我的书签
添加书签
移除书签Filter Vulnerabilities
Hide Unfixed Vulnerabilities
By default, Trivy also detects unpatched/unfixed vulnerabilities. This means you can’t fix these vulnerabilities even if you update all packages. If you would like to ignore them, use the --ignore-unfixed option.
$ trivy image --ignore-unfixed ruby:2.4.0
Result
2019-05-16T12:49:52.656+0900 INFO Updating vulnerability database...2019-05-16T12:50:14.786+0900 INFO Detecting Debian vulnerabilities...ruby:2.4.0 (debian 8.7)=======================Total: 4730 (UNKNOWN: 1, LOW: 145, MEDIUM: 3487, HIGH: 1014, CRITICAL: 83)+------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |+------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+| apt | CVE-2019-3462 | CRITICAL | 1.0.9.8.3 | 1.0.9.8.5 | Incorrect sanitation of the || | | | | | 302 redirect field in HTTP || | | | | | transport method of... |+ +------------------+----------+ +----------------------------------+-----------------------------------------------------+| | CVE-2016-1252 | MEDIUM | | 1.0.9.8.4 | The apt package in Debian || | | | | | jessie before 1.0.9.8.4, in || | | | | | Debian unstable before... |+------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+| bash | CVE-2019-9924 | HIGH | 4.3-11 | 4.3-11+deb8u2 | bash: BASH_CMD is writable in || | | | | | restricted bash shells |+ +------------------+ + +----------------------------------+-----------------------------------------------------+| | CVE-2016-7543 | | | 4.3-11+deb8u1 | bash: Specially crafted || | | | | | SHELLOPTS+PS4 variables allows || | | | | | command substitution |+ +------------------+----------+ + +-----------------------------------------------------+| | CVE-2016-0634 | MEDIUM | | | bash: Arbitrary code execution || | | | | | via malicious hostname |+ +------------------+----------+ +----------------------------------+-----------------------------------------------------+| | CVE-2016-9401 | LOW | | 4.3-11+deb8u2 | bash: popd controlled free |+------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+...
By Severity
Use --severity option.
$ trivy image --severity HIGH,CRITICAL ruby:2.4.0
Result
2019-05-16T01:51:46.255+0900 INFO Updating vulnerability database...2019-05-16T01:51:49.213+0900 INFO Detecting Debian vulnerabilities...ruby:2.4.0 (debian 8.7)=======================Total: 1785 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1680, CRITICAL: 105)+-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |+-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+| apt | CVE-2019-3462 | CRITICAL | 1.0.9.8.3 | 1.0.9.8.5 | Incorrect sanitation of the || | | | | | 302 redirect field in HTTP || | | | | | transport method of... |+-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+| bash | CVE-2019-9924 | HIGH | 4.3-11 | 4.3-11+deb8u2 | bash: BASH_CMD is writable in || | | | | | restricted bash shells |+ +------------------+ + +----------------------------------+-------------------------------------------------+| | CVE-2016-7543 | | | 4.3-11+deb8u1 | bash: Specially crafted || | | | | | SHELLOPTS+PS4 variables allows || | | | | | command substitution |+-----------------------------+------------------+ +---------------------------+----------------------------------+-------------------------------------------------+| binutils | CVE-2017-8421 | | 2.25-5 | | binutils: Memory exhaustion in || | | | | | objdump via a crafted PE file |+ +------------------+ + +----------------------------------+-------------------------------------------------+| | CVE-2017-14930 | | | | binutils: Memory leak in || | | | | | decode_line_info |+ +------------------+ + +----------------------------------+-------------------------------------------------+| | CVE-2017-7614 | | | | binutils: NULL || | | | | | pointer dereference in || | | | | | bfd_elf_final_link function |+ +------------------+ + +----------------------------------+-------------------------------------------------+| | CVE-2014-9939 | | | | binutils: buffer overflow in || | | | | | ihex.c |+ +------------------+ + +----------------------------------+-------------------------------------------------+| | CVE-2017-13716 | | | | binutils: Memory leak with the || | | | | | C++ symbol demangler routine || | | | | | in libiberty |+ +------------------+ + +----------------------------------+-------------------------------------------------+| | CVE-2018-12699 | | | | binutils: heap-based buffer || | | | | | overflow in finish_stab in || | | | | | stabs.c |+-----------------------------+------------------+ +---------------------------+----------------------------------+-------------------------------------------------+| bsdutils | CVE-2015-5224 | | 2.25.2-6 | | util-linux: File name || | | | | | collision due to incorrect || | | | | | mkstemp use |+ +------------------+ + +----------------------------------+-------------------------------------------------+| | CVE-2016-2779 | | | | util-linux: runuser tty hijack || | | | | | via TIOCSTI ioctl |+-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+
By Vulnerability IDs
Use .trivyignore.
$ cat .trivyignore# Accept the riskCVE-2018-14618# No impact in our settingsCVE-2019-1543$ trivy image python:3.4-alpine3.9
Result
2019-05-16T12:53:10.076+0900 INFO Updating vulnerability database...2019-05-16T12:53:28.134+0900 INFO Detecting Alpine vulnerabilities...python:3.4-alpine3.9 (alpine 3.9.2)===================================Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
By Type
Use --vuln-type option.
$ trivy image --vuln-type os ruby:2.4.0
Available values: - library - os
Result
2019-05-22T19:36:50.530+0200 [34mINFO[0m Updating vulnerability database...2019-05-22T19:36:51.681+0200 [34mINFO[0m Detecting Alpine vulnerabilities...2019-05-22T19:36:51.685+0200 [34mINFO[0m Updating npm Security DB...2019-05-22T19:36:52.389+0200 [34mINFO[0m Detecting npm vulnerabilities...2019-05-22T19:36:52.390+0200 [34mINFO[0m Updating pipenv Security DB...2019-05-22T19:36:53.406+0200 [34mINFO[0m Detecting pipenv vulnerabilities...ruby:2.4.0 (debian 8.7)Total: 4751 (UNKNOWN: 1, LOW: 150, MEDIUM: 3504, HIGH: 1013, CRITICAL: 83)+---------+------------------+----------+-------------------+---------------+----------------------------------+| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |+---------+------------------+----------+-------------------+---------------+----------------------------------+| curl | CVE-2018-14618 | CRITICAL | 7.61.0-r0 | 7.61.1-r0 | curl: NTLM password overflow || | | | | | via integer overflow |+ +------------------+----------+ +---------------+----------------------------------+| | CVE-2018-16839 | HIGH | | 7.61.1-r1 | curl: Integer overflow leading || | | | | | to heap-based buffer overflow in || | | | | | Curl_sasl_create_plain_message() |+ +------------------+ + +---------------+----------------------------------+| | CVE-2019-3822 | | | 7.61.1-r2 | curl: NTLMv2 type-3 header || | | | | | stack buffer overflow |+ +------------------+ + +---------------+----------------------------------+| | CVE-2018-16840 | | | 7.61.1-r1 | curl: Use-after-free when || | | | | | closing "easy" handle in || | | | | | Curl_close() |+ +------------------+----------+ +---------------+----------------------------------+| | CVE-2019-3823 | MEDIUM | | 7.61.1-r2 | curl: SMTP end-of-response || | | | | | out-of-bounds read |+ +------------------+ + + +----------------------------------+| | CVE-2018-16890 | | | | curl: NTLM type-2 heap || | | | | | out-of-bounds buffer read |+ +------------------+ + +---------------+----------------------------------+| | CVE-2018-16842 | | | 7.61.1-r1 | curl: Heap-based buffer || | | | | | over-read in the curl tool || | | | | | warning formatting |+---------+------------------+----------+-------------------+---------------+----------------------------------+| git | CVE-2018-17456 | HIGH | 2.15.2-r0 | 2.15.3-r0 | git: arbitrary code execution || | | | | | via .gitmodules |+ +------------------+ + + +----------------------------------+| | CVE-2018-19486 | | | | git: Improper handling of || | | | | | PATH allows for commands to be || | | | | | executed from... |+---------+------------------+----------+-------------------+---------------+----------------------------------+| libssh2 | CVE-2019-3855 | CRITICAL | 1.8.0-r2 | 1.8.1-r0 | libssh2: Integer overflow in || | | | | | transport read resulting in || | | | | | out of bounds write... |+ +------------------+----------+ + +----------------------------------+| | CVE-2019-3861 | MEDIUM | | | libssh2: Out-of-bounds reads || | | | | | with specially crafted SSH || | | | | | packets |+ +------------------+ + + +----------------------------------+| | CVE-2019-3857 | | | | libssh2: Integer overflow in || | | | | | SSH packet processing channel || | | | | | resulting in out of... |+ +------------------+ + + +----------------------------------+| | CVE-2019-3856 | | | | libssh2: Integer overflow in || | | | | | keyboard interactive handling || | | | | | resulting in out of bounds... |+ +------------------+ + + +----------------------------------+| | CVE-2019-3863 | | | | libssh2: Integer overflow || | | | | | in user authenticate || | | | | | keyboard interactive allows || | | | | | out-of-bounds writes |+ +------------------+ + + +----------------------------------+| | CVE-2019-3862 | | | | libssh2: Out-of-bounds memory || | | | | | comparison with specially || | | | | | crafted message channel || | | | | | request |+ +------------------+ + + +----------------------------------+| | CVE-2019-3860 | | | | libssh2: Out-of-bounds reads || | | | | | with specially crafted SFTP || | | | | | packets |+ +------------------+ + + +----------------------------------+| | CVE-2019-3858 | | | | libssh2: Zero-byte allocation || | | | | | with a specially crafted SFTP || | | | | | packed leading to an... |+ +------------------+ + + +----------------------------------+| | CVE-2019-3859 | | | | libssh2: Unchecked use of || | | | | | _libssh2_packet_require and || | | | | | _libssh2_packet_requirev || | | | | | resulting in out-of-bounds || | | | | | read |+---------+------------------+ +-------------------+---------------+----------------------------------+| libxml2 | CVE-2018-14404 | | 2.9.7-r0 | 2.9.8-r1 | libxml2: NULL pointer || | | | | | dereference in || | | | | | xpath.c:xmlXPathCompOpEval() || | | | | | can allow attackers to cause || | | | | | a... |+ +------------------+ + + +----------------------------------+| | CVE-2018-14567 | | | | libxml2: Infinite loop when || | | | | | --with-lzma is used allows for || | | | | | denial of service... |+ +------------------+----------+ + +----------------------------------+| | CVE-2018-9251 | LOW | | | libxml2: infinite loop in || | | | | | xz_decomp function in xzlib.c |+---------+------------------+----------+-------------------+---------------+----------------------------------+| openssh | CVE-2019-6109 | MEDIUM | 7.5_p1-r9 | 7.5_p1-r10 | openssh: Missing character || | | | | | encoding in progress display || | | | | | allows for spoofing of scp... |+ +------------------+ + + +----------------------------------+| | CVE-2019-6111 | | | | openssh: Improper validation || | | | | | of object names allows || | | | | | malicious server to overwrite || | | | | | files... |+ +------------------+----------+ + +----------------------------------+| | CVE-2018-20685 | LOW | | | openssh: scp client improper || | | | | | directory name validation |+---------+------------------+----------+-------------------+---------------+----------------------------------+| sqlite | CVE-2018-20346 | MEDIUM | 3.21.0-r1 | 3.25.3-r0 | CVE-2018-20505 CVE-2018-20506 || | | | | | sqlite: Multiple flaws in || | | | | | sqlite which can be triggered || | | | | | via... |+---------+------------------+----------+-------------------+---------------+----------------------------------+| tar | CVE-2018-20482 | LOW | 1.29-r1 | 1.31-r0 | tar: Infinite read loop in || | | | | | sparse_dump_region function in || | | | | | sparse.c |+---------+------------------+----------+-------------------+---------------+----------------------------------+
By Open Policy Agent
[EXPERIMENTAL] This feature might change without preserving backwards compatibility.
Trivy supports Open Policy Agent (OPA) to filter vulnerabilities. You can specify a Rego file with --ignore-policy option.
The Rego package name must be trivy and it must include a rule called ignore which determines if each individual vulnerability should be excluded (ignore=true) or not (ignore=false). In the policy, each vulnerability will be available for inspection as the input variable. The structure of each vulnerability input is the same as for the Trivy JSON output.
There is a built-in Rego library with helper functions that you can import into your policy using: import data.lib.trivy. For more info about the helper functions, look at the library here
To get started, see the example policy.
$ trivy image --ignore-policy contrib/example_filter/basic.rego centos:7
Result
centos:7 (centos 7.8.2003)==========================Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)+---------+------------------+----------+-------------------+---------------+--------------------------------+| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |+---------+------------------+----------+-------------------+---------------+--------------------------------+| glib2 | CVE-2016-3191 | HIGH | 2.56.1-5.el7 | | pcre: workspace overflow || | | | | | for (*ACCEPT) with deeply || | | | | | nested parentheses (8.39/13, || | | | | | 10.22/12) |+---------+------------------+----------+-------------------+---------------+--------------------------------+
