v0.27.0

[aqua-bot]

🚀 What's new? 🚀

🔓 Secret Scanning 🎉

Trivy scans hardcoded secrets like passwords, API keys and tokens. The secret scanning is enabled for container images, filesystems and git repositories by default.

The following example detects vulnerabilities and secrets in a container image.

$ trivy image myimage:1.0.0
2022-04-21T18:56:44.099+0300    INFO    Detected OS: alpine
2022-04-21T18:56:44.099+0300    INFO    Detecting Alpine vulnerabilities...
2022-04-21T18:56:44.101+0300    INFO    Number of language-specific files: 0

myimage:1.0.0 (alpine 3.15.0)
=============================
Total: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 2)

+--------------+------------------+----------+-------------------+---------------+---------------------------------------+
|   LIBRARY    | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
+--------------+------------------+----------+-------------------+---------------+---------------------------------------+
| busybox      | CVE-2022-28391   | CRITICAL | 1.34.1-r3         | 1.34.1-r5     | CVE-2022-28391 affecting              |
|              |                  |          |                   |               | package busybox 1.35.0                |
|              |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2022-28391 |
+--------------+------------------|          |-------------------+---------------+---------------------------------------+
| ssl_client   | CVE-2022-28391   |          | 1.34.1-r3         | 1.34.1-r5     | CVE-2022-28391 affecting              |
|              |                  |          |                   |               | package busybox 1.35.0                |
|              |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2022-28391 |
+--------------+------------------+----------+-------------------+---------------+---------------------------------------+

app/secret.sh (secrets)
=======================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)

+----------+-------------------+----------+---------+--------------------------------+
| CATEGORY |    DESCRIPTION    | SEVERITY | LINE NO |             MATCH              |
+----------+-------------------+----------+---------+--------------------------------+
|   AWS    | AWS Access Key ID | CRITICAL |   10    | export AWS_ACCESS_KEY_ID=***** |
+----------+-------------------+----------+---------+--------------------------------+

It also supports custom rules so that you can capture your original secrets. Please check it out for the detail.

Kudos to @VaismanLior

🍶 Support TTL in Redis cache

Trivy stores artifact information such as OS and packages in cache. The cache contains only JSON and should not be such a big size. But just in case scanning a lot of images, Trivy offers --cache-ttl to configure TTL only when the cache backend is Redis.

$ docker run --name my-redis -p 6379:6379 -d redis
$ trivy image \
  --cache-backend=redis://localhost:6379 \
  --cache-ttl=1m alpine:3.14.1
$ docker exec -it my-redis redis-cli --scan --pattern '*'
"fanal::artifact::sha256:1d0ac90d0d332b5f9d0f981a8b4bb723ce4ebc39bd2687efaa1eb8f80c23087c"
"fanal::blob::sha256:a840fcf61b91e94d456a40da3fb3c87f2acde8c94e0a9d392ee5beb9398c77e7"
$ sleep 60
$ docker exec -it my-redis redis-cli --scan --pattern '*'
[no output]

See here also.

🐞 Bug fixes 🐛

Changelog

• 9fd86da fix(go): fixed panic to scan gomod without version (fix(go): fixed panic to scanning gomod without version #2038)
• fbc9030 docs(mariner): confirm it works with Mariner 2.0 VM (docs(mariner): confirm it works with Mariner 2.0 VM #2036)
• e2a31ab feat(secret): support enable rules (feat(secret): support enable rules #2035)
• 708a7a7 chore: app version 26.0 (chore: app version 26.0 #2030)
• e000329 docs(secret): add a demo movie (docs(secret): add a demo movie #2031)
• e127334 feat: support cache TTL in Redis (feat: support cache TTL in Redis #2021)
• 3870515 fix(go): skip system installed binaries (fix(go): skip system installed binaries #2028)
• 4e6389a fix(go): check if go.sum is nil (fix(go): check if go.sum is nil #2029)
• 5f047f9 feat: add secret scanning (feat: add secret scanning #1901)
• 0700586 chore: gh publish only with push the tag release (chore: gh publish only with push the tag release #2025)
• 1f393c1 fix(fs): ignore permission errors (fix(fs): ignore permission errors #2022)
• 110c534 test(mod): using correct module inside test go.mod (test(deps): using a correct module inside go.mod for integration tests #2020)
• 525e268 feat(server): re-add proxy support for client/server communications (feat(server): re-add proxy support for client/server communications #1995)
• 9898ac9 fix(report): truncate a description before escaping in ASFF template (fix(report): truncate a description before escaping in ASFF template #2004)
• 453a1ed fix(cloudformation): correct margin removal for empty lines (fix(cloudformation): correct margin removal for empty lines #2002)
• 407f3b6 fix(template): correct check of old sarif template files (fix(report): correct check of old sarif template files #2003)

---

This discussion was created from the release v0.27.0.