feat(vuln): support vulnerability status

[knqyf263]

Description

The detail is described in #4763.

• Display the status in table/json.
• Add --ignore-status
  • e.g. trivy image --ignore-status will_not_fix centos:7

Before

centos:7 (centos 7.9.2009)
==========================
Total: 1026 (UNKNOWN: 0, LOW: 565, MEDIUM: 455, HIGH: 6, CRITICAL: 0)

┌─────────────────────────────┬──────────────────┬──────────┬───────────────────────┬──────────────────────────┬──────────────────────────────────────────────────────────────┐
│           Library           │  Vulnerability   │ Severity │   Installed Version   │      Fixed Version       │                            Title                             │
├─────────────────────────────┼──────────────────┼──────────┼───────────────────────┼──────────────────────────┼──────────────────────────────────────────────────────────────┤
│ audit-libs                  │ CVE-2015-5186    │ MEDIUM   │ 2.8.5-4.el7           │                          │ log terminal emulator escape sequences handling              │
│                             │                  │          │                       │                          │ https://avd.aquasec.com/nvd/cve-2015-5186                    │
├─────────────────────────────┼──────────────────┤          ├───────────────────────┼──────────────────────────┼──────────────────────────────────────────────────────────────┤
│ bash                        │ CVE-2012-6711    │          │ 4.2.46-34.el7         │                          │ bash: heap-based buffer overflow during echo of unsupported  │
│                             │                  │          │                       │                          │ characters                                                   │
│                             │                  │          │                       │                          │ https://avd.aquasec.com/nvd/cve-2012-6711                    │
│                             ├──────────────────┼──────────┤                       ├──────────────────────────┼──────────────────────────────────────────────────────────────┤
│                             │ CVE-2019-18276   │ LOW      │                       │                          │ bash: when effective UID is not equal to its real UID the... │
│                             │                  │          │                       │                          │ https://avd.aquasec.com/nvd/cve-2019-18276                   │
├─────────────────────────────┼──────────────────┼──────────┼───────────────────────┼──────────────────────────┼──────────────────────────────────────────────────────────────┤
│ bind-license                │ CVE-2020-8625    │ HIGH     │ 32:9.11.4-26.P2.el7   │ 32:9.11.4-26.P2.el7_9.4  │ bind: Buffer overflow in the SPNEGO implementation affecting │
│                             │                  │          │                       │                          │ GSSAPI security policy negotiation...                        │
│                             │                  │          │                       │                          │ https://avd.aquasec.com/nvd/cve-2020-8625                    │
│                             ├──────────────────┤          │                       ├──────────────────────────┼──────────────────────────────────────────────────────────────┤

After

centos:7 (centos 7.9.2009)
==========================
Total: 1026 (UNKNOWN: 0, LOW: 564, MEDIUM: 456, HIGH: 6, CRITICAL: 0)

┌─────────────────────────────┬──────────────────┬──────────┬─────────────────────┬───────────────────────┬──────────────────────────┬──────────────────────────────────────────────────────────────┐
│           Library           │  Vulnerability   │ Severity │       Status        │   Installed Version   │      Fixed Version       │                            Title                             │
├─────────────────────────────┼──────────────────┼──────────┼─────────────────────┼───────────────────────┼──────────────────────────┼──────────────────────────────────────────────────────────────┤
│ audit-libs                  │ CVE-2015-5186    │ MEDIUM   │ will_not_fix        │ 2.8.5-4.el7           │                          │ log terminal emulator escape sequences handling              │
│                             │                  │          │                     │                       │                          │ https://avd.aquasec.com/nvd/cve-2015-5186                    │
├─────────────────────────────┼──────────────────┤          │                     ├───────────────────────┼──────────────────────────┼──────────────────────────────────────────────────────────────┤
│ bash                        │ CVE-2012-6711    │          │                     │ 4.2.46-34.el7         │                          │ bash: heap-based buffer overflow during echo of unsupported  │
│                             │                  │          │                     │                       │                          │ characters                                                   │
│                             │                  │          │                     │                       │                          │ https://avd.aquasec.com/nvd/cve-2012-6711                    │
│                             ├──────────────────┼──────────┤                     │                       ├──────────────────────────┼──────────────────────────────────────────────────────────────┤
│                             │ CVE-2019-18276   │ LOW      │                     │                       │                          │ bash: when effective UID is not equal to its real UID the... │
│                             │                  │          │                     │                       │                          │ https://avd.aquasec.com/nvd/cve-2019-18276                   │
├─────────────────────────────┼──────────────────┼──────────┼─────────────────────┼───────────────────────┼──────────────────────────┼──────────────────────────────────────────────────────────────┤
│ bind-license                │ CVE-2020-8625    │ HIGH     │ fixed               │ 32:9.11.4-26.P2.el7   │ 32:9.11.4-26.P2.el7_9.4  │ bind: Buffer overflow in the SPNEGO implementation affecting │
│                             │                  │          │                     │                       │                          │ GSSAPI security policy negotiation...                        │
│                             │                  │          │                     │                       │                          │ https://avd.aquasec.com/nvd/cve-2020-8625                    │
│                             ├──────────────────┤          │                     │                       ├──────────────────────────┼──────────────────────────────────────────────────────────────┤
│                             │ CVE-2021-25215   │          │                     │                       │ 32:9.11.4-26.P2.el7_9.5  │ bind: An assertion check can fail while answering queries    │
│                             │                  │          │                     │                       │                          │ for DNAME records...                                         │
│                             │                  │          │                     │                       │                          │ https://avd.aquasec.com/nvd/cve-2021-25215                   │
│                             ├──────────────────┤          │                     │                       ├──────────────────────────┼──────────────────────────────────────────────────────────────┤
│                             │ CVE-2022-38177   │          │                     │                       │ 32:9.11.4-26.P2.el7_9.10 │ bind: memory leak in ECDSA DNSSEC verification code          │
│                             │                  │          │                     │                       │                          │ https://avd.aquasec.com/nvd/cve-2022-38177                   │
│                             ├──────────────────┤          │                     │                       │                          ├──────────────────────────────────────────────────────────────┤
│                             │ CVE-2022-38178   │          │                     │                       │                          │ bind: memory leaks in EdDSA DNSSEC verification code         │
│                             │                  │          │                     │                       │                          │ https://avd.aquasec.com/nvd/cve-2022-38178                   │
│                             ├──────────────────┤          ├─────────────────────┤                       ├──────────────────────────┼──────────────────────────────────────────────────────────────┤
│                             │ CVE-2023-2828    │          │ affected            │                       │                          │ named's configured cache size limit can be significantly     │
│                             │                  │          │                     │                       │                          │ exceeded                                                     │
│                             │                  │          │                     │                       │                          │ https://avd.aquasec.com/nvd/cve-2023-2828                    │
│                             ├──────────────────┼──────────┼─────────────────────┤                       ├──────────────────────────┼──────────────────────────────────────────────────────────────┤

Related issues

• Close Add more detailed vulnerability status on unfixed vulnerabilities #4763

Related PRs

• feat: add vulnerability status trivy-db#328

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

@itaysk @AnaisUrlichs Could you take a quick look at the document? The source code should be ok as Dmitriy and I cross-review changes.
It is marked as a draft so I won't forget to remove replace in go.mod, but it is ready for review.