Missing packages and vulnerabilities in trivy image scan results

[namandf]

Description

Scanned a debian image using the latest trivy version, but see a discrepancy in the packages and vulnerabilities reported when compared with other tools

Eg. Trivy scan of debian:unstable-20240311 reports 86 packages with no vulnerabilities while dockerhub (https://hub.docker.com/layers/library/debian/unstable-20240311/images/sha256-8690225da3ca369e9be720446f73e0aa06f290776fdf2605b6ec80c2b229b9f6) reports 125 with 21 vulnerabilities.

Desired Behavior

Consistent results w.r.t packages and vulnerabilities
x

Actual Behavior

Unreported packages and vulnerabilities
Eg. missing xz-utils package and associated vulnerabilities

          "ID": "liblzma5@5.6.0-0.2",
          "Name": "liblzma5",
          "Identifier": {
            "PURL": "pkg:deb/debian/liblzma5@5.6.0-0.2?arch=amd64\u0026distro=debian-trixie%2Fsid"
          },
          "Version": "5.6.0",
          "Release": "0.2",
          "Arch": "amd64",
          "SrcName": "xz-utils",
          "SrcVersion": "5.6.0",
          "SrcRelease": "0.2",

Reproduction Steps

1.trivy image debian:unstable-20240311 --list-all-pkgs --format json --output xz.json

Target

Container Image

Scanner

Vulnerability

Output Format

JSON

Mode

Standalone

Debug Output

trivy image debian:unstable-20240311 --list-all-pkgs --format json --output xz.json --debug

2024-04-01T14:47:57.273+0530	DEBUG	Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2024-04-01T14:47:57.274+0530	DEBUG	Ignore statuses	{"statuses": null}
2024-04-01T14:47:57.318+0530	DEBUG	cache dir:  /Users/deepfactor/Library/Caches/trivy
2024-04-01T14:47:57.318+0530	DEBUG	DB update was skipped because the local DB is the latest
2024-04-01T14:47:57.318+0530	DEBUG	DB Schema: 2, UpdatedAt: 2024-04-01 06:10:28.650317521 +0000 UTC, NextUpdate: 2024-04-01 12:10:28.65031714 +0000 UTC, DownloadedAt: 2024-04-01 07:14:06.52392 +0000 UTC
2024-04-01T14:47:57.319+0530	INFO	Vulnerability scanning is enabled
2024-04-01T14:47:57.319+0530	DEBUG	Vulnerability type:  [os library]
2024-04-01T14:47:57.319+0530	INFO	Secret scanning is enabled
2024-04-01T14:47:57.319+0530	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-04-01T14:47:57.319+0530	INFO	Please see also https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#recommendation for faster secret detection
2024-04-01T14:47:57.319+0530	DEBUG	Enabling misconfiguration scanners: [azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-04-01T14:48:00.801+0530	DEBUG	No secret config detected: trivy-secret.yaml
2024-04-01T14:48:00.803+0530	DEBUG	The nuget packages directory couldn't be found. License search disabled
2024-04-01T14:48:00.803+0530	DEBUG	No secret config detected: trivy-secret.yaml
2024-04-01T14:48:01.143+0530	DEBUG	Image ID: sha256:7ae99452637b883520961deae33180fbe89e1e3d16614537b36420779454090d
2024-04-01T14:48:01.143+0530	DEBUG	Diff IDs: [sha256:0f28dfebbf3451ccfe3d5b11d17bc38cc8d1c4e721b842969466dc7989d835e3]
2024-04-01T14:48:01.143+0530	DEBUG	Base Layers: []
2024-04-01T14:48:01.161+0530	INFO	Detected OS: debian
2024-04-01T14:48:01.161+0530	WARN	This OS version is not on the EOL list: debian trixie/sid
2024-04-01T14:48:01.161+0530	INFO	Detecting Debian vulnerabilities...
2024-04-01T14:48:01.161+0530	DEBUG	debian: os version: trixie/sid
2024-04-01T14:48:01.161+0530	DEBUG	debian: the number of packages: 86
2024-04-01T14:48:01.162+0530	INFO	Number of language-specific files: 0

Operating System

macOS Sonoma

Version

trivy --version
Version: 0.50.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-04-01 06:10:28.650317521 +0000 UTC
  NextUpdate: 2024-04-01 12:10:28.65031714 +0000 UTC
  DownloadedAt: 2024-04-01 07:14:06.52392 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2023-09-11 00:53:00.064262708 +0000 UTC
  NextUpdate: 2023-09-14 00:53:00.064262008 +0000 UTC
  DownloadedAt: 2023-09-11 19:22:04.868176 +0000 UTC

Checklist

• Run trivy image --reset
• Read the troubleshooting

[knqyf263]

Debian sid is not supported for now.
#487