Repository navigation
Replies: 12 comments 2 replies
|
@tuananh Do you think which JAR file should be detected? Are you sure those vulnerabilities should be detected? Could you share more detail? |
|
Grype looks correct to me since keycloak uses it. I double check the deps from source
eg: snakeyaml 1.33
https://github.com/keycloak/keycloak/blob/main/pom.xml#L121
the jar files are in /usr/share/java/keycloak-21.0.2 folder
…On Thu, Apr 13, 2023, at 1:02 AM, Teppei Fukuda wrote:
@tuananh <https://github.com/tuananh> Do you think which JAR file
should be detected? Are you sure those vulnerabilities should be
detected? Could you share more detail?
People are likely confused between false positives and true negatives
and assume that a false positive is correct., so we first need to check
what is the correct result.
—
Reply to this email directly, view it on GitHub
<#4046 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAEZETX7LW52PS2OES4EKBTXA3U2XANCNFSM6AAAAAAW35E42Y>.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
|
Hello @tuananh There jars installed from Similar case - #4043 (comment) Regrads, Dmitriy |
|
Is there a flag to "not skip it"? I saw the skip flag in the other issue but I don't want to skip. UPDATE: my bad, it seems like i need to skip this file ? |
|
@DmitriyLewen it works but if I do skip I'm seeing this in the logs if that's the case, I will need to scan twice and combine output? |
|
Our opinion - if package is installed from the package manager - the OS vendor is responsible for this package and all included files -https://aquasecurity.github.io/trivy/v0.40/docs/vulnerability/detection/data-source/.
So this way can contain false positives.
That is why we don't have option for this.
Right. But this is a workaround and you do it at your own risk |
|
I see. but what happened for those that package the application ourselves into format like deb/apk/etc... for deployment? |
|
hm... that is s good question! @knqyf263 wdyt? We may need to add a flag to be able to exclude some files from |
|
@DmitriyLewen Thanks for sorting this out. @tuananh As Dmitriy explained, we should use security advisories from the OS vendor if the package is distributed by vendor because it could have backport fixes. For example, CVE-2023-0465 has a backport patch in Wolfi, fixed in 3.1.0-r2, while upstream OpenSSL fixed that in 3.1.1. If we use upstream advisories, 3.1.0-r2 looks vulnerable, resulting in a false positive. https://github.com/wolfi-dev/os/blob/c787a63d32cbd4500ff1a6c76182389f0a2ee7c7/openssl.yaml#L250-L253 This is why we use vendor advisories; otherwise, it brings a lot of false positives. Hence, I think the right approach here is to report the vulnerability to Wolfi's keycloak package. But if you don't want to trust Wolfi's advisories and accept false positives and duplications, it may be worth adding such an option as you asked.
Trivy checks OS vendors and tries not to skip files installed by 3rd-party packages. trivy/pkg/fanal/analyzer/pkg/rpm/rpm.go Lines 47 to 61 in 914c6f0 |
|
How about |
|
it's not very clear for the purpose of the flag but i couldnt think of a better one |
|
@DmitriyLewen Can you create an issue for the enhancement? I'd like to close this discussion. |
|
Done - #4257 |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Description
trivy fails to detect java libs.
grype can detect it
What did you expect to happen?
multiple java libs with cve detected.
What happened instead?
no cve got detected
Output of run with
-debug:Output of
trivy -v:Additional details (base image name, container registry info...):
https://github.com/tuananh/keycloak
All reactions