Repository: aquasecurity/trivy-db

Issue:
Scanning failure for non-amd64 Red Hat images created before June 2020
## Description:
We've identified an issue in our scanning process for Red Hat container images.

### Problem
Scanning fails for Red Hat container images that meet both of these criteria:

- Created before June 2020
- Architecture other than amd64

### Root cause:

These older images lack `/root/buildinfo/content_manifests`, requiring NVR-to-CPE conversion.
Our current [NVR-to-CPE mapping](https://github.com/aquasecurity/vuln-list-redhat/blob/main/cpe/nvr-to-cpe.json) only includes amd64 architectures.


### Impact
Incomplete vulnerability scanning for affected images

Discussion:
@atgreen: I'm getting this same error, pointing me at this Issue, despite the fact that the image DOES contain `/root/buildinfo/content_manifests` and was created in 2024.

```
green@fedora:~/ctest$ trivy image registry.redhat.io/ocp-tools-4/jenkins-rhel8:v4.14.0-1725667424
2024-09-21T07:45:26-04:00	INFO	[vuln] Vulnerability scanning is enabled
2024-09-21T07:45:26-04:00	INFO	[secret] Secret scanning is enabled
2024-09-21T07:45:26-04:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-09-21T07:45:26-04:00	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-09-21T07:45:32-04:00	INFO	Detected OS	family="redhat" version="8.10"
2024-09-21T07:45:32-04:00	INFO	[redhat] Detecting RHEL/CentOS vulnerabilities...	os_version="8" pkg_num=375
2024-09-21T07:45:32-04:00	FATAL	Fatal error	image scan error: scan error: scan failed: scan failed: failed to detect vulnerabilities: unable to scan OS packages: failed vulnerability detection of OS packages: failed detection: redhat vulnerability detection error: failed to get Red Hat advisories: unable to find CPE indices. See https://github.com/aquasecurity/trivy-db/issues/435 for details
```@knqyf263: @DmitriyLewen Can you please take a look?@DmitriyLewen: Hello @atgreen 
It looks like the `content_manifests` file contains unknown repositories.

Unfortunately, I don't have access to this image.

Can you send me the `/root/buildinfo/content_manifests/*.json` file from this image?

UPD.
But `Pyxis` shows correct content sets:
```bash
➜ curl -X 'GET' \ 
  'https://catalog.redhat.com/api/containers/v1/images/id/66db9ee0a82efda2c54a9ec6' \
  -H 'accept: application/json' | jq .content_sets
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 47900  100 47900    0     0  66602      0 --:--:-- --:--:-- --:--:-- 66527
[
  "rhel-8-for-aarch64-baseos-rpms",
  "rhel-8-for-aarch64-appstream-rpms"
]
```@atgreen: [out.txt](https://github.com/user-attachments/files/17095447/out.txt)
@DmitriyLewen: It looks like several files contain incorrect `content_sets`:
```
====== /root/buildinfo/content_manifests/openshift-base-rhel8-container-v4.14.0-202408260910.p0.gf020942.assembly.stream.el8.json ======
{
    ...
    "content_sets": [
        "rhel-8-for-x86_64-appstream-rpms__8",
        "rhel-8-for-x86_64-baseos-rpms__8"
    ]
}====== /root/buildinfo/content_manifests/openshift-enterprise-base-container-v4.14.0-202408260910.p0.g03e5f40.assembly.stream.el8.json ======
{
    ...
    "content_sets": [
        "rhel-8-for-x86_64-appstream-rpms__8",
        "rhel-8-for-x86_64-baseos-rpms__8"
    ]
}====== /root/buildinfo/content_manifests/openshift-enterprise-cli-container-v4.14.0-202408260910.p0.g44b3ac2.assembly.stream.el8.json ======
{
    ...
    "content_sets": [
        "rhel-8-for-x86_64-appstream-rpms__8",
        "rhel-8-for-x86_64-baseos-rpms__8"
    ]
}====== /root/buildinfo/content_manifests/openshift-jenkins-2-container-v4.14.0-1725667424.json ====== 
{
    ...
    "content_sets": [
        "rhel-8-for-x86_64-baseos-rpms",
        "rhel-8-for-x86_64-appstream-rpms"
    ]
}====== /root/buildinfo/content_manifests/ubi8-container-8.10-901.1717584420.json ====== 
{
    ...
    "content_sets": [
        "rhel-8-for-x86_64-baseos-rpms",
        "rhel-8-for-x86_64-appstream-rpms"
    ],
    "image_contents": []
}

```
`rhel-8-for-x86_64-baseos-rpms` and `rhel-8-for-x86_64-appstream-rpms` are correct (see output of `Pyxis`).
`rhel-8-for-x86_64-appstream-rpms__8` and `rhel-8-for-x86_64-baseos-rpms__8` are wrong.

@knqyf263 you have more experience in this matter.
I have 2 question:
- IIUC `/root/buildinfo/content_manifests` should contain one manifest file. Is it correct that this directory contains more than 1 file?
- if yes - should we merge `content_sets` from these files?
   https://github.com/aquasecurity/trivy/blob/37d549e5b86a1c5dce6710fbfd2310aec9abe949/pkg/fanal/analyzer/analyzer.go#L294-L296@knqyf263: >IIUC /root/buildinfo/content_manifests should contain one manifest file. Is it correct that this directory contains more than 1 file?

My understanding is that there should only be one file per layer. However, the image as a whole may contain multiple files. Therefore, it is necessary to look up the appropriate buildinfo for each package.
https://github.com/aquasecurity/trivy/blob/37d549e5b86a1c5dce6710fbfd2310aec9abe949/pkg/fanal/applier/docker.go#L53-L76
@sayan-biswas: This is the content set we have used in our config.
```
aarch64:
- rhel-8-for-aarch64-baseos-rpms
- rhel-8-for-aarch64-appstream-rpms
ppc64le:
- rhel-8-for-ppc64le-baseos-rpms
- rhel-8-for-ppc64le-appstream-rpms
s390x:
- rhel-8-for-s390x-baseos-rpms
- rhel-8-for-s390x-appstream-rpms
x86_64:
- rhel-8-for-x86_64-baseos-rpms
- rhel-8-for-x86_64-appstream-rpms
```@knqyf263: @sayan-biswas Thanks for sharing. We see some content sets, like `rhel-8-for-x86_64-appstream-rpms__8`. Is it legitimate or a mistake?

```
$ docker run --rm -it --entrypoint cat registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:b142a2461dcf8bc50cc6311808867c38a3de45c82145df648d34d37a75496d0f -- /root/buildinfo/content_manifests/openshift-enterprise-base-container-v4.15.0-202408260908.p0.g27f1695.assembly.stream.el8.json | jq .cont
ent_sets
[
  "rhel-8-for-aarch64-appstream-rpms__8",
  "rhel-8-for-aarch64-baseos-rpms__8"
]
```@AdmiralGT: I'm also seeing this error with the following content in content_manifests

```
[root@a481dbded621 /]# ls -l /root/buildinfo/content_manifests/
total 4
-rw-rw-r-- 1 root root 368 Oct 23  2023 ubi8-container-8.8-1067.1698056881.json
[root@a481dbded621 /]# cat /root/buildinfo/content_manifests/ubi8-container-8.8-1067.1698056881.json
{
    "metadata": {
        "icm_version": 1,
        "icm_spec": "https://raw.githubusercontent.com/containerbuildsystem/atomic-reactor/master/atomic_reactor/schemas/content_manifest.json",
        "image_layer_index": 0
    },
    "content_sets": [
        "rhel-8-for-x86_64-baseos-rpms",
        "rhel-8-for-x86_64-appstream-rpms"
    ],
    "image_contents": []
}
```

Based on the above comments, it looks like these are correct (and I only have a single file in content_manifests)@DmitriyLewen: > I'm also seeing this error with the following content in content_manifests

Hmm... this is very strange...
Can you share this image?@AdmiralGT: I'm afraid not, but we've upgraded from v0.55.1 to v0.55.5 of trivy and that appears to have resolved the issue.@DmitriyLewen: Trivy doesn't have `v0.55.5` version 😄 @AdmiralGT: > Trivy doesn't have `v0.55.5` version 😄

Haha, I've not fully woken up yet, we've reverted to 0.55.0 (which does work) rather than 0.55.1 (which doesn't)@DmitriyLewen: > [root@a481dbded621 /]# ls -l /root/buildinfo/content_manifests/
total 4
-rw-rw-r-- 1 root root 368 Oct 23  2023 ubi8-container-8.8-1067.1698056881.json
[root@a481dbded621 /]# cat /root/buildinfo/content_manifests/ubi8-container-8.8-1067.1698056881.json
{
    "metadata": {
        "icm_version": 1,
        "icm_spec": "https://raw.githubusercontent.com/containerbuildsystem/atomic-reactor/master/atomic_reactor/schemas/content_manifest.json",
        "image_layer_index": 0
    },
    "content_sets": [
        "rhel-8-for-x86_64-baseos-rpms",
        "rhel-8-for-x86_64-appstream-rpms"
    ],
    "image_contents": []
}


Is this possible that manifest files for other layers have been deleted?@AdmiralGT: I don't believe so. Our build infrastructure templates our docker files but I couldn't find anything in the infrastructure to suggest it was deleting manifest files from other layers. I'll see if I can get out the templated docker file but that might not happen until next week I'm afraid.@DmitriyLewen: ok, i'll wait for the info.
i just can't think of any other ideas why you get an error with a valid context_sets@andersjdba: We started to see failures which directed to this issue after upgrading from trivy 0.55.1 to 0.56.1. We couldn't understand why we were seeing this and were at a bit of a loss. 

Rightly or wrongly, we've always scanned our images in our CI in parallel. Out of curiosity more than anything, I reverted the parallel scan to run in serial and this error went away. I haven't had chance to look in to the "why" as yet but thought id share this incase it helps in anyway without muddying the waters.@bjd: Seeing the same issue on standard amd64 UBI9 9.5 image (tested with trivy version: 0.57.0)

```
$ /home/dev/tools/trivy/trivy image registry.access.redhat.com/ubi9/ubi-minimal:9.5
2024-11-13T11:28:52Z    INFO    [vuln] Vulnerability scanning is enabled
2024-11-13T11:28:52Z    INFO    [secret] Secret scanning is enabled
2024-11-13T11:28:52Z    INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-13T11:28:52Z    INFO    [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-13T11:28:55Z    INFO    Detected OS     family="redhat" version="9.5"
2024-11-13T11:28:55Z    INFO    [redhat] Detecting RHEL/CentOS vulnerabilities...       os_version="9" pkg_num=105
2024-11-13T11:28:55Z    FATAL   Fatal error     image scan error: scan error: scan failed: scan failed: failed to detect vulnerabilities: unable to scan OS packages: failed vulnerability detection of OS packages: failed detection: redhat vulnerability detection error: failed to get Red Hat advisories: unable to find CPE indices. See https://github.com/aquasecurity/trivy-db/issues/435 for details
```
It has the following in content_manifests:

```
[root@b1c38098ed17 /]# ls -l /root/buildinfo/content_manifests
total 592
-rw-r--r--. 1 root root 479275 Nov  1 19:30 sbom-cyclonedx.json
-rw-r--r--. 1 root root 120511 Nov  1 19:30 sbom-purl.json
```

For comparison, the 9.4 version which works does not have the above manifests but a different one:
```
[root@85f0c1ce845b /]# ls -l /root/buildinfo/content_manifests/
total 4
-rw-rw-r--. 1 root root 368 Sep 18 21:24 ubi9-minimal-container-9.4-1227.1726694542.json
```


@DmitriyLewen: Hello @bjd 
We already found this case - https://github.com/aquasecurity/trivy/issues/7911
eems to be a bug in latest `ubi9-minimal` that `/root/buildinfo/content_manifests` doesn't contain a file with contentSet.

But in any case we should not return an error (in this case we should use default contentSets).
I created https://github.com/aquasecurity/trivy/pull/7912 to fix this issue.@seebi: I hope that v0.57.1 would solve this issue but unfortunately not:

```
∴ trivy --version; trivy image --scanners vuln --severity HIGH,CRITICAL  registry.access.redhat.com/ubi9/ubi-micro
Version: 0.57.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-10-23 06:16:55.145362881 +0000 UTC
  NextUpdate: 2024-10-24 06:16:55.14536257 +0000 UTC
  DownloadedAt: 2024-11-19 18:28:10.941552 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-11-15 03:03:12.781740813 +0000 UTC
  NextUpdate: 2024-11-18 03:03:12.781740492 +0000 UTC
  DownloadedAt: 2024-11-15 17:51:43.387032 +0000 UTC
2024-11-19T19:31:09+01:00	INFO	[vuln] Vulnerability scanning is enabled
2024-11-19T19:31:09+01:00	INFO	Detected OS	family="redhat" version="9.5"
2024-11-19T19:31:09+01:00	INFO	[redhat] Detecting RHEL/CentOS vulnerabilities...	os_version="9" pkg_num=20
2024-11-19T19:31:09+01:00	FATAL	Fatal error	image scan error: scan error: scan failed: scan failed: failed to detect vulnerabilities: unable to scan OS packages: failed vulnerability detection of OS packages: failed detection: redhat vulnerability detection error: failed to get Red Hat advisories: unable to find CPE indices. See https://github.com/aquasecurity/trivy-db/issues/435 for details
```
@gysel: > I hope that v0.57.1 would solve this issue but unfortunately not:

I was able to run a UBI scan with `0.57.1` after I did a `trivy clean --all`.

@seebi: @gysel I can confirm that this solves the problem. thx 👍🏻 @atgreen: For what it's worth, I'm still experiencing this error with 0.57.1: https://github.com/aquasecurity/trivy-db/issues/435#issuecomment-2365157835@knqyf263: @atgreen Please reference https://github.com/aquasecurity/trivy-db/issues/435#issuecomment-2368306012. The image you scanned also has invalid content sets.@xrow: I'm still experiencing this error with 0.58.1: https://github.com/aquasecurity/trivy-db/issues/435#issuecomment-2365157835
https://gitlab.com/xrow-public/ci-tools/-/jobs/8776737600#L31

```
[info] Trivy Version: 0.58.1
Scanning: registry.gitlab.com/xrow-public/ci-tools/podman:0992d9[27](https://gitlab.com/xrow-public/ci-tools/-/jobs/8776737600#L27)fee75c507ef742d9d3f38cc3b447c060
2025-01-06T13:18:00Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-06T13:18:11Z	INFO	Detected OS	family="redhat" version="9.5"
2025-01-06T13:18:11Z	INFO	[redhat] Detecting RHEL/CentOS vulnerabilities...	os_version="9" pkg_num=[30](https://gitlab.com/xrow-public/ci-tools/-/jobs/8776737600#L30)4
2025-01-06T13:18:11Z	FATAL	Fatal error	image scan error: scan error: scan failed: scan failed: failed to detect vulnerabilities: unable to scan OS packages: failed vulnerability detection of OS packages: failed detection: redhat vulnerability detection error: failed to get Red Hat advisories: unable to find CPE indices. See https://github.com/aquasecurity/trivy-db/issues/435 for details
Uploading artifacts for failed job
```@DmitriyLewen: Hello @xrow 
Can you share scanned image?

Or send files from `/root/buildinfo/content_manifests/` (perhaps this is https://github.com/aquasecurity/trivy-db/issues/435#issuecomment-2367776616 case)@xrow: @DmitriyLewen 

The image was registry.gitlab.com/xrow-public/ci-tools/podman:0992d927fee75c507ef742d9d3f38cc3b447c060. I had some bad copy and paste stuff in the comment.

I think it is important to note that the error was not permanent. At later builds is was fine.@DmitriyLewen: @xrow 

I don't see error for this image:
```
➜  trivy -q image registry.gitlab.com/xrow-public/ci-tools/podman:0992d927fee75c507ef742d9d3f38cc3b447c060

registry.gitlab.com/xrow-public/ci-tools/podman:0992d927fee75c507ef742d9d3f38cc3b447c060 (redhat 9.5)

Total: 219 (UNKNOWN: 0, LOW: 161, MEDIUM: 56, HIGH: 2, CRITICAL: 0)
```

If you have image with stable error - you can send it to me for research.

PS. don't forget to clear cache after updating Trivy to `v0.58.1` if you scan images locally (https://github.com/aquasecurity/trivy-db/issues/435#issuecomment-2486603118).
@lm-sig: After seeing this fixed I am encountering it again on a new UBI 9 image. Version 0.57.1. Running "--clean" before the scan does not help.

image: registry.redhat.io/ubi9/python-312@sha256:9b84a91c94aa7e7ebfcd416db7857610bc7872ba6170cfa7b0753590d4b71dd0

```sh
(app-root) ls -la /root/buildinfo/content_manifests/
total 4
drwxr-xr-x. 1 root root  31 Jan  8 12:15 .
drwxr-xr-x. 1 root root  31 Jan  8 05:06 ..
-rw-r--r--. 1 root root 387 Jan  8 12:15 content-sets.json
```

/root/buildinfo/content_manifests/content-sets.json
```json
{
  "metadata": {
    "icm_version": 1,
    "icm_spec": "https://raw.githubusercontent.com/containerbuildsystem/atomic-reactor/master/atomic_reactor/schemas/content_manifest.json",
    "image_layer_index": 0
  },
  "from_dnf_hint": true,
  "content_sets": [
    "rhel-9-appstream-rpms",
    "rhel-9-appstream-source-rpms",
    "rhel-9-baseos-rpms",
    "rhel-9-baseos-source-rpms"
  ]
}
```

The previous UBI 9 image that worked looked like this:

image: registry.redhat.io/ubi9/python-312@sha256:1d8846b7c6558a50b434f1ea76131f200dcdd92cfaf16b81996003b14657b491

```
(app-root) ls -l /root/buildinfo/content_manifests/
total 1160
-rw-r--r--. 1 root root 974658 Nov 28 14:34 sbom-cyclonedx.json
-rw-r--r--. 1 root root 210101 Nov 28 14:34 sbom-purl.json
```@DmitriyLewen: both images works correcty :
```
➜  trivy571 -v
Version: 0.57.1

➜  trivy571 clean --all
2025-01-10T10:46:01+06:00	INFO	Removing scan cache...
2025-01-10T10:46:01+06:00	INFO	Removing vulnerability database...
2025-01-10T10:46:01+06:00	INFO	Removing Java database...
2025-01-10T10:46:01+06:00	INFO	Removing check bundle...
2025-01-10T10:46:01+06:00	INFO	Removing VEX repositories...
➜  trivy571 -q image --severity CRITICAL registry.redhat.io/ubi9/python-312@sha256:9b84a91c94aa7e7ebfcd416db7857610bc7872ba6170cfa7b0753590d4b71dd0 

registry.redhat.io/ubi9/python-312@sha256:9b84a91c94aa7e7ebfcd416db7857610bc7872ba6170cfa7b0753590d4b71dd0 (redhat 9.5)

Total: 0 (CRITICAL: 0)

➜  trivy571 -q image --severity CRITICAL registry.redhat.io/ubi9/python-312@sha256:1d8846b7c6558a50b434f1ea76131f200dcdd92cfaf16b81996003b14657b491 

registry.redhat.io/ubi9/python-312@sha256:1d8846b7c6558a50b434f1ea76131f200dcdd92cfaf16b81996003b14657b491 (redhat 9.5)

Total: 0 (CRITICAL: 0)

````

Can you share logs with `--debug` flag for `registry.redhat.io/ubi9/python-312@sha256:9b84a91c94aa7e7ebfcd416db7857610bc7872ba6170cfa7b0753590d4b71dd0 image?@lm-sig: I retried the scan today and... it worked. :(

I will capture debug output the next time I see it, which is hopefully never. Thank you.@wagde-orca: i am still having problem with some images that should be scanned
I have an image with
"Created": "2022-01-25T11:30:04.726931532Z",
"Architecture": "amd64",

and when I try to scan it I get the error (I am using latest trivy 0.58.2 and ran trivy clean --all before)
```
2025-01-23T12:23:29+02:00	DEBUG	[image] Detected base layers	diff_ids=[]
2025-01-23T12:23:29+02:00	INFO	Detected OS	family="redhat" version="8.4"
2025-01-23T12:23:29+02:00	INFO	[redhat] Detecting RHEL/CentOS vulnerabilities...	os_version="8" pkg_num=232
2025-01-23T12:23:29+02:00	FATAL	Fatal error
  - image scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:387
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:261
  - scan failed:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:622
  - scan failed:
    github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact
        github.com/aquasecurity/trivy/pkg/scanner/scan.go:169
  - failed to detect vulnerabilities:
    github.com/aquasecurity/trivy/pkg/scanner/local.Scanner.ScanTarget
        github.com/aquasecurity/trivy/pkg/scanner/local/scan.go:117
  - unable to scan OS packages:
    github.com/aquasecurity/trivy/pkg/scanner/local.Scanner.scanVulnerabilities
        github.com/aquasecurity/trivy/pkg/scanner/local/scan.go:168
  - failed vulnerability detection of OS packages:
    github.com/aquasecurity/trivy/pkg/scanner/ospkg.(*scanner).Scan
        github.com/aquasecurity/trivy/pkg/scanner/ospkg/scan.go:57
  - failed detection:
    github.com/aquasecurity/trivy/pkg/detector/ospkg.Detect
        github.com/aquasecurity/trivy/pkg/detector/ospkg/detect.go:83
  - redhat vulnerability detection error:
    github.com/aquasecurity/trivy/pkg/detector/ospkg/redhat.(*Scanner).Detect
        github.com/aquasecurity/trivy/pkg/detector/ospkg/redhat/redhat.go:92
  - failed to get Red Hat advisories:
    github.com/aquasecurity/trivy/pkg/detector/ospkg/redhat.(*Scanner).detect
        github.com/aquasecurity/trivy/pkg/detector/ospkg/redhat/redhat.go:114
  - unable to find CPE indices. See https://github.com/aquasecurity/trivy-db/issues/435 for details:
    github.com/aquasecurity/trivy-db/pkg/vulnsrc/redhat-oval.VulnSrc.Get
        github.com/aquasecurity/trivy-db@v0.0.0-20241209111357-8c398f13db0e/pkg/vulnsrc/redhat-oval/redhat-oval.go:252
```@DmitriyLewen: I think your image contains invalid `content_sets` (see https://github.com/aquasecurity/trivy-db/issues/435#issuecomment-2490139813).

check your `/root/buildinfo/content_manifests/*.json` files@wagde-orca: @DmitriyLewen there are two files tehre...
```
cat /root/buildinfo/content_manifests/openjdk-8-ubi8-container-1.3-15.json
{
    "metadata": {
        "icm_version": 1,
        "icm_spec": "https://raw.githubusercontent.com/containerbuildsystem/atomic-reactor/master/atomic_reactor/schemas/content_manifest.json",
        "image_layer_index": 2
    },
    "content_sets": [
        "ubi-8-for-x86_64-baseos-rpms__8",
        "ubi-8-for-x86_64-appstream-rpms__8"
    ],
    "image_contents": []
}


cat /root/buildinfo/content_manifests/ubi8-minimal-container-8.4-205.1626828526.json
{
    "metadata": {
        "icm_version": 1,
        "icm_spec": "https://raw.githubusercontent.com/containerbuildsystem/atomic-reactor/master/atomic_reactor/schemas/content_manifest.json",
        "image_layer_index": 1
    },
    "content_sets": [
        "rhel-8-for-x86_64-baseos-rpms",
        "rhel-8-for-x86_64-appstream-rpms"
    ],
    "image_contents": []
}
```@DmitriyLewen: @wagde-orca This is case as in https://github.com/aquasecurity/trivy-db/issues/435#issuecomment-2367776616
`ubi-8-for-x86_64-baseos-rpms__8` is incorrect.

You can see all repositories in https://security.access.redhat.com/data/metrics/repository-to-cpe.json@wagde-orca: @DmitriyLewen any workaround for this? or plans to fix it?@DmitriyLewen: Hello @wagde-orca 
We currently tnink this is bug in RedHat images and they should fix it (because we have no information how we can compare incorrect (e.g. `ubi-8-for-x86_64-baseos-rpms__8`) content_sets:
- we can't remove the incorrect suffix because we are not sure that `ubi-8-for-x86_64-baseos-rpms__8` is equal to `ubi-8-for-x86_64-baseos-rpms`.
- we can't skip (or use default content_sets) packages with incorrect content_sets (even with a warning in the log) because users will miss it and may use vulnerable packages without knowing it.


____


hello @sayan-biswas 
Sorry for the ping, but we need your help.
Can you clarify: `ubi-8-for-x86_64-baseos-rpms__8` is a valid content_set? (https://github.com/aquasecurity/trivy-db/issues/435#issuecomment-2368306012).
Or is this a bug and we can trim the `__8` suffix (and use `ubi-8-for-x86_64-baseos-rpms`)?@ChristianLoewel: Hello @DmitriyLewen,

I contacted Red Hat Support to ask about these __8 suffixes as I'm also affected by this. Here's their response:

> I would like to tell you that I had a detailed discussion with the engineering and according to them, content set without "suffix" or version such as `rhocp-4.14-for-rhel-9-x86_64-rpms` are the valid ones and are valid if your image is built from the mainline (standard) RHEL repos,( not using EUS ). The suffixes( i.e __9_DOT_2 ) are meant only for specific RHEL EUS versions, not for regular UBI8 images. So, if your image is built using EUS (xUS) repos — like RHEL 9.2 EUS, then the content set should be specific: `rhel-9-...__9_DOT_2` and it should match what's listed in the official `repository-to-cpe.json` and this would work for the scanners as in your case.
>
>But, if you see only `__8`, that’s likely too generic or incorrect for EUS and may break tooling (like security scanners). If your image is built from the mainline (standard) RHEL repos, not using EUS then it's okay for the content set to have no suffix, or a generic one like `__8`. These generic suffixes are harmless for non-EUS builds and can usually be ignored.
>
>Basically, these suffixes are meant only for specific RHEL EUS versions (like __9_DOT_2), not for regular UBI9 images.
>
>So, for now you can either trim the suffix for the scanner to work( which is not recommended by RedHat ) or you could wait for a month before this issue is resolved as Red Hat will be migrated to Konflux( new build system ) in which the problem with the __8 suffix will be automatically fixed.

Apparently, these generic suffixes are a bug on Red Hat's end, and it's okay to cut them.@knqyf263: @ChristianLoewel Thanks for the information! It's good to know that it's a bug on Red Hat's side, as we expected. Cutting the suffix wouldn't seem to cause any issues, but I'm a little concerned about the fact that it's not recommended by Red Hat...

> which is not recommended by RedHat@ChristianLoewel: I guess it would be the only way to fix scanning for old affected images that were created before Red Hat's fix. Should be fine as long as it's ensured that only incomplete suffixes are truncated. I'll check back with them and ask for any specific reasons why it's not recommended.@ChristianLoewel: Got another response:

> Regarding truncating generic suffixes is not recommended by Red Hat, its specially for the *US streams but since this issue is the one which can only be resolved by trimming the suffix or waiting for openshift to migrate to Konflux , so as per my further discussions with engineering, you can move forward to trim the suffix for your scanners to work properly.

As I read it, Red Hat is okay with this as long as only the generic suffixes are cut, not the correct EUS suffixes.@knqyf263: @ChristianLoewel Thanks for sharing that. We added trimming of the malformed suffixes. It should mitigate this problem.
https://github.com/aquasecurity/trivy/pull/8818

This will be included in [v0.63.0](https://github.com/aquasecurity/trivy/milestone/49).@Romain-Geissler-1A: Hi,

For people landing here, there are other possibilities for having this message:
 - Your image no longer has /root/buildinfo/content_manifests. Recently Red Hat has moved these json files inside /usr/share/buildinfo (as announced by Red Hat here: https://github.com/aquasecurity/trivy/discussions/8209). Then you should make sure you use an up to date Trivy to have it read /usr/share/buildinfo as well (Trivy >= 0.59.0).
 - Your image is actually recognized as a Red Hat image, but still is not fully recognized. Typically because you use a new major version of RHEL, like RHEL 10 released recently. Then the error message is misleading, the real problem is that Trivy doesn't know yet about this major version and support shall be added, like in https://github.com/aquasecurity/trivy/pull/8910@johanheylen: I'm hitting the same error message when I use trivy 0.67.0 in the server/client model to scan a RHEL 10 image.

```
trivy image registry.access.redhat.com/ubi10/ubi-micro --debug --server http://localhost:4954
2025-10-07T20:34:06+02:00	DEBUG	No plugins loaded
2025-10-07T20:34:06+02:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-10-07T20:34:06+02:00	DEBUG	Cache dir	dir="/Users/johan.heylen/Library/Caches/trivy"
2025-10-07T20:34:06+02:00	DEBUG	Cache dir	dir="/Users/johan.heylen/Library/Caches/trivy"
2025-10-07T20:34:06+02:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-10-07T20:34:06+02:00	DEBUG	Ignore statuses	statuses=[]
2025-10-07T20:34:06+02:00	WARN	Trivy runs in client/server mode, but misconfiguration and license scanning will be done on the client side, see https://trivy.dev/v0.67/docs/references/modes/client-server
2025-10-07T20:34:06+02:00	DEBUG	[pkg] Package types	types=[os library]
2025-10-07T20:34:06+02:00	DEBUG	[pkg] Package relationships	relationships=[unknown root workspace direct indirect]
2025-10-07T20:34:06+02:00	INFO	[vuln] Vulnerability scanning is enabled
2025-10-07T20:34:06+02:00	INFO	[secret] Secret scanning is enabled
2025-10-07T20:34:06+02:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-10-07T20:34:06+02:00	INFO	[secret] Please see https://trivy.dev/v0.67/docs/scanner/secret#recommendation for faster secret detection
2025-10-07T20:34:06+02:00	DEBUG	[notification] Running version check
2025-10-07T20:34:06+02:00	DEBUG	[notification] Version check completed	latest_version="0.67.0"
2025-10-07T20:34:07+02:00	DEBUG	[image] Image found	image="registry.access.redhat.com/ubi10/ubi-micro" source="remote"
2025-10-07T20:34:07+02:00	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2025-10-07T20:34:07+02:00	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2025-10-07T20:34:07+02:00	DEBUG	Created process-specific temp directory	path="/var/folders/tf/3w3vr0hj1kv7df4rdx9gl2280000gp/T/trivy-4752"
2025-10-07T20:34:07+02:00	DEBUG	[image] Detected image ID	image_id="sha256:8ff85d1db41adf2a8a2aa3b509d88a916b18f66449ab8a5d88a8755bfc14eb7b"
2025-10-07T20:34:07+02:00	DEBUG	[image] Detected diff ID	diff_ids=[sha256:4ab82aeaa78022df99bcad67e322cca2e814401f15f88a1561c6d2835dfe9eaa]
2025-10-07T20:34:07+02:00	DEBUG	[image] Detected base layers	diff_ids=[]
2025-10-07T20:34:07+02:00	DEBUG	Cleaning up temp directory	path="/var/folders/tf/3w3vr0hj1kv7df4rdx9gl2280000gp/T/trivy-4752"
2025-10-07T20:34:07+02:00	FATAL	Fatal error
  - run error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:398
  - image scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.run
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:439
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:291
  - scan failed:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:693
  - scan failed:
    github.com/aquasecurity/trivy/pkg/scan.Service.ScanArtifact
        github.com/aquasecurity/trivy/pkg/scan/service.go:59
  - failed to detect vulnerabilities via RPC:
    github.com/aquasecurity/trivy/pkg/rpc/client.Service.Scan
        github.com/aquasecurity/trivy/pkg/rpc/client/client.go:106
  - twirp error internal: failed scan, registry.access.redhat.com/ubi10/ubi-micro: failed to detect vulnerabilities: unable to scan OS packages: failed vulnerability detection of OS packages: failed detection: redhat vulnerability detection error: failed to get Red Hat advisories: unable to find CPE indices. See https://github.com/aquasecurity/trivy-db/issues/435 for details
```

Scanning with same trivy version in stand-alone version does work

```
trivy image registry.access.redhat.com/ubi10/ubi-micro --debug                               
2025-10-07T20:32:50+02:00	DEBUG	No plugins loaded
2025-10-07T20:32:50+02:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-10-07T20:32:50+02:00	DEBUG	Cache dir	dir="/Users/johan.heylen/Library/Caches/trivy"
2025-10-07T20:32:50+02:00	DEBUG	Cache dir	dir="/Users/johan.heylen/Library/Caches/trivy"
2025-10-07T20:32:50+02:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-10-07T20:32:50+02:00	DEBUG	Ignore statuses	statuses=[]
2025-10-07T20:32:50+02:00	DEBUG	DB update was skipped because the local DB is the latest
2025-10-07T20:32:50+02:00	DEBUG	DB info	schema=2 updated_at=2025-10-07T12:33:30.458351681Z next_update=2025-10-08T12:33:30.458351441Z downloaded_at=2025-10-07T18:19:12.119906Z
2025-10-07T20:32:50+02:00	DEBUG	[pkg] Package types	types=[os library]
2025-10-07T20:32:50+02:00	DEBUG	[pkg] Package relationships	relationships=[unknown root workspace direct indirect]
2025-10-07T20:32:50+02:00	INFO	[vuln] Vulnerability scanning is enabled
2025-10-07T20:32:50+02:00	INFO	[secret] Secret scanning is enabled
2025-10-07T20:32:50+02:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-10-07T20:32:50+02:00	INFO	[secret] Please see https://trivy.dev/v0.67/docs/scanner/secret#recommendation for faster secret detection
2025-10-07T20:32:50+02:00	DEBUG	[notification] Running version check
2025-10-07T20:32:50+02:00	DEBUG	Initializing scan cache...	type="fs"
2025-10-07T20:32:50+02:00	DEBUG	[notification] Version check completed	latest_version="0.67.0"
2025-10-07T20:32:51+02:00	DEBUG	[image] Image found	image="registry.access.redhat.com/ubi10/ubi-micro" source="remote"
2025-10-07T20:32:51+02:00	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2025-10-07T20:32:51+02:00	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2025-10-07T20:32:51+02:00	DEBUG	Created process-specific temp directory	path="/var/folders/tf/3w3vr0hj1kv7df4rdx9gl2280000gp/T/trivy-4417"
2025-10-07T20:32:51+02:00	DEBUG	[image] Detected image ID	image_id="sha256:8ff85d1db41adf2a8a2aa3b509d88a916b18f66449ab8a5d88a8755bfc14eb7b"
2025-10-07T20:32:51+02:00	DEBUG	[image] Detected diff ID	diff_ids=[sha256:4ab82aeaa78022df99bcad67e322cca2e814401f15f88a1561c6d2835dfe9eaa]
2025-10-07T20:32:51+02:00	DEBUG	[image] Detected base layers	diff_ids=[]
2025-10-07T20:32:51+02:00	INFO	Detected OS	family="redhat" version="10.0"
2025-10-07T20:32:51+02:00	INFO	[redhat] Detecting RHEL/CentOS vulnerabilities...	os_version="10" pkg_num=23
2025-10-07T20:32:51+02:00	INFO	Number of language-specific files	num=0
2025-10-07T20:32:51+02:00	DEBUG	Specified ignore file does not exist	file=".trivyignore"
2025-10-07T20:32:51+02:00	DEBUG	[vex] VEX filtering is disabled

Report Summary

┌──────────────────────────────────────────────────────────┬────────┬─────────────────┬─────────┐
│                          Target                          │  Type  │ Vulnerabilities │ Secrets │
├──────────────────────────────────────────────────────────┼────────┼─────────────────┼─────────┤
│ registry.access.redhat.com/ubi10/ubi-micro (redhat 10.0) │ redhat │        0        │    -    │
└──────────────────────────────────────────────────────────┴────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

2025-10-07T20:32:51+02:00	DEBUG	Cleaning up temp directory	path="/var/folders/tf/3w3vr0hj1kv7df4rdx9gl2280000gp/T/trivy-4417"
```

Any ideas what can cause the difference and what should I do make the server version as well?@DmitriyLewen: Hello @johanheylen 

I should note upfront — Trivy does not currently support vulnerability detection for RHEL 10 (see https://trivy.dev/latest/docs/coverage/os/#supported-os).  
This is due to Red Hat’s new (VEX) advisory format, but we are actively working on it.

About error - i will investigate this and write to you.

UPD created https://github.com/aquasecurity/trivy/pull/9608 to fix error in client/server mode@johanheylen: Hello Dmitriy,

thanks for the fast response, pull request and release of trivy.
I've retested with version 0.67.2 but still no luck, the fatal error remains@DmitriyLewen: Hello @johanheylen,  
you need to do two things:  
1. bump both Trivy (client and server);  
2. clear the server cache — the server uses old info (without buildInfo) from the cache.@candrews: Using Trivy 0.67.2, using `trivy image` works:
```
$ trivy image redhat/ubi10
2025-10-16T13:27:27-04:00	INFO	[vuln] Vulnerability scanning is enabled
2025-10-16T13:27:27-04:00	INFO	[secret] Secret scanning is enabled
2025-10-16T13:27:27-04:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-10-16T13:27:27-04:00	INFO	[secret] Please see https://trivy.dev/v0.67/docs/scanner/secret#recommendation for faster secret detection
2025-10-16T13:27:30-04:00	INFO	[python] Licenses acquired from one or more METADATA files may be subject to additional terms. Use `--debug` flag to see all affected packages.
2025-10-16T13:27:30-04:00	INFO	Detected OS	family="redhat" version="10.0"
2025-10-16T13:27:30-04:00	INFO	[redhat] Detecting RHEL/CentOS vulnerabilities...	os_version="10" pkg_num=172
2025-10-16T13:27:30-04:00	INFO	Number of language-specific files	num=0

Report Summary

┌────────────────────────────┬────────┬─────────────────┬─────────┐
│           Target           │  Type  │ Vulnerabilities │ Secrets │
├────────────────────────────┼────────┼─────────────────┼─────────┤
│ redhat/ubi10 (redhat 10.0) │ redhat │        0        │    -    │
└────────────────────────────┴────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)
```

However, generating an SBOM then scanning it does not:
```
$ trivy image --format cyclonedx --output test.cdx.json redhat/ubi10 && trivy sbom test.cdx.json 
2025-10-16T13:28:40-04:00	INFO	"--format cyclonedx" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the "cyclonedx" report.
2025-10-16T13:28:42-04:00	INFO	Detected OS	family="redhat" version="10.0"
2025-10-16T13:28:42-04:00	INFO	Number of language-specific files	num=0
2025-10-16T13:28:42-04:00	INFO	[vuln] Vulnerability scanning is enabled
2025-10-16T13:28:42-04:00	INFO	Detected SBOM format	format="cyclonedx-json"
2025-10-16T13:28:42-04:00	INFO	Detected OS	family="redhat" version="10.0"
2025-10-16T13:28:42-04:00	INFO	[redhat] Detecting RHEL/CentOS vulnerabilities...	os_version="10" pkg_num=172
2025-10-16T13:28:42-04:00	FATAL	Fatal error	run error: sbom scan error: scan error: scan failed: scan failed: failed to detect vulnerabilities: unable to scan OS packages: failed vulnerability detection of OS packages: failed detection: redhat vulnerability detection error: failed to get Red Hat advisories: unable to find CPE indices. See https://github.com/aquasecurity/trivy-db/issues/435 for details
[1]
```

I reported this issue at https://github.com/aquasecurity/trivy/discussions/9679@DmitriyLewen: Hello @candrews

This happens because Trivy currently doesn’t support vulnerability detection for Red Hat 10.
However, it might be worth making the error message clearer for users.

Solution patch:
diff --git a/go.mod b/go.mod
index 168e297..d35eb18 100644
--- a/go.mod
+++ b/go.mod
@@ -14,13 +14,13 @@ require (
 	github.com/knqyf263/go-rpm-version v0.0.0-20170716094938-74609b86c936
 	github.com/masahiro331/go-mvn-version v0.0.0-20210429150710-d3157d602a08
 	github.com/pandatix/go-cvss v0.6.2
-	github.com/samber/lo v1.39.0
+	github.com/samber/lo v1.47.0
 	github.com/stretchr/testify v1.9.0
 	github.com/urfave/cli v1.22.15
-	go.etcd.io/bbolt v1.3.10
+	go.etcd.io/bbolt v1.3.11
 	golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1
-	golang.org/x/text v0.16.0
-	golang.org/x/tools v0.23.0
+	golang.org/x/text v0.17.0
+	golang.org/x/tools v0.24.0
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1
 	gopkg.in/cheggaaa/pb.v1 v1.0.28
 	gopkg.in/yaml.v2 v2.4.0
@@ -40,9 +40,9 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	go.uber.org/multierr v1.10.0 // indirect
-	golang.org/x/mod v0.19.0 // indirect
-	golang.org/x/sync v0.7.0 // indirect
-	golang.org/x/sys v0.22.0 // indirect
+	golang.org/x/mod v0.20.0 // indirect
+	golang.org/x/sync v0.8.0 // indirect
+	golang.org/x/sys v0.23.0 // indirect
 	golang.org/x/term v0.1.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/go.sum b/go.sum
index 4baacba..4819bf3 100644
--- a/go.sum
+++ b/go.sum
@@ -66,8 +66,8 @@ github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/samber/lo v1.39.0 h1:4gTz1wUhNYLhFSKl6O+8peW0v2F4BCY034GRpU9WnuA=
-github.com/samber/lo v1.39.0/go.mod h1:+m/ZKRl6ClXCE2Lgf3MsQlWfh4bn1bz6CXEOxnEXnEA=
+github.com/samber/lo v1.47.0 h1:z7RynLwP5nbyRscyvcD043DWYoOcYRv3mV8lBeqOCLc=
+github.com/samber/lo v1.47.0/go.mod h1:RmDH9Ct32Qy3gduHQuKJ3gW1fMHAnE/fAzQuf6He5cU=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -88,8 +88,8 @@ github.com/urfave/cli v1.22.15 h1:nuqt+pdC/KqswQKhETJjo7pvn/k4xMUxgW6liI7XpnM=
 github.com/urfave/cli v1.22.15/go.mod h1:wSan1hmo5zeyLGBjRJbzRTNk8gwoYa2B9n4q9dmRIc0=
 github.com/urfave/cli/v2 v2.3.0/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
 go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
-go.etcd.io/bbolt v1.3.10 h1:+BqfJTcCzTItrop8mq/lbzL8wSGtj94UO/3U31shqG0=
-go.etcd.io/bbolt v1.3.10/go.mod h1:bK3UQLPJZly7IlNmV7uVHJDxfe5aK9Ll93e/74Y9oEQ=
+go.etcd.io/bbolt v1.3.11 h1:yGEzV1wPz2yVCLsD8ZAiGHhHVlczyC9d1rP43/VCRJ0=
+go.etcd.io/bbolt v1.3.11/go.mod h1:dksAq7YMXoljX0xu6VF5DMZGbhYYoLUalEiSySYAS4I=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
@@ -98,10 +98,10 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1 h1:k/i9J1pBpvlfR+9QsetwPyERsqu1GIbi967PQMq3Ivc=
 golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
-golang.org/x/mod v0.19.0 h1:fEdghXQSo20giMthA7cd28ZC+jts4amQ3YMXiP5oMQ8=
-golang.org/x/mod v0.19.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
-golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/mod v0.20.0 h1:utOm6MM3R3dnawAiJgn0y+xvuYRsm1RKM/4giyfDgV0=
+golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
+golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191010194322-b09406accb47/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -110,17 +110,17 @@ golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200831180312-196b9ba8737a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
-golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
+golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.1.0 h1:g6Z6vPFA9dYBAF7DWcH6sCcOntplXsDKcliusYijMlw=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
-golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
+golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
+golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.23.0 h1:SGsXPZ+2l4JsgaCKkx+FQ9YZ5XEtA1GZYuoDjenLjvg=
-golang.org/x/tools v0.23.0/go.mod h1:pnu6ufv6vQkll6szChhK3C3L/ruaIv5eBeztNG8wtsI=
+golang.org/x/tools v0.24.0 h1:J1shsA93PJUEVaUSaay7UXAyE8aimq3GW0pjlolpa24=
+golang.org/x/tools v0.24.0/go.mod h1:YhNqVBIfWHdzvTLs0d8LCuMhkKUgSUKldakyV7W/WDQ=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/pkg/db/db.go b/pkg/db/db.go
index e9603dd..9d51f1a 100644
--- a/pkg/db/db.go
+++ b/pkg/db/db.go
@@ -52,10 +52,26 @@ type Operation interface {
 	RedHatNVRToCPEs(nvr string) (cpeIndices []int, err error)
 }
 
-type Config struct {
+type Config struct{}
+
+type Option func(*Options)
+
+type Options struct {
+	boltOptions *bolt.Options
 }
 
-func Init(dbDir string) (err error) {
+func WithBoltOptions(boltOpts *bolt.Options) Option {
+	return func(opts *Options) {
+		opts.boltOptions = boltOpts
+	}
+}
+
+func Init(dbDir string, opts ...Option) (err error) {
+	dbOptions := &Options{}
+	for _, opt := range opts {
+		opt(dbOptions)
+	}
+
 	if err = os.MkdirAll(dbDir, 0700); err != nil {
 		return xerrors.Errorf("failed to mkdir: %w", err)
 	}
@@ -69,12 +85,12 @@ func Init(dbDir string) (err error) {
 			if err = os.Remove(dbPath); err != nil {
 				return
 			}
-			db, err = bolt.Open(dbPath, 0600, nil)
+			db, err = bolt.Open(dbPath, 0600, dbOptions.boltOptions)
 		}
 		debug.SetPanicOnFault(false)
 	}()
 
-	db, err = bolt.Open(dbPath, 0600, nil)
+	db, err = bolt.Open(dbPath, 0600, dbOptions.boltOptions)
 	if err != nil {
 		return xerrors.Errorf("failed to open db: %w", err)
 	}
diff --git a/pkg/vulnsrc/redhat-oval/redhat-oval.go b/pkg/vulnsrc/redhat-oval/redhat-oval.go
index 1958e94..08faa61 100644
--- a/pkg/vulnsrc/redhat-oval/redhat-oval.go
+++ b/pkg/vulnsrc/redhat-oval/redhat-oval.go
@@ -248,6 +248,10 @@ func (vs VulnSrc) Get(pkgName string, repositories, nvrs []string) ([]types.Advi
 		return nil, xerrors.Errorf("CPE convert error: %w", err)
 	}
 
+	if len(cpeIndices) == 0 {
+		return nil, xerrors.Errorf("unable to find CPE indices. See https://github.com/aquasecurity/trivy-db/issues/435 for details")
+	}
+
 	rawAdvisories, err := vs.dbc.ForEachAdvisory([]string{rootBucket}, pkgName)
 	if err != nil {
 		return nil, xerrors.Errorf("unable to iterate advisories: %w", err)



Test patch:
diff --git a/pkg/db/db_test.go b/pkg/db/db_test.go
index d71882a..a852827 100644
--- a/pkg/db/db_test.go
+++ b/pkg/db/db_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"go.etcd.io/bbolt"
 
 	"github.com/aquasecurity/trivy-db/pkg/db"
 )
@@ -15,6 +16,7 @@ func TestInit(t *testing.T) {
 	tests := []struct {
 		name   string
 		dbPath string
+		dbOpts *bbolt.Options
 	}{
 		{
 			name:   "normal db",
@@ -43,7 +45,7 @@ func TestInit(t *testing.T) {
 				require.NoError(t, err)
 			}
 
-			err := db.Init(tmpDir)
+			err := db.Init(tmpDir, db.WithBoltOptions(tt.dbOpts))
 			require.NoError(t, err)
 		})
 	}
diff --git a/pkg/vulnsrc/redhat-oval/redhat-oval_test.go b/pkg/vulnsrc/redhat-oval/redhat-oval_test.go
index 1d308b7..572d58d 100644
--- a/pkg/vulnsrc/redhat-oval/redhat-oval_test.go
+++ b/pkg/vulnsrc/redhat-oval/redhat-oval_test.go
@@ -918,7 +918,7 @@ func TestVulnSrc_Get(t *testing.T) {
 				"testdata/fixtures/happy.yaml",
 				"testdata/fixtures/cpe.yaml",
 			},
-			want: []types.Advisory(nil),
+			wantErr: "unable to find CPE indices.",
 		},
 		{
 			name: "no advisory bucket",
@@ -936,7 +936,7 @@ func TestVulnSrc_Get(t *testing.T) {
 				repositories: []string{"rhel-8-for-x86_64-baseos-rpms"},
 			},
 			fixtures: []string{"testdata/fixtures/happy.yaml"},
-			want:     []types.Advisory(nil),
+			wantErr:  "unable to find CPE indices.",
 		},
 		{
 			name: "broken JSON",