fix(deps): update module github.com/aquasecurity/trivy to v0.51.2 [security] #1686
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
|
Blocked since bump requires Go 1.22 |
renovate
bot
force-pushed
the
renovate/go-git.luolix.top/aquasecurity/trivy-vulnerability
branch
3 times, most recently
from
bd66caf
to
f4eb42a
Compare
This comment has been minimized.
This comment has been minimized.
renovate
bot
force-pushed
the
renovate/go-git.luolix.top/aquasecurity/trivy-vulnerability
branch
from
d02bddf
to
d256b9b
Compare
This comment has been minimized.
This comment has been minimized.
paralta
previously approved these changes
May 23, 2024
renovate
bot
force-pushed
the
renovate/go-git.luolix.top/aquasecurity/trivy-vulnerability
branch
from
fe2ea97
to
8882319
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
|
Hey! Your images are ready:
|
paralta
approved these changes
May 23, 2024
ramizpolic
approved these changes
May 24, 2024
paralta
deleted the
renovate/go-git.luolix.top/aquasecurity/trivy-vulnerability
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.50.4->v0.51.2Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2024-35192
Impact
If a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access.
Taking AWS as an example, the leakage only occurs when Trivy is able to transparently obtain registry credentials from the default credential provider chain. You are affected if Trivy is executed in any of the following situations:
You are not affected if the default credential provider chain is unable to obtain valid credentials. The same applies to GCP and Azure.
Workarounds
If you are using Trivy v0.51.2 or later, you are not affected. If you are using Trivy v0.51.1 or prior, you should ensure you only scan images from trusted registries.
This vulnerability only applies when scanning container images directly from a registry. If you use Docker, containerd or other runtime to pull images locally and scan them with Trivy, you are not affected. To enforce this behavior, you can use the
--image-srcflag to select which sources you trust.Trivy possibly leaks registry credential when scanning images from malicious registries
CVE-2024-35192 / GHSA-xcq4-m2r3-cmrj / GO-2024-2870
More information
Details
Impact
If a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access.
Taking AWS as an example, the leakage only occurs when Trivy is able to transparently obtain registry credentials from the default credential provider chain. You are affected if Trivy is executed in any of the following situations:
You are not affected if the default credential provider chain is unable to obtain valid credentials. The same applies to GCP and Azure.
Workarounds
If you are using Trivy v0.51.2 or later, you are not affected. If you are using Trivy v0.51.1 or prior, you should ensure you only scan images from trusted registries.
This vulnerability only applies when scanning container images directly from a registry. If you use Docker, containerd or other runtime to pull images locally and scan them with Trivy, you are not affected. To enforce this behavior, you can use the
--image-srcflag to select which sources you trust.Severity
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Credential leakage in github.com/aquasecurity/trivy
CVE-2024-35192 / GHSA-xcq4-m2r3-cmrj / GO-2024-2870
More information
Details
A malicious registry can cause Trivy to leak credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR) if the registry is scanned from directly using Trivy. These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access. This vulnerability only applies when scanning container images directly from a registry. If you use Docker, containerd or other runtime to pull images locally and scan them with Trivy, you are not affected. To enforce this behavior, you can use the --image-src flag to select which sources you trust.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Release Notes
aquasecurity/trivy (github.com/aquasecurity/trivy)
v0.51.2Compare Source
Changelog
eadc6fbfix: node-collector high and critical cves (#6707)cc489b1Merge pull request from GHSA-xcq4-m2r3-cmrj013f71achore: auto-bump golang patch versions (#6711)113a5b2fix(misconf): don't shift ignore rule related to code (#6708)733e5acfix(go): include only.version|.ver(no prefixes) ldflags forgobinaries(#6705)d311e49fix(go): add only non-empty root modules forgobinaries(#6710)cf1a7bfrefactor: unify package addition and vulnerability scanning (#6579)d465d9dfix: Golang version parsing from binaries w/GOEXPERIMENT (#6696)0af225cfix(conda): add supportpipdeps forenvironment.ymlfiles (#6675)6f64d55fix(misconf): skip Rego errors with a nil location (#6666)8c27430fix(misconf): skip Rego errors with a nil location (#6638)c2b46d3refactor: unify Library and Package structs (#6633)4368f11fix: use of specified context to obtain cluster name (#6645)5ec62f8docs: fix usage of image-config-scanners (#6635)v0.51.1Compare Source
Changelog
8016b82fix(fs): handle default skip dirs properly (#6628)7a25dadfix(misconf): load cached tf modules (#6607)9c794c0fix(misconf): do not use semver for parsing tf module versions (#6614)v0.51.0Compare Source
⚡Release highlights and summary⚡
👉 https://github.com/aquasecurity/trivy/discussions/6622
Changelog
14c1024refactor: move setting scanners when using compliance reports to flag parsing (#6619)998f750feat: introduce package UIDs for improved vulnerability mapping (#6583)770b141perf(misconf): Improve cause performance (#6586)3ccb1a0docs: trivy-k8s new experiance remove un-used section (#6608)58cfd1bchore(deps): bump github.com/docker/docker from 26.0.1+incompatible to 26.0.2+incompatible (#6612)715963ddocs: remove mention of GitLab Gold because it doesn't exist anymore (#6609)37da98dfeat(misconf): Use updated terminology for misconfiguration checks (#6476)cdee703chore(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/manager from 1.15.15 to 1.16.15 (#6593)6a2225bdocs: usegenericlink fromtrivy-repo(#6606)a2a02dedocs: update trivy k8s with new experience (#6465)e739ab8feat: support--skip-imagesscanning flag (#6334)c6d5d85BREAKING: add support for k8sdisable-node-collectorflag (#6311)194a814chore(deps): bump github.com/zclconf/go-cty from 1.14.1 to 1.14.4 (#6601)03830c5chore(deps): bump github.com/sigstore/rekor from 1.2.2 to 1.3.6 (#6599)8e814fachore(deps): bump google.golang.org/protobuf from 1.33.0 to 1.34.0 (#6597)2dc76bachore(deps): bump sigstore/cosign-installer from 3.4.0 to 3.5.0 (#6588)c17176bchore(deps): bump github.com/testcontainers/testcontainers-go from 0.28.0 to 0.30.0 (#6595)bce70afchore(deps): bump github.com/open-policy-agent/opa from 0.62.0 to 0.64.1 (#6596)4369a19feat: add ubuntu 23.10 and 24.04 support (#6573)5566548chore(deps): bump azure/setup-helm from 3.5 to 4 (#6590)a8af76achore(deps): bump actions/checkout from 4.1.2 to 4.1.4 (#6587)c8ed432chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.24.6 to 1.27.4 (#6598)551a46edocs(go): add stdlib (#6580)261649bchore(deps): bump github.com/containerd/containerd from 1.7.13 to 1.7.16 (#6592)acfddd4chore(deps): bump github.com/go-openapi/runtime from 0.27.1 to 0.28.0 (#6600)419e3d2feat(go): parse main mod version from build info settings (#6564)f0961d5feat: respect custom exit code from plugin (#6584)a5d485cdocs: add asdf and mise installation method (#6063)29b8faffeat(vuln): Handle scanning conan v2.x lockfiles (#6357)e3bef02feat: add supportenvironment.yamlfiles (#6569)916f6c6fix: close plugin.yaml (#6577)8e6cd0efix: trivy k8s avoid deleting non-default node collector namespace (#6559)060d0bbBREAKING: support excludekinds/namespacesand includekinds/namespaces(#6323)2d090effeat(go): add main module (#6574)6343e4ffeat: add relationships (#6563)a018ee1ci: disableGocache forreusable-release.yaml(#6572)5da053fdocs: mention--show-suppressedis available in table (#6571)3d66cb8chore: fix sqlite to support loong64 (#6511)9aca98cfix(debian): sort dpkg info before parsing due to exclude directories (#6551)7811ad0docs: update info about config file (#6547)fae710ddocs: remove RELEASE_VERSION from trivy.repo (#6546)d2d4022fix(sbom): change error to warning for multiple OSes (#6541)164b025fix(vuln): skip empty versions (#6542)5dd9bd4feat(c): add license support for conan lock files (#6329)7c2017ffix(terraform): Attribute and fileset fixes (#6544)63c9469refactor: change warning if no vulnerability details are found (#6230)aa822c2refactor(misconf): improve error handling in the Rego scanner (#6527)30cc88fci: use tmp dir inside Trivy repo dir for GoReleaser (#6533)e32215cfeat(go): parse main module of go binary files (#6530)d4da83cchore(deps): bump golang.org/x/net from 0.21.0 to 0.23.0 (#6526)0d7d97drefactor(misconf): simplify the retrieval of module annotations (#6528)9873cf3chore(deps): bump github.com/hashicorp/go-getter from 1.7.3 to 1.7.4 (#6523)95c8fd9docs(nodejs): add info about supported versions of pnpm lock files (#6510)12ec0dffeat(misconf): loading embedded checks as a fallback (#6502)9b7d713fix(misconf): Parse JSON k8s manifests properly (#6490)13e72ecrefactor: remove parallel walk (#5180)a986199fix: close pom.xml (#6507)46d5abafix(secret): convert severity for custom rules (#6500)34ab09dfix(java): update logic to detectpom.xmlfile snapshot artifacts from remote repositories (#6412)1ba5b59fix: typo (#6283)4fab0f8docs(k8s,image): fix command-line syntax issues (#6403)d770981chore(deps): bump actions/checkout from 4.1.1 to 4.1.2 (#6435)4337068fix(misconf): avoid panic if the scheme is not valid (#6496)d82d6cbfeat(image): goversion as stdlib (#6277)cfddfb3fix: add color for error inside of log message (#6493)dfcb0f9chore(deps): bump actions/add-to-project from 0.4.1 to 1.0.0 (#6438)183eaafdocs: fix links to OPA docs (#6480)94d6e8crefactor: replace zap with slog (#6466)336c47edocs: update links to IaC schemas (#6477)06b4473chore: bump Go to 1.22 (#6075)a51ceddrefactor(terraform): sync funcs with Terraform (#6415)53517d6feat(misconf): add helm-api-version and helm-kube-version flag (#6332)ad544e9chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.4.0 to 1.5.1 (#6426)089368dchore(deps): bump github.com/go-openapi/strfmt from 0.22.0 to 0.23.0 (#6452)1163565chore(deps): bump github.com/hashicorp/golang-lru/v2 from 2.0.6 to 2.0.7 (#6430)637da2bchore(deps): bump aquaproj/aqua-installer from 2.2.0 to 3.0.0 (#6437)13190e9fix(terraform): eval submodules (#6411)6bca7c3refactor(terraform): remove unused options (#6446)8e4279brefactor(terraform): remove unused file (#6445)e98c873chore(deps): bump github.com/testcontainers/testcontainers-go to v0.28.0 (#6387)b1c2eabchore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.9.0 to 1.10.0 (#6427)1c49a16fix(misconf): Escape template value correctly (#6292)8dd0fcdfeat(misconf): add support for wildcard ignores (#6414)74e4c6efix(cloudformation): resolveDedicatedMasterEnabledparsing issue (#6439)245c120refactor(terraform): remove metrics collection (#6444)86714bffeat(cloudformation): add support for logging and endpoint access for EKS (#6440)a758392chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.51.1 to 1.53.1 (#6424)4d00d8bchore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.27.4 to 1.27.10 (#6428)3ad2b3echore(deps): bump go.etcd.io/bbolt from 1.3.8 to 1.3.9 (#6429)8baccd7fix(db): check schema version for image name only (#6410)e75a90fchore(deps): bump github.com/google/wire from 0.5.0 to 0.6.0 (#6425)6625bd3chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.149.1 to 1.155.1 (#6433)826fe60chore(deps): bump actions/cache from 4.0.0 to 4.0.2 (#6436)f23ed77feat(misconf): Support private registries for misconf check bundle (#6327)df024e8feat(cloudformation): inline ignore support for YAML templates (#6358)29dee32feat(terraform): ignore resources by nested attributes (#6302)1a67472perf(helm): load in-memory files (#6383)09e37b7feat(aws): apply filter options to result (#6367)87a9aa6feat(aws): quiet flag support (#6331)712dcd3fix(misconf): clear location URI for SARIF (#6405)625f22btest(cloudformation): add CF tests (#6315)6a2f6fdfix(cloudformation): infer type after resolving a function (#6406)Configuration
📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Mend Renovate. View repository job log here.