0300 INFO Detecting Alpine vulnerabilities... 2022-10-25T21:00:56.191+0300 INFO Number of language-specific files: 0 alpine:3.16.1 (alpine 3.16.1) ============================= Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 zlib \u2502 CVE-2022-37434 \u2502 CRITICAL \u2502 1.2.12-r1 \u2502 1.2.12-r2 \u2502 zlib: heap-based buffer over-read and overflow in inflate() \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 in inflate.c via a... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-37434 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Configure Docker daemon socket to connect to. You can configure Docker daemon socket with DOCKER_HOST or --docker-host . $ trivy image --docker-host tcp://127.0.0.1:2375 YOUR_IMAGE","title":"Container Image"},{"location":"docs/target/container_image/#container-image","text":"Trivy supports two targets for container images. Files inside container images Container image metadata","title":"Container Image"},{"location":"docs/target/container_image/#files-inside-container-images","text":"Container images consist of files. For instance, new files will be installed if you install a package. Trivy scans the files inside container images for Vulnerabilities Misconfigurations Secrets Licenses By default, vulnerability and secret scanning are enabled, and you can configure that with --scanners .","title":"Files inside container images"},{"location":"docs/target/container_image/#vulnerabilities","text":"It is enabled by default. You can simply specify your image name (and a tag). It detects known vulnerabilities in your container image. See here for the detail. $ trivy image [YOUR_IMAGE_NAME] For example: $ trivy image python:3.4-alpine Result 2019-05-16T01:20:43.180+0900 INFO Updating vulnerability database... 2019-05-16T01:20:53.029+0900 INFO Detecting Alpine vulnerabilities... python:3.4-alpine3.9 (alpine 3.9.2) =================================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) +---------+------------------+----------+-------------------+---------------+--------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------+------------------+----------+-------------------+---------------+--------------------------------+ | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 | | | | | | | with long nonces | +---------+------------------+----------+-------------------+---------------+--------------------------------+ To enable only vulnerability scanning, you can specify --scanners vuln . $ trivy image --scanners vuln [ YOUR_IMAGE_NAME ]","title":"Vulnerabilities"},{"location":"docs/target/container_image/#misconfigurations","text":"It is supported, but it is not useful in most cases. As mentioned here , Trivy mainly supports Infrastructure as Code (IaC) files for misconfigurations. If your container image includes IaC files such as Kubernetes YAML files or Terraform files, you should enable this feature with --scanners config . $ trivy image --scanners config [YOUR_IMAGE_NAME]","title":"Misconfigurations"},{"location":"docs/target/container_image/#secrets","text":"It is enabled by default. See here for the detail. $ trivy image [ YOUR_IMAGE_NAME ]","title":"Secrets"},{"location":"docs/target/container_image/#licenses","text":"It is disabled by default. See here for the detail. $ trivy image --scanners license [ YOUR_IMAGE_NAME ]","title":"Licenses"},{"location":"docs/target/container_image/#container-image-metadata","text":"Container images have configuration . docker inspect and docker history show the information according to the configuration. Trivy scans the configuration of container images for Misconfigurations Secrets They are disabled by default. You can enable them with --image-config-scanners . Tips The configuration can be exported as the JSON file by docker save .","title":"Container image metadata"},{"location":"docs/target/container_image/#misconfigurations_1","text":"Trivy detects misconfigurations on the configuration of container images. The image config is converted into Dockerfile and Trivy handles it as Dockerfile. See here for the detail of Dockerfile scanning. It is disabled by default. You can enable it with --image-config-scanners config . $ trivy image --image-config-scanners config [YOUR_IMAGE_NAME] If you just want to scan the image config, you can disable scanners with --scanners none . For example: $ trivy image --scanners none --image-config-scanners config alpine:3.17.0 Result alpine:3.17 (dockerfile) ======================== Tests: 24 (SUCCESSES: 21, FAILURES: 3, EXCEPTIONS: 0) Failures: 3 (UNKNOWN: 0, LOW: 2, MEDIUM: 0, HIGH: 1, CRITICAL: 0) HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. See https://avd.aquasec.com/misconfig/ds002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 LOW: Consider using 'COPY file:e4d600fc4c9c293efe360be7b30ee96579925d1b4634c94332e2ec73f7d8eca1 in /' command instead of 'ADD file:e4d600fc4c9c293efe360be7b30ee96579925d1b4634c94332e2ec73f7d8eca1 in /' \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files. See https://avd.aquasec.com/misconfig/ds005 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 alpine:3.17:1 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 [ ADD file:e4d600fc4c9c293efe360be7b30ee96579925d1b4634c94332e2ec73f7d8eca1 in / \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 LOW: Add HEALTHCHECK instruction in your Dockerfile \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 You shoud add HEALTHCHECK instruction in your docker container images to perform the health check on running containers. See https://avd.aquasec.com/misconfig/ds026 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Tip You can see how each layer is created with docker history .","title":"Misconfigurations"},{"location":"docs/target/container_image/#secrets_1","text":"Trivy detects secrets on the configuration of container images. The image config is converted into JSON and Trivy scans the file for secrets. It is especially useful for environment variables that are likely to have credentials by accident. See here for the detail. $ trivy image --image-config-scanners secret [ YOUR_IMAGE_NAME ] If you just want to scan the image config, you can disable scanners with --scanners none . For example: $ trivy image --scanners none --image-config-scanners secret vuln-image Result vuln-image (alpine 3.17.1) ========================== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) vuln-image (secrets) ==================== Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 2) CRITICAL: GitHub (github-pat) \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 GitHub Personal Access Token \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 test:16 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 14 { 15 \"created\": \"2023-01-09T17:05:20Z\", 16 [ \"created_by\": \"ENV secret=****************************************\", 17 \"comment\": \"buildkit.dockerfile.v0\", \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 CRITICAL: GitHub (github-pat) \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 GitHub Personal Access Token \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 test:34 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 32 \"Env\": [ 33 \"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", 34 [ \"secret=****************************************\" 35 ] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Tip You can see environment variables with docker inspect .","title":"Secrets"},{"location":"docs/target/container_image/#supported","text":"Trivy will look for the specified image in a series of locations. By default, it will first look in the local Docker Engine, then Containerd, Podman, and finally container registry. This behavior can be modified with the --image-src flag. For example, the command trivy image --image-src podman,containerd alpine:3.7.3 Will first search in Podman. If the image is found there, it will be scanned and the results returned. If the image is not found in Podman, then Trivy will search in Containerd. If the image is not found there either, the scan will fail and no more image sources will be searched.","title":"Supported"},{"location":"docs/target/container_image/#docker-engine","text":"Trivy tries to looks for the specified image in your local Docker Engine. It will be skipped if Docker Engine is not running locally. If your docker socket is not the default path, you can override it via DOCKER_HOST .","title":"Docker Engine"},{"location":"docs/target/container_image/#containerd","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy tries to looks for the specified image in your local containerd . It will be skipped if containerd is not running locally. Specify your image name in containerd running locally. $ nerdctl images REPOSITORY TAG IMAGE ID CREATED PLATFORM SIZE BLOB SIZE aquasec/nginx latest 2bcabc23b454 3 hours ago linux/amd64 149 .1 MiB 54 .1 MiB $ trivy image aquasec/nginx If your containerd socket is not the default path ( //run/containerd/containerd.sock ), you can override it via CONTAINERD_ADDRESS . $ export CONTAINERD_ADDRESS = /run/k3s/containerd/containerd.sock $ trivy image aquasec/nginx If your scan targets are images in a namespace other than containerd's default namespace ( default ), you can override it via CONTAINERD_NAMESPACE . $ export CONTAINERD_NAMESPACE = k8s.io $ trivy image aquasec/nginx","title":"containerd"},{"location":"docs/target/container_image/#podman","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. Scan your image in Podman (>=2.0) running locally. The remote Podman is not supported. Before performing Trivy commands, you must enable the podman.sock systemd service on your machine. For more details, see here . $ systemctl --user enable --now podman.socket Then, you can scan your image in Podman. $ cat Dockerfile FROM alpine:3.12 RUN apk add --no-cache bash $ podman build -t test . $ podman images REPOSITORY TAG IMAGE ID CREATED SIZE localhost/test latest efc372d4e0de About a minute ago 7 .94 MB $ trivy image test","title":"Podman"},{"location":"docs/target/container_image/#container-registry","text":"Trivy supports registries that comply with the following specifications. Docker Registry HTTP API V2 OCI Distribution Specification You can configure credentials with docker login . See here for the detail.","title":"Container Registry"},{"location":"docs/target/container_image/#tar-files","text":"Trivy supports image tar files generated by the following tools. Docker Image Specification Moby Project Buildah Podman img Kaniko $ docker pull ruby:3.1-alpine3.15 $ docker save ruby:3.1-alpine3.15 -o ruby-3.1.tar $ trivy image --input ruby-3.1.tar Result 2022-02-03T10:08:19.127Z INFO Detected OS: alpine 2022-02-03T10:08:19.127Z WARN This OS version is not on the EOL list: alpine 3.15 2022-02-03T10:08:19.127Z INFO Detecting Alpine vulnerabilities... 2022-02-03T10:08:19.127Z INFO Number of language-specific files: 2 2022-02-03T10:08:19.127Z INFO Detecting gemspec vulnerabilities... 2022-02-03T10:08:19.128Z INFO Detecting node-pkg vulnerabilities... 2022-02-03T10:08:19.128Z WARN This OS version is no longer supported by the distribution: alpine 3.15.0 2022-02-03T10:08:19.128Z WARN The vulnerability detection may be insufficient because security updates are not provided ruby-3.1.tar (alpine 3.15.0) ============================ Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 3, CRITICAL: 0) +----------+------------------+----------+-------------------+---------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +----------+------------------+----------+-------------------+---------------+---------------------------------------+ | gmp | CVE-2021-43618 | HIGH | 6.2.1-r0 | 6.2.1-r1 | gmp: Integer overflow and resultant | | | | | | | buffer overflow via crafted input | | | | | | | -->avd.aquasec.com/nvd/cve-2021-43618 | +----------+ + + + + + | gmp-dev | | | | | | | | | | | | | | | | | | | | +----------+ + + + + + | libgmpxx | | | | | | | | | | | | | | | | | | | | +----------+------------------+----------+-------------------+---------------+---------------------------------------+ Node.js (node-pkg) ================== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) Ruby (gemspec) ============== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)","title":"Tar Files"},{"location":"docs/target/container_image/#oci-layout","text":"Trivy supports image directories compliant with Open Container Image Layout Specification . Buildah: $ buildah push docker.io/library/alpine:3.11 oci:/path/to/alpine $ trivy image --input /path/to/alpine Skopeo: $ skopeo copy docker-daemon:alpine:3.11 oci:/path/to/alpine $ trivy image --input /path/to/alpine Referencing specific images can be done by their tag or by their manifest digest: # Referenced by tag $ trivy image --input /path/to/alpine:3.15 # Referenced by digest $ trivy image --input /path/to/alpine@sha256:82389ea44e50c696aba18393b168a833929506f5b29b9d75eb817acceb6d54ba","title":"OCI Layout"},{"location":"docs/target/container_image/#sbom","text":"Trivy supports the generation of Software Bill of Materials (SBOM) for container images and the search for SBOMs during vulnerability scanning.","title":"SBOM"},{"location":"docs/target/container_image/#generation","text":"Trivy can generate SBOM for container images. See here for the detail.","title":"Generation"},{"location":"docs/target/container_image/#discovery","text":"Trivy can search for Software Bill of Materials (SBOMs) that reference container images. If an SBOM is found, the vulnerability scan is performed using the SBOM instead of the container image. By using the SBOM, you can perform a vulnerability scan more quickly, as it allows you to skip pulling the container image and analyzing its layers. To enable this functionality, you need to specify the --sbom-sources flag. The following two sources are supported: OCI Registry ( oci ) Rekor ( rekor ) Example: $ trivy image --sbom-sources oci ghcr.io/knqyf263/oci-referrers 2023 -03-05T17:36:55.278+0200 INFO Vulnerability scanning is enabled 2023 -03-05T17:36:58.103+0200 INFO Detected SBOM format: cyclonedx-json 2023 -03-05T17:36:58.129+0200 INFO Found SBOM ( cyclonedx ) in the OCI referrers ... ghcr.io/knqyf263/oci-referrers ( alpine 3 .16.2 ) ============================================== Total: 17 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 5 , HIGH: 9 , CRITICAL: 3 ) The OCI Registry utilizes the Referrers API . For more information about Rekor, please refer to its documentation .","title":"Discovery"},{"location":"docs/target/container_image/#compliance","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. This section describes container image specific compliance reports. For an overview of Trivy's Compliance feature, including working with custom compliance, check out the Compliance documentation .","title":"Compliance"},{"location":"docs/target/container_image/#built-in-reports","text":"The following reports are available out of the box: Compliance Version Name for command More info CIS Docker Community Edition Benchmark 1.1.0 docker-cis Link","title":"Built in reports"},{"location":"docs/target/container_image/#examples","text":"Scan a container image configuration and generate a compliance summary report: $ trivy image --compliance docker-cis [YOUR_IMAGE_NAME] Note The Issues column represent the total number of failed checks for this control.","title":"Examples"},{"location":"docs/target/container_image/#authentication","text":"Please reference this page .","title":"Authentication"},{"location":"docs/target/container_image/#options","text":"","title":"Options"},{"location":"docs/target/container_image/#scan-image-on-a-specific-architecture-and-os","text":"By default, Trivy loads an image on a \"linux/amd64\" machine. To customise this, pass a --platform argument in the format OS/Architecture for the image: $ trivy image --platform=os/architecture [YOUR_IMAGE_NAME] For example: $ trivy image --platform=linux/arm alpine:3.16.1 Result 2022-10-25T21:00:50.972+0300 INFO Vulnerability scanning is enabled 2022-10-25T21:00:50.972+0300 INFO Secret scanning is enabled 2022-10-25T21:00:50.972+0300 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2022-10-25T21:00:50.972+0300 INFO Please see also https://aquasecurity.github.io/trivy/dev/docs/secret/scanning/#recommendation for faster secret detection 2022-10-25T21:00:56.190+0300 INFO Detected OS: alpine 2022-10-25T21:00:56.190+0300 INFO Detecting Alpine vulnerabilities... 2022-10-25T21:00:56.191+0300 INFO Number of language-specific files: 0 alpine:3.16.1 (alpine 3.16.1) ============================= Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 zlib \u2502 CVE-2022-37434 \u2502 CRITICAL \u2502 1.2.12-r1 \u2502 1.2.12-r2 \u2502 zlib: heap-based buffer over-read and overflow in inflate() \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 in inflate.c via a... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-37434 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"Scan Image on a specific Architecture and OS"},{"location":"docs/target/container_image/#configure-docker-daemon-socket-to-connect-to","text":"You can configure Docker daemon socket with DOCKER_HOST or --docker-host . $ trivy image --docker-host tcp://127.0.0.1:2375 YOUR_IMAGE","title":"Configure Docker daemon socket to connect to."},{"location":"docs/target/filesystem/","text":"Filesystem Scan your local projects for Vulnerabilities Misconfigurations Secrets Licenses By default, vulnerability and secret scanning are enabled, and you can configure that with --scanners . $ trivy fs /path/to/project It's also possible to scan a single file. $ trivy fs ~/src/github.com/aquasecurity/trivy-ci-test/Pipfile.lock Scanners Vulnerabilities It is enabled by default. Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json. See here for the detail. $ trivy fs ~/src/github.com/aquasecurity/trivy-ci-test Result 2020-06-01T17:06:58.652+0300 WARN OS is not detected and vulnerabilities in OS packages are not detected. 2020-06-01T17:06:58.652+0300 INFO Detecting pipenv vulnerabilities... 2020-06-01T17:06:58.691+0300 INFO Detecting cargo vulnerabilities... Pipfile.lock ============ Total: 10 (UNKNOWN: 2, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0) +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | django | CVE-2020-7471 | HIGH | 2.0.9 | 3.0.3, 2.2.10, 1.11.28 | django: potential | | | | | | | SQL injection via | | | | | | | StringAgg(delimiter) | + +------------------+----------+ +------------------------+------------------------------------+ | | CVE-2019-19844 | MEDIUM | | 3.0.1, 2.2.9, 1.11.27 | Django: crafted email address | | | | | | | allows account takeover | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-3498 | | | 2.1.5, 2.0.10, 1.11.18 | python-django: Content | | | | | | | spoofing via URL path in | | | | | | | default 404 page | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-6975 | | | 2.1.6, 2.0.11, 1.11.19 | python-django: | | | | | | | memory exhaustion in | | | | | | | django.utils.numberformat.format() | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ ... Misconfigurations It is disabled by default and can be enabled with --scanners config . See here for the detail. $ trivy fs --scanners config /path/to/project Secrets It is enabled by default. See here for the detail. $ trivy fs /path/to/project Licenses It is disabled by default. See here for the detail. $ trivy fs --scanners license /path/to/project SBOM generation Trivy can generate SBOM for local projects. See here for the detail.","title":"Filesystem"},{"location":"docs/target/filesystem/#filesystem","text":"Scan your local projects for Vulnerabilities Misconfigurations Secrets Licenses By default, vulnerability and secret scanning are enabled, and you can configure that with --scanners . $ trivy fs /path/to/project It's also possible to scan a single file. $ trivy fs ~/src/github.com/aquasecurity/trivy-ci-test/Pipfile.lock","title":"Filesystem"},{"location":"docs/target/filesystem/#scanners","text":"","title":"Scanners"},{"location":"docs/target/filesystem/#vulnerabilities","text":"It is enabled by default. Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json. See here for the detail. $ trivy fs ~/src/github.com/aquasecurity/trivy-ci-test Result 2020-06-01T17:06:58.652+0300 WARN OS is not detected and vulnerabilities in OS packages are not detected. 2020-06-01T17:06:58.652+0300 INFO Detecting pipenv vulnerabilities... 2020-06-01T17:06:58.691+0300 INFO Detecting cargo vulnerabilities... Pipfile.lock ============ Total: 10 (UNKNOWN: 2, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0) +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | django | CVE-2020-7471 | HIGH | 2.0.9 | 3.0.3, 2.2.10, 1.11.28 | django: potential | | | | | | | SQL injection via | | | | | | | StringAgg(delimiter) | + +------------------+----------+ +------------------------+------------------------------------+ | | CVE-2019-19844 | MEDIUM | | 3.0.1, 2.2.9, 1.11.27 | Django: crafted email address | | | | | | | allows account takeover | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-3498 | | | 2.1.5, 2.0.10, 1.11.18 | python-django: Content | | | | | | | spoofing via URL path in | | | | | | | default 404 page | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-6975 | | | 2.1.6, 2.0.11, 1.11.19 | python-django: | | | | | | | memory exhaustion in | | | | | | | django.utils.numberformat.format() | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ ...","title":"Vulnerabilities"},{"location":"docs/target/filesystem/#misconfigurations","text":"It is disabled by default and can be enabled with --scanners config . See here for the detail. $ trivy fs --scanners config /path/to/project","title":"Misconfigurations"},{"location":"docs/target/filesystem/#secrets","text":"It is enabled by default. See here for the detail. $ trivy fs /path/to/project","title":"Secrets"},{"location":"docs/target/filesystem/#licenses","text":"It is disabled by default. See here for the detail. $ trivy fs --scanners license /path/to/project","title":"Licenses"},{"location":"docs/target/filesystem/#sbom-generation","text":"Trivy can generate SBOM for local projects. See here for the detail.","title":"SBOM generation"},{"location":"docs/target/kubernetes/","text":"Kubernetes EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy can connect to your Kubernetes cluster and scan it for security issues using the trivy k8s command. This page covers the technical capabilities of Trivy Kubernetes scanning. Trivy can also be installed inside your cluster as a Kubernetes Operator, and continuously scan it. For more about this, please see the [Trivy Operator][https://aquasecurity.github.io/trivy-operator/] project. When scanning a Kubernetes cluster, Trivy differentiates between the following: Cluster infrastructure (e.g api-server, kubelet, addons) Cluster configuration (e.g Roles, ClusterRoles). Application workloads (e.g nginx, postgresql). When scanning any of the above, the container image is scanned separately to the Kubernetes resource definition (the YAML manifest) that defines the resource. Container image is scanned for: - Vulnerabilities - Misconfigurations - Exposed secrets Kubernetes resource definition is scanned for: - Vulnerabilities - partially supported through KBOM scanning - Misconfigurations - Exposed secrets Kubernetes target configurations Trivy follows the behavior of the kubectl tool as much as possible. Scope The command expects an argument that selects the scope of the scan (similarly to how kubectl expects an argument after kubectl get ). This argument can be: 1. A Kubernetes Kind. e.g pod , deployment , etc. 2. A Kubernetes Resource. e.g pods/mypod , etc. 3. all . Scan common workload kinds, as listed here 4. cluster scan the entire cluster including all namespaced resources and cluster level resources. Examples: trivy k8s all trivy k8s pods trivy k8s deploy myapp trivy k8s pod/mypod trivy k8s pods,deploy trivy k8s cluster Note that the scope argument must appear last in the command line, after any other flag. Cluster By default Trivy will look for a kubeconfig configuration file in the default location , and use the default cluster that is specified. You can also specify a kubeconfig using the --kubeconfig flag: trivy k8s --kubeconfig ~/.kube/config2 Namespace By default Trivy will scan all namespaces (following kubectl behavior). To specify a namespace use the --namespace flag: trivy k8s --kubeconfig ~/.kube/config2 --namespace default Node You can exclude specific nodes from the scan using the --exclude-nodes flag, which takes a label in the format label-name:label-value and excludes all matching nodes: trivy k8s cluster --report summary --exclude-nodes kubernetes.io/arch:arm6 Components types You can control what kinds of components are discovered using the --components flag: - --components infra will discover only cluster infrastructure components. - --components workloads will discover only application workloads. - If the flag is omitted: infra, workloads, and RBAC are discovered. Reporting and filtering Since scanning an entire cluster for any security issue can be overwhelming, By default Trivy summarizes the results in a simple \"summary\" view. By scoping the scan on a specific resource, you can see the detailed report. You can always choose the report granularity using the --report summary / --report all flag. Scan a full cluster and generate a simple summary report: $ trivy k8s --report=summary cluster Filter by severity: trivy k8s --severity=CRITICAL --report=all cluster Filter by scanners (Vulnerabilities, Secrets or Misconfigurations): trivy k8s --scanners=secret --report=summary cluster # or trivy k8s --scanners=config --report=summary cluster The supported output formats are table , which is the default, and json . trivy k8s --format json -o results.json cluster Result { \"ClusterName\" : \"minikube\" , \"Vulnerabilities\" : [ { \"Namespace\" : \"default\" , \"Kind\" : \"Deployment\" , \"Name\" : \"app\" , \"Results\" : [ { \"Target\" : \"ubuntu:latest (ubuntu 22.04)\" , \"Class\" : \"os-pkgs\" , \"Type\" : \"ubuntu\" , \"Vulnerabilities\" : [ { \"VulnerabilityID\" : \"CVE-2016-2781\" , \"PkgName\" : \"coreutils\" , \"InstalledVersion\" : \"8.32-4.1ubuntu1\" , \"Layer\" : { \"Digest\" : \"sha256:125a6e411906fe6b0aaa50fc9d600bf6ff9bb11a8651727ce1ed482dc271c24c\" , \"DiffID\" : \"sha256:e59fc94956120a6c7629f085027578e6357b48061d45714107e79f04a81a6f0c\" }, \"SeveritySource\" : \"ubuntu\" , \"PrimaryURL\" : \"https://avd.aquasec.com/nvd/cve-2016-2781\" , \"DataSource\" : { \"ID\" : \"ubuntu\" , \"Name\" : \"Ubuntu CVE Tracker\" , \"URL\" : \"https://git.launchpad.net/ubuntu-cve-tracker\" }, \"Title\" : \"coreutils: Non-privileged session can escape to the parent session in chroot\" , \"Description\" : \"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.\" , \"Severity\" : \"LOW\" , \"CweIDs\" : [ \"CWE-20\" ], \"VendorSeverity\" : { \"cbl-mariner\" : 2 , \"nvd\" : 2 , \"redhat\" : 2 , \"ubuntu\" : 1 }, \"CVSS\" : { \"nvd\" : { \"V2Vector\" : \"AV:L/AC:L/Au:N/C:N/I:P/A:N\" , \"V3Vector\" : \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N\" , \"V2Score\" : 2.1 , \"V3Score\" : 6.5 }, \"redhat\" : { \"V2Vector\" : \"AV:L/AC:H/Au:N/C:C/I:C/A:C\" , \"V3Vector\" : \"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\" , \"V2Score\" : 6.2 , \"V3Score\" : 8.6 } }, \"References\" : [ \"http://seclists.org/oss-sec/2016/q1/452\" , \"http://www.openwall.com/lists/oss-security/2016/02/28/2\" , \"http://www.openwall.com/lists/oss-security/2016/02/28/3\" , \"https://access.redhat.com/security/cve/CVE-2016-2781\" , \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781\" , \"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E\" , \"https://lore.kernel.org/patchwork/patch/793178/\" , \"https://nvd.nist.gov/vuln/detail/CVE-2016-2781\" ], \"PublishedDate\" : \"2017-02-07T15:59:00Z\" , \"LastModifiedDate\" : \"2021-02-25T17:15:00Z\" } ] } ] } ], \"Misconfigurations\" : [ { \"Namespace\" : \"default\" , \"Kind\" : \"Deployment\" , \"Name\" : \"app\" , \"Results\" : [ { \"Target\" : \"Deployment/app\" , \"Class\" : \"config\" , \"Type\" : \"kubernetes\" , \"MisconfSummary\" : { \"Successes\" : 20 , \"Failures\" : 19 , \"Exceptions\" : 0 }, \"Misconfigurations\" : [ { \"Type\" : \"Kubernetes Security Check\" , \"ID\" : \"KSV001\" , \"Title\" : \"Process can elevate its own privileges\" , \"Description\" : \"A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node.\" , \"Message\" : \"Container 'app' of Deployment 'app' should set 'securityContext.allowPrivilegeEscalation' to false\" , \"Namespace\" : \"builtin.kubernetes.KSV001\" , \"Query\" : \"data.builtin.kubernetes.KSV001.deny\" , \"Resolution\" : \"Set 'set containers[].securityContext.allowPrivilegeEscalation' to 'false'.\" , \"Severity\" : \"MEDIUM\" , \"PrimaryURL\" : \"https://avd.aquasec.com/misconfig/ksv001\" , \"References\" : [ \"https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted\" , \"https://avd.aquasec.com/misconfig/ksv001\" ], \"Status\" : \"FAIL\" , \"Layer\" : {}, \"IacMetadata\" : { \"Provider\" : \"Kubernetes\" , \"Service\" : \"general\" , \"StartLine\" : 121 , \"EndLine\" : 133 } }, { \"Type\" : \"Kubernetes Security Check\" , \"ID\" : \"KSV003\" , \"Title\" : \"Default capabilities not dropped\" , \"Description\" : \"The container should drop all default capabilities and add only those that are needed for its execution.\" , \"Message\" : \"Container 'app' of Deployment 'app' should add 'ALL' to 'securityContext.capabilities.drop'\" , \"Namespace\" : \"builtin.kubernetes.KSV003\" , \"Query\" : \"data.builtin.kubernetes.KSV003.deny\" , \"Resolution\" : \"Add 'ALL' to containers[].securityContext.capabilities.drop.\" , \"Severity\" : \"LOW\" , \"PrimaryURL\" : \"https://avd.aquasec.com/misconfig/ksv003\" , \"References\" : [ \"https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/\" , \"https://avd.aquasec.com/misconfig/ksv003\" ], \"Status\" : \"FAIL\" , \"Layer\" : {}, \"IacMetadata\" : { \"Provider\" : \"Kubernetes\" , \"Service\" : \"general\" , \"StartLine\" : 121 , \"EndLine\" : 133 } } ] } ] }, { \"Namespace\" : \"default\" , \"Kind\" : \"ConfigMap\" , \"Name\" : \"kube-root-ca.crt\" } ] } Compliance This section describes Kubernetes specific compliance reports. For an overview of Trivy's Compliance feature, including working with custom compliance, check out the Compliance documentation . The following reports are available out of the box: Compliance Name for command More info NSA, CISA Kubernetes Hardening Guidance v1.2 k8s-nsa Link CIS Benchmark for Kubernetes v1.23 k8s-cis Link Pod Security Standards, Baseline k8s-pss-baseline Link Pod Security Standards, Restricted k8s-pss-restricted Link Examples: Scan the cluster for Kubernetes Pod Security Standards Baseline compliance: trivy k8s cluster --compliance=k8s-pss-baseline --report summary Get the detailed report for checks: trivy k8s cluster --compliance=k8s-cis --report all Get summary report in JSON format: trivy k8s cluster --compliance=k8s-cis --report summary --format json Get detailed report in JSON format: trivy k8s cluster --compliance=k8s-cis --report all --format json KBOM KBOM, Kubernetes Bill of Materials, is a manifest of all the important components that make up your Kubernetes cluster \u2013 Control plane components, Node Components, and Addons, including their versions and images. Which \u201capi-server\u201d version are you currently running? Which flavor of \"kubelet\" is running on each node? What kind of etcd or storage are you currently using? And most importantly \u2013 are there any vulnerabilities known to affect these components? These are all questions that KBOM can help you answer. For more background on KBOM, see here . Trivy can generate KBOM in CycloneDX format: trivy k8s cluster --format cyclonedx --output mykbom.cdx.json Trivy can also scan that generated KBOM (or any SBOM) for vulnerabilities: trivy sbom mykbom.cdx.json Result 2023-09-28T22:52:25.707+0300 INFO Vulnerability scanning is enabled 2023-09-28T22:52:25.707+0300 INFO Detected SBOM format: cyclonedx-json 2023-09-28T22:52:25.717+0300 WARN No OS package is detected. Make sure you haven't deleted any files that contain information about the installed packages. 2023-09-28T22:52:25.717+0300 WARN e.g. files under \"/lib/apk/db/\", \"/var/lib/dpkg/\" and \"/var/lib/rpm\" 2023-09-28T22:52:25.717+0300 INFO Detected OS: debian gnu/linux 2023-09-28T22:52:25.717+0300 WARN unsupported os : debian gnu/linux 2023-09-28T22:52:25.717+0300 INFO Number of language-specific files: 3 2023-09-28T22:52:25.717+0300 INFO Detecting kubernetes vulnerabilities... 2023-09-28T22:52:25.718+0300 INFO Detecting gobinary vulnerabilities... Kubernetes (kubernetes) Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Status \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 k8s.io/kubelet \u2502 CVE-2021-25749 \u2502 HIGH \u2502 fixed \u2502 1.24.0 \u2502 1.22.14, 1.23.11, 1.24.5 \u2502 runAsNonRoot logic bypass for Windows containers \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25749 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2023-2431 \u2502 LOW \u2502 \u2502 \u2502 1.24.14, 1.25.9, 1.26.4, 1.27.1 \u2502 Bypass of seccomp profile enforcement \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2023-2431 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Find more in the documentation for SBOM scanning . Currently KBOM vulnerability matching works for plain Kubernetes distributions and does not work well for vendor variants, including some cloud managed distributions.","title":"Kubernetes"},{"location":"docs/target/kubernetes/#kubernetes","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. Trivy can connect to your Kubernetes cluster and scan it for security issues using the trivy k8s command. This page covers the technical capabilities of Trivy Kubernetes scanning. Trivy can also be installed inside your cluster as a Kubernetes Operator, and continuously scan it. For more about this, please see the [Trivy Operator][https://aquasecurity.github.io/trivy-operator/] project. When scanning a Kubernetes cluster, Trivy differentiates between the following: Cluster infrastructure (e.g api-server, kubelet, addons) Cluster configuration (e.g Roles, ClusterRoles). Application workloads (e.g nginx, postgresql). When scanning any of the above, the container image is scanned separately to the Kubernetes resource definition (the YAML manifest) that defines the resource. Container image is scanned for: - Vulnerabilities - Misconfigurations - Exposed secrets Kubernetes resource definition is scanned for: - Vulnerabilities - partially supported through KBOM scanning - Misconfigurations - Exposed secrets","title":"Kubernetes"},{"location":"docs/target/kubernetes/#kubernetes-target-configurations","text":"Trivy follows the behavior of the kubectl tool as much as possible.","title":"Kubernetes target configurations"},{"location":"docs/target/kubernetes/#scope","text":"The command expects an argument that selects the scope of the scan (similarly to how kubectl expects an argument after kubectl get ). This argument can be: 1. A Kubernetes Kind. e.g pod , deployment , etc. 2. A Kubernetes Resource. e.g pods/mypod , etc. 3. all . Scan common workload kinds, as listed here 4. cluster scan the entire cluster including all namespaced resources and cluster level resources. Examples: trivy k8s all trivy k8s pods trivy k8s deploy myapp trivy k8s pod/mypod trivy k8s pods,deploy trivy k8s cluster Note that the scope argument must appear last in the command line, after any other flag.","title":"Scope"},{"location":"docs/target/kubernetes/#cluster","text":"By default Trivy will look for a kubeconfig configuration file in the default location , and use the default cluster that is specified. You can also specify a kubeconfig using the --kubeconfig flag: trivy k8s --kubeconfig ~/.kube/config2","title":"Cluster"},{"location":"docs/target/kubernetes/#namespace","text":"By default Trivy will scan all namespaces (following kubectl behavior). To specify a namespace use the --namespace flag: trivy k8s --kubeconfig ~/.kube/config2 --namespace default","title":"Namespace"},{"location":"docs/target/kubernetes/#node","text":"You can exclude specific nodes from the scan using the --exclude-nodes flag, which takes a label in the format label-name:label-value and excludes all matching nodes: trivy k8s cluster --report summary --exclude-nodes kubernetes.io/arch:arm6","title":"Node"},{"location":"docs/target/kubernetes/#components-types","text":"You can control what kinds of components are discovered using the --components flag: - --components infra will discover only cluster infrastructure components. - --components workloads will discover only application workloads. - If the flag is omitted: infra, workloads, and RBAC are discovered.","title":"Components types"},{"location":"docs/target/kubernetes/#reporting-and-filtering","text":"Since scanning an entire cluster for any security issue can be overwhelming, By default Trivy summarizes the results in a simple \"summary\" view. By scoping the scan on a specific resource, you can see the detailed report. You can always choose the report granularity using the --report summary / --report all flag. Scan a full cluster and generate a simple summary report: $ trivy k8s --report=summary cluster Filter by severity: trivy k8s --severity=CRITICAL --report=all cluster Filter by scanners (Vulnerabilities, Secrets or Misconfigurations): trivy k8s --scanners=secret --report=summary cluster # or trivy k8s --scanners=config --report=summary cluster The supported output formats are table , which is the default, and json . trivy k8s --format json -o results.json cluster Result { \"ClusterName\" : \"minikube\" , \"Vulnerabilities\" : [ { \"Namespace\" : \"default\" , \"Kind\" : \"Deployment\" , \"Name\" : \"app\" , \"Results\" : [ { \"Target\" : \"ubuntu:latest (ubuntu 22.04)\" , \"Class\" : \"os-pkgs\" , \"Type\" : \"ubuntu\" , \"Vulnerabilities\" : [ { \"VulnerabilityID\" : \"CVE-2016-2781\" , \"PkgName\" : \"coreutils\" , \"InstalledVersion\" : \"8.32-4.1ubuntu1\" , \"Layer\" : { \"Digest\" : \"sha256:125a6e411906fe6b0aaa50fc9d600bf6ff9bb11a8651727ce1ed482dc271c24c\" , \"DiffID\" : \"sha256:e59fc94956120a6c7629f085027578e6357b48061d45714107e79f04a81a6f0c\" }, \"SeveritySource\" : \"ubuntu\" , \"PrimaryURL\" : \"https://avd.aquasec.com/nvd/cve-2016-2781\" , \"DataSource\" : { \"ID\" : \"ubuntu\" , \"Name\" : \"Ubuntu CVE Tracker\" , \"URL\" : \"https://git.launchpad.net/ubuntu-cve-tracker\" }, \"Title\" : \"coreutils: Non-privileged session can escape to the parent session in chroot\" , \"Description\" : \"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.\" , \"Severity\" : \"LOW\" , \"CweIDs\" : [ \"CWE-20\" ], \"VendorSeverity\" : { \"cbl-mariner\" : 2 , \"nvd\" : 2 , \"redhat\" : 2 , \"ubuntu\" : 1 }, \"CVSS\" : { \"nvd\" : { \"V2Vector\" : \"AV:L/AC:L/Au:N/C:N/I:P/A:N\" , \"V3Vector\" : \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N\" , \"V2Score\" : 2.1 , \"V3Score\" : 6.5 }, \"redhat\" : { \"V2Vector\" : \"AV:L/AC:H/Au:N/C:C/I:C/A:C\" , \"V3Vector\" : \"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\" , \"V2Score\" : 6.2 , \"V3Score\" : 8.6 } }, \"References\" : [ \"http://seclists.org/oss-sec/2016/q1/452\" , \"http://www.openwall.com/lists/oss-security/2016/02/28/2\" , \"http://www.openwall.com/lists/oss-security/2016/02/28/3\" , \"https://access.redhat.com/security/cve/CVE-2016-2781\" , \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781\" , \"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E\" , \"https://lore.kernel.org/patchwork/patch/793178/\" , \"https://nvd.nist.gov/vuln/detail/CVE-2016-2781\" ], \"PublishedDate\" : \"2017-02-07T15:59:00Z\" , \"LastModifiedDate\" : \"2021-02-25T17:15:00Z\" } ] } ] } ], \"Misconfigurations\" : [ { \"Namespace\" : \"default\" , \"Kind\" : \"Deployment\" , \"Name\" : \"app\" , \"Results\" : [ { \"Target\" : \"Deployment/app\" , \"Class\" : \"config\" , \"Type\" : \"kubernetes\" , \"MisconfSummary\" : { \"Successes\" : 20 , \"Failures\" : 19 , \"Exceptions\" : 0 }, \"Misconfigurations\" : [ { \"Type\" : \"Kubernetes Security Check\" , \"ID\" : \"KSV001\" , \"Title\" : \"Process can elevate its own privileges\" , \"Description\" : \"A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node.\" , \"Message\" : \"Container 'app' of Deployment 'app' should set 'securityContext.allowPrivilegeEscalation' to false\" , \"Namespace\" : \"builtin.kubernetes.KSV001\" , \"Query\" : \"data.builtin.kubernetes.KSV001.deny\" , \"Resolution\" : \"Set 'set containers[].securityContext.allowPrivilegeEscalation' to 'false'.\" , \"Severity\" : \"MEDIUM\" , \"PrimaryURL\" : \"https://avd.aquasec.com/misconfig/ksv001\" , \"References\" : [ \"https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted\" , \"https://avd.aquasec.com/misconfig/ksv001\" ], \"Status\" : \"FAIL\" , \"Layer\" : {}, \"IacMetadata\" : { \"Provider\" : \"Kubernetes\" , \"Service\" : \"general\" , \"StartLine\" : 121 , \"EndLine\" : 133 } }, { \"Type\" : \"Kubernetes Security Check\" , \"ID\" : \"KSV003\" , \"Title\" : \"Default capabilities not dropped\" , \"Description\" : \"The container should drop all default capabilities and add only those that are needed for its execution.\" , \"Message\" : \"Container 'app' of Deployment 'app' should add 'ALL' to 'securityContext.capabilities.drop'\" , \"Namespace\" : \"builtin.kubernetes.KSV003\" , \"Query\" : \"data.builtin.kubernetes.KSV003.deny\" , \"Resolution\" : \"Add 'ALL' to containers[].securityContext.capabilities.drop.\" , \"Severity\" : \"LOW\" , \"PrimaryURL\" : \"https://avd.aquasec.com/misconfig/ksv003\" , \"References\" : [ \"https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/\" , \"https://avd.aquasec.com/misconfig/ksv003\" ], \"Status\" : \"FAIL\" , \"Layer\" : {}, \"IacMetadata\" : { \"Provider\" : \"Kubernetes\" , \"Service\" : \"general\" , \"StartLine\" : 121 , \"EndLine\" : 133 } } ] } ] }, { \"Namespace\" : \"default\" , \"Kind\" : \"ConfigMap\" , \"Name\" : \"kube-root-ca.crt\" } ] }","title":"Reporting and filtering"},{"location":"docs/target/kubernetes/#compliance","text":"This section describes Kubernetes specific compliance reports. For an overview of Trivy's Compliance feature, including working with custom compliance, check out the Compliance documentation . The following reports are available out of the box: Compliance Name for command More info NSA, CISA Kubernetes Hardening Guidance v1.2 k8s-nsa Link CIS Benchmark for Kubernetes v1.23 k8s-cis Link Pod Security Standards, Baseline k8s-pss-baseline Link Pod Security Standards, Restricted k8s-pss-restricted Link Examples: Scan the cluster for Kubernetes Pod Security Standards Baseline compliance: trivy k8s cluster --compliance=k8s-pss-baseline --report summary Get the detailed report for checks: trivy k8s cluster --compliance=k8s-cis --report all Get summary report in JSON format: trivy k8s cluster --compliance=k8s-cis --report summary --format json Get detailed report in JSON format: trivy k8s cluster --compliance=k8s-cis --report all --format json","title":"Compliance"},{"location":"docs/target/kubernetes/#kbom","text":"KBOM, Kubernetes Bill of Materials, is a manifest of all the important components that make up your Kubernetes cluster \u2013 Control plane components, Node Components, and Addons, including their versions and images. Which \u201capi-server\u201d version are you currently running? Which flavor of \"kubelet\" is running on each node? What kind of etcd or storage are you currently using? And most importantly \u2013 are there any vulnerabilities known to affect these components? These are all questions that KBOM can help you answer. For more background on KBOM, see here . Trivy can generate KBOM in CycloneDX format: trivy k8s cluster --format cyclonedx --output mykbom.cdx.json Trivy can also scan that generated KBOM (or any SBOM) for vulnerabilities: trivy sbom mykbom.cdx.json Result 2023-09-28T22:52:25.707+0300 INFO Vulnerability scanning is enabled 2023-09-28T22:52:25.707+0300 INFO Detected SBOM format: cyclonedx-json 2023-09-28T22:52:25.717+0300 WARN No OS package is detected. Make sure you haven't deleted any files that contain information about the installed packages. 2023-09-28T22:52:25.717+0300 WARN e.g. files under \"/lib/apk/db/\", \"/var/lib/dpkg/\" and \"/var/lib/rpm\" 2023-09-28T22:52:25.717+0300 INFO Detected OS: debian gnu/linux 2023-09-28T22:52:25.717+0300 WARN unsupported os : debian gnu/linux 2023-09-28T22:52:25.717+0300 INFO Number of language-specific files: 3 2023-09-28T22:52:25.717+0300 INFO Detecting kubernetes vulnerabilities... 2023-09-28T22:52:25.718+0300 INFO Detecting gobinary vulnerabilities... Kubernetes (kubernetes) Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Status \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 k8s.io/kubelet \u2502 CVE-2021-25749 \u2502 HIGH \u2502 fixed \u2502 1.24.0 \u2502 1.22.14, 1.23.11, 1.24.5 \u2502 runAsNonRoot logic bypass for Windows containers \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25749 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2023-2431 \u2502 LOW \u2502 \u2502 \u2502 1.24.14, 1.25.9, 1.26.4, 1.27.1 \u2502 Bypass of seccomp profile enforcement \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2023-2431 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 Find more in the documentation for SBOM scanning . Currently KBOM vulnerability matching works for plain Kubernetes distributions and does not work well for vendor variants, including some cloud managed distributions.","title":"KBOM"},{"location":"docs/target/repository/","text":"Code Repository Scan your local or remote code repositories for Vulnerabilities Misconfigurations Secrets Licenses By default, vulnerability and secret scanning are enabled, and you can configure that with --scanners . $ trivy repo ( REPO_PATH | REPO_URL ) For example, you can scan a local repository as below. $ trivy repo ./ It's also possible to scan a single file. $ trivy repo ./trivy-ci-test/Pipfile.lock To scan remote code repositories, you need to specify the URL. $ trivy repo https://github.com/aquasecurity/trivy-ci-test Rationale trivy repo is designed to scan code repositories, and it is intended to be used for scanning local/remote repositories in your machine or in your CI environment. Therefore, unlike container/VM image scanning, it targets lock files such as package-lock.json and does not target artifacts like JAR files, binary files, etc. See here for the detail. Scanners Vulnerabilities It is enabled by default. Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json. See here for the detail. $ trivy repo ~/src/github.com/aquasecurity/trivy-ci-test Result 2020-06-01T17:06:58.652+0300 WARN OS is not detected and vulnerabilities in OS packages are not detected. 2020-06-01T17:06:58.652+0300 INFO Detecting pipenv vulnerabilities... 2020-06-01T17:06:58.691+0300 INFO Detecting cargo vulnerabilities... Pipfile.lock ============ Total: 10 (UNKNOWN: 2, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0) +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | django | CVE-2020-7471 | HIGH | 2.0.9 | 3.0.3, 2.2.10, 1.11.28 | django: potential | | | | | | | SQL injection via | | | | | | | StringAgg(delimiter) | + +------------------+----------+ +------------------------+------------------------------------+ | | CVE-2019-19844 | MEDIUM | | 3.0.1, 2.2.9, 1.11.27 | Django: crafted email address | | | | | | | allows account takeover | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-3498 | | | 2.1.5, 2.0.10, 1.11.18 | python-django: Content | | | | | | | spoofing via URL path in | | | | | | | default 404 page | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-6975 | | | 2.1.6, 2.0.11, 1.11.19 | python-django: | | | | | | | memory exhaustion in | | | | | | | django.utils.numberformat.format() | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ ... Misconfigurations It is disabled by default and can be enabled with --scanners config . See here for the detail. $ trivy repo --scanners config ( REPO_PATH | REPO_URL ) Secrets It is enabled by default. See here for the detail. $ trivy repo ( REPO_PATH | REPO_URL ) Licenses It is disabled by default. See here for the detail. $ trivy repo --scanners license ( REPO_PATH | REPO_URL ) SBOM generation Trivy can generate SBOM for code repositories. See here for the detail. References The following flags and environmental variables are available for remote git repositories. Scanning a Branch Pass a --branch argument with a valid branch name on the remote repository provided: $ trivy repo --branch <branch-name> <repo-name> Scanning upto a Commit Pass a --commit argument with a valid commit hash on the remote repository provided: $ trivy repo --commit <commit-hash> <repo-name> Scanning a Tag Pass a --tag argument with a valid tag on the remote repository provided: $ trivy repo --tag <tag-name> <repo-name> Scanning Private Repositories In order to scan private GitHub or GitLab repositories, the environment variable GITHUB_TOKEN or GITLAB_TOKEN must be set, respectively, with a valid token that has access to the private repository being scanned. The GITHUB_TOKEN environment variable will take precedence over GITLAB_TOKEN , so if a private GitLab repository will be scanned, then GITHUB_TOKEN must be unset. You can find how to generate your GitHub Token in the following GitHub documentation. For example: $ export GITHUB_TOKEN=\"your_private_github_token\" $ trivy repo <your private GitHub repo URL> # or $ export GITLAB_TOKEN=\"your_private_gitlab_token\" $ trivy repo <your private GitLab repo URL>","title":"Code Repository"},{"location":"docs/target/repository/#code-repository","text":"Scan your local or remote code repositories for Vulnerabilities Misconfigurations Secrets Licenses By default, vulnerability and secret scanning are enabled, and you can configure that with --scanners . $ trivy repo ( REPO_PATH | REPO_URL ) For example, you can scan a local repository as below. $ trivy repo ./ It's also possible to scan a single file. $ trivy repo ./trivy-ci-test/Pipfile.lock To scan remote code repositories, you need to specify the URL. $ trivy repo https://github.com/aquasecurity/trivy-ci-test","title":"Code Repository"},{"location":"docs/target/repository/#rationale","text":"trivy repo is designed to scan code repositories, and it is intended to be used for scanning local/remote repositories in your machine or in your CI environment. Therefore, unlike container/VM image scanning, it targets lock files such as package-lock.json and does not target artifacts like JAR files, binary files, etc. See here for the detail.","title":"Rationale"},{"location":"docs/target/repository/#scanners","text":"","title":"Scanners"},{"location":"docs/target/repository/#vulnerabilities","text":"It is enabled by default. Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json. See here for the detail. $ trivy repo ~/src/github.com/aquasecurity/trivy-ci-test Result 2020-06-01T17:06:58.652+0300 WARN OS is not detected and vulnerabilities in OS packages are not detected. 2020-06-01T17:06:58.652+0300 INFO Detecting pipenv vulnerabilities... 2020-06-01T17:06:58.691+0300 INFO Detecting cargo vulnerabilities... Pipfile.lock ============ Total: 10 (UNKNOWN: 2, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0) +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ | django | CVE-2020-7471 | HIGH | 2.0.9 | 3.0.3, 2.2.10, 1.11.28 | django: potential | | | | | | | SQL injection via | | | | | | | StringAgg(delimiter) | + +------------------+----------+ +------------------------+------------------------------------+ | | CVE-2019-19844 | MEDIUM | | 3.0.1, 2.2.9, 1.11.27 | Django: crafted email address | | | | | | | allows account takeover | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-3498 | | | 2.1.5, 2.0.10, 1.11.18 | python-django: Content | | | | | | | spoofing via URL path in | | | | | | | default 404 page | + +------------------+ + +------------------------+------------------------------------+ | | CVE-2019-6975 | | | 2.1.6, 2.0.11, 1.11.19 | python-django: | | | | | | | memory exhaustion in | | | | | | | django.utils.numberformat.format() | +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+ ...","title":"Vulnerabilities"},{"location":"docs/target/repository/#misconfigurations","text":"It is disabled by default and can be enabled with --scanners config . See here for the detail. $ trivy repo --scanners config ( REPO_PATH | REPO_URL )","title":"Misconfigurations"},{"location":"docs/target/repository/#secrets","text":"It is enabled by default. See here for the detail. $ trivy repo ( REPO_PATH | REPO_URL )","title":"Secrets"},{"location":"docs/target/repository/#licenses","text":"It is disabled by default. See here for the detail. $ trivy repo --scanners license ( REPO_PATH | REPO_URL )","title":"Licenses"},{"location":"docs/target/repository/#sbom-generation","text":"Trivy can generate SBOM for code repositories. See here for the detail.","title":"SBOM generation"},{"location":"docs/target/repository/#references","text":"The following flags and environmental variables are available for remote git repositories.","title":"References"},{"location":"docs/target/repository/#scanning-a-branch","text":"Pass a --branch argument with a valid branch name on the remote repository provided: $ trivy repo --branch <branch-name> <repo-name>","title":"Scanning a Branch"},{"location":"docs/target/repository/#scanning-upto-a-commit","text":"Pass a --commit argument with a valid commit hash on the remote repository provided: $ trivy repo --commit <commit-hash> <repo-name>","title":"Scanning upto a Commit"},{"location":"docs/target/repository/#scanning-a-tag","text":"Pass a --tag argument with a valid tag on the remote repository provided: $ trivy repo --tag <tag-name> <repo-name>","title":"Scanning a Tag"},{"location":"docs/target/repository/#scanning-private-repositories","text":"In order to scan private GitHub or GitLab repositories, the environment variable GITHUB_TOKEN or GITLAB_TOKEN must be set, respectively, with a valid token that has access to the private repository being scanned. The GITHUB_TOKEN environment variable will take precedence over GITLAB_TOKEN , so if a private GitLab repository will be scanned, then GITHUB_TOKEN must be unset. You can find how to generate your GitHub Token in the following GitHub documentation. For example: $ export GITHUB_TOKEN=\"your_private_github_token\" $ trivy repo <your private GitHub repo URL> # or $ export GITLAB_TOKEN=\"your_private_gitlab_token\" $ trivy repo <your private GitLab repo URL>","title":"Scanning Private Repositories"},{"location":"docs/target/rootfs/","text":"Rootfs Rootfs scanning is for special use cases such as Host machine Root filesystem Unpacked filesystem $ trivy rootfs /path/to/rootfs Note Rootfs scanning works differently from the Filesystem scanning. You should use trivy fs to scan your local projects in CI/CD. See here for the differences.","title":"Rootfs"},{"location":"docs/target/rootfs/#rootfs","text":"Rootfs scanning is for special use cases such as Host machine Root filesystem Unpacked filesystem $ trivy rootfs /path/to/rootfs Note Rootfs scanning works differently from the Filesystem scanning. You should use trivy fs to scan your local projects in CI/CD. See here for the differences.","title":"Rootfs"},{"location":"docs/target/sbom/","text":"SBOM scanning Trivy can take the following SBOM formats as an input and scan for vulnerabilities. CycloneDX SPDX SPDX JSON CycloneDX-type attestation KBOM in CycloneDX format To scan SBOM, you can use the sbom subcommand and pass the path to the SBOM. The input format is automatically detected. $ trivy sbom /path/to/sbom_file Note Passing SBOMs generated by tool other than Trivy may result in inaccurate detection because Trivy relies on custom properties in SBOM for accurate scanning. CycloneDX Trivy supports CycloneDX as an input. Note CycloneDX XML is not supported at the moment. $ trivy sbom /path/to/cyclonedx.json SPDX Trivy supports the SPDX SBOM as an input. The following SPDX formats are supported: Tag-value ( --format spdx ) JSON ( --format spdx-json ) $ trivy image --format spdx-json --output spdx.json alpine:3.16.0 $ trivy sbom spdx.json Result 2022-09-15T21:32:27.168+0300 INFO Vulnerability scanning is enabled 2022-09-15T21:32:27.169+0300 INFO Detected SBOM format: spdx-json 2022-09-15T21:32:27.210+0300 INFO Detected OS: alpine 2022-09-15T21:32:27.210+0300 INFO Detecting Alpine vulnerabilities... 2022-09-15T21:32:27.211+0300 INFO Number of language-specific files: 0 spdx.json (alpine 3.16.0) ========================= Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 2, CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 busybox \u2502 CVE-2022-30065 \u2502 HIGH \u2502 1.35.0-r13 \u2502 1.35.0-r15 \u2502 busybox: A use-after-free in Busybox's awk applet leads to \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 denial of service... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-30065 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 libcrypto1.1 \u2502 CVE-2022-2097 \u2502 MEDIUM \u2502 1.1.1o-r0 \u2502 1.1.1q-r0 \u2502 openssl: AES OCB fails to encrypt some bytes \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-2097 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 libssl1.1 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 ssl_client \u2502 CVE-2022-30065 \u2502 HIGH \u2502 1.35.0-r13 \u2502 1.35.0-r15 \u2502 busybox: A use-after-free in Busybox's awk applet leads to \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 denial of service... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-30065 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 zlib \u2502 CVE-2022-37434 \u2502 CRITICAL \u2502 1.2.12-r1 \u2502 1.2.12-r2 \u2502 zlib: a heap-based buffer over-read or buffer overflow in \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 inflate in inflate.c... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-37434 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 SBOM attestation You can also scan an SBOM attestation. In the following example, Cosign gets an attestation and Trivy scans it. You must create CycloneDX-type attestation before trying the example. To learn more about how to create an CycloneDX-Type attestation and attach it to an image, see the SBOM attestation page . $ cosign verify-attestation --key /path/to/cosign.pub --type cyclonedx <IMAGE> > sbom.cdx.intoto.jsonl $ trivy sbom ./sbom.cdx.intoto.jsonl sbom.cdx.intoto.jsonl ( alpine 3 .7.3 ) ========================= Total: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 musl \u2502 CVE-2019-14697 \u2502 CRITICAL \u2502 1 .1.18-r3 \u2502 1 .1.18-r4 \u2502 musl libc through 1 .1.23 has an x87 floating-point stack \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 adjustment im ...... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-14697 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 KBOM To read more about KBOM, see the documentation for Kubernetes scanning . shell $ trivy k8s --format cyclonedx cluster -o kbom.json $ trivy sbom kbom.json 2023-09-28T22:52:25.707+0300 INFO Vulnerability scanning is enabled 2023-09-28T22:52:25.707+0300 INFO Detected SBOM format: cyclonedx-json 2023-09-28T22:52:25.717+0300 WARN No OS package is detected. Make sure you haven't deleted any files that contain information about the installed packages. 2023-09-28T22:52:25.717+0300 WARN e.g. files under \"/lib/apk/db/\", \"/var/lib/dpkg/\" and \"/var/lib/rpm\" 2023-09-28T22:52:25.717+0300 INFO Detected OS: debian gnu/linux 2023-09-28T22:52:25.717+0300 WARN unsupported os : debian gnu/linux 2023-09-28T22:52:25.717+0300 INFO Number of language-specific files: 3 2023-09-28T22:52:25.717+0300 INFO Detecting kubernetes vulnerabilities... 2023-09-28T22:52:25.718+0300 INFO Detecting gobinary vulnerabilities... Kubernetes (kubernetes) Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Status \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 k8s.io/kubelet \u2502 CVE-2021-25749 \u2502 HIGH \u2502 fixed \u2502 1.24.0 \u2502 1.22.14, 1.23.11, 1.24.5 \u2502 runAsNonRoot logic bypass for Windows containers \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25749 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2023-2431 \u2502 LOW \u2502 \u2502 \u2502 1.24.14, 1.25.9, 1.26.4, 1.27.1 \u2502 Bypass of seccomp profile enforcement \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2023-2431 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"SBOM"},{"location":"docs/target/sbom/#sbom-scanning","text":"Trivy can take the following SBOM formats as an input and scan for vulnerabilities. CycloneDX SPDX SPDX JSON CycloneDX-type attestation KBOM in CycloneDX format To scan SBOM, you can use the sbom subcommand and pass the path to the SBOM. The input format is automatically detected. $ trivy sbom /path/to/sbom_file Note Passing SBOMs generated by tool other than Trivy may result in inaccurate detection because Trivy relies on custom properties in SBOM for accurate scanning.","title":"SBOM scanning"},{"location":"docs/target/sbom/#cyclonedx","text":"Trivy supports CycloneDX as an input. Note CycloneDX XML is not supported at the moment. $ trivy sbom /path/to/cyclonedx.json","title":"CycloneDX"},{"location":"docs/target/sbom/#spdx","text":"Trivy supports the SPDX SBOM as an input. The following SPDX formats are supported: Tag-value ( --format spdx ) JSON ( --format spdx-json ) $ trivy image --format spdx-json --output spdx.json alpine:3.16.0 $ trivy sbom spdx.json Result 2022-09-15T21:32:27.168+0300 INFO Vulnerability scanning is enabled 2022-09-15T21:32:27.169+0300 INFO Detected SBOM format: spdx-json 2022-09-15T21:32:27.210+0300 INFO Detected OS: alpine 2022-09-15T21:32:27.210+0300 INFO Detecting Alpine vulnerabilities... 2022-09-15T21:32:27.211+0300 INFO Number of language-specific files: 0 spdx.json (alpine 3.16.0) ========================= Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 2, CRITICAL: 1) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 busybox \u2502 CVE-2022-30065 \u2502 HIGH \u2502 1.35.0-r13 \u2502 1.35.0-r15 \u2502 busybox: A use-after-free in Busybox's awk applet leads to \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 denial of service... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-30065 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 libcrypto1.1 \u2502 CVE-2022-2097 \u2502 MEDIUM \u2502 1.1.1o-r0 \u2502 1.1.1q-r0 \u2502 openssl: AES OCB fails to encrypt some bytes \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-2097 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 libssl1.1 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 ssl_client \u2502 CVE-2022-30065 \u2502 HIGH \u2502 1.35.0-r13 \u2502 1.35.0-r15 \u2502 busybox: A use-after-free in Busybox's awk applet leads to \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 denial of service... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-30065 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 zlib \u2502 CVE-2022-37434 \u2502 CRITICAL \u2502 1.2.12-r1 \u2502 1.2.12-r2 \u2502 zlib: a heap-based buffer over-read or buffer overflow in \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 inflate in inflate.c... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-37434 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"SPDX"},{"location":"docs/target/sbom/#sbom-attestation","text":"You can also scan an SBOM attestation. In the following example, Cosign gets an attestation and Trivy scans it. You must create CycloneDX-type attestation before trying the example. To learn more about how to create an CycloneDX-Type attestation and attach it to an image, see the SBOM attestation page . $ cosign verify-attestation --key /path/to/cosign.pub --type cyclonedx <IMAGE> > sbom.cdx.intoto.jsonl $ trivy sbom ./sbom.cdx.intoto.jsonl sbom.cdx.intoto.jsonl ( alpine 3 .7.3 ) ========================= Total: 2 ( UNKNOWN: 0 , LOW: 0 , MEDIUM: 0 , HIGH: 0 , CRITICAL: 2 ) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 musl \u2502 CVE-2019-14697 \u2502 CRITICAL \u2502 1 .1.18-r3 \u2502 1 .1.18-r4 \u2502 musl libc through 1 .1.23 has an x87 floating-point stack \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 adjustment im ...... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2019-14697 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 musl-utils \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"SBOM attestation"},{"location":"docs/target/sbom/#kbom","text":"To read more about KBOM, see the documentation for Kubernetes scanning . shell $ trivy k8s --format cyclonedx cluster -o kbom.json $ trivy sbom kbom.json 2023-09-28T22:52:25.707+0300 INFO Vulnerability scanning is enabled 2023-09-28T22:52:25.707+0300 INFO Detected SBOM format: cyclonedx-json 2023-09-28T22:52:25.717+0300 WARN No OS package is detected. Make sure you haven't deleted any files that contain information about the installed packages. 2023-09-28T22:52:25.717+0300 WARN e.g. files under \"/lib/apk/db/\", \"/var/lib/dpkg/\" and \"/var/lib/rpm\" 2023-09-28T22:52:25.717+0300 INFO Detected OS: debian gnu/linux 2023-09-28T22:52:25.717+0300 WARN unsupported os : debian gnu/linux 2023-09-28T22:52:25.717+0300 INFO Number of language-specific files: 3 2023-09-28T22:52:25.717+0300 INFO Detecting kubernetes vulnerabilities... 2023-09-28T22:52:25.718+0300 INFO Detecting gobinary vulnerabilities... Kubernetes (kubernetes) Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Status \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 k8s.io/kubelet \u2502 CVE-2021-25749 \u2502 HIGH \u2502 fixed \u2502 1.24.0 \u2502 1.22.14, 1.23.11, 1.24.5 \u2502 runAsNonRoot logic bypass for Windows containers \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25749 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2023-2431 \u2502 LOW \u2502 \u2502 \u2502 1.24.14, 1.25.9, 1.26.4, 1.27.1 \u2502 Bypass of seccomp profile enforcement \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2023-2431 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518","title":"KBOM"},{"location":"docs/target/vm/","text":"Virtual Machine Image EXPERIMENTAL This feature might change without preserving backwards compatibility. To scan virtual machine (VM) images, you can use the vm subcommand. Targets The following targets are currently supported: Local file AWS EC2 Amazon Machine Image (AMI) Amazon Elastic Block Store (EBS) Snapshot Local file Pass the path to your local VM image file. $ trivy vm --scanners vuln disk.vmdk Result disk.vmdk (amazon 2 (Karoo)) =========================================================================================== Total: 802 (UNKNOWN: 0, LOW: 17, MEDIUM: 554, HIGH: 221, CRITICAL: 10) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 amazon-ssm-agent \u2502 CVE-2022-24675 \u2502 HIGH \u2502 3.0.529.0-1.amzn2 \u2502 3.1.1575.0-1.amzn2 \u2502 golang: encoding/pem: fix stack overflow in Decode \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-24675 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 bind-export-libs \u2502 CVE-2021-25215 \u2502 \u2502 32:9.11.4-26.P2.amzn2.4 \u2502 32:9.11.4-26.P2.amzn2.5 \u2502 bind: An assertion check can fail while answering queries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for DNAME records... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25215 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-25214 \u2502 MEDIUM \u2502 \u2502 32:9.11.4-26.P2.amzn2.5.2 \u2502 bind: Broken inbound incremental zone update (IXFR) can \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 cause named to terminate... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25214 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 bind-libs \u2502 CVE-2021-25215 \u2502 HIGH \u2502 \u2502 32:9.11.4-26.P2.amzn2.5 \u2502 bind: An assertion check can fail while answering queries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for DNAME records... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25215 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-25214 \u2502 MEDIUM \u2502 \u2502 32:9.11.4-26.P2.amzn2.5.2 \u2502 bind: Broken inbound incremental zone update (IXFR) can \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 cause named to terminate... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25214 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 bind-libs-lite \u2502 CVE-2021-25215 \u2502 HIGH \u2502 \u2502 32:9.11.4-26.P2.amzn2.5 \u2502 bind: An assertion check can fail while answering queries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for DNAME records... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25215 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-25214 \u2502 MEDIUM \u2502 \u2502 32:9.11.4-26.P2.amzn2.5.2 \u2502 bind: Broken inbound incremental zone update (IXFR) can \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 cause named to terminate... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25214 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 ... Amazon Machine Image (AMI) You can specify your AMI ID with the ami: prefix. $ trivy vm ami: ${ your_ami_id } Note AMIs in the marketplace are not supported because the EBS direct APIs don't support that. See the AWS documentation for the detail. Example $ trivy vm --scanners vuln ami:ami-0123456789abcdefg If you want to scan a AMI of non-default setting region, you can set any region via --aws-region option. $ trivy vm --aws-region ap-northeast-1 ami:ami-0123456789abcdefg Required Actions Some actions on EBS are also necessary since Trivy scans an EBS snapshot tied to the specified AMI under the hood. ec2:DescribeImages ebs:ListSnapshotBlocks ebs:GetSnapshotBlock Amazon Elastic Block Store (EBS) Snapshot You can specify your EBS snapshot ID with the ebs: prefix. $ trivy vm ebs: ${ your_ebs_snapshot_id } Note Public snapshots are not supported because the EBS direct APIs don't support that. See the AWS documentation for the detail. Example $ trivy vm --scanners vuln ebs:snap-0123456789abcdefg If you want to scan an EBS Snapshot of non-default setting region, you can set any region via --aws-region option. $ trivy vm --aws-region ap-northeast-1 ebs:ebs-0123456789abcdefg The above command takes a while as it calls EBS API and fetches the EBS blocks. If you want to scan the same snapshot several times, you can download the snapshot locally by using coldsnap maintained by AWS. Then, Trivy can scan the local VM image file. $ coldsnap download snap-0123456789abcdefg disk.img $ trivy vm ./disk.img Required Actions ebs:ListSnapshotBlocks ebs:GetSnapshotBlock Scanners Trivy supports VM image scanning for Vulnerabilities Misconfigurations Secrets Licenses Vulnerabilities It is enabled by default. You can simply specify your VM image location. It detects known vulnerabilities in your VM image. See here for the detail. $ trivy vm [YOUR_VM_IMAGE] Misconfigurations It is supported, but it is not useful in most cases. As mentioned here , Trivy mainly supports Infrastructure as Code (IaC) files for misconfigurations. If your VM image includes IaC files such as Kubernetes YAML files or Terraform files, you should enable this feature with --scanners config . $ trivy vm --scanners config [YOUR_VM_IMAGE] Secrets It is enabled by default. See here for the detail. $ trivy vm [ YOUR_VM_IMAGE ] Tip The scanning could be faster if you enable only vulnerability scanning ( --scanners vuln ) because Trivy tries to download only necessary blocks for vulnerability detection. Licenses It is disabled by default. See here for the detail. $ trivy vm --scanners license [ YOUR_VM_IMAGE ] SBOM generation Trivy can generate SBOM for VM images. See here for the detail. Supported Architectures Virtual machine images Image format Support VMDK \u2714 OVA VHD VHDX QCOW2 VMDK disk types VMDK disk type Support streamOptimized \u2714 monolithicSparse vmfs vmfsSparse twoGbMaxExtentSparse monolithicFlat twoGbMaxExtentFlat vmfsRaw fullDevice partitionedDevice vmfsRawDeviceMap vmfsPassthroughRawDeviceMap Reference: VMware Virtual Disk Format 1.1.pdf Disk partitions Disk format Support Master boot record (MBR) \u2714 Extended master boot record GUID partition table (GPT) \u2714 Logical volume manager (LVM) Filesystems Filesystem format Support XFS \u2714 EXT4 \u2714 EXT2/3 ZFS","title":"Virtual Machine Image"},{"location":"docs/target/vm/#virtual-machine-image","text":"EXPERIMENTAL This feature might change without preserving backwards compatibility. To scan virtual machine (VM) images, you can use the vm subcommand.","title":"Virtual Machine Image"},{"location":"docs/target/vm/#targets","text":"The following targets are currently supported: Local file AWS EC2 Amazon Machine Image (AMI) Amazon Elastic Block Store (EBS) Snapshot","title":"Targets"},{"location":"docs/target/vm/#local-file","text":"Pass the path to your local VM image file. $ trivy vm --scanners vuln disk.vmdk Result disk.vmdk (amazon 2 (Karoo)) =========================================================================================== Total: 802 (UNKNOWN: 0, LOW: 17, MEDIUM: 554, HIGH: 221, CRITICAL: 10) \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Library \u2502 Vulnerability \u2502 Severity \u2502 Installed Version \u2502 Fixed Version \u2502 Title \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 amazon-ssm-agent \u2502 CVE-2022-24675 \u2502 HIGH \u2502 3.0.529.0-1.amzn2 \u2502 3.1.1575.0-1.amzn2 \u2502 golang: encoding/pem: fix stack overflow in Decode \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2022-24675 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 bind-export-libs \u2502 CVE-2021-25215 \u2502 \u2502 32:9.11.4-26.P2.amzn2.4 \u2502 32:9.11.4-26.P2.amzn2.5 \u2502 bind: An assertion check can fail while answering queries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for DNAME records... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25215 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-25214 \u2502 MEDIUM \u2502 \u2502 32:9.11.4-26.P2.amzn2.5.2 \u2502 bind: Broken inbound incremental zone update (IXFR) can \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 cause named to terminate... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25214 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 bind-libs \u2502 CVE-2021-25215 \u2502 HIGH \u2502 \u2502 32:9.11.4-26.P2.amzn2.5 \u2502 bind: An assertion check can fail while answering queries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for DNAME records... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25215 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-25214 \u2502 MEDIUM \u2502 \u2502 32:9.11.4-26.P2.amzn2.5.2 \u2502 bind: Broken inbound incremental zone update (IXFR) can \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 cause named to terminate... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25214 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 bind-libs-lite \u2502 CVE-2021-25215 \u2502 HIGH \u2502 \u2502 32:9.11.4-26.P2.amzn2.5 \u2502 bind: An assertion check can fail while answering queries \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 for DNAME records... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25215 \u2502 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u2502 \u2502 CVE-2021-25214 \u2502 MEDIUM \u2502 \u2502 32:9.11.4-26.P2.amzn2.5.2 \u2502 bind: Broken inbound incremental zone update (IXFR) can \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 cause named to terminate... \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 https://avd.aquasec.com/nvd/cve-2021-25214 \u2502 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524 ...","title":"Local file"},{"location":"docs/target/vm/#amazon-machine-image-ami","text":"You can specify your AMI ID with the ami: prefix. $ trivy vm ami: ${ your_ami_id } Note AMIs in the marketplace are not supported because the EBS direct APIs don't support that. See the AWS documentation for the detail.","title":"Amazon Machine Image (AMI)"},{"location":"docs/target/vm/#example","text":"$ trivy vm --scanners vuln ami:ami-0123456789abcdefg If you want to scan a AMI of non-default setting region, you can set any region via --aws-region option. $ trivy vm --aws-region ap-northeast-1 ami:ami-0123456789abcdefg","title":"Example"},{"location":"docs/target/vm/#required-actions","text":"Some actions on EBS are also necessary since Trivy scans an EBS snapshot tied to the specified AMI under the hood. ec2:DescribeImages ebs:ListSnapshotBlocks ebs:GetSnapshotBlock","title":"Required Actions"},{"location":"docs/target/vm/#amazon-elastic-block-store-ebs-snapshot","text":"You can specify your EBS snapshot ID with the ebs: prefix. $ trivy vm ebs: ${ your_ebs_snapshot_id } Note Public snapshots are not supported because the EBS direct APIs don't support that. See the AWS documentation for the detail.","title":"Amazon Elastic Block Store (EBS) Snapshot"},{"location":"docs/target/vm/#example_1","text":"$ trivy vm --scanners vuln ebs:snap-0123456789abcdefg If you want to scan an EBS Snapshot of non-default setting region, you can set any region via --aws-region option. $ trivy vm --aws-region ap-northeast-1 ebs:ebs-0123456789abcdefg The above command takes a while as it calls EBS API and fetches the EBS blocks. If you want to scan the same snapshot several times, you can download the snapshot locally by using coldsnap maintained by AWS. Then, Trivy can scan the local VM image file. $ coldsnap download snap-0123456789abcdefg disk.img $ trivy vm ./disk.img","title":"Example"},{"location":"docs/target/vm/#required-actions_1","text":"ebs:ListSnapshotBlocks ebs:GetSnapshotBlock","title":"Required Actions"},{"location":"docs/target/vm/#scanners","text":"Trivy supports VM image scanning for Vulnerabilities Misconfigurations Secrets Licenses","title":"Scanners"},{"location":"docs/target/vm/#vulnerabilities","text":"It is enabled by default. You can simply specify your VM image location. It detects known vulnerabilities in your VM image. See here for the detail. $ trivy vm [YOUR_VM_IMAGE]","title":"Vulnerabilities"},{"location":"docs/target/vm/#misconfigurations","text":"It is supported, but it is not useful in most cases. As mentioned here , Trivy mainly supports Infrastructure as Code (IaC) files for misconfigurations. If your VM image includes IaC files such as Kubernetes YAML files or Terraform files, you should enable this feature with --scanners config . $ trivy vm --scanners config [YOUR_VM_IMAGE]","title":"Misconfigurations"},{"location":"docs/target/vm/#secrets","text":"It is enabled by default. See here for the detail. $ trivy vm [ YOUR_VM_IMAGE ] Tip The scanning could be faster if you enable only vulnerability scanning ( --scanners vuln ) because Trivy tries to download only necessary blocks for vulnerability detection.","title":"Secrets"},{"location":"docs/target/vm/#licenses","text":"It is disabled by default. See here for the detail. $ trivy vm --scanners license [ YOUR_VM_IMAGE ]","title":"Licenses"},{"location":"docs/target/vm/#sbom-generation","text":"Trivy can generate SBOM for VM images. See here for the detail.","title":"SBOM generation"},{"location":"docs/target/vm/#supported-architectures","text":"","title":"Supported Architectures"},{"location":"docs/target/vm/#virtual-machine-images","text":"Image format Support VMDK \u2714 OVA VHD VHDX QCOW2","title":"Virtual machine images"},{"location":"docs/target/vm/#vmdk-disk-types","text":"VMDK disk type Support streamOptimized \u2714 monolithicSparse vmfs vmfsSparse twoGbMaxExtentSparse monolithicFlat twoGbMaxExtentFlat vmfsRaw fullDevice partitionedDevice vmfsRawDeviceMap vmfsPassthroughRawDeviceMap Reference: VMware Virtual Disk Format 1.1.pdf","title":"VMDK disk types"},{"location":"docs/target/vm/#disk-partitions","text":"Disk format Support Master boot record (MBR) \u2714 Extended master boot record GUID partition table (GPT) \u2714 Logical volume manager (LVM)","title":"Disk partitions"},{"location":"docs/target/vm/#filesystems","text":"Filesystem format Support XFS \u2714 EXT4 \u2714 EXT2/3 ZFS","title":"Filesystems"},{"location":"ecosystem/","text":"Ecosystem Trivy is integrated into many popular tools and applications, so that you can easily add security to your workflow. In this section you will find an aggregation of the different integrations. Integrations are listed as either \"official\" or \"community\". Official integrations are developed by the core Trivy team and supported by it. Community integrations are integrations developed by the community, and collected here for your convenience. For support or questions about community integrations, please contact the original developers. \ud83d\udc48 Please use the side-navigation on the left in order to browse the different topics. Add missing integration We are happy to showcase community integrations in this section. To suggest an addition simply make a Pull Request to add the missing integration.","title":"Overview"},{"location":"ecosystem/#ecosystem","text":"Trivy is integrated into many popular tools and applications, so that you can easily add security to your workflow. In this section you will find an aggregation of the different integrations. Integrations are listed as either \"official\" or \"community\". Official integrations are developed by the core Trivy team and supported by it. Community integrations are integrations developed by the community, and collected here for your convenience. For support or questions about community integrations, please contact the original developers. \ud83d\udc48 Please use the side-navigation on the left in order to browse the different topics.","title":"Ecosystem"},{"location":"ecosystem/#add-missing-integration","text":"We are happy to showcase community integrations in this section. To suggest an addition simply make a Pull Request to add the missing integration.","title":"Add missing integration"},{"location":"ecosystem/cicd/","text":"CI/CD Integrations GitHub Actions GitHub Actions is GitHub's native CI/CD and job orchestration service. trivy-action (Official) GitHub Action for integrating Trivy into your GitHub pipeline \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-action Azure DevOps (Official) Azure Devops is Microsoft Azure cloud native CI/CD service. Trivy has a \"Azure Devops Pipelines Task\" for Trivy, that lets you easily introduce security scanning into your workflow, with an integrated Azure Devops UI. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-azure-pipelines-task trivy-action (Community) GitHub Action to scan vulnerability using Trivy. If vulnerabilities are found by Trivy, it creates a GitHub Issue. \ud83d\udc49 Get it at: https://github.com/marketplace/actions/trivy-action trivy-github-issues (Community) In this action, Trivy scans the dependency files such as package-lock.json and go.sum in your repository, then create GitHub issues according to the result. \ud83d\udc49 Get it at: https://github.com/marketplace/actions/trivy-github-issues Buildkite Plugin (Community) The trivy buildkite plugin provides a convenient mechanism for running the open-source trivy static analysis tool on your project. \ud83d\udc49 Get it at: https://github.com/equinixmetal-buildkite/trivy-buildkite-plugin Semaphore (Community) Semaphore is a CI/CD service. You can use Trivy in Semaphore for scanning code, containers, infrastructure, and Kubernetes in Semaphore workflow. \ud83d\udc49 Get it at: https://semaphoreci.com/blog/continuous-container-vulnerability-testing-with-trivy CircleCI (Community) CircleCI is a CI/CD service. You can use the Trivy Orb for Circle CI to introduce security scanning into your workflow. \ud83d\udc49 Get it at: https://circleci.com/developer/orbs/orb/fifteen5/trivy-orb Source: https://github.com/15five/trivy-orb Woodpecker CI (Community) Example Trivy step in pipeline pipeline: securitycheck: image: aquasec/trivy:latest commands: # use any trivy command, if exit code is 0 woodpecker marks it as passed, else it assumes it failed - trivy fs --exit-code 1 --skip-dirs web/ --skip-dirs docs/ --severity MEDIUM,HIGH,CRITICAL . Woodpecker does use Trivy itself so you can see it in use there . Concourse CI (Community) Concourse CI is a CI/CD service. You can use Trivy Resource in Concourse for scanning containers and introducing security scanning into your workflow. It has capabilities to fail the pipeline, create issues, alert communication channels (using respective resources) based on Trivy scan output. \ud83d\udc49 Get it at: https://github.com/Comcast/trivy-resource/","title":"CI/CD"},{"location":"ecosystem/cicd/#cicd-integrations","text":"","title":"CI/CD Integrations"},{"location":"ecosystem/cicd/#github-actions","text":"GitHub Actions is GitHub's native CI/CD and job orchestration service.","title":"GitHub Actions"},{"location":"ecosystem/cicd/#trivy-action-official","text":"GitHub Action for integrating Trivy into your GitHub pipeline \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-action","title":"trivy-action (Official)"},{"location":"ecosystem/cicd/#azure-devops-official","text":"Azure Devops is Microsoft Azure cloud native CI/CD service. Trivy has a \"Azure Devops Pipelines Task\" for Trivy, that lets you easily introduce security scanning into your workflow, with an integrated Azure Devops UI. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-azure-pipelines-task","title":"Azure DevOps (Official)"},{"location":"ecosystem/cicd/#trivy-action-community","text":"GitHub Action to scan vulnerability using Trivy. If vulnerabilities are found by Trivy, it creates a GitHub Issue. \ud83d\udc49 Get it at: https://github.com/marketplace/actions/trivy-action","title":"trivy-action (Community)"},{"location":"ecosystem/cicd/#trivy-github-issues-community","text":"In this action, Trivy scans the dependency files such as package-lock.json and go.sum in your repository, then create GitHub issues according to the result. \ud83d\udc49 Get it at: https://github.com/marketplace/actions/trivy-github-issues","title":"trivy-github-issues (Community)"},{"location":"ecosystem/cicd/#buildkite-plugin-community","text":"The trivy buildkite plugin provides a convenient mechanism for running the open-source trivy static analysis tool on your project. \ud83d\udc49 Get it at: https://github.com/equinixmetal-buildkite/trivy-buildkite-plugin","title":"Buildkite Plugin (Community)"},{"location":"ecosystem/cicd/#semaphore-community","text":"Semaphore is a CI/CD service. You can use Trivy in Semaphore for scanning code, containers, infrastructure, and Kubernetes in Semaphore workflow. \ud83d\udc49 Get it at: https://semaphoreci.com/blog/continuous-container-vulnerability-testing-with-trivy","title":"Semaphore (Community)"},{"location":"ecosystem/cicd/#circleci-community","text":"CircleCI is a CI/CD service. You can use the Trivy Orb for Circle CI to introduce security scanning into your workflow. \ud83d\udc49 Get it at: https://circleci.com/developer/orbs/orb/fifteen5/trivy-orb Source: https://github.com/15five/trivy-orb","title":"CircleCI (Community)"},{"location":"ecosystem/cicd/#woodpecker-ci-community","text":"Example Trivy step in pipeline pipeline: securitycheck: image: aquasec/trivy:latest commands: # use any trivy command, if exit code is 0 woodpecker marks it as passed, else it assumes it failed - trivy fs --exit-code 1 --skip-dirs web/ --skip-dirs docs/ --severity MEDIUM,HIGH,CRITICAL . Woodpecker does use Trivy itself so you can see it in use there .","title":"Woodpecker CI (Community)"},{"location":"ecosystem/cicd/#concourse-ci-community","text":"Concourse CI is a CI/CD service. You can use Trivy Resource in Concourse for scanning containers and introducing security scanning into your workflow. It has capabilities to fail the pipeline, create issues, alert communication channels (using respective resources) based on Trivy scan output. \ud83d\udc49 Get it at: https://github.com/Comcast/trivy-resource/","title":"Concourse CI (Community)"},{"location":"ecosystem/ide/","text":"IDE and developer tools Integrations VSCode (Official) Visual Studio Code is an open source versatile code editor and development environment. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-vscode-extension JetBrains (Official) JetBrains makes IDEs such as Goland, Pycharm, IntelliJ, Webstorm, and more. The Trivy plugin for JetBrains IDEs lets you use Trivy right from your development environment. \ud83d\udc49 Get it at: https://plugins.jetbrains.com/plugin/18690-trivy-findings-explorer Kubernetes Lens (Official) Kubernetes Lens is a management application for Kubernetes clusters. Trivy has an extension for Kubernetes Lens that lets you scan Kubernetes workloads and view the results in the Lens UI. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-operator-lens-extension Vim (Community) Vim is a terminal based text editor. Vim plugin for Trivy to install and run Trivy. \ud83d\udc49 Get it at: https://github.com/aquasecurity/vim-trivy Docker Desktop (Community) Docker Desktop is an easy way to install Docker container engine on your development machine, and manage it in a GUI . Trivy Docker Desktop extension for scanning container images for vulnerabilities and generating SBOMs \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-docker-extension Rancher Desktop (Community) Rancher Desktop is an easy way to use containers and Kubernetes on your development machine, and manage it in a GUI. Trivy is natively integrated with Rancher, no installation is needed. More info in Rancher documentation: https://docs.rancherdesktop.io/getting-started/features#scanning-images LazyTrivy (Community) A terminal native UI for Trivy \ud83d\udc49 Get it at: https://github.com/owenrumney/lazytrivy Trivy Vulnerability explorer (Community) Web application that allows to load a Trivy report in json format and displays the vulnerabilities of a single target in an interactive data table \ud83d\udc49 Get it at: https://github.com/dbsystel/trivy-vulnerability-explorer Trivy pre-commit (Community) A trivy pre-commit hook that runs a trivy fs in your git repo before commiting, preventing you from commiting secrets in the first place. \ud83d\udc49 Get it at: https://github.com/mxab/pre-commit-trivy AWS CDK The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. image-scanner-with-trivy (Community) A CDK Construct Library to scan an image with trivy in CDK codes. \ud83d\udc49 Get it at: https://constructs.dev/packages/image-scanner-with-trivy","title":"IDE and Dev tools"},{"location":"ecosystem/ide/#ide-and-developer-tools-integrations","text":"","title":"IDE and developer tools Integrations"},{"location":"ecosystem/ide/#vscode-official","text":"Visual Studio Code is an open source versatile code editor and development environment. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-vscode-extension","title":"VSCode (Official)"},{"location":"ecosystem/ide/#jetbrains-official","text":"JetBrains makes IDEs such as Goland, Pycharm, IntelliJ, Webstorm, and more. The Trivy plugin for JetBrains IDEs lets you use Trivy right from your development environment. \ud83d\udc49 Get it at: https://plugins.jetbrains.com/plugin/18690-trivy-findings-explorer","title":"JetBrains (Official)"},{"location":"ecosystem/ide/#kubernetes-lens-official","text":"Kubernetes Lens is a management application for Kubernetes clusters. Trivy has an extension for Kubernetes Lens that lets you scan Kubernetes workloads and view the results in the Lens UI. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-operator-lens-extension","title":"Kubernetes Lens (Official)"},{"location":"ecosystem/ide/#vim-community","text":"Vim is a terminal based text editor. Vim plugin for Trivy to install and run Trivy. \ud83d\udc49 Get it at: https://github.com/aquasecurity/vim-trivy","title":"Vim (Community)"},{"location":"ecosystem/ide/#docker-desktop-community","text":"Docker Desktop is an easy way to install Docker container engine on your development machine, and manage it in a GUI . Trivy Docker Desktop extension for scanning container images for vulnerabilities and generating SBOMs \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-docker-extension","title":"Docker Desktop (Community)"},{"location":"ecosystem/ide/#rancher-desktop-community","text":"Rancher Desktop is an easy way to use containers and Kubernetes on your development machine, and manage it in a GUI. Trivy is natively integrated with Rancher, no installation is needed. More info in Rancher documentation: https://docs.rancherdesktop.io/getting-started/features#scanning-images","title":"Rancher Desktop (Community)"},{"location":"ecosystem/ide/#lazytrivy-community","text":"A terminal native UI for Trivy \ud83d\udc49 Get it at: https://github.com/owenrumney/lazytrivy","title":"LazyTrivy (Community)"},{"location":"ecosystem/ide/#trivy-vulnerability-explorer-community","text":"Web application that allows to load a Trivy report in json format and displays the vulnerabilities of a single target in an interactive data table \ud83d\udc49 Get it at: https://github.com/dbsystel/trivy-vulnerability-explorer","title":"Trivy Vulnerability explorer (Community)"},{"location":"ecosystem/ide/#trivy-pre-commit-community","text":"A trivy pre-commit hook that runs a trivy fs in your git repo before commiting, preventing you from commiting secrets in the first place. \ud83d\udc49 Get it at: https://github.com/mxab/pre-commit-trivy","title":"Trivy pre-commit (Community)"},{"location":"ecosystem/ide/#aws-cdk","text":"The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation.","title":"AWS CDK"},{"location":"ecosystem/ide/#image-scanner-with-trivy-community","text":"A CDK Construct Library to scan an image with trivy in CDK codes. \ud83d\udc49 Get it at: https://constructs.dev/packages/image-scanner-with-trivy","title":"image-scanner-with-trivy (Community)"},{"location":"ecosystem/prod/","text":"Production and cloud Integrations Kubernetes Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. Trivy Operator (Official) Using the Trivy Operator you can install Trivy into a Kubernetes cluster so that it automatically and continuously scan your workloads and cluster for security issues. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-operator Harbor (Official) Harbor is an open source cloud native container and artifact registry. Trivy is natively integrated into Harbor, no installation is needed. More info in Harbor documentation: https://goharbor.io/docs/2.6.0/administration/vulnerability-scanning Kyverno (Community) Kyverno is a policy management tool for Kubernetes. You can use Kyverno to ensure and enforce that deployed workloads' images are scanned for vulnerabilities. \ud83d\udc49 Get it at: https://neonmirrors.net/post/2022-07/attesting-image-scans-kyverno","title":"Production and Clouds"},{"location":"ecosystem/prod/#production-and-cloud-integrations","text":"","title":"Production and cloud Integrations"},{"location":"ecosystem/prod/#kubernetes","text":"Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications.","title":"Kubernetes"},{"location":"ecosystem/prod/#trivy-operator-official","text":"Using the Trivy Operator you can install Trivy into a Kubernetes cluster so that it automatically and continuously scan your workloads and cluster for security issues. \ud83d\udc49 Get it at: https://github.com/aquasecurity/trivy-operator","title":"Trivy Operator (Official)"},{"location":"ecosystem/prod/#harbor-official","text":"Harbor is an open source cloud native container and artifact registry. Trivy is natively integrated into Harbor, no installation is needed. More info in Harbor documentation: https://goharbor.io/docs/2.6.0/administration/vulnerability-scanning","title":"Harbor (Official)"},{"location":"ecosystem/prod/#kyverno-community","text":"Kyverno is a policy management tool for Kubernetes. You can use Kyverno to ensure and enforce that deployed workloads' images are scanned for vulnerabilities. \ud83d\udc49 Get it at: https://neonmirrors.net/post/2022-07/attesting-image-scans-kyverno","title":"Kyverno (Community)"},{"location":"ecosystem/security/","text":"Security Management SonarQube (Community) A Trivy plugin that converts JSON report to SonarQube generic issues format . \ud83d\udc49 Get it at: https://github.com/umax/trivy-plugin-sonarqube DefectDojo (Community) DefectDojo can parse Trivy JSON reports. The parser supports deduplication and auto-close features. \ud83d\udc49 Get it at: https://github.com/DefectDojo/django-DefectDojo","title":"Security Management"},{"location":"ecosystem/security/#security-management","text":"","title":"Security Management"},{"location":"ecosystem/security/#sonarqube-community","text":"A Trivy plugin that converts JSON report to SonarQube generic issues format . \ud83d\udc49 Get it at: https://github.com/umax/trivy-plugin-sonarqube","title":"SonarQube (Community)"},{"location":"ecosystem/security/#defectdojo-community","text":"DefectDojo can parse Trivy JSON reports. The parser supports deduplication and auto-close features. \ud83d\udc49 Get it at: https://github.com/DefectDojo/django-DefectDojo","title":"DefectDojo (Community)"},{"location":"getting-started/faq/","text":"FAQ How to pronounce the name \"Trivy\"? tri is pronounced like tri gger, vy is pronounced like en vy . Does Trivy support X? Check out the Scanning coverage page . Is there a paid version of Trivy? If you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering. You can find a high level comparison table specific to Trivy users here . In addition check out the https://aquasec.com website for more information about our products and services. If you'd like to contact Aqua or request a demo, please use this form: https://www.aquasec.com/demo How to generate multiple reports? See here . How to run Trivy under air-gapped environment? See here . Why trivy fs and trivy repo does not scan JAR files for vulnerabilities? See here .","title":"FAQ"},{"location":"getting-started/faq/#faq","text":"","title":"FAQ"},{"location":"getting-started/faq/#how-to-pronounce-the-name-trivy","text":"tri is pronounced like tri gger, vy is pronounced like en vy .","title":"How to pronounce the name \"Trivy\"?"},{"location":"getting-started/faq/#does-trivy-support-x","text":"Check out the Scanning coverage page .","title":"Does Trivy support X?"},{"location":"getting-started/faq/#is-there-a-paid-version-of-trivy","text":"If you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering. You can find a high level comparison table specific to Trivy users here . In addition check out the https://aquasec.com website for more information about our products and services. If you'd like to contact Aqua or request a demo, please use this form: https://www.aquasec.com/demo","title":"Is there a paid version of Trivy?"},{"location":"getting-started/faq/#how-to-generate-multiple-reports","text":"See here .","title":"How to generate multiple reports?"},{"location":"getting-started/faq/#how-to-run-trivy-under-air-gapped-environment","text":"See here .","title":"How to run Trivy under air-gapped environment?"},{"location":"getting-started/faq/#why-trivy-fs-and-trivy-repo-does-not-scan-jar-files-for-vulnerabilities","text":"See here .","title":"Why trivy fs and trivy repo does not scan JAR files for vulnerabilities?"},{"location":"getting-started/installation/","text":"Installing Trivy In this section you will find an aggregation of the different ways to install Trivy. installations are listed as either \"official\" or \"community\". Official integrations are developed by the core Trivy team and supported by it. Community integrations are integrations developed by the community, and collected here for your convenience. For support or questions about community integrations, please contact the original developers. Install using Package Manager RHEL/CentOS (Official) Repository RPM Add repository setting to /etc/yum.repos.d . RELEASE_VERSION = $( grep -Po '(?<=VERSION_ID=\")[0-9]' /etc/os-release ) cat << EOF | sudo tee -a /etc/yum.repos.d/trivy.repo [trivy] name=Trivy repository baseurl=https://aquasecurity.github.io/trivy-repo/rpm/releases/$RELEASE_VERSION/\\$basearch/ gpgcheck=1 enabled=1 gpgkey=https://aquasecurity.github.io/trivy-repo/rpm/public.key EOF sudo yum -y update sudo yum -y install trivy rpm -ivh https://github.com/aquasecurity/trivy/releases/download/v0.45.1/trivy_0.45.1_Linux-64bit.rpm Debian/Ubuntu (Official) Repository DEB Add repository setting to /etc/apt/sources.list.d . sudo apt-get install wget apt-transport-https gnupg lsb-release wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null echo \"deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $( lsb_release -sc ) main\" | sudo tee -a /etc/apt/sources.list.d/trivy.list sudo apt-get update sudo apt-get install trivy wget https://github.com/aquasecurity/trivy/releases/download/v0.45.1/trivy_0.45.1_Linux-64bit.deb sudo dpkg -i trivy_0.45.1_Linux-64bit.deb Homebrew (Official) Homebrew for MacOS and Linux. brew install trivy Arch Linux (Community) Arch Community Package Manager. pacman -S trivy References: - https://archlinux.org/packages/community/x86_64/trivy/ - https://github.com/archlinux/svntogit-community/blob/packages/trivy/trunk/PKGBUILD MacPorts (Community) MacPorts for MacOS. sudo port install trivy References: - https://ports.macports.org/port/trivy/details/ Nix/NixOS (Community) Nix package manager for Linux and MacOS. Command line nix-env --install -A nixpkgs.trivy Configuration # your other config ... environment . systemPackages = with pkgs ; [ # your other packages ... trivy ]; Home Manager # your other config ... home . packages = with pkgs ; [ # your other packages ... trivy ]; References: - https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/admin/trivy/default.nix Install from GitHub Release (Official) Download Binary Download the file for your operating system/architecture from GitHub Release assets ( curl -LO https://url.to/trivy.tar.gz ). Unpack the downloaded archive ( tar -xzf ./trivy.tar.gz ). Put the binary somewhere in your $PATH (e.g mv ./trivy /usr/local/bin/ ). Make sure the binary has execution bit turned on ( chmod +x ./trivy ). Install Script The process above can be automated by the following script: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.45.1 Install from source git clone --depth 1 --branch v0.45.1 https://github.com/aquasecurity/trivy cd trivy go install ./cmd/trivy Use container image Pull Trivy image ( docker pull aquasec/trivy:0.45.1 ) It is advisable to mount a consistent cache dir on the host into the Trivy container. For scanning container images with Trivy, mount docker.sock from the host into the Trivy container. Example: docker run -v /var/run/docker.sock:/var/run/docker.sock -v $HOME /Library/Caches:/root/.cache/ aquasec/trivy:0.45.1 image python:3.4-alpine Registry | Repository | Link | Supportability Docker Hub | docker.io/aquasec/trivy | https://hub.docker.com/r/aquasec/trivy | Official GitHub Container Registry (GHCR) | ghcr.io/aquasecurity/trivy | https://github.com/orgs/aquasecurity/packages/container/package/trivy | Official AWS Elastic Container Registry (ECR) | public.ecr.aws/aquasecurity/trivy | https://gallery.ecr.aws/aquasecurity/trivy | Official Other Tools to use and deploy Trivy For additional tools and ways to install and use Trivy in different environments such as in IDE, Kubernetes or CI/CD, see Ecosystem section .","title":"Installation"},{"location":"getting-started/installation/#installing-trivy","text":"In this section you will find an aggregation of the different ways to install Trivy. installations are listed as either \"official\" or \"community\". Official integrations are developed by the core Trivy team and supported by it. Community integrations are integrations developed by the community, and collected here for your convenience. For support or questions about community integrations, please contact the original developers.","title":"Installing Trivy"},{"location":"getting-started/installation/#install-using-package-manager","text":"","title":"Install using Package Manager"},{"location":"getting-started/installation/#rhelcentos-official","text":"Repository RPM Add repository setting to /etc/yum.repos.d . RELEASE_VERSION = $( grep -Po '(?<=VERSION_ID=\")[0-9]' /etc/os-release ) cat << EOF | sudo tee -a /etc/yum.repos.d/trivy.repo [trivy] name=Trivy repository baseurl=https://aquasecurity.github.io/trivy-repo/rpm/releases/$RELEASE_VERSION/\\$basearch/ gpgcheck=1 enabled=1 gpgkey=https://aquasecurity.github.io/trivy-repo/rpm/public.key EOF sudo yum -y update sudo yum -y install trivy rpm -ivh https://github.com/aquasecurity/trivy/releases/download/v0.45.1/trivy_0.45.1_Linux-64bit.rpm","title":"RHEL/CentOS (Official)"},{"location":"getting-started/installation/#debianubuntu-official","text":"Repository DEB Add repository setting to /etc/apt/sources.list.d . sudo apt-get install wget apt-transport-https gnupg lsb-release wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null echo \"deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $( lsb_release -sc ) main\" | sudo tee -a /etc/apt/sources.list.d/trivy.list sudo apt-get update sudo apt-get install trivy wget https://github.com/aquasecurity/trivy/releases/download/v0.45.1/trivy_0.45.1_Linux-64bit.deb sudo dpkg -i trivy_0.45.1_Linux-64bit.deb","title":"Debian/Ubuntu (Official)"},{"location":"getting-started/installation/#homebrew-official","text":"Homebrew for MacOS and Linux. brew install trivy","title":"Homebrew (Official)"},{"location":"getting-started/installation/#arch-linux-community","text":"Arch Community Package Manager. pacman -S trivy References: - https://archlinux.org/packages/community/x86_64/trivy/ - https://github.com/archlinux/svntogit-community/blob/packages/trivy/trunk/PKGBUILD","title":"Arch Linux (Community)"},{"location":"getting-started/installation/#macports-community","text":"MacPorts for MacOS. sudo port install trivy References: - https://ports.macports.org/port/trivy/details/","title":"MacPorts (Community)"},{"location":"getting-started/installation/#nixnixos-community","text":"Nix package manager for Linux and MacOS. Command line nix-env --install -A nixpkgs.trivy Configuration # your other config ... environment . systemPackages = with pkgs ; [ # your other packages ... trivy ]; Home Manager # your other config ... home . packages = with pkgs ; [ # your other packages ... trivy ]; References: - https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/admin/trivy/default.nix","title":"Nix/NixOS (Community)"},{"location":"getting-started/installation/#install-from-github-release-official","text":"","title":"Install from GitHub Release (Official)"},{"location":"getting-started/installation/#download-binary","text":"Download the file for your operating system/architecture from GitHub Release assets ( curl -LO https://url.to/trivy.tar.gz ). Unpack the downloaded archive ( tar -xzf ./trivy.tar.gz ). Put the binary somewhere in your $PATH (e.g mv ./trivy /usr/local/bin/ ). Make sure the binary has execution bit turned on ( chmod +x ./trivy ).","title":"Download Binary"},{"location":"getting-started/installation/#install-script","text":"The process above can be automated by the following script: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.45.1","title":"Install Script"},{"location":"getting-started/installation/#install-from-source","text":"git clone --depth 1 --branch v0.45.1 https://github.com/aquasecurity/trivy cd trivy go install ./cmd/trivy","title":"Install from source"},{"location":"getting-started/installation/#use-container-image","text":"Pull Trivy image ( docker pull aquasec/trivy:0.45.1 ) It is advisable to mount a consistent cache dir on the host into the Trivy container. For scanning container images with Trivy, mount docker.sock from the host into the Trivy container. Example: docker run -v /var/run/docker.sock:/var/run/docker.sock -v $HOME /Library/Caches:/root/.cache/ aquasec/trivy:0.45.1 image python:3.4-alpine Registry | Repository | Link | Supportability Docker Hub | docker.io/aquasec/trivy | https://hub.docker.com/r/aquasec/trivy | Official GitHub Container Registry (GHCR) | ghcr.io/aquasecurity/trivy | https://github.com/orgs/aquasecurity/packages/container/package/trivy | Official AWS Elastic Container Registry (ECR) | public.ecr.aws/aquasecurity/trivy | https://gallery.ecr.aws/aquasecurity/trivy | Official","title":"Use container image"},{"location":"getting-started/installation/#other-tools-to-use-and-deploy-trivy","text":"For additional tools and ways to install and use Trivy in different environments such as in IDE, Kubernetes or CI/CD, see Ecosystem section .","title":"Other Tools to use and deploy Trivy"},{"location":"getting-started/signature-verification/","text":"Signature Verification Verifying a Cosign signature All binaries and container images are signed by Cosign . You need the following tool: Cosign Verifying signed container images Use the following command for keyless verification : cosign verify aquasec/trivy:<version> \\ --certificate-identity-regexp 'https://github\\.com/aquasecurity/trivy/\\.github/workflows/.+' \\ --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" You should get the following output Verification for index.docker.io/aquasec/trivy:latest -- The following checks were performed on each of these signatures: - The cosign claims were validated - Existence of the claims in the transparency log was verified offline - The code-signing certificate was verified using trusted certificate authority certificates .... Verifying signed binaries Download the required tarball, associated signature and certificate files Use the following command for keyless verification: cosign verify-blob <path to binray> \\ --certificate <path to cert> \\ --signature <path to sig> \\ --certificate-identity-regexp 'https://github\\.com/aquasecurity/trivy/\\.github/workflows/.+' \\ --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" You should get the following output Verified OK For example: $ wget \"https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy_0.45.0_Linux-32bit.tar.gz\" $ wget \"https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy_0.45.0_Linux-32bit.tar.gz.pem\" $ wget \"https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy_0.45.0_Linux-32bit.tar.gz.sig\" $ cosign verify-blob trivy_0.45.0_Linux-32bit.tar.gz \\ --certificate trivy_0.45.0_Linux-32bit.tar.gz.pem \\ --signature trivy_0.45.0_Linux-32bit.tar.gz.sig \\ --certificate-identity-regexp 'https://github\\.com/aquasecurity/trivy/\\.github/workflows/.+' \\ --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" Vetified OK Verifying a GPG signature RPM and Deb packages are also signed by GPG. Verifying RPM The public key downloaded here . Download the public key curl https://aquasecurity.github.io/trivy-repo/rpm/public.key \\ --output pub.key Import the key rpm --import pub.key Verify that the key has been imported rpm -q --queryformat \"%{SUMMARY}\\n\" $( rpm -q gpg-pubkey ) You should get the following output gpg ( trivy ) Download the required binary curl -L https://github.com/aquasecurity/trivy/releases/download/<version>/<file name>.rpm \\ --output trivy.rpm Check the binary with the following command rpm -K trivy.rpm You should get the following output trivy.rpm: digests signatures OK","title":"Signature Verification"},{"location":"getting-started/signature-verification/#signature-verification","text":"","title":"Signature Verification"},{"location":"getting-started/signature-verification/#verifying-a-cosign-signature","text":"All binaries and container images are signed by Cosign . You need the following tool: Cosign","title":"Verifying a Cosign signature"},{"location":"getting-started/signature-verification/#verifying-signed-container-images","text":"Use the following command for keyless verification : cosign verify aquasec/trivy:<version> \\ --certificate-identity-regexp 'https://github\\.com/aquasecurity/trivy/\\.github/workflows/.+' \\ --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" You should get the following output Verification for index.docker.io/aquasec/trivy:latest -- The following checks were performed on each of these signatures: - The cosign claims were validated - Existence of the claims in the transparency log was verified offline - The code-signing certificate was verified using trusted certificate authority certificates ....","title":"Verifying signed container images"},{"location":"getting-started/signature-verification/#verifying-signed-binaries","text":"Download the required tarball, associated signature and certificate files Use the following command for keyless verification: cosign verify-blob <path to binray> \\ --certificate <path to cert> \\ --signature <path to sig> \\ --certificate-identity-regexp 'https://github\\.com/aquasecurity/trivy/\\.github/workflows/.+' \\ --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" You should get the following output Verified OK For example: $ wget \"https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy_0.45.0_Linux-32bit.tar.gz\" $ wget \"https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy_0.45.0_Linux-32bit.tar.gz.pem\" $ wget \"https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy_0.45.0_Linux-32bit.tar.gz.sig\" $ cosign verify-blob trivy_0.45.0_Linux-32bit.tar.gz \\ --certificate trivy_0.45.0_Linux-32bit.tar.gz.pem \\ --signature trivy_0.45.0_Linux-32bit.tar.gz.sig \\ --certificate-identity-regexp 'https://github\\.com/aquasecurity/trivy/\\.github/workflows/.+' \\ --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" Vetified OK","title":"Verifying signed binaries"},{"location":"getting-started/signature-verification/#verifying-a-gpg-signature","text":"RPM and Deb packages are also signed by GPG.","title":"Verifying a GPG signature"},{"location":"getting-started/signature-verification/#verifying-rpm","text":"The public key downloaded here . Download the public key curl https://aquasecurity.github.io/trivy-repo/rpm/public.key \\ --output pub.key Import the key rpm --import pub.key Verify that the key has been imported rpm -q --queryformat \"%{SUMMARY}\\n\" $( rpm -q gpg-pubkey ) You should get the following output gpg ( trivy ) Download the required binary curl -L https://github.com/aquasecurity/trivy/releases/download/<version>/<file name>.rpm \\ --output trivy.rpm Check the binary with the following command rpm -K trivy.rpm You should get the following output trivy.rpm: digests signatures OK","title":"Verifying RPM"},{"location":"tutorials/overview/","text":"Tutorials In this section you can find step-by-step guides that help you accomplish specific tasks. \ud83d\udc48 Please use the side-navigation on the left in order to browse the different topics. Adding tutorials You are welcome to create tutorials and showcase them here. Tutorials can be either included in here as full articles, or included as external links under external community resources . Before sending PR, please first create an issue (of kind \"Documentation\") and describe the suggestion, if it's external link or article, and what category it's under. Guidelines: Focus on a specific use case. Start by clearly describing the use case and when/who it is relevant for. Provide an end-to-end set of instructions. Make sure anyone can easily follow. Describe the expected outcome after each step. Include examples as much as possible.","title":"Overview"},{"location":"tutorials/overview/#tutorials","text":"In this section you can find step-by-step guides that help you accomplish specific tasks. \ud83d\udc48 Please use the side-navigation on the left in order to browse the different topics.","title":"Tutorials"},{"location":"tutorials/overview/#adding-tutorials","text":"You are welcome to create tutorials and showcase them here. Tutorials can be either included in here as full articles, or included as external links under external community resources . Before sending PR, please first create an issue (of kind \"Documentation\") and describe the suggestion, if it's external link or article, and what category it's under. Guidelines: Focus on a specific use case. Start by clearly describing the use case and when/who it is relevant for. Provide an end-to-end set of instructions. Make sure anyone can easily follow. Describe the expected outcome after each step. Include examples as much as possible.","title":"Adding tutorials"},{"location":"tutorials/additional-resources/cks/","text":"CKS preparation resources The Certified Kubernetes Security Specialist (CKS) Exam is offered by The Linux Foundation. It provides assurance that a CKS has the skills, knowledge, and competence on a broad range of best practices for securing container-based applications and Kubernetes platforms during build, deployment and runtime. CKA certification is required to sit for this exam. Community Resources Trivy Video overview (short) Example questions from the exam More example questions CKS exam study guide Docker Image Vulnerabilities & Trivy Image Scanning Demo | K21Academy Aqua Security Blog posts to learn more Supply chain security best practices Supply chain attacks If you know of interesting resources, please start a PR to add those to the list.","title":"CKS Reference"},{"location":"tutorials/additional-resources/cks/#cks-preparation-resources","text":"The Certified Kubernetes Security Specialist (CKS) Exam is offered by The Linux Foundation. It provides assurance that a CKS has the skills, knowledge, and competence on a broad range of best practices for securing container-based applications and Kubernetes platforms during build, deployment and runtime. CKA certification is required to sit for this exam.","title":"CKS preparation resources"},{"location":"tutorials/additional-resources/cks/#community-resources","text":"Trivy Video overview (short) Example questions from the exam More example questions CKS exam study guide Docker Image Vulnerabilities & Trivy Image Scanning Demo | K21Academy","title":"Community Resources"},{"location":"tutorials/additional-resources/cks/#aqua-security-blog-posts-to-learn-more","text":"Supply chain security best practices Supply chain attacks If you know of interesting resources, please start a PR to add those to the list.","title":"Aqua Security Blog posts to learn more"},{"location":"tutorials/additional-resources/community/","text":"Community References Below is a list of additional resources from the community. Vulnerability Scanning Detecting Spring4Shell with Trivy and Grype Scan OS of your EC2 instances with Trivy CI/CD Pipelines How to use Tekton to set up a CI pipeline with OpenShift Pipelines Continuous Container Vulnerability Testing with Trivy Getting Started With Trivy and Jenkins How to use Tekton to set up a CI pipeline with OpenShift Pipelines Misconfiguration Scanning Identifying Misconfigurations in your Terraform How to write custom policies for Trivy SBOM, Attestation & related Attesting Image Scans With Kyverno Trivy Kubernetes Using Trivy Kubernetes in OVHCloud documentation. Comparisons the vulnerability remediation lifecycle of Alpine containers Open Source CVE Scanner Round-Up: Clair vs Anchore vs Trivy Docker Image Security: Static Analysis Tool Comparison \u2013 Anchore Engine vs Clair vs Trivy Evaluations Istio evaluating to use Trivy Research Spike: evaluate Trivy for scanning running containers","title":"Community References"},{"location":"tutorials/additional-resources/community/#community-references","text":"Below is a list of additional resources from the community.","title":"Community References"},{"location":"tutorials/additional-resources/community/#vulnerability-scanning","text":"Detecting Spring4Shell with Trivy and Grype Scan OS of your EC2 instances with Trivy","title":"Vulnerability Scanning"},{"location":"tutorials/additional-resources/community/#cicd-pipelines","text":"How to use Tekton to set up a CI pipeline with OpenShift Pipelines Continuous Container Vulnerability Testing with Trivy Getting Started With Trivy and Jenkins How to use Tekton to set up a CI pipeline with OpenShift Pipelines","title":"CI/CD Pipelines"},{"location":"tutorials/additional-resources/community/#misconfiguration-scanning","text":"Identifying Misconfigurations in your Terraform How to write custom policies for Trivy","title":"Misconfiguration Scanning"},{"location":"tutorials/additional-resources/community/#sbom-attestation-related","text":"Attesting Image Scans With Kyverno","title":"SBOM, Attestation &amp; related"},{"location":"tutorials/additional-resources/community/#trivy-kubernetes","text":"Using Trivy Kubernetes in OVHCloud documentation.","title":"Trivy Kubernetes"},{"location":"tutorials/additional-resources/community/#comparisons","text":"the vulnerability remediation lifecycle of Alpine containers Open Source CVE Scanner Round-Up: Clair vs Anchore vs Trivy Docker Image Security: Static Analysis Tool Comparison \u2013 Anchore Engine vs Clair vs Trivy","title":"Comparisons"},{"location":"tutorials/additional-resources/community/#evaluations","text":"Istio evaluating to use Trivy Research Spike: evaluate Trivy for scanning running containers","title":"Evaluations"},{"location":"tutorials/additional-resources/references/","text":"Additional Resources and Tutorials Below is a list of additional resources from Aqua Security. Announcements Trivy Vulnerability Scanner Joins the Aqua Open-source Family Trivy Image Vulnerability Scanner Now Under Apache 2.0 License Vulnerability Scanning Using Trivy to Discover Vulnerabilities in VS Code Projects How does a vulnerability scanner identify packages? Handling Container Vulnerabilities with Open Policy Agent - Teppei Fukuda, Aqua Security CI/CD Pipelines DevSecOps with Trivy and GitHub Actions Find Image Vulnerabilities Using GitHub and Aqua Security Trivy Action Misconfiguration Scanning Identifying Misconfigurations in your Terraform Client/Server Using Trivy in client server mode Workshops Trivy Live Demo & Q&A First Steps to Full Lifecycle Security with Open Source Tools - Rory McCune & Anais Urlichs Older Resources Webinar: Trivy Open Source Scanner for Container Images \u2013 Just Download and Run! Kubernetes Security through GitOps Best Practices: ArgoCD and Starboard Get started with Kubernetes Security and Starboard","title":"Additional Resources"},{"location":"tutorials/additional-resources/references/#additional-resources-and-tutorials","text":"Below is a list of additional resources from Aqua Security.","title":"Additional Resources and Tutorials"},{"location":"tutorials/additional-resources/references/#announcements","text":"Trivy Vulnerability Scanner Joins the Aqua Open-source Family Trivy Image Vulnerability Scanner Now Under Apache 2.0 License","title":"Announcements"},{"location":"tutorials/additional-resources/references/#vulnerability-scanning","text":"Using Trivy to Discover Vulnerabilities in VS Code Projects How does a vulnerability scanner identify packages? Handling Container Vulnerabilities with Open Policy Agent - Teppei Fukuda, Aqua Security","title":"Vulnerability Scanning"},{"location":"tutorials/additional-resources/references/#cicd-pipelines","text":"DevSecOps with Trivy and GitHub Actions Find Image Vulnerabilities Using GitHub and Aqua Security Trivy Action","title":"CI/CD Pipelines"},{"location":"tutorials/additional-resources/references/#misconfiguration-scanning","text":"Identifying Misconfigurations in your Terraform","title":"Misconfiguration Scanning"},{"location":"tutorials/additional-resources/references/#clientserver","text":"Using Trivy in client server mode","title":"Client/Server"},{"location":"tutorials/additional-resources/references/#workshops","text":"Trivy Live Demo & Q&A First Steps to Full Lifecycle Security with Open Source Tools - Rory McCune & Anais Urlichs","title":"Workshops"},{"location":"tutorials/additional-resources/references/#older-resources","text":"Webinar: Trivy Open Source Scanner for Container Images \u2013 Just Download and Run! Kubernetes Security through GitOps Best Practices: ArgoCD and Starboard Get started with Kubernetes Security and Starboard","title":"Older Resources"},{"location":"tutorials/integrations/","text":"Integrations Scan your image automatically as part of your CI workflow, failing the workflow if a vulnerability is found. When you don't want to fail the test, specify --exit-code 0 .","title":"Overview"},{"location":"tutorials/integrations/#integrations","text":"Scan your image automatically as part of your CI workflow, failing the workflow if a vulnerability is found. When you don't want to fail the test, specify --exit-code 0 .","title":"Integrations"},{"location":"tutorials/integrations/aws-codepipeline/","text":"AWS CodePipeline See this blog post for an example of using Trivy within AWS CodePipeline.","title":"AWS CodePipeline"},{"location":"tutorials/integrations/aws-codepipeline/#aws-codepipeline","text":"See this blog post for an example of using Trivy within AWS CodePipeline.","title":"AWS CodePipeline"},{"location":"tutorials/integrations/aws-security-hub/","text":"AWS Security Hub Upload findings to Security Hub In the following example using the template asff.tpl , ASFF file can be generated. $ AWS_REGION=us-west-1 AWS_ACCOUNT_ID=123456789012 trivy image --format template --template \"@contrib/asff.tpl\" -o report.asff golang:1.12-alpine ASFF template needs AWS_REGION and AWS_ACCOUNT_ID from environment variables. The Product ARN field follows the pattern below to match what AWS requires for the product resource type . \"ProductArn\": \"arn:aws:securityhub:{{ env \"AWS_REGION\" }}::product/aquasecurity/aquasecurity\", In order to upload results you must first run enable-import-findings-for-product like: aws securityhub enable-import-findings-for-product --product-arn arn:aws:securityhub:<AWS_REGION>::product/aquasecurity/aquasecurity The findings are formatted for the API with a key of Findings and a value of the array of findings. In order to upload via the CLI the outer wrapping must be removed being left with only the array of findings. The easiest way of doing this is with the jq library using the command cat report.asff | jq '.Findings' Then, you can upload it with AWS CLI. $ aws securityhub batch-import-findings --findings file://report.asff Note The batch-import-findings command limits the number of findings uploaded to 100 per request. The best known workaround to this problem is using jq to run the following command jq '.[:100]' report.asff 1> short_report.asff Customize You can customize asff.tpl $ export AWS_REGION=us-west-1 $ export AWS_ACCOUNT_ID=123456789012 $ trivy image --format template --template \"@your-asff.tpl\" -o report.asff golang:1.12-alpine Reference aws.amazon.com/blogs/security/how-to-build-ci-cd-pipeline-container-vulnerability-scanning-trivy-and-aws-security-hub/","title":"AWS Security Hub"},{"location":"tutorials/integrations/aws-security-hub/#aws-security-hub","text":"","title":"AWS Security Hub"},{"location":"tutorials/integrations/aws-security-hub/#upload-findings-to-security-hub","text":"In the following example using the template asff.tpl , ASFF file can be generated. $ AWS_REGION=us-west-1 AWS_ACCOUNT_ID=123456789012 trivy image --format template --template \"@contrib/asff.tpl\" -o report.asff golang:1.12-alpine ASFF template needs AWS_REGION and AWS_ACCOUNT_ID from environment variables. The Product ARN field follows the pattern below to match what AWS requires for the product resource type . \"ProductArn\": \"arn:aws:securityhub:{{ env \"AWS_REGION\" }}::product/aquasecurity/aquasecurity\", In order to upload results you must first run enable-import-findings-for-product like: aws securityhub enable-import-findings-for-product --product-arn arn:aws:securityhub:<AWS_REGION>::product/aquasecurity/aquasecurity The findings are formatted for the API with a key of Findings and a value of the array of findings. In order to upload via the CLI the outer wrapping must be removed being left with only the array of findings. The easiest way of doing this is with the jq library using the command cat report.asff | jq '.Findings' Then, you can upload it with AWS CLI. $ aws securityhub batch-import-findings --findings file://report.asff","title":"Upload findings to Security Hub"},{"location":"tutorials/integrations/aws-security-hub/#note","text":"The batch-import-findings command limits the number of findings uploaded to 100 per request. The best known workaround to this problem is using jq to run the following command jq '.[:100]' report.asff 1> short_report.asff","title":"Note"},{"location":"tutorials/integrations/aws-security-hub/#customize","text":"You can customize asff.tpl $ export AWS_REGION=us-west-1 $ export AWS_ACCOUNT_ID=123456789012 $ trivy image --format template --template \"@your-asff.tpl\" -o report.asff golang:1.12-alpine","title":"Customize"},{"location":"tutorials/integrations/aws-security-hub/#reference","text":"aws.amazon.com/blogs/security/how-to-build-ci-cd-pipeline-container-vulnerability-scanning-trivy-and-aws-security-hub/","title":"Reference"},{"location":"tutorials/integrations/azure-devops/","text":"Azure Devops Here is the Azure DevOps Pipelines Task for Trivy Use ImageCleaner to clean up stale images on your Azure Kubernetes Service cluster It's common to use pipelines to build and deploy images on Azure Kubernetes Service (AKS) clusters. While great for image creation, this process often doesn't account for the stale images left behind and can lead to image bloat on cluster nodes. These images can present security issues as they may contain vulnerabilities. By cleaning these unreferenced images, you can remove an area of risk in your clusters. When done manually, this process can be time intensive, which ImageCleaner can mitigate via automatic image identification and removal. Vulnerability is determined based on a trivy scan, after which images with a LOW, MEDIUM, HIGH, or CRITICAL classification are flagged. An updated ImageList will be automatically generated by ImageCleaner based on a set time interval, and can also be supplied manually. Microsoft Defender for container registries and Trivy This blog explains how to scan your Azure Container Registry-based container images with the integrated vulnerability scanner when they're built as part of your GitHub workflows. To set up the scanner, you'll need to enable Microsoft Defender for Containers and the CI/CD integration. When your CI/CD workflows push images to your registries, you can view registry scan results and a summary of CI/CD scan results. The findings of the CI/CD scans are an enrichment to the existing registry scan findings by Qualys. Defender for Cloud's CI/CD scanning is powered by Aqua Trivy","title":"Azure"},{"location":"tutorials/integrations/azure-devops/#azure-devops","text":"Here is the Azure DevOps Pipelines Task for Trivy","title":"Azure Devops"},{"location":"tutorials/integrations/azure-devops/#use-imagecleaner-to-clean-up-stale-images-on-your-azure-kubernetes-service-cluster","text":"It's common to use pipelines to build and deploy images on Azure Kubernetes Service (AKS) clusters. While great for image creation, this process often doesn't account for the stale images left behind and can lead to image bloat on cluster nodes. These images can present security issues as they may contain vulnerabilities. By cleaning these unreferenced images, you can remove an area of risk in your clusters. When done manually, this process can be time intensive, which ImageCleaner can mitigate via automatic image identification and removal. Vulnerability is determined based on a trivy scan, after which images with a LOW, MEDIUM, HIGH, or CRITICAL classification are flagged. An updated ImageList will be automatically generated by ImageCleaner based on a set time interval, and can also be supplied manually.","title":"Use ImageCleaner to clean up stale images on your Azure Kubernetes Service cluster"},{"location":"tutorials/integrations/azure-devops/#microsoft-defender-for-container-registries-and-trivy","text":"This blog explains how to scan your Azure Container Registry-based container images with the integrated vulnerability scanner when they're built as part of your GitHub workflows. To set up the scanner, you'll need to enable Microsoft Defender for Containers and the CI/CD integration. When your CI/CD workflows push images to your registries, you can view registry scan results and a summary of CI/CD scan results. The findings of the CI/CD scans are an enrichment to the existing registry scan findings by Qualys. Defender for Cloud's CI/CD scanning is powered by Aqua Trivy","title":"Microsoft Defender for container registries and Trivy"},{"location":"tutorials/integrations/bitbucket/","text":"Bitbucket Pipelines See trivy-pipe for the details.","title":"Bitbucket Pipelines"},{"location":"tutorials/integrations/bitbucket/#bitbucket-pipelines","text":"See trivy-pipe for the details.","title":"Bitbucket Pipelines"},{"location":"tutorials/integrations/circleci/","text":"CircleCI $ cat .circleci/config.yml jobs: build: docker: - image: docker:stable-git steps: - checkout - setup_remote_docker - run: name: Build image command: docker build -t trivy-ci-test:${CIRCLE_SHA1} . - run: name: Install trivy command: | apk add --update-cache --upgrade curl curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin - run: name: Scan the local image with trivy command: trivy image --exit-code 0 --no-progress trivy-ci-test:${CIRCLE_SHA1} workflows: version: 2 release: jobs: - build Example Repository","title":"CircleCI"},{"location":"tutorials/integrations/circleci/#circleci","text":"$ cat .circleci/config.yml jobs: build: docker: - image: docker:stable-git steps: - checkout - setup_remote_docker - run: name: Build image command: docker build -t trivy-ci-test:${CIRCLE_SHA1} . - run: name: Install trivy command: | apk add --update-cache --upgrade curl curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin - run: name: Scan the local image with trivy command: trivy image --exit-code 0 --no-progress trivy-ci-test:${CIRCLE_SHA1} workflows: version: 2 release: jobs: - build Example Repository","title":"CircleCI"},{"location":"tutorials/integrations/github-actions/","text":"GitHub Actions Here is the Trivy GitHub Action The Microsoft Azure team have written a container-scan action that uses Trivy and Dockle For full control over the options specified to Trivy, this blog post describes adding Trivy into your own GitHub action workflows","title":"GitHub Actions"},{"location":"tutorials/integrations/github-actions/#github-actions","text":"Here is the Trivy GitHub Action The Microsoft Azure team have written a container-scan action that uses Trivy and Dockle For full control over the options specified to Trivy, this blog post describes adding Trivy into your own GitHub action workflows","title":"GitHub Actions"},{"location":"tutorials/integrations/gitlab-ci/","text":"GitLab CI GitLab 15.0 includes free integration with Trivy. To configure container scanning with Trivy in GitLab , simply include the CI template in your .gitlab-ci.yml file: include : - template : Security/Container-Scanning.gitlab-ci.yml If you're a GitLab 14.x Ultimate customer, you can use the same configuration above. Alternatively, you can always use the example configurations below. stages : - test trivy : stage : test image : docker:stable services : - name : docker:dind entrypoint : [ \"env\" , \"-u\" , \"DOCKER_HOST\" ] command : [ \"dockerd-entrypoint.sh\" ] variables : DOCKER_HOST : tcp://docker:2375/ DOCKER_DRIVER : overlay2 # See https://github.com/docker-library/docker/pull/166 DOCKER_TLS_CERTDIR : \"\" IMAGE : trivy-ci-test:$CI_COMMIT_SHA TRIVY_NO_PROGRESS : \"true\" TRIVY_CACHE_DIR : \".trivycache/\" before_script : - export TRIVY_VERSION=$(wget -qO - \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | grep '\"tag_name\":' | sed -E 's/.*\"v([^\"]+)\".*/\\1/') - echo $TRIVY_VERSION - wget --no-verbose https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz -O - | tar -zxvf - allow_failure : true script : # Build image - docker build -t $IMAGE . # Build report - ./trivy image --exit-code 0 --format template --template \"@contrib/gitlab.tpl\" -o gl-container-scanning-report.json $IMAGE # Print report - ./trivy image --exit-code 0 --severity HIGH $IMAGE # Fail on severe vulnerabilities - ./trivy image --exit-code 1 --severity CRITICAL $IMAGE cache : paths : - .trivycache/ # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold) artifacts : reports : container_scanning : gl-container-scanning-report.json Example Repository GitLab CI using Trivy container To scan a previously built image that has already been pushed into the GitLab container registry the following CI job manifest can be used. Note that entrypoint needs to be unset for the script section to work. In case of a non-public GitLab project Trivy additionally needs to authenticate to the registry to be able to pull your application image. Finally, it is not necessary to clone the project repo as we only work with the container image. container_scanning : image : name : docker.io/aquasec/trivy:latest entrypoint : [ \"\" ] variables : # No need to clone the repo, we exclusively work on artifacts. See # https://docs.gitlab.com/ee/ci/runners/configure_runners.html#git-strategy GIT_STRATEGY : none TRIVY_USERNAME : \"$CI_REGISTRY_USER\" TRIVY_PASSWORD : \"$CI_REGISTRY_PASSWORD\" TRIVY_AUTH_URL : \"$CI_REGISTRY\" TRIVY_NO_PROGRESS : \"true\" TRIVY_CACHE_DIR : \".trivycache/\" FULL_IMAGE_NAME : $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG script : - trivy --version # cache cleanup is needed when scanning images with the same tags, it does not remove the database - time trivy image --clear-cache # update vulnerabilities db - time trivy image --download-db-only # Builds report and puts it in the default workdir $CI_PROJECT_DIR, so `artifacts:` can take it from there - time trivy image --exit-code 0 --format template --template \"@/contrib/gitlab.tpl\" --output \"$CI_PROJECT_DIR/gl-container-scanning-report.json\" \"$FULL_IMAGE_NAME\" # Prints full report - time trivy image --exit-code 0 \"$FULL_IMAGE_NAME\" # Fail on critical vulnerabilities - time trivy image --exit-code 1 --severity CRITICAL \"$FULL_IMAGE_NAME\" cache : paths : - .trivycache/ # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold) artifacts : when : always reports : container_scanning : gl-container-scanning-report.json tags : - docker-runner GitLab CI alternative template Depending on the edition of gitlab you have or your desired workflow, the container scanning template may not meet your needs. As an addition to the above container scanning template, a template for code climate has been included. The key things to update from the above examples are the template and report type. An updated example is below. stages : - test trivy : stage : test image : docker:stable services : - name : docker:dind entrypoint : [ \"env\" , \"-u\" , \"DOCKER_HOST\" ] command : [ \"dockerd-entrypoint.sh\" ] variables : DOCKER_HOST : tcp://docker:2375/ DOCKER_DRIVER : overlay2 # See https://github.com/docker-library/docker/pull/166 DOCKER_TLS_CERTDIR : \"\" IMAGE : trivy-ci-test:$CI_COMMIT_SHA TRIVY_NO_PROGRESS : \"true\" TRIVY_CACHE_DIR : \".trivycache/\" before_script : - export TRIVY_VERSION=$(wget -qO - \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | grep '\"tag_name\":' | sed -E 's/.*\"v([^\"]+)\".*/\\1/') - echo $TRIVY_VERSION - wget --no-verbose https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz -O - | tar -zxvf - allow_failure : true script : # Build image - docker build -t $IMAGE . # Image report - ./trivy image --exit-code 0 --format template --template \"@contrib/gitlab-codequality.tpl\" -o gl-codeclimate-image.json $IMAGE # Filesystem report - ./trivy filesystem --scanners config,vuln --exit-code 0 --format template --template \"@contrib/gitlab-codequality.tpl\" -o gl-codeclimate-fs.json . # Combine report - apk update && apk add jq - jq -s 'add' gl-codeclimate-image.json gl-codeclimate-fs.json > gl-codeclimate.json cache : paths : - .trivycache/ # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold) artifacts : paths : - gl-codeclimate.json reports : codequality : gl-codeclimate.json Currently gitlab only supports a single code quality report. There is an open feature request to support multiple reports. Until this has been implemented, if you already have a code quality report in your pipeline, you can use jq to combine reports. Depending on how you name your artifacts, it may be necessary to rename the artifact if you want to reuse the name. To then combine the previous artifact with the output of trivy, the following jq command can be used, jq -s 'add' prev-codeclimate.json trivy-codeclimate.json > gl-codeclimate.json . GitLab CI alternative template example report You'll be able to see a full report in the GitLab pipeline code quality UI, where filesystem vulnerabilities and misconfigurations include links to the flagged files and image vulnerabilities report the image/os or runtime/library that the vulnerability originates from instead.","title":"GitLab CI"},{"location":"tutorials/integrations/gitlab-ci/#gitlab-ci","text":"GitLab 15.0 includes free integration with Trivy. To configure container scanning with Trivy in GitLab , simply include the CI template in your .gitlab-ci.yml file: include : - template : Security/Container-Scanning.gitlab-ci.yml If you're a GitLab 14.x Ultimate customer, you can use the same configuration above. Alternatively, you can always use the example configurations below. stages : - test trivy : stage : test image : docker:stable services : - name : docker:dind entrypoint : [ \"env\" , \"-u\" , \"DOCKER_HOST\" ] command : [ \"dockerd-entrypoint.sh\" ] variables : DOCKER_HOST : tcp://docker:2375/ DOCKER_DRIVER : overlay2 # See https://github.com/docker-library/docker/pull/166 DOCKER_TLS_CERTDIR : \"\" IMAGE : trivy-ci-test:$CI_COMMIT_SHA TRIVY_NO_PROGRESS : \"true\" TRIVY_CACHE_DIR : \".trivycache/\" before_script : - export TRIVY_VERSION=$(wget -qO - \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | grep '\"tag_name\":' | sed -E 's/.*\"v([^\"]+)\".*/\\1/') - echo $TRIVY_VERSION - wget --no-verbose https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz -O - | tar -zxvf - allow_failure : true script : # Build image - docker build -t $IMAGE . # Build report - ./trivy image --exit-code 0 --format template --template \"@contrib/gitlab.tpl\" -o gl-container-scanning-report.json $IMAGE # Print report - ./trivy image --exit-code 0 --severity HIGH $IMAGE # Fail on severe vulnerabilities - ./trivy image --exit-code 1 --severity CRITICAL $IMAGE cache : paths : - .trivycache/ # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold) artifacts : reports : container_scanning : gl-container-scanning-report.json Example Repository","title":"GitLab CI"},{"location":"tutorials/integrations/gitlab-ci/#gitlab-ci-using-trivy-container","text":"To scan a previously built image that has already been pushed into the GitLab container registry the following CI job manifest can be used. Note that entrypoint needs to be unset for the script section to work. In case of a non-public GitLab project Trivy additionally needs to authenticate to the registry to be able to pull your application image. Finally, it is not necessary to clone the project repo as we only work with the container image. container_scanning : image : name : docker.io/aquasec/trivy:latest entrypoint : [ \"\" ] variables : # No need to clone the repo, we exclusively work on artifacts. See # https://docs.gitlab.com/ee/ci/runners/configure_runners.html#git-strategy GIT_STRATEGY : none TRIVY_USERNAME : \"$CI_REGISTRY_USER\" TRIVY_PASSWORD : \"$CI_REGISTRY_PASSWORD\" TRIVY_AUTH_URL : \"$CI_REGISTRY\" TRIVY_NO_PROGRESS : \"true\" TRIVY_CACHE_DIR : \".trivycache/\" FULL_IMAGE_NAME : $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG script : - trivy --version # cache cleanup is needed when scanning images with the same tags, it does not remove the database - time trivy image --clear-cache # update vulnerabilities db - time trivy image --download-db-only # Builds report and puts it in the default workdir $CI_PROJECT_DIR, so `artifacts:` can take it from there - time trivy image --exit-code 0 --format template --template \"@/contrib/gitlab.tpl\" --output \"$CI_PROJECT_DIR/gl-container-scanning-report.json\" \"$FULL_IMAGE_NAME\" # Prints full report - time trivy image --exit-code 0 \"$FULL_IMAGE_NAME\" # Fail on critical vulnerabilities - time trivy image --exit-code 1 --severity CRITICAL \"$FULL_IMAGE_NAME\" cache : paths : - .trivycache/ # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold) artifacts : when : always reports : container_scanning : gl-container-scanning-report.json tags : - docker-runner","title":"GitLab CI using Trivy container"},{"location":"tutorials/integrations/gitlab-ci/#gitlab-ci-alternative-template","text":"Depending on the edition of gitlab you have or your desired workflow, the container scanning template may not meet your needs. As an addition to the above container scanning template, a template for code climate has been included. The key things to update from the above examples are the template and report type. An updated example is below. stages : - test trivy : stage : test image : docker:stable services : - name : docker:dind entrypoint : [ \"env\" , \"-u\" , \"DOCKER_HOST\" ] command : [ \"dockerd-entrypoint.sh\" ] variables : DOCKER_HOST : tcp://docker:2375/ DOCKER_DRIVER : overlay2 # See https://github.com/docker-library/docker/pull/166 DOCKER_TLS_CERTDIR : \"\" IMAGE : trivy-ci-test:$CI_COMMIT_SHA TRIVY_NO_PROGRESS : \"true\" TRIVY_CACHE_DIR : \".trivycache/\" before_script : - export TRIVY_VERSION=$(wget -qO - \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | grep '\"tag_name\":' | sed -E 's/.*\"v([^\"]+)\".*/\\1/') - echo $TRIVY_VERSION - wget --no-verbose https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz -O - | tar -zxvf - allow_failure : true script : # Build image - docker build -t $IMAGE . # Image report - ./trivy image --exit-code 0 --format template --template \"@contrib/gitlab-codequality.tpl\" -o gl-codeclimate-image.json $IMAGE # Filesystem report - ./trivy filesystem --scanners config,vuln --exit-code 0 --format template --template \"@contrib/gitlab-codequality.tpl\" -o gl-codeclimate-fs.json . # Combine report - apk update && apk add jq - jq -s 'add' gl-codeclimate-image.json gl-codeclimate-fs.json > gl-codeclimate.json cache : paths : - .trivycache/ # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold) artifacts : paths : - gl-codeclimate.json reports : codequality : gl-codeclimate.json Currently gitlab only supports a single code quality report. There is an open feature request to support multiple reports. Until this has been implemented, if you already have a code quality report in your pipeline, you can use jq to combine reports. Depending on how you name your artifacts, it may be necessary to rename the artifact if you want to reuse the name. To then combine the previous artifact with the output of trivy, the following jq command can be used, jq -s 'add' prev-codeclimate.json trivy-codeclimate.json > gl-codeclimate.json .","title":"GitLab CI alternative template"},{"location":"tutorials/integrations/gitlab-ci/#gitlab-ci-alternative-template-example-report","text":"You'll be able to see a full report in the GitLab pipeline code quality UI, where filesystem vulnerabilities and misconfigurations include links to the flagged files and image vulnerabilities report the image/os or runtime/library that the vulnerability originates from instead.","title":"GitLab CI alternative template example report"},{"location":"tutorials/integrations/travis-ci/","text":"Travis CI $ cat .travis.yml services: - docker env: global: - COMMIT=${TRAVIS_COMMIT::8} before_install: - docker build -t trivy-ci-test:${COMMIT} . - export VERSION=$(curl --silent \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | grep '\"tag_name\":' | sed -E 's/.*\"v([^\"]+)\".*/\\1/') - wget https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz - tar zxvf trivy_${VERSION}_Linux-64bit.tar.gz script: - ./trivy image --exit-code 0 --severity HIGH --no-progress trivy-ci-test:${COMMIT} - ./trivy image --exit-code 1 --severity CRITICAL --no-progress trivy-ci-test:${COMMIT} cache: directories: - $HOME/.cache/trivy Example Repository","title":"Travis CI"},{"location":"tutorials/integrations/travis-ci/#travis-ci","text":"$ cat .travis.yml services: - docker env: global: - COMMIT=${TRAVIS_COMMIT::8} before_install: - docker build -t trivy-ci-test:${COMMIT} . - export VERSION=$(curl --silent \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | grep '\"tag_name\":' | sed -E 's/.*\"v([^\"]+)\".*/\\1/') - wget https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz - tar zxvf trivy_${VERSION}_Linux-64bit.tar.gz script: - ./trivy image --exit-code 0 --severity HIGH --no-progress trivy-ci-test:${COMMIT} - ./trivy image --exit-code 1 --severity CRITICAL --no-progress trivy-ci-test:${COMMIT} cache: directories: - $HOME/.cache/trivy Example Repository","title":"Travis CI"},{"location":"tutorials/kubernetes/cluster-scanning/","text":"Kubernetes Scanning Tutorial Prerequisites To test the following commands yourself, make sure that you\u2019re connected to a Kubernetes cluster. A simple kind, a Docker-Desktop or microk8s cluster will do. In our case, we\u2019ll use a one-node kind cluster. Pro tip: The output of the commands will be even more interesting if you have some workloads running in your cluster. Cluster Scanning Trivy K8s is great to get an overview of all the vulnerabilities and misconfiguration issues or to scan specific workloads that are running in your cluster. You would want to use the Trivy K8s command either on your own local cluster or in your CI/CD pipeline post deployments. The trivy k8s command is part of the Trivy CLI. With the following command, we can scan our entire Kubernetes cluster for vulnerabilities and get a summary of the scan: trivy k8s --report=summary cluster To get detailed information for all your resources, just replace \u2018summary\u2019 with \u2018all\u2019: trivy k8s --report=all cluster However, we recommend displaying all information only in case you scan a specific namespace or resource since you can get overwhelmed with additional details. Furthermore, we can specify the namespace that Trivy is supposed to scan to focus on specific resources in the scan result: trivy k8s -n kube-system --report=summary cluster Again, if you\u2019d like to receive additional details, use the \u2018--report=all\u2019 flag: trivy k8s -n kube-system --report=all cluster Like with scanning for vulnerabilities, we can also filter in-cluster security issues by severity of the vulnerabilities: trivy k8s --severity=CRITICAL --report=summary cluster Note that you can use any of the Trivy flags on the Trivy K8s command. With the Trivy K8s command, you can also scan specific workloads that are running within your cluster, such as our deployment: trivy k8s --namespace app --report=summary deployments/react-application Trivy Operator The Trivy K8s command is an imperative model to scan resources. We wouldn\u2019t want to manually scan each resource across different environments. The larger the cluster and the more workloads are running in it, the more error-prone this process would become. With the Trivy Operator, we can automate the scanning process after the deployment. The Trivy Operator follows the Kubernetes Operator Model. Operators automate human actions, and the result of the task is saved as custom resource definitions (CRDs) within your cluster. This has several benefits: Trivy Operator is installed CRDs in our cluster. As a result, all our resources, including our security scanner and its scan results, are Kubernetes resources. This makes it much easier to integrate the Trivy Operator directly into our existing processes, such as connecting Trivy with Prometheus, a monitoring system. The Trivy Operator will automatically scan your resources every six hours. You can set up automatic alerting in case new critical security issues are discovered. The CRDs can be both machine and human-readable depending on which applications consume the CRDs. This allows for more versatile applications of the Trivy operator. There are several ways that you can install the Trivy Operator in your cluster. In this guide, we\u2019re going to use the Helm installation based on the following documentation. Please follow the Trivy Operator documentation for further information on: Installation of the Trivy Operator Getting started guide","title":"Cluster Scanning"},{"location":"tutorials/kubernetes/cluster-scanning/#kubernetes-scanning-tutorial","text":"","title":"Kubernetes Scanning Tutorial"},{"location":"tutorials/kubernetes/cluster-scanning/#prerequisites","text":"To test the following commands yourself, make sure that you\u2019re connected to a Kubernetes cluster. A simple kind, a Docker-Desktop or microk8s cluster will do. In our case, we\u2019ll use a one-node kind cluster. Pro tip: The output of the commands will be even more interesting if you have some workloads running in your cluster.","title":"Prerequisites"},{"location":"tutorials/kubernetes/cluster-scanning/#cluster-scanning","text":"Trivy K8s is great to get an overview of all the vulnerabilities and misconfiguration issues or to scan specific workloads that are running in your cluster. You would want to use the Trivy K8s command either on your own local cluster or in your CI/CD pipeline post deployments. The trivy k8s command is part of the Trivy CLI. With the following command, we can scan our entire Kubernetes cluster for vulnerabilities and get a summary of the scan: trivy k8s --report=summary cluster To get detailed information for all your resources, just replace \u2018summary\u2019 with \u2018all\u2019: trivy k8s --report=all cluster However, we recommend displaying all information only in case you scan a specific namespace or resource since you can get overwhelmed with additional details. Furthermore, we can specify the namespace that Trivy is supposed to scan to focus on specific resources in the scan result: trivy k8s -n kube-system --report=summary cluster Again, if you\u2019d like to receive additional details, use the \u2018--report=all\u2019 flag: trivy k8s -n kube-system --report=all cluster Like with scanning for vulnerabilities, we can also filter in-cluster security issues by severity of the vulnerabilities: trivy k8s --severity=CRITICAL --report=summary cluster Note that you can use any of the Trivy flags on the Trivy K8s command. With the Trivy K8s command, you can also scan specific workloads that are running within your cluster, such as our deployment: trivy k8s --namespace app --report=summary deployments/react-application","title":"Cluster Scanning"},{"location":"tutorials/kubernetes/cluster-scanning/#trivy-operator","text":"The Trivy K8s command is an imperative model to scan resources. We wouldn\u2019t want to manually scan each resource across different environments. The larger the cluster and the more workloads are running in it, the more error-prone this process would become. With the Trivy Operator, we can automate the scanning process after the deployment. The Trivy Operator follows the Kubernetes Operator Model. Operators automate human actions, and the result of the task is saved as custom resource definitions (CRDs) within your cluster. This has several benefits: Trivy Operator is installed CRDs in our cluster. As a result, all our resources, including our security scanner and its scan results, are Kubernetes resources. This makes it much easier to integrate the Trivy Operator directly into our existing processes, such as connecting Trivy with Prometheus, a monitoring system. The Trivy Operator will automatically scan your resources every six hours. You can set up automatic alerting in case new critical security issues are discovered. The CRDs can be both machine and human-readable depending on which applications consume the CRDs. This allows for more versatile applications of the Trivy operator. There are several ways that you can install the Trivy Operator in your cluster. In this guide, we\u2019re going to use the Helm installation based on the following documentation. Please follow the Trivy Operator documentation for further information on: Installation of the Trivy Operator Getting started guide","title":"Trivy Operator"},{"location":"tutorials/kubernetes/gitops/","text":"Installing the Trivy-Operator through GitOps This tutorial shows you how to install the Trivy Operator through GitOps platforms, namely ArgoCD and FluxCD. ArgoCD Make sure to have ArgoCD installed and running in your Kubernetes cluster. You can either deploy the Trivy Operator through the argocd CLI or by applying a Kubernetes manifest. ArgoCD command: > kubectl create ns trivy-system > argocd app create trivy-operator --repo https://github.com/aquasecurity/trivy-operator --path deploy/helm --dest-server https://kubernetes.default.svc --dest-namespace trivy-system Note that this installation is directly related to our official Helm Chart. If you want to change any of the value, we'd suggest you to create a separate values.yaml file. Kubernetes manifest trivy-operator.yaml : apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: trivy-operator namespace: argocd spec: project: default source: chart: trivy-operator repoURL: https://aquasecurity.github.io/helm-charts/ targetRevision: 0.0.3 helm: values: | trivy: ignoreUnfixed: true destination: server: https://kubernetes.default.svc namespace: trivy-system syncPolicy: automated: prune: true selfHeal: true To apply the Kubernetes manifest, if you have the manifest locally, you can use the following command through kubectl: > kubectl apply -f trivy-operator.yaml application.argoproj.io/trivy-operator created If you have the manifest in a Git repository, you can apply it to your cluster through the following command: > kubectl apply -n argocd -f https://raw.githubusercontent.com/AnaisUrlichs/argocd-starboard/main/starboard/argocd-starboard.yaml The latter command would allow you to make changes to the YAML manifest that ArgoCD would register automatically. Once deployed, you want to tell ArgoCD to sync the application from the actual state to the desired state: argocd app sync trivy-operator Now you can see the deployment in the ArgoCD UI. Have a look at the ArgoCD documentation to know how to access the UI. Note that ArgoCD is unable to show the Trivy CRDs as synced. FluxCD Make sure to have FluxCD installed and running in your Kubernetes cluster. You can either deploy the Trivy Operator through the Flux CLI or by applying a Kubernetes manifest. Flux command: > kubectl create ns trivy-system > flux create source helm trivy-operator --url https://aquasecurity.github.io/helm-charts --namespace trivy-system > flux create helmrelease trivy-operator --chart trivy-operator --source HelmRepository/trivy-operator --chart-version 0.0.3 --namespace trivy-system Kubernetes manifest trivy-operator.yaml : apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository metadata: name: trivy-operator namespace: flux-system spec: interval: 60m url: https://aquasecurity.github.io/helm-charts/ --- apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: name: trivy-operator namespace: trivy-system spec: chart: spec: chart: trivy-operator sourceRef: kind: HelmRepository name: trivy-operator namespace: flux-system version: 0.10.1 interval: 60m values: trivy: ignoreUnfixed: true install: crds: CreateReplace createNamespace: true You can then apply the file to your Kubernetes cluster: kubectl apply -f trivy-operator.yaml After the installation After the install, you want to check that the Trivy operator is running in the trivy-system namespace: kubectl get deployment -n trivy-system","title":"GitOps"},{"location":"tutorials/kubernetes/gitops/#installing-the-trivy-operator-through-gitops","text":"This tutorial shows you how to install the Trivy Operator through GitOps platforms, namely ArgoCD and FluxCD.","title":"Installing the Trivy-Operator through GitOps"},{"location":"tutorials/kubernetes/gitops/#argocd","text":"Make sure to have ArgoCD installed and running in your Kubernetes cluster. You can either deploy the Trivy Operator through the argocd CLI or by applying a Kubernetes manifest. ArgoCD command: > kubectl create ns trivy-system > argocd app create trivy-operator --repo https://github.com/aquasecurity/trivy-operator --path deploy/helm --dest-server https://kubernetes.default.svc --dest-namespace trivy-system Note that this installation is directly related to our official Helm Chart. If you want to change any of the value, we'd suggest you to create a separate values.yaml file. Kubernetes manifest trivy-operator.yaml : apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: trivy-operator namespace: argocd spec: project: default source: chart: trivy-operator repoURL: https://aquasecurity.github.io/helm-charts/ targetRevision: 0.0.3 helm: values: | trivy: ignoreUnfixed: true destination: server: https://kubernetes.default.svc namespace: trivy-system syncPolicy: automated: prune: true selfHeal: true To apply the Kubernetes manifest, if you have the manifest locally, you can use the following command through kubectl: > kubectl apply -f trivy-operator.yaml application.argoproj.io/trivy-operator created If you have the manifest in a Git repository, you can apply it to your cluster through the following command: > kubectl apply -n argocd -f https://raw.githubusercontent.com/AnaisUrlichs/argocd-starboard/main/starboard/argocd-starboard.yaml The latter command would allow you to make changes to the YAML manifest that ArgoCD would register automatically. Once deployed, you want to tell ArgoCD to sync the application from the actual state to the desired state: argocd app sync trivy-operator Now you can see the deployment in the ArgoCD UI. Have a look at the ArgoCD documentation to know how to access the UI. Note that ArgoCD is unable to show the Trivy CRDs as synced.","title":"ArgoCD"},{"location":"tutorials/kubernetes/gitops/#fluxcd","text":"Make sure to have FluxCD installed and running in your Kubernetes cluster. You can either deploy the Trivy Operator through the Flux CLI or by applying a Kubernetes manifest. Flux command: > kubectl create ns trivy-system > flux create source helm trivy-operator --url https://aquasecurity.github.io/helm-charts --namespace trivy-system > flux create helmrelease trivy-operator --chart trivy-operator --source HelmRepository/trivy-operator --chart-version 0.0.3 --namespace trivy-system Kubernetes manifest trivy-operator.yaml : apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository metadata: name: trivy-operator namespace: flux-system spec: interval: 60m url: https://aquasecurity.github.io/helm-charts/ --- apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: name: trivy-operator namespace: trivy-system spec: chart: spec: chart: trivy-operator sourceRef: kind: HelmRepository name: trivy-operator namespace: flux-system version: 0.10.1 interval: 60m values: trivy: ignoreUnfixed: true install: crds: CreateReplace createNamespace: true You can then apply the file to your Kubernetes cluster: kubectl apply -f trivy-operator.yaml","title":"FluxCD"},{"location":"tutorials/kubernetes/gitops/#after-the-installation","text":"After the install, you want to check that the Trivy operator is running in the trivy-system namespace: kubectl get deployment -n trivy-system","title":"After the installation"},{"location":"tutorials/kubernetes/kyverno/","text":"Attesting Image Scans With Kyverno This tutorial is based on the following blog post by Chip Zoller: Attesting Image Scans With Kyverno This tutorial details Verify the container image has an attestation with Kyverno Prerequisites Attestation of the vulnerability scan uploaded A running Kubernetes cluster that kubectl is connected to Kyverno Policy to check attestation The following policy ensures that the attestation is no older than 168h: vuln-attestation.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: check-vulnerabilities spec: validationFailureAction: enforce webhookTimeoutSeconds: 10 failurePolicy: Fail rules: - name: not-older-than-one-week match: any: - resources: kinds: - Pod verifyImages: - imageReferences: - \"CONTAINER-REGISTRY/*:*\" attestations: - predicateType: cosign.sigstore.dev/attestation/vuln/v1 conditions: - all: - key: \"{{ time_since('','{{metadata.scanFinishedOn}}','') }}\" operator: LessThanOrEquals value: \"168h\" Apply the policy to your Kubernetes cluster Ensure that you have Kyverno already deployed and running on your cluster -- for instance through he Kyverno Helm Chart. Next, apply the above policy: kubectl apply -f vuln-attestation.yaml To ensure that the policy worked, we can deploye an example deployment file with our container image: deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: cns-website namespace: app spec: replicas: 2 selector: matchLabels: run: cns-website template: metadata: labels: run: cns-website spec: containers: - name: cns-website image: docker.io/anaisurlichs/cns-website:0.0.6 ports: - containerPort: 80 imagePullPolicy: Always resources: limits: memory: 512Mi cpu: 200m securityContext: allowPrivilegeEscalation: false Once we apply the deployment, it should pass since our attestation is available: kubectl apply -f deployment.yaml -n app deployment.apps/cns-website created However, if we try to deploy any other container image, our deployment will fail. We can verify this by replacing the image referenced in the deployment with docker.io/anaisurlichs/cns-website:0.0.5 and applying the deployment: kubectl apply -f deployment-two.yaml Resource: \"apps/v1, Resource=deployments\", GroupVersionKind: \"apps/v1, Kind=Deployment\" Name: \"cns-website\", Namespace: \"app\" for: \"deployment-two.yaml\": admission webhook \"mutate.kyverno.svc-fail\" denied the request: resource Deployment/app/cns-website was blocked due to the following policies check-image: autogen-check-image: | failed to verify signature for docker.io/anaisurlichs/cns-website:0.0.5: .attestors[0].entries[0].keys: no matching signatures:","title":"Kyverno"},{"location":"tutorials/kubernetes/kyverno/#attesting-image-scans-with-kyverno","text":"This tutorial is based on the following blog post by Chip Zoller: Attesting Image Scans With Kyverno This tutorial details Verify the container image has an attestation with Kyverno","title":"Attesting Image Scans With Kyverno"},{"location":"tutorials/kubernetes/kyverno/#prerequisites","text":"Attestation of the vulnerability scan uploaded A running Kubernetes cluster that kubectl is connected to","title":"Prerequisites"},{"location":"tutorials/kubernetes/kyverno/#kyverno-policy-to-check-attestation","text":"The following policy ensures that the attestation is no older than 168h: vuln-attestation.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: check-vulnerabilities spec: validationFailureAction: enforce webhookTimeoutSeconds: 10 failurePolicy: Fail rules: - name: not-older-than-one-week match: any: - resources: kinds: - Pod verifyImages: - imageReferences: - \"CONTAINER-REGISTRY/*:*\" attestations: - predicateType: cosign.sigstore.dev/attestation/vuln/v1 conditions: - all: - key: \"{{ time_since('','{{metadata.scanFinishedOn}}','') }}\" operator: LessThanOrEquals value: \"168h\"","title":"Kyverno Policy to check attestation"},{"location":"tutorials/kubernetes/kyverno/#apply-the-policy-to-your-kubernetes-cluster","text":"Ensure that you have Kyverno already deployed and running on your cluster -- for instance through he Kyverno Helm Chart. Next, apply the above policy: kubectl apply -f vuln-attestation.yaml To ensure that the policy worked, we can deploye an example deployment file with our container image: deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: cns-website namespace: app spec: replicas: 2 selector: matchLabels: run: cns-website template: metadata: labels: run: cns-website spec: containers: - name: cns-website image: docker.io/anaisurlichs/cns-website:0.0.6 ports: - containerPort: 80 imagePullPolicy: Always resources: limits: memory: 512Mi cpu: 200m securityContext: allowPrivilegeEscalation: false Once we apply the deployment, it should pass since our attestation is available: kubectl apply -f deployment.yaml -n app deployment.apps/cns-website created However, if we try to deploy any other container image, our deployment will fail. We can verify this by replacing the image referenced in the deployment with docker.io/anaisurlichs/cns-website:0.0.5 and applying the deployment: kubectl apply -f deployment-two.yaml Resource: \"apps/v1, Resource=deployments\", GroupVersionKind: \"apps/v1, Kind=Deployment\" Name: \"cns-website\", Namespace: \"app\" for: \"deployment-two.yaml\": admission webhook \"mutate.kyverno.svc-fail\" denied the request: resource Deployment/app/cns-website was blocked due to the following policies check-image: autogen-check-image: | failed to verify signature for docker.io/anaisurlichs/cns-website:0.0.5: .attestors[0].entries[0].keys: no matching signatures:","title":"Apply the policy to your Kubernetes cluster"},{"location":"tutorials/misconfiguration/terraform/","text":"Scanning Terraform files with Trivy This tutorial is focused on ways Trivy can scan Terraform IaC configuration files. A video tutorial on Terraform Misconfiguration scans can be found on the Aqua Open Source YouTube account. A note to tfsec users We have been consolidating all of our scanning-related efforts in one place, and that is Trivy. You can read more on the decision in the tfsec discussions. Trivy Config Command Terraform configuration scanning is available as part of the trivy config command. This command scans all configuration files for misconfiguration issues. You can find the details within misconfiguration scans in the Trivy documentation. Command structure: trivy config <any flags you want to use> <file or directory that you would like to scan> The trivy config command can scan Terraform configuration, CloudFormation, Dockerfile, Kubernetes manifests, and Helm Charts for misconfiguration. Trivy will compare the configuration found in the file with a set of best practices. If the configuration is following best practices, the check will pass, If the configuration does not define the resource of some configuration, Trivy will assume the default configuration for the resource creation is used. In this case, the check might fail. If the configuration that has been defined does not follow best practices, the check will fail. Prerequisites Install Trivy on your local machines. The documentation provides several different installation options. This tutorial will use this example Terraform tutorial for terraform misconfiguration scanning with Trivy. Git clone the tutorial and cd into the directory: git clone git@github.com:Cloud-Native-Security/trivy-demo.git cd bad_iac/terraform In this case, the folder only containes Terraform configuration files. However, you could scan a directory that contains several different configurations e.g. Kubernetes YAML manifests, Dockerfile, and Terraform. Trivy will then detect the different configuration files and apply the right rules automatically. Different types of trivy config scans Below are several examples of how the trivy config scan can be used. General Terraform scan with trivy: trivy config <specify the directory> So if we are already in the directory that we want to scan: trivy config ./ Specify the scan format The --format flag changes the way that Trivy displays the scan result: JSON: trivy config -f json terraform-infra Sarif: trivy config -f sarif terraform-infra Specifying the output location The --output flag specifies the file location in which the scan result should be saved: JSON: trivy config -f json -o example.json terraform-infra Sarif: trivy config -f sarif -o example.sarif terraform-infra Filtering by severity If you are presented with lots and lots of misconfiguration across different files, you might want to filter or the misconfiguration with the highest severity: trivy config --severity CRITICAL, MEDIUM terraform-infra Passing tf.tfvars files into trivy config scans You can pass terraform values to Trivy to override default values found in the Terraform HCL code. More information are provided in the documentation. trivy conf --tf-vars terraform.tfvars ./ Custom Checks We have lots of examples in the documentation on how you can write and pass custom Rego policies into terraform misconfiguration scans. Secret and vulnerability scans The trivy config command does not perform secrete and vulnerability checks out of the box. However, you can specify as part of your trivy fs scan that you would like to scan you terraform files for exposed secrets and misconfiguraction through the following flags: trivy fs --scanners secret,config ./ The trivy config command is a sub-command of the trivy fs command. You can learn more about this command in the documentation. Scanning Terraform Plan files Instead of scanning your different Terraform resources individually, you could also scan your terraform plan output before it is deployed for misconfiguration. This will give you insights into any misconfiguration of your resources as they would become deployed. Here is the link to the documentation. First, create a terraform plan and save it to a file: terraform plan --out tfplan.binary Next, convert the file into json format: terraform show -json tfplan.binary > tfplan.json Lastly, scan the file with the trivy config command: trivy config ./tfplan.json Note that you need to be able to create a terraform init and plan without any errors. Using Trivy in your CI/CD pipeline Similar to tfsec, Trivy can be used either on local developer machines or integrated into your CI/CD pipeline. There are several steps available for different pipelines, including GitHub Actions, Circle CI, GitLab, Travis and more in the tutorials section of the documentation: https://aquasecurity.github.io/trivy/latest/tutorials/integrations/","title":"Terraform scanning"},{"location":"tutorials/misconfiguration/terraform/#scanning-terraform-files-with-trivy","text":"This tutorial is focused on ways Trivy can scan Terraform IaC configuration files. A video tutorial on Terraform Misconfiguration scans can be found on the Aqua Open Source YouTube account. A note to tfsec users We have been consolidating all of our scanning-related efforts in one place, and that is Trivy. You can read more on the decision in the tfsec discussions.","title":"Scanning Terraform files with Trivy"},{"location":"tutorials/misconfiguration/terraform/#trivy-config-command","text":"Terraform configuration scanning is available as part of the trivy config command. This command scans all configuration files for misconfiguration issues. You can find the details within misconfiguration scans in the Trivy documentation. Command structure: trivy config <any flags you want to use> <file or directory that you would like to scan> The trivy config command can scan Terraform configuration, CloudFormation, Dockerfile, Kubernetes manifests, and Helm Charts for misconfiguration. Trivy will compare the configuration found in the file with a set of best practices. If the configuration is following best practices, the check will pass, If the configuration does not define the resource of some configuration, Trivy will assume the default configuration for the resource creation is used. In this case, the check might fail. If the configuration that has been defined does not follow best practices, the check will fail.","title":"Trivy Config Command"},{"location":"tutorials/misconfiguration/terraform/#prerequisites","text":"Install Trivy on your local machines. The documentation provides several different installation options. This tutorial will use this example Terraform tutorial for terraform misconfiguration scanning with Trivy. Git clone the tutorial and cd into the directory: git clone git@github.com:Cloud-Native-Security/trivy-demo.git cd bad_iac/terraform In this case, the folder only containes Terraform configuration files. However, you could scan a directory that contains several different configurations e.g. Kubernetes YAML manifests, Dockerfile, and Terraform. Trivy will then detect the different configuration files and apply the right rules automatically.","title":"Prerequisites"},{"location":"tutorials/misconfiguration/terraform/#different-types-of-trivy-config-scans","text":"Below are several examples of how the trivy config scan can be used. General Terraform scan with trivy: trivy config <specify the directory> So if we are already in the directory that we want to scan: trivy config ./","title":"Different types of trivy config scans"},{"location":"tutorials/misconfiguration/terraform/#specify-the-scan-format","text":"The --format flag changes the way that Trivy displays the scan result: JSON: trivy config -f json terraform-infra Sarif: trivy config -f sarif terraform-infra","title":"Specify the scan format"},{"location":"tutorials/misconfiguration/terraform/#specifying-the-output-location","text":"The --output flag specifies the file location in which the scan result should be saved: JSON: trivy config -f json -o example.json terraform-infra Sarif: trivy config -f sarif -o example.sarif terraform-infra","title":"Specifying the output location"},{"location":"tutorials/misconfiguration/terraform/#filtering-by-severity","text":"If you are presented with lots and lots of misconfiguration across different files, you might want to filter or the misconfiguration with the highest severity: trivy config --severity CRITICAL, MEDIUM terraform-infra","title":"Filtering by severity"},{"location":"tutorials/misconfiguration/terraform/#passing-tftfvars-files-into-trivy-config-scans","text":"You can pass terraform values to Trivy to override default values found in the Terraform HCL code. More information are provided in the documentation. trivy conf --tf-vars terraform.tfvars ./","title":"Passing tf.tfvars files into trivy config scans"},{"location":"tutorials/misconfiguration/terraform/#custom-checks","text":"We have lots of examples in the documentation on how you can write and pass custom Rego policies into terraform misconfiguration scans.","title":"Custom Checks"},{"location":"tutorials/misconfiguration/terraform/#secret-and-vulnerability-scans","text":"The trivy config command does not perform secrete and vulnerability checks out of the box. However, you can specify as part of your trivy fs scan that you would like to scan you terraform files for exposed secrets and misconfiguraction through the following flags: trivy fs --scanners secret,config ./ The trivy config command is a sub-command of the trivy fs command. You can learn more about this command in the documentation.","title":"Secret and vulnerability scans"},{"location":"tutorials/misconfiguration/terraform/#scanning-terraform-plan-files","text":"Instead of scanning your different Terraform resources individually, you could also scan your terraform plan output before it is deployed for misconfiguration. This will give you insights into any misconfiguration of your resources as they would become deployed. Here is the link to the documentation. First, create a terraform plan and save it to a file: terraform plan --out tfplan.binary Next, convert the file into json format: terraform show -json tfplan.binary > tfplan.json Lastly, scan the file with the trivy config command: trivy config ./tfplan.json Note that you need to be able to create a terraform init and plan without any errors.","title":"Scanning Terraform Plan files"},{"location":"tutorials/misconfiguration/terraform/#using-trivy-in-your-cicd-pipeline","text":"Similar to tfsec, Trivy can be used either on local developer machines or integrated into your CI/CD pipeline. There are several steps available for different pipelines, including GitHub Actions, Circle CI, GitLab, Travis and more in the tutorials section of the documentation: https://aquasecurity.github.io/trivy/latest/tutorials/integrations/","title":"Using Trivy in your CI/CD pipeline"},{"location":"tutorials/shell/shell-completion/","text":"Enable shell completion Below is example steps to enable shell completion feature for trivy cli: 1. Know your current shell $ echo $SHELL /bin/zsh # For this example it is zsh, but will be vary depend on your $SHELL, maybe /bin/bash or /bin/fish 2. Run completion command to get sub-commands $ trivy completion zsh -h Generate the autocompletion script for the zsh shell. If shell completion is not already enabled in your environment you will need to enable it. You can execute the following once: echo \"autoload -U compinit; compinit\" >> ~/.zshrc To load completions in your current shell session: source < ( trivy completion zsh ) ; compdef _trivy trivy To load completions for every new session, execute once: #### Linux: trivy completion zsh > \" ${ fpath [1] } /_trivy\" #### macOS: trivy completion zsh > $( brew --prefix ) /share/zsh/site-functions/_trivy You will need to start a new shell for this setup to take effect. 3. Run the sub-commands following the instruction echo \"autoload -U compinit; compinit\" >> ~/.zshrc source < ( trivy completion zsh ) ; compdef _trivy trivy trivy completion zsh > \" ${ fpath [1] } /_trivy\" 4. Start a new shell and you can see the shell completion $ trivy [ tab ] aws -- scan aws account completion -- Generate the autocompletion script for the specified shell config -- Scan config files for misconfigurations filesystem -- Scan local filesystem help -- Help about any command image -- Scan a container image kubernetes -- scan kubernetes cluster module -- Manage modules plugin -- Manage plugins repository -- Scan a repository rootfs -- Scan rootfs sbom -- Scan SBOM for vulnerabilities server -- Server mode version -- Print the version","title":"Completion"},{"location":"tutorials/shell/shell-completion/#enable-shell-completion","text":"Below is example steps to enable shell completion feature for trivy cli:","title":"Enable shell completion"},{"location":"tutorials/shell/shell-completion/#1-know-your-current-shell","text":"$ echo $SHELL /bin/zsh # For this example it is zsh, but will be vary depend on your $SHELL, maybe /bin/bash or /bin/fish","title":"1. Know your current shell"},{"location":"tutorials/shell/shell-completion/#2-run-completion-command-to-get-sub-commands","text":"$ trivy completion zsh -h Generate the autocompletion script for the zsh shell. If shell completion is not already enabled in your environment you will need to enable it. You can execute the following once: echo \"autoload -U compinit; compinit\" >> ~/.zshrc To load completions in your current shell session: source < ( trivy completion zsh ) ; compdef _trivy trivy To load completions for every new session, execute once: #### Linux: trivy completion zsh > \" ${ fpath [1] } /_trivy\" #### macOS: trivy completion zsh > $( brew --prefix ) /share/zsh/site-functions/_trivy You will need to start a new shell for this setup to take effect.","title":"2. Run completion command to get sub-commands"},{"location":"tutorials/shell/shell-completion/#3-run-the-sub-commands-following-the-instruction","text":"echo \"autoload -U compinit; compinit\" >> ~/.zshrc source < ( trivy completion zsh ) ; compdef _trivy trivy trivy completion zsh > \" ${ fpath [1] } /_trivy\"","title":"3. Run the sub-commands following the instruction"},{"location":"tutorials/shell/shell-completion/#4-start-a-new-shell-and-you-can-see-the-shell-completion","text":"$ trivy [ tab ] aws -- scan aws account completion -- Generate the autocompletion script for the specified shell config -- Scan config files for misconfigurations filesystem -- Scan local filesystem help -- Help about any command image -- Scan a container image kubernetes -- scan kubernetes cluster module -- Manage modules plugin -- Manage plugins repository -- Scan a repository rootfs -- Scan rootfs sbom -- Scan SBOM for vulnerabilities server -- Server mode version -- Print the version","title":"4. Start a new shell and you can see the shell completion"},{"location":"tutorials/signing/vuln-attestation/","text":"Vulnerability Scan Record Attestation This tutorial details Scan your container image for vulnerabilities Generate an attestation with Cosign Prerequisites Trivy CLI installed Cosign installed Scan Container Image for vulnerabilities Scan your container image for vulnerabilities and save the scan result to a scan.json file: trivy image --ignore-unfixed --format json --output scan.json anaisurlichs/cns-website:0.0.6 --ignore-unfixed: Ensures that only the vulnerabilities are displayed that have a already a fix available --output scan.json: The scan output is saved to a scan.json file instead of being displayed in the terminal. Note: Replace the container image with the container image that you would like to scan. Attestation of the vulnerability scan with Cosign The following command generates an attestation for the vulnerability scan and uploads it to our container image: cosign attest --replace --predicate scan.json --type vuln anaisurlichs/cns-website:0.0.6 Note: Replace the container image with the container image that you would like to scan. See here for more details.","title":"Vulnerability Scan Record Attestation"},{"location":"tutorials/signing/vuln-attestation/#vulnerability-scan-record-attestation","text":"This tutorial details Scan your container image for vulnerabilities Generate an attestation with Cosign","title":"Vulnerability Scan Record Attestation"},{"location":"tutorials/signing/vuln-attestation/#prerequisites","text":"Trivy CLI installed Cosign installed","title":"Prerequisites"},{"location":"tutorials/signing/vuln-attestation/#scan-container-image-for-vulnerabilities","text":"Scan your container image for vulnerabilities and save the scan result to a scan.json file: trivy image --ignore-unfixed --format json --output scan.json anaisurlichs/cns-website:0.0.6 --ignore-unfixed: Ensures that only the vulnerabilities are displayed that have a already a fix available --output scan.json: The scan output is saved to a scan.json file instead of being displayed in the terminal. Note: Replace the container image with the container image that you would like to scan.","title":"Scan Container Image for vulnerabilities"},{"location":"tutorials/signing/vuln-attestation/#attestation-of-the-vulnerability-scan-with-cosign","text":"The following command generates an attestation for the vulnerability scan and uploads it to our container image: cosign attest --replace --predicate scan.json --type vuln anaisurlichs/cns-website:0.0.6 Note: Replace the container image with the container image that you would like to scan. See here for more details.","title":"Attestation of the vulnerability scan with Cosign"}]}
\ No newline at end of file
diff --git a/dev/sitemap.xml b/dev/sitemap.xml
index 84292c984e..af1af9866d 100644
--- a/dev/sitemap.xml
+++ b/dev/sitemap.xml
@@ -2,727 +2,727 @@
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/community/contribute/discussion/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/community/contribute/issue/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/community/contribute/pr/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/community/maintainer/help-wanted/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/community/maintainer/triage/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/advanced/air-gap/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/advanced/modules/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/advanced/plugins/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/advanced/container/embed-in-dockerfile/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/advanced/container/unpacked-filesystem/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/advanced/private-registries/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/advanced/private-registries/acr/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/advanced/private-registries/docker-hub/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/advanced/private-registries/ecr/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/advanced/private-registries/gcr/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/advanced/private-registries/self/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/compliance/compliance/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/configuration/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/configuration/cache/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/configuration/db/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/configuration/filtering/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/configuration/others/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/configuration/reporting/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/configuration/skipping/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/kubernetes/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/iac/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/iac/azure-arm/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/iac/cloudformation/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/iac/docker/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/iac/helm/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/iac/kubernetes/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/iac/terraform/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/language/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/language/c/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/language/dart/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/language/dotnet/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/language/elixir/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/language/golang/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/language/java/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/language/nodejs/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/language/php/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/language/python/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/language/ruby/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/language/rust/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/language/swift/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/alma/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/alpine/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/amazon/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/bitnami/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/cbl-mariner/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/centos/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/chainguard/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/debian/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/google-distroless/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/oracle/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/photon/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/rhel/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/rocky/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/suse/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/ubuntu/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/coverage/os/wolfi/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/troubleshooting/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/config-file/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_aws/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_config/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_convert/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_filesystem/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_image/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_kubernetes/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_module/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_module_install/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_module_uninstall/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_plugin/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_plugin_info/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_plugin_install/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_plugin_list/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_plugin_run/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_plugin_uninstall/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_plugin_update/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_repository/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_rootfs/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_sbom/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_server/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_version/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/configuration/cli/trivy_vm/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/modes/client-server/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/references/modes/standalone/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/scanner/license/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/scanner/vulnerability/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/scanner/misconfiguration/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/scanner/misconfiguration/custom/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/scanner/misconfiguration/custom/combine/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/scanner/misconfiguration/custom/data/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/scanner/misconfiguration/custom/debug/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/scanner/misconfiguration/custom/schema/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/scanner/misconfiguration/custom/selectors/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/scanner/misconfiguration/custom/testing/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/scanner/misconfiguration/policy/builtin/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/scanner/misconfiguration/policy/exceptions/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/supply-chain/sbom/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/supply-chain/vex/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/supply-chain/attestation/rekor/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/supply-chain/attestation/sbom/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/supply-chain/attestation/vuln/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/target/aws/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/target/container_image/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/target/filesystem/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/target/kubernetes/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/target/repository/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/target/rootfs/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/target/sbom/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/docs/target/vm/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/ecosystem/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/ecosystem/cicd/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/ecosystem/ide/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/ecosystem/prod/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/ecosystem/security/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/getting-started/faq/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/getting-started/installation/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/getting-started/signature-verification/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/overview/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/additional-resources/cks/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/additional-resources/community/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/additional-resources/references/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/integrations/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/integrations/aws-codepipeline/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/integrations/aws-security-hub/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/integrations/azure-devops/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/integrations/bitbucket/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/integrations/circleci/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/integrations/github-actions/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/integrations/gitlab-ci/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/integrations/travis-ci/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/kubernetes/cluster-scanning/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/kubernetes/gitops/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/kubernetes/kyverno/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/misconfiguration/terraform/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/shell/shell-completion/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://aquasecurity.github.io/trivy/dev/tutorials/signing/vuln-attestation/</loc>
-         <lastmod>2023-10-13</lastmod>
+         <lastmod>2023-10-14</lastmod>
          <changefreq>daily</changefreq>
     </url>
 </urlset>
\ No newline at end of file
diff --git a/dev/sitemap.xml.gz b/dev/sitemap.xml.gz
index 89c76c3050..68b25aaf81 100644
Binary files a/dev/sitemap.xml.gz and b/dev/sitemap.xml.gz differ
diff --git a/versions.json b/versions.json
index 91aea98ac1..16eddbc389 100644
--- a/versions.json
+++ b/versions.json
@@ -1 +1 @@
-[{"version": "v0.45", "title": "v0.45", "aliases": ["latest"]}, {"version": "v0.44", "title": "v0.44", "aliases": []}, {"version": "v0.43", "title": "v0.43", "aliases": []}, {"version": "v0.42", "title": "v0.42", "aliases": []}, {"version": "v0.41", "title": "v0.41", "aliases": []}, {"version": "v0.40", "title": "v0.40", "aliases": []}, {"version": "v0.39", "title": "v0.39", "aliases": []}, {"version": "v0.38", "title": "v0.38", "aliases": []}, {"version": "v0.37", "title": "v0.37", "aliases": []}, {"version": "v0.36", "title": "v0.36", "aliases": []}, {"version": "v0.35", "title": "v0.35", "aliases": []}, {"version": "v0.34", "title": "v0.34", "aliases": []}, {"version": "v0.33", "title": "v0.33", "aliases": []}, {"version": "v0.32", "title": "v0.32", "aliases": []}, {"version": "v0.31.3", "title": "v0.31", "aliases": ["v0.31.1", "v0.31.0", "v0.31.2"]}, {"version": "v0.30.4", "title": "v0.30", "aliases": ["v0.30.1", "v0.30.2", "v0.30.3", "v0.30.0"]}, {"version": "v0.29.2", "title": "v0.29", "aliases": ["v0.29.0", "v0.29.1"]}, {"version": "v0.28.1", "title": "v0.28", "aliases": ["v0.28.0"]}, {"version": "v0.27.1", "title": "v0.27", "aliases": ["v0.27.0"]}, {"version": "v0.26.0", "title": "v0.26", "aliases": []}, {"version": "v0.25.4", "title": "v0.25", "aliases": ["v0.25.1", "v0.25.0", "v0.25.2", "v0.25.3"]}, {"version": "v0.24.4", "title": "v0.24", "aliases": ["v0.24.0", "v0.24.3", "v0.24.2", "v0.24.1"]}, {"version": "v0.23.0", "title": "v0.23", "aliases": []}, {"version": "v0.22.0", "title": "v0.22", "aliases": []}, {"version": "v0.21.3", "title": "v0.21", "aliases": ["v0.21.1", "v0.21.0", "v0.21.2"]}, {"version": "v0.20.2", "title": "v0.20", "aliases": ["v0.20.0", "v0.20.1"]}, {"version": "v0.19.2", "title": "v0.19", "aliases": ["v0.19.0", "v0.19.1"]}, {"version": "v0.18.3", "title": "v0.18", "aliases": ["v0.18.1", "v0.18.2", "v0.18.0"]}, {"version": "v0.17.2", "title": "v0.17", "aliases": ["v0.17.0", "v0.17.1"]}, {"version": "v0.16.0", "title": "v0.16", "aliases": []}, {"version": "v0.15.0", "title": "v0.15", "aliases": []}, {"version": "test", "title": "test", "aliases": []}, {"version": "dev", "title": "dev", "aliases": []}]
\ No newline at end of file
+[{"version": "v0.45", "title": "v0.45", "aliases": ["latest"]}, {"version": "v0.44", "title": "v0.44", "aliases": []}, {"version": "v0.43", "title": "v0.43", "aliases": []}, {"version": "v0.42", "title": "v0.42", "aliases": []}, {"version": "v0.41", "title": "v0.41", "aliases": []}, {"version": "v0.40", "title": "v0.40", "aliases": []}, {"version": "v0.39", "title": "v0.39", "aliases": []}, {"version": "v0.38", "title": "v0.38", "aliases": []}, {"version": "v0.37", "title": "v0.37", "aliases": []}, {"version": "v0.36", "title": "v0.36", "aliases": []}, {"version": "v0.35", "title": "v0.35", "aliases": []}, {"version": "v0.34", "title": "v0.34", "aliases": []}, {"version": "v0.33", "title": "v0.33", "aliases": []}, {"version": "v0.32", "title": "v0.32", "aliases": []}, {"version": "v0.31.3", "title": "v0.31", "aliases": ["v0.31.1", "v0.31.0", "v0.31.2"]}, {"version": "v0.30.4", "title": "v0.30", "aliases": ["v0.30.3", "v0.30.1", "v0.30.0", "v0.30.2"]}, {"version": "v0.29.2", "title": "v0.29", "aliases": ["v0.29.1", "v0.29.0"]}, {"version": "v0.28.1", "title": "v0.28", "aliases": ["v0.28.0"]}, {"version": "v0.27.1", "title": "v0.27", "aliases": ["v0.27.0"]}, {"version": "v0.26.0", "title": "v0.26", "aliases": []}, {"version": "v0.25.4", "title": "v0.25", "aliases": ["v0.25.0", "v0.25.2", "v0.25.1", "v0.25.3"]}, {"version": "v0.24.4", "title": "v0.24", "aliases": ["v0.24.0", "v0.24.2", "v0.24.1", "v0.24.3"]}, {"version": "v0.23.0", "title": "v0.23", "aliases": []}, {"version": "v0.22.0", "title": "v0.22", "aliases": []}, {"version": "v0.21.3", "title": "v0.21", "aliases": ["v0.21.2", "v0.21.0", "v0.21.1"]}, {"version": "v0.20.2", "title": "v0.20", "aliases": ["v0.20.0", "v0.20.1"]}, {"version": "v0.19.2", "title": "v0.19", "aliases": ["v0.19.0", "v0.19.1"]}, {"version": "v0.18.3", "title": "v0.18", "aliases": ["v0.18.1", "v0.18.0", "v0.18.2"]}, {"version": "v0.17.2", "title": "v0.17", "aliases": ["v0.17.0", "v0.17.1"]}, {"version": "v0.16.0", "title": "v0.16", "aliases": []}, {"version": "v0.15.0", "title": "v0.15", "aliases": []}, {"version": "test", "title": "test", "aliases": []}, {"version": "dev", "title": "dev", "aliases": []}]
\ No newline at end of file