v0.76.0

[github-actions[bot]]

📑 Table of Contents

• 🚀 What's new? 🚀
  • Security levels of cryptographic algorithms in CBOM
  • Vulnerability detection for Echo-patched Java and Node.js packages
  • RapidFort support for more base OSes
• 👷‍♂️ Notable Fixes 🛠️

🚀 What's new? 🚀

Security levels of cryptographic algorithms in CBOM

⚠️ EXPERIMENTAL: CBOM generation is still experimental. This feature might change without preserving backward compatibility.

Trivy now reports nominal security levels of the algorithms in the CBOM, so that downstream tools can assess the strength of the cryptography found.

The classical security level is the strength in bits against classical attacks.
The NIST quantum security level is the NIST post-quantum security category from 1 to 5, or 0 for an algorithm that meets none of the categories.
The levels are taken from NIST and IETF publications and are reported in CycloneDX as algorithmProperties.classicalSecurityLevel and algorithmProperties.nistQuantumSecurityLevel.
A level that cannot be estimated is left out.

{
  "name": "RSA-2048",
  "cryptoProperties": {
    "assetType": "algorithm",
    "algorithmProperties": {
      "primitive": "unknown",
      "parameterSetIdentifier": "2048",
      "classicalSecurityLevel": 112,
      "nistQuantumSecurityLevel": 0
    },
    "oid": "1.2.840.113549.1.1.1"
  }
}

DSA algorithms are now told apart by both FIPS 186 parameter lengths: L (the length of p) and N (the length of q).
The pair is reported in parameterSetIdentifier, such as 2048-256, so DSA keys of (2048, 224) and (2048, 256) show up as different algorithms.
The bom-ref of DSA algorithm components changes accordingly, together with the references to them from keys and certificates (…:key-size%3D2048 → …:key-size%3D2048%2Csubgroup-size%3D256).

See the documentation for the table of levels and its sources.

Vulnerability detection for Echo-patched Java and Node.js packages

Trivy now detects vulnerabilities in Maven and npm packages patched by Echo, in addition to Python packages.

These packages are identified by the +echo.N version suffix (e.g. org.springframework:spring-core 6.1.21+echo.1 or nanoid 3.3.6+echo.2) and are checked against Echo's own security advisories from the Echo OSV feed instead of the upstream ones.
This works in all scan modes and does not depend on the OS: Echo packages are detected not only in Echo-based images.

See the documentation for details.

RapidFort support for more base OSes

In addition to Ubuntu-, Alpine- and Red Hat Enterprise Linux-based images, Trivy now scans RapidFort curated images based on Debian, Oracle Linux, Rocky Linux, AlmaLinux and Amazon Linux against the RapidFort feed.

See the documentation for details.

👷‍♂️ Notable Fixes 🛠️

• fix(echo): match +echo.N local segment anywhere in pip versions #11367
• fix(vex): avoid panic on CSAF advisory without a CVE #10990 Thanks to @dervoeti
• fix(php): keep dependency edges to packages named like PHP extensions #11051 Thanks to @sueun-dev