Project: Trivy (Provisioning / Security & Compliance)
File: vulnerability.md

Trivy detects known vulnerabilities according to the versions of installed packages. The following packages are supported. Trivy also detects known vulnerabilities in Kubernetes components using KBOM (Kubernetes bill of Material) scanning. To learn more, see the . Trivy is capable of automatically detecting installed OS packages when scanning container images, VM images and running hosts. !!! note Trivy doesn't support third-party/self-compiled packages/binaries, but official packages provided by vendors such as Red Hat and Debian. See for the supported OSes. | OS | Source | | - | | | Arch Linux | | | Alpine Linux | | | Wolfi Linux | | | Chainguard | | | Amazon Linux | | | Debian | / | | Ubuntu | | | RHEL/CentOS | / | | AlmaLinux | | | Rocky Linux | | | Oracle Linux | | | CBL-Mariner | | | OpenSUSE/SLES | | | Photon OS | | Trivy only consumes security advisories from the sources listed in the above table. As for packages installed from OS package managers (`dpkg`, `yum`, `apk`, etc.), Trivy uses the advisory database from the appropriate OS vendor. For example: for a python package installed from `yum` (Amazon linux), Trivy will only get advisories from . But for a python package installed from another source (e.g. `pip`), Trivy will get advisories from the `GitLab` and `GitHub` databases. This advisory selection is essential to avoid getting false positives because OS vendors usually backport upstream fixes, and the fixed version can be different from the upstream fixed version. The severity is taken from the selected data source since the severity from vendors is more accurate. Using CVE-2023-0464 as an example, while it is , Red Hat has marked its 'Impact' as . As a result, Trivy will display it as "Low". The severity depends on the compile option, the default configuration, etc. NVD doesn't know how the vendor distributes the software. Red Hat evaluates the severity more accurately. That's why Trivy prefers vendor scores over NVD. If the data source does not provide a severity, the severity is determined based on the CVSS score as follows: | Base Score Range | Severity | | - | -- | | 0.1-3.9 | Low | | 4.0-6.9 | Medium | | 7.0-8.9 | High | |

| Critical | If the CVSS score is also not provided, it falls back to , and if NVD does not have severity, it will be UNKNOWN. The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution. To hide unfixed/unfixable vulnerabilities, you can use the `--ignore-unfixed` flag. See for the supported languages. | Language | Source | Commercial Use | Delay[^1] | |-|--|:--:|::| | PHP | | | - | | | | | - | | Python | | | - | | | | | - | | Ruby | | | - | | | | | - | | Node.js | | | - | | | | | - | | Java | | | - | | Go | | | - | | | | | - | | Rust | | | - | | .NET | | | - | | C/C++ | | | 1 month | | Dart | | | - | | Elixir | | | - | | Swift | | | - | Trivy can detect vulnerabilities in Kubernetes clusters and components. | Vendor | Source | | - || | Kubernetes | [^1] | Trivy downloads every 6 hours. Trivy uses two types of databases for vulnerability detection: Vulnerability Database Java Index Database This page provides detailed information about these databases. Trivy utilizes a database containing vulnerability information. This database is built every six hours on and is distributed via . The database is cached and updated as needed. As Trivy updates the database automatically during execution, users don't need to be concerned about it. For CLI flags related to the database, please refer to . If you host the database on your own OCI registry, you can specify a different repository with the `--db-repository` flag. The default is `ghcr.io/aquasecurity/trivy-db`. ```shell $ trivy image --db-repository YOURREPO YOURIMAGE ``` If authentication is required, it can be configured in the same way as for private images. Please refer to for more details. This database is only downloaded when scanning JAR files so that Trivy can identify the groupId, artifactId, and version of JAR files. It is built once a day on and distributed via . Like the vulnerability database, it is automatically downloaded and updated when needed, so users don't need to worry about it. If you host the database on your own OCI registry, you can specify a different repository with the `--java-db-repository` flag. The default is

If authentication is required, you need to run `docker login YOUR_REGISTRY`. Currently, specifying a username and password is not supported. This section describes vulnerability-specific configuration. Other common options are documented . It's possible to only enable certain package types if you prefer. You can do so by passing the `--vuln-type` option. This flag takes a comma-separated list of package types. Available values: os Scan OS packages managed by the OS package manager (e.g. `dpkg`, `yum`, `apk`). library Scan language-specific packages (e.g. packages installed by `pip`, `npm`, or `gem`). ```bash $ trivy image --vuln-type os ruby:2.4.0 ``` <details> <summary>Result</summary> ```bash 2019-05-22T19:36:50.530+0200 [34mINFO[0m Updating vulnerability database... 2019-05-22T19:36:51.681+0200 [34mINFO[0m Detecting Alpine vulnerabilities... 2019-05-22T19:36:51.685+0200 [34mINFO[0m Updating npm Security DB... 2019-05-22T19:36:52.389+0200 [34mINFO[0m Detecting npm vulnerabilities... 2019-05-22T19:36:52.390+0200 [34mINFO[0m Updating pipenv Security DB... 2019-05-22T19:36:53.406+0200 [34mINFO[0m Detecting pipenv vulnerabilities... ruby:2.4.0 (debian 8.7) ======================= Total: 7 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 3, CRITICAL: 2) +++-+-++-+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +++-+-++-+ | curl | CVE-2018-14618 | CRITICAL | 7.61.0-r0 | 7.61.1-r0 | curl: NTLM password overflow | | | | | | | via integer overflow | ++-+ ++-+ | | CVE-2018-16839 | HIGH | | 7.61.1-r1 | curl: Integer overflow leading | | | | | | | to heap-based buffer overflow in | | | | | | | Curlsaslcreateplainmessage() | +++-+-++-+ | git | CVE-2018-17456 | HIGH | 2.15.2-r0 | 2.15.3-r0 | git: arbitrary code execution | | | | | | | via .gitmodules | ++ + + +-+ | | CVE-2018-19486 | | | | git: Improper handling of | | | | | | | PATH allows for commands to be | | | | | | | executed from... | +++-+-++-+ | libssh2 | CVE-2019-3855 | CRITICAL | 1.8.0-r2 | 1.8.1-r0 | libssh2: Integer overflow in | | | | | | | transport read resulting in | | | | | | | out of bounds write... | +++-+-++-+ | sqlite | CVE-2018-20346 | MEDIUM | 3.21.0-r1 | 3.25.3-r0 | CVE-2018-20505 CVE-2018-20506 | | | | | | | sqlite: Multiple flaws in | | | | | | | sqlite which can be triggered | | | | | | | via... | +++-+-++-+ | tar | CVE-2018-20482 | LOW | 1.29-r1 | 1.31-r0 | tar: Infinite read loop in | | | | | | | sparsedumpregion function in | | | | | | | sparse.c | +++-+-++-+ ``` </details>