feat(vuln): Add `--detection-priority` flag for accuracy tuning #7288

knqyf263 · 2024-08-01T07:20:27Z

Description

This PR introduces a new --detection-priority flag to Trivy, allowing users to control the balance between false positives and false negatives in vulnerability detection. This feature enhances Trivy's flexibility in different use cases and risk tolerance levels.

Red Hat UBI 8

`--detection-priority precise`

$ trivy image registry.access.redhat.com/ubi8/ubi --detection-priority precise --scanners vuln

Result

2024-08-01T11:16:55+04:00       INFO    [vuln] Vulnerability scanning is enabled
2024-08-01T11:17:02+04:00       INFO    Detected OS     family="redhat" version="8.10"
2024-08-01T11:17:02+04:00       INFO    [redhat] Detecting RHEL/CentOS vulnerabilities...       os_version="8" pkg_num=183
2024-08-01T11:17:02+04:00       INFO    Number of language-specific files       num=0

registry.access.redhat.com/ubi8/ubi (redhat 8.10)
=================================================
Total: 180 (UNKNOWN: 0, LOW: 160, MEDIUM: 20, HIGH: 0, CRITICAL: 0)

`--detection-priority comprehensive`

$ trivy image registry.access.redhat.com/ubi8/ubi --detection-priority comprehensive --scanners vuln

Result

2024-08-01T11:18:16+04:00       INFO    [vuln] Vulnerability scanning is enabled
2024-08-01T11:18:23+04:00       INFO    Detected OS     family="redhat" version="8.10"
2024-08-01T11:18:23+04:00       INFO    [redhat] Detecting RHEL/CentOS vulnerabilities...       os_version="8" pkg_num=183
2024-08-01T11:18:23+04:00       INFO    Number of language-specific files       num=1
2024-08-01T11:18:23+04:00       INFO    [python-pkg] Detecting vulnerabilities...

registry.access.redhat.com/ubi8/ubi (redhat 8.10)
=================================================
Total: 180 (UNKNOWN: 0, LOW: 160, MEDIUM: 20, HIGH: 0, CRITICAL: 0)

...

2024-08-01T11:18:23+04:00       INFO    Table result includes only package filenames. Use '--format json' option to get the full path to the package file.

Python (python-pkg)
===================
Total: 10 (UNKNOWN: 0, LOW: 0, MEDIUM: 8, HIGH: 2, CRITICAL: 0)

┌───────────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬─────────────────────────────────────────────────────────────┐
│        Library        │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version  │                            Title                            │
├───────────────────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ idna (PKG-INFO)       │ CVE-2024-3651  │ MEDIUM   │ fixed  │ 2.5               │ 3.7            │ python-idna: potential DoS via resource consumption via     │
│                       │                │          │        │                   │                │ specially crafted inputs to idna.encode()...                │
│                       │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2024-3651                   │
├───────────────────────┼────────────────┤          │        ├───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ requests (PKG-INFO)   │ CVE-2023-32681 │          │        │ 2.20.0            │ 2.31.0         │ python-requests: Unintended leak of Proxy-Authorization     │
│                       │                │          │        │                   │                │ header                                                      │
│                       │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2023-32681                  │
│                       ├────────────────┤          │        │                   ├────────────────┼─────────────────────────────────────────────────────────────┤
│                       │ CVE-2024-35195 │          │        │                   │ 2.32.0         │ requests: subsequent requests to the same host ignore cert  │
│                       │                │          │        │                   │                │ verification                                                │
│                       │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2024-35195                  │
├───────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ setuptools (METADATA) │ CVE-2022-40897 │ HIGH     │        │ 39.2.0            │ 65.5.1         │ pypa-setuptools: Regular Expression Denial of Service       │
│                       │                │          │        │                   │                │ (ReDoS) in package_index.py                                 │
│                       │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2022-40897                  │
│                       ├────────────────┤          │        │                   ├────────────────┼─────────────────────────────────────────────────────────────┤
│                       │ CVE-2024-6345  │          │        │                   │ 70.0.0         │ pypa/setuptools: Remote code execution via download         │
│                       │                │          │        │                   │                │ functions in the package_index module in...                 │
│                       │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2024-6345                   │
├───────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ urllib3 (PKG-INFO)    │ CVE-2019-11236 │ MEDIUM   │        │ 1.24.2            │ 1.24.3         │ python-urllib3: CRLF injection due to not encoding the      │
│                       │                │          │        │                   │                │ '\r\n' sequence leading to...                               │
│                       │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2019-11236                  │
│                       ├────────────────┤          │        │                   ├────────────────┼─────────────────────────────────────────────────────────────┤
│                       │ CVE-2020-26137 │          │        │                   │ 1.25.9         │ python-urllib3: CRLF injection via HTTP request method      │
│                       │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2020-26137                  │
│                       ├────────────────┤          │        │                   ├────────────────┼─────────────────────────────────────────────────────────────┤
│                       │ CVE-2023-43804 │          │        │                   │ 2.0.6, 1.26.17 │ python-urllib3: Cookie request header isn't stripped during │
│                       │                │          │        │                   │                │ cross-origin redirects                                      │
│                       │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2023-43804                  │
│                       ├────────────────┤          │        │                   ├────────────────┼─────────────────────────────────────────────────────────────┤
│                       │ CVE-2023-45803 │          │        │                   │ 2.0.7, 1.26.18 │ urllib3: Request body not stripped after redirect from 303  │
│                       │                │          │        │                   │                │ status changes request...                                   │
│                       │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2023-45803                  │
│                       ├────────────────┤          │        │                   ├────────────────┼─────────────────────────────────────────────────────────────┤
│                       │ CVE-2024-37891 │          │        │                   │ 1.26.19, 2.2.2 │ urllib3: proxy-authorization request header is not stripped │
│                       │                │          │        │                   │                │ during cross-origin redirects                               │
│                       │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2024-37891                  │
└───────────────────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────┴─────────────────────────────────────────────────────────────┘

cgr.dev/chainguard/argocd

`--detection-priority precise`

$ trivy image cgr.dev/chainguard/argocd --detection-priority precise --scanners vuln

Result

2024-08-01T11:27:12+04:00       INFO    [vuln] Vulnerability scanning is enabled
2024-08-01T11:27:12+04:00       INFO    Detected OS     family="wolfi" version="20230201"
2024-08-01T11:27:12+04:00       INFO    [wolfi] Detecting vulnerabilities...    pkg_num=10
2024-08-01T11:27:12+04:00       INFO    Number of language-specific files       num=0
2024-08-01T11:27:12+04:00       WARN    Using severities from other vendors for some vulnerabilities. Read https://aquasecurity.github.io/trivy/dev/docs/scanner/vulnerability#severity-selection for details.

cgr.dev/chainguard/argocd (wolfi 20230201)
==========================================
Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 2, CRITICAL: 0)

┌─────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                       Title                        │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────┤
│ argo-cd-2.11        │ CVE-2024-40634 │ HIGH     │ fixed  │ 2.11.5-r0         │ 2.11.6-r0     │ argocd: Unauthenticated Denial of Service (DoS)    │
│                     │                │          │        │                   │               │ Vulnerability via /api/webhook Endpoint in Argo... │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-40634         │
├─────────────────────┤                │          │        │                   │               │                                                    │
│ argo-cd-2.11-compat │                │          │        │                   │               │                                                    │
│                     │                │          │        │                   │               │                                                    │
│                     │                │          │        │                   │               │                                                    │
└─────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────┘

`--detection-priority comprehensive`

$ trivy image cgr.dev/chainguard/argocd --detection-priority comprehensive --scanners vuln

Result

2024-08-01T11:27:54+04:00       INFO    [vuln] Vulnerability scanning is enabled
2024-08-01T11:27:54+04:00       INFO    Detected OS     family="wolfi" version="20230201"
2024-08-01T11:27:54+04:00       INFO    [wolfi] Detecting vulnerabilities...    pkg_num=10
2024-08-01T11:27:54+04:00       INFO    Number of language-specific files       num=2
2024-08-01T11:27:54+04:00       INFO    [gobinary] Detecting vulnerabilities...
2024-08-01T11:27:54+04:00       WARN    Using severities from other vendors for some vulnerabilities. Read https://aquasecurity.github.io/trivy/dev/docs/scanner/vulnerability#severity-selection for details.

cgr.dev/chainguard/argocd (wolfi 20230201)
==========================================
Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 2, CRITICAL: 0)

┌─────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                       Title                        │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────┤
│ argo-cd-2.11        │ CVE-2024-40634 │ HIGH     │ fixed  │ 2.11.5-r0         │ 2.11.6-r0     │ argocd: Unauthenticated Denial of Service (DoS)    │
│                     │                │          │        │                   │               │ Vulnerability via /api/webhook Endpoint in Argo... │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-40634         │
├─────────────────────┤                │          │        │                   │               │                                                    │
│ argo-cd-2.11-compat │                │          │        │                   │               │                                                    │
│                     │                │          │        │                   │               │                                                    │
│                     │                │          │        │                   │               │                                                    │
└─────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────┘

usr/bin/argocd (gobinary)
=========================
Total: 4 (UNKNOWN: 0, LOW: 1, MEDIUM: 2, HIGH: 1, CRITICAL: 0)

┌──────────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────────────────────┬───────────────────────────────────────────────────────────┐
│                     Library                      │ Vulnerability  │ Severity │ Status │ Installed Version │          Fixed Version           │                           Title                           │
├──────────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ github.com/Azure/azure-sdk-for-go/sdk/azidentity │ CVE-2024-35255 │ MEDIUM   │ fixed  │ v1.1.0            │ 1.6.0                            │ azure-identity: Azure Identity Libraries Elevation of     │
│                                                  │                │          │        │                   │                                  │ Privilege Vulnerability in                                │
│                                                  │                │          │        │                   │                                  │ github.com/Azure/azure-sdk-for-go/sdk/azidentity          │
│                                                  │                │          │        │                   │                                  │ https://avd.aquasec.com/nvd/cve-2024-35255                │
├──────────────────────────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ github.com/argoproj/argo-cd/v2                   │ CVE-2024-40634 │ HIGH     │        │ 2.11.5            │ 2.9.20, 2.10.15, 2.11.6          │ argocd: Unauthenticated Denial of Service (DoS)           │
│                                                  │                │          │        │                   │                                  │ Vulnerability via /api/webhook Endpoint in Argo...        │
│                                                  │                │          │        │                   │                                  │ https://avd.aquasec.com/nvd/cve-2024-40634                │
├──────────────────────────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ k8s.io/kubernetes                                │ CVE-2024-5321  │ MEDIUM   │        │ v1.26.11          │ 1.27.16, 1.28.12, 1.29.7, 1.30.3 │ kubelet: Incorrect permissions on Windows containers logs │
│                                                  │                │          │        │                   │                                  │ https://avd.aquasec.com/nvd/cve-2024-5321                 │
│                                                  ├────────────────┼──────────┤        │                   ├──────────────────────────────────┼───────────────────────────────────────────────────────────┤
│                                                  │ CVE-2024-3177  │ LOW      │        │                   │ 1.27.13, 1.29.4, 1.28.9          │ kubernetes: kube-apiserver: bypassing mountable secrets   │
│                                                  │                │          │        │                   │                                  │ policy imposed by the ServiceAccount admission plugin...  │
│                                                  │                │          │        │                   │                                  │ https://avd.aquasec.com/nvd/cve-2024-3177                 │
└──────────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────────┴───────────────────────────────────────────────────────────┘

...

Notes

OS packages:
- When OS vendors provide sufficient advisories (e.g., Red Hat), --detection-priority comprehensive may not significantly increase true positive detections. Newly detected vulnerabilities are likely to be false positives or duplicates of vulnerabilities already detected via OS vendor advisories (see the above example).
- For cases where OS vendor advisories are insufficient or delayed compared to upstream advisories, the comprehensive mode may detect more relevant vulnerabilities.
Language-specific packages:
- In cases where exact versions cannot be determined (e.g., version ranges), --detection-priority comprehensive uses the lower bound of version ranges for vulnerability detection. This detects possible vulnerabilities, but may lead to false positives if the actual version used is not at this lower bound.

Key changes

Implemented the --detection-priority flag with two modes: precise and comprehensive
Added logic to adjust vulnerability detection based on the chosen mode
Updated relevant tests to cover the new functionality
Added documentation explaining the new flag and its usage

Implementation details

precise mode (default): Focuses on reducing false positives, resulting in less noisy vulnerability reports
comprehensive mode: Aims to detect more vulnerabilities, potentially including some false positives, for broader coverage
- Analyze files installed by an OS package manager
- Use a minimum version of the version ranges
Included brief user review considerations for each mode

Terminology

I chose comprehensive instead of coverage for the following reasons:

Clarity of meaning: comprehensive better describes the broader detection approach
Avoiding confusion with the existing Scanning Coverage documentation
Distinction from technical terms: coverage has specific meanings in testing contexts

Related issues

Close Add --detection-priority #7270

Related PRs

feat: add third party flag for os packages #4109

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

Signed-off-by: knqyf263 <knqyf263@gmail.com>

DmitriyLewen

LGTM
Left a couple of comments.

docs/docs/scanner/vulnerability.md

pkg/cache/key_test.go

Signed-off-by: knqyf263 <knqyf263@gmail.com>

DmitriyLewen · 2024-08-02T09:41:30Z

docs/docs/coverage/language/python.md

-| Poetry          | poetry.lock      |            ✓            |     Exclude      |                  ✓                   |    -     |
+| Package manager | File             | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position | [Detection Priority][detection-priority] |
+|-----------------|------------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|:----------------------------------------:|
+| pip             | requirements.txt |            -            |     Include      |                  -                   |    ✓     |                    -                     |


we can add table for conda environment.yml files (this file list requirements.txt)

Did we forget to add environment.yaml to the doc?

Oh, I found it under OS. Do you remember why we put it here?
https://aquasecurity.github.io/trivy/v0.54/docs/coverage/os/conda/

Conda doesn't only contain Python packages.
You can install OS packages.
Conda is thus compilation of package manager (like apt) and pip.

I thought about adding Conda to package managers, but we don't have pages for that.
So we decided to put Conda in OS first.

You can install OS packages.

Is there any document about it?

Anyway, I added.
9e8cdb1

https://docs.anaconda.com/working-with-conda/packages/install-packages/#installing-conda-packages

e.g. you can install curl - https://anaconda.org/conda-forge/curl

I have reconsidered this, but my personal definition of "OS packages" is a package distributed by an OS vendor, such as Red Hat and SUSE. Conda is simply building and distributing third-party software, which is different from an operating system. Bitnami does the same and it seems better to create a new category in addition to OS and Language. We should discuss it later.

We just didn't have a suitable category.
But in general we can separate conda + bitnami into a separate category.

docs/docs/coverage/language/java.md

Signed-off-by: knqyf263 <knqyf263@gmail.com>

DmitriyLewen

LGTM

* feat(vm): Support direct filesystem (aquasecurity#7058) Signed-off-by: yusuke.koyoshi <yusuke.koyoshi@bizreach.co.jp> * feat(cli)!: delete deprecated SBOM flags (aquasecurity#7266) Signed-off-by: knqyf263 <knqyf263@gmail.com> * feat(vm): support the Ext2/Ext3 filesystems (aquasecurity#6983) * fix(plugin): do not call GitHub content API for releases and tags (aquasecurity#7274) Signed-off-by: knqyf263 <knqyf263@gmail.com> * fix(java): Return error when trying to find a remote pom to avoid segfault (aquasecurity#7275) Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io> * fix(flag): incorrect behavior for deprected flag `--clear-cache` (aquasecurity#7281) * refactor(misconf): remove file filtering from parsers (aquasecurity#7289) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * feat(vuln): Add `--detection-priority` flag for accuracy tuning (aquasecurity#7288) Signed-off-by: knqyf263 <knqyf263@gmail.com> * docs: add auto-generated config (aquasecurity#7261) Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: knqyf263 <knqyf263@gmail.com> * fix(terraform): add aws_region name to presets (aquasecurity#7184) * perf(misconf): do not convert contents of a YAML file to string (aquasecurity#7292) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * refactor(misconf): remove unused universal scanner (aquasecurity#7293) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * perf(misconf): use json.Valid to check validity of JSON (aquasecurity#7308) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * fix(misconf): load only submodule if it is specified in source (aquasecurity#7112) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * feat(misconf): support for policy and bucket grants (aquasecurity#7284) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * fix(misconf): do not set default value for default_cache_behavior (aquasecurity#7234) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * feat(misconf): iterator argument support for dynamic blocks (aquasecurity#7236) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> Co-authored-by: simar7 <1254783+simar7@users.noreply.github.com> * chore(deps): bump the common group across 1 directory with 7 updates (aquasecurity#7305) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs: update client/server docs for misconf and license scanning (aquasecurity#7277) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: knqyf263 <knqyf263@gmail.com> * docs: update links to packaging.python.org (aquasecurity#7318) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * perf(misconf): optimize work with context (aquasecurity#6968) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * refactor: replace ftypes.Gradle with packageurl.TypeGradle (aquasecurity#7323) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * docs: update air-gapped docs (aquasecurity#7160) Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: knqyf263 <knqyf263@gmail.com> * docs(misconf): Update callsites to use correct naming (aquasecurity#7335) * chore(deps): bump the common group with 9 updates (aquasecurity#7333) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(misconf): change default TLS values for the Azure storage account (aquasecurity#7345) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * refactor(misconf): highlight only affected rows (aquasecurity#7310) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * fix(misconf): wrap Azure PortRange in iac types (aquasecurity#7357) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * feat(misconf): scanning support for YAML and JSON (aquasecurity#7311) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * feat(misconf): variable support for Terraform Plan (aquasecurity#7228) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * fix: safely check if the directory exists (aquasecurity#7353) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * chore(deps): bump the aws group across 1 directory with 7 updates (aquasecurity#7358) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(server): add internal `--path-prefix` flag for client/server mode (aquasecurity#7321) Signed-off-by: knqyf263 <knqyf263@gmail.com> * chore(deps): bump trivy-checks (aquasecurity#7350) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * refactor(misconf): use slog (aquasecurity#7295) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * feat(misconf): ignore duplicate checks (aquasecurity#7317) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * fix(misconf): init frameworks before updating them (aquasecurity#7376) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * fix(misconf): support deprecating for Go checks (aquasecurity#7377) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * feat(python): use minimum version for pip packages (aquasecurity#7348) * docs: add pkg flags to config file page (aquasecurity#7370) * feat(misconf): Add support for using spec from on-disk bundle (aquasecurity#7179) * fix(report): escape `Message` field in `asff.tpl` template (aquasecurity#7401) * fix(misconf): use module to log when metadata retrieval fails (aquasecurity#7405) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * feat(misconf): support for ignore by nested attributes (aquasecurity#7205) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * fix(misconf): do not filter Terraform plan JSON by name (aquasecurity#7406) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * feat(misconf): port and protocol support for EC2 networks (aquasecurity#7146) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * chore: fix allow rule of ignoring test files to make it case insensitive (aquasecurity#7415) * fix(secret): use only line with secret for long secret lines (aquasecurity#7412) * chore: update CODEOWNERS (aquasecurity#7398) Signed-off-by: knqyf263 <knqyf263@gmail.com> * feat(server): Make Trivy Server Multiplexer Exported (aquasecurity#7389) * feat(report): export modified findings in JSON (aquasecurity#7383) Signed-off-by: knqyf263 <knqyf263@gmail.com> * fix(sbom): use `NOASSERTION` for licenses fields in SPDX formats (aquasecurity#7403) * fix(misconf): do not register Rego libs in checks registry (aquasecurity#7420) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * chore(deps): Bump trivy-checks (aquasecurity#7417) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> Co-authored-by: nikpivkin <nikita.pivkin@smartforce.io> * fix(misconf): do not recreate filesystem map (aquasecurity#7416) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * fix(secret): use `.eyJ` keyword for JWT secret (aquasecurity#7410) * fix(misconf): fix infer type for null value (aquasecurity#7424) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * fix(aws): handle ECR repositories in different regions (aquasecurity#6217) Signed-off-by: Kevin Conner <kev.conner@getupcloud.com> * fix: logger initialization before flags parsing (aquasecurity#7372) Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: knqyf263 <knqyf263@gmail.com> * fix(nodejs): check all `importers` to detect dev deps from pnpm-lock.yaml file (aquasecurity#7387) * test: add integration plugin tests (aquasecurity#7299) * feat(sbom): set User-Agent header on requests to Rekor (aquasecurity#7396) Signed-off-by: Bob Callaway <bcallaway@google.com> * fix(helm): explicitly define `kind` and `apiVersion` of `volumeClaimTemplate` element (aquasecurity#7362) * chore(deps): Bump trivy-checks and pin OPA (aquasecurity#7427) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> Co-authored-by: nikpivkin <nikita.pivkin@smartforce.io> * feat(java): add `test` scope support for `pom.xml` files (aquasecurity#7414) * fix(license): add license handling to JUnit template (aquasecurity#7409) * feat(go): use `toolchain` as `stdlib` version for `go.mod` files (aquasecurity#7163) * release: v0.55.0 [main] (aquasecurity#7271) * fix(license): stop spliting a long license text (aquasecurity#7336) Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: knqyf263 <knqyf263@gmail.com> * refactor(java): add error/statusCode for logs when we can't get pom.xml/maven-metadata.xml from remote repo (aquasecurity#7451) * chore(helm): bump up Trivy Helm chart (aquasecurity#7441) * chore(deps): bump the common group across 1 directory with 19 updates (aquasecurity#7436) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: knqyf263 <knqyf263@gmail.com> * chore(deps): bump the aws group with 6 updates (aquasecurity#7468) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(oracle): Update EOL date for Oracle 7 (aquasecurity#7480) * fix(report): change a receiver of MarshalJSON (aquasecurity#7483) Signed-off-by: knqyf263 <knqyf263@gmail.com> * fix(report): fix error with unmarshal of `ExperimentalModifiedFindings` (aquasecurity#7463) Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: knqyf263 <knqyf263@gmail.com> * docs(oci): Add a note About the expected Media Type for the Trivy-DB OCI Artifact (aquasecurity#7449) * feat(license): improve license normalization (aquasecurity#7131) Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io> Co-authored-by: knqyf263 <knqyf263@gmail.com> * docs(db): add a manifest example (aquasecurity#7485) Signed-off-by: knqyf263 <knqyf263@gmail.com> * revert(java): stop supporting of `test` scope for `pom.xml` files (aquasecurity#7488) * docs: refine go docs (aquasecurity#7442) Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: knqyf263 <knqyf263@gmail.com> * chore(vex): suppress openssl vulnerabilities (aquasecurity#7500) Signed-off-by: knqyf263 <knqyf263@gmail.com> * chore(deps): bump alpine from 3.20.0 to 3.20.3 (aquasecurity#7508) * chore(vex): add `CVE-2024-34155`, `CVE-2024-34156` and `CVE-2024-34158` in `trivy.openvex.json` (aquasecurity#7510) * fix(java): use `dependencyManagement` from root/child pom's for dependencies from parents (aquasecurity#7497) * refactor: split `.egg` and `packaging` analyzers (aquasecurity#7514) * feat(misconf): Register checks only when needed (aquasecurity#7435) * fix(misconf): Fix logging typo (aquasecurity#7473) * chore(deps): bump go-ebs-file (aquasecurity#7513) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * fix(sbom): parse type `framework` as `library` when unmarshalling `CycloneDX` files (aquasecurity#7527) * refactor(misconf): pass options to Rego scanner as is (aquasecurity#7529) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * fix(sbom): export bom-ref when converting a package to a component (aquasecurity#7340) Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: amf <amf@macbook.local> Co-authored-by: knqyf263 <knqyf263@gmail.com> * perf(misconf): use port ranges instead of enumeration (aquasecurity#7549) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * fix(misconf): Fixed scope for China Cloud (aquasecurity#7560) * docs(misconf): Add more info on how to use arbitrary JSON/YAML scan feat (aquasecurity#7458) * chore(deps): remove broken replaces for opa and discovery (aquasecurity#7600) * ci: cache test images for `integration`, `VM` and `module` tests (aquasecurity#7599) * ci: add `workflow_dispatch` trigger for test workflow. (aquasecurity#7606) * chore(deps): bump the common group across 1 directory with 20 updates (aquasecurity#7604) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: knqyf263 <knqyf263@gmail.com> * fix(db): check `DownloadedAt` for `trivy-java-db` (aquasecurity#7592) * fix: allow access to '..' in mapfs (aquasecurity#7575) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * test: use a local registry for remote scanning (aquasecurity#7607) Signed-off-by: knqyf263 <knqyf263@gmail.com> * fix(misconf): escape all special sequences (aquasecurity#7558) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * feat(misconf): add ability to disable checks by ID (aquasecurity#7536) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> Co-authored-by: Simar <simar@linux.com> * feat(suse): added SUSE Linux Enterprise Micro support (aquasecurity#7294) Signed-off-by: Marcus Meissner <meissner@suse.de> Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: knqyf263 <knqyf263@gmail.com> * fix(misconf): disable DS016 check for image history analyzer (aquasecurity#7540) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * ci: split `save` and `restore` cache actions (aquasecurity#7614) * refactor: fix auth error handling (aquasecurity#7615) Signed-off-by: knqyf263 <knqyf263@gmail.com> * feat(secret): enhance secret scanning for python binary files (aquasecurity#7223) Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: knqyf263 <knqyf263@gmail.com> * feat(java): add empty versions if `pom.xml` dependency versions can't be detected (aquasecurity#7520) Co-authored-by: Teppei Fukuda <knqyf263@gmail.com> * test: use loaded image names (aquasecurity#7617) Signed-off-by: knqyf263 <knqyf263@gmail.com> * ci: don't use cache for `setup-go` (aquasecurity#7622) * feat: support multiple DB repositories for vulnerability and Java DB (aquasecurity#7605) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * feat(misconf): Support `--skip-*` for all included modules (aquasecurity#7579) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> Co-authored-by: nikpivkin <nikita.pivkin@smartforce.io> * chore: add prefixes to log messages (aquasecurity#7625) Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: simar7 <1254783+simar7@users.noreply.github.com> * fix(misconf): Disable deprecated checks by default (aquasecurity#7632) * chore(deps): Bump trivy-checks to v1.1.0 (aquasecurity#7631) * fix(secret): change grafana token regex to find them without unquoted (aquasecurity#7627) * feat: support RPM archives (aquasecurity#7628) Signed-off-by: knqyf263 <knqyf263@gmail.com> * fix(misconf): not to warn about missing selectors of libraries (aquasecurity#7638) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> * release: v0.56.0 [main] (aquasecurity#7447) * fix(db): fix javadb downloading error handling [backport: release/v0.56] (aquasecurity#7646) Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> Co-authored-by: Nikita Pivkin <nikita.pivkin@smartforce.io> * release: v0.56.1 [release/v0.56] (aquasecurity#7648) * fix(sbom): add options for DBs in private registries [backport: release/v0.56] (aquasecurity#7691) Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: Teppei Fukuda <knqyf263@gmail.com> * fix(redhat): include arch in PURL qualifiers [backport: release/v0.56] (aquasecurity#7702) Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: Teppei Fukuda <knqyf263@gmail.com> * release: v0.56.2 [release/v0.56] (aquasecurity#7694) * Make liveness probe configurable (#3) --------- Signed-off-by: yusuke.koyoshi <yusuke.koyoshi@bizreach.co.jp> Signed-off-by: knqyf263 <knqyf263@gmail.com> Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io> Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Kevin Conner <kev.conner@getupcloud.com> Signed-off-by: Bob Callaway <bcallaway@google.com> Signed-off-by: Marcus Meissner <meissner@suse.de> Co-authored-by: yusuke-koyoshi <92022336+yusuke-koyoshi@users.noreply.github.com> Co-authored-by: Teppei Fukuda <knqyf263@gmail.com> Co-authored-by: Aruneko <yuki.fujita@bizreach.co.jp> Co-authored-by: Colm O hEigeartaigh <coheigea@users.noreply.github.com> Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io> Co-authored-by: afdesk <work@afdesk.com> Co-authored-by: Nikita Pivkin <nikita.pivkin@smartforce.io> Co-authored-by: Alberto Donato <albertodonato@users.noreply.github.com> Co-authored-by: simar7 <1254783+simar7@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Itay Shakury <itay@itaysk.com> Co-authored-by: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com> Co-authored-by: aasish-r <aasishrampalli1997@gmail.com> Co-authored-by: Ori <59772293+orizerah@users.noreply.github.com> Co-authored-by: Kevin Conner <kev.conner@gmail.com> Co-authored-by: Bob Callaway <bobcallaway@users.noreply.github.com> Co-authored-by: vhash <29121316+LucasVanHaaren@users.noreply.github.com> Co-authored-by: psibre <psibre@users.noreply.github.com> Co-authored-by: Aqua Security automated builds <54269356+aqua-bot@users.noreply.github.com> Co-authored-by: s-reddy1498 <41355782+s-reddy1498@users.noreply.github.com> Co-authored-by: Squiddim <82903357+Squiddim@users.noreply.github.com> Co-authored-by: Pierre Baumard <pierre.baumard@cnav.fr> Co-authored-by: Lior Kaplan <lior@kaplanopensource.co.il> Co-authored-by: amf <amf@macbook.local> Co-authored-by: bloomadcariad <adam.bloom@cariad.us> Co-authored-by: Sylvain Baubeau <lebauce@gmail.com> Co-authored-by: Simar <simar@linux.com> Co-authored-by: Marcus Meissner <meissner@suse.de> Co-authored-by: Samuel Gaist <samuel.gaist@idiap.ch>

…security#7288) Signed-off-by: knqyf263 <knqyf263@gmail.com>

knqyf263 added 13 commits July 31, 2024 19:59

feat: add --detection-priority

b173d30

Signed-off-by: knqyf263 <knqyf263@gmail.com>

feat(dart): use minimum version only with coverage priority

6746c17

Signed-off-by: knqyf263 <knqyf263@gmail.com>

feat: not filter system files in post analysis

c0bee63

Signed-off-by: knqyf263 <knqyf263@gmail.com>

feat: deregister post handler for filtering system files

e97ff02

Signed-off-by: knqyf263 <knqyf263@gmail.com>

feat: consider detection priority for calculating cache key

b21a66d

Signed-off-by: knqyf263 <knqyf263@gmail.com>

test: delete unused arg

b985f50

Signed-off-by: knqyf263 <knqyf263@gmail.com>

test: rename flag

ff573bb

Signed-off-by: knqyf263 <knqyf263@gmail.com>

test(integration): add a case for coverage priority

6c9985c

Signed-off-by: knqyf263 <knqyf263@gmail.com>

docs: add --detection-priority

0fa8f52

Signed-off-by: knqyf263 <knqyf263@gmail.com>

feat: rename coverage to comprehensive

41a86ee

Signed-off-by: knqyf263 <knqyf263@gmail.com>

docs: auto-generate

aefe131

Signed-off-by: knqyf263 <knqyf263@gmail.com>

fix: omitempty

3e79c5c

Signed-off-by: knqyf263 <knqyf263@gmail.com>

fix: use disabled handlers

1626611

Signed-off-by: knqyf263 <knqyf263@gmail.com>

knqyf263 marked this pull request as ready for review August 1, 2024 09:23

knqyf263 requested a review from DmitriyLewen as a code owner August 1, 2024 09:23

DmitriyLewen reviewed Aug 2, 2024

View reviewed changes

docs/docs/scanner/vulnerability.md Show resolved Hide resolved

pkg/cache/key_test.go Outdated Show resolved Hide resolved

knqyf263 added 2 commits August 2, 2024 12:06

docs: add more details

67b80d3

Signed-off-by: knqyf263 <knqyf263@gmail.com>

test: calc cache key with detection priority

1ce2e4b

Signed-off-by: knqyf263 <knqyf263@gmail.com>

DmitriyLewen reviewed Aug 2, 2024

View reviewed changes

docs(conda): add a table

9e8cdb1

Signed-off-by: knqyf263 <knqyf263@gmail.com>

DmitriyLewen approved these changes Aug 2, 2024

View reviewed changes

knqyf263 added this pull request to the merge queue Aug 2, 2024

Merged via the queue into aquasecurity:main with commit fd8348d Aug 2, 2024
17 checks passed

knqyf263 deleted the feat/detection_priority branch August 2, 2024 11:02

aqua-bot mentioned this pull request Aug 2, 2024

release: v0.55.0 [main] #7271

Merged

knqyf263 mentioned this pull request Aug 7, 2024

feat: add third party flag for os packages #4109

Closed

10 tasks

fhielpos pushed a commit to giantswarm/trivy-upstream that referenced this pull request Dec 20, 2024

feat(vuln): Add --detection-priority flag for accuracy tuning (aqua…

648b68c

…security#7288) Signed-off-by: knqyf263 <knqyf263@gmail.com>

DmitriyLewen mentioned this pull request Jan 14, 2025

Add flag to scan OS package files as language packages #4257

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(vuln): Add `--detection-priority` flag for accuracy tuning #7288

feat(vuln): Add `--detection-priority` flag for accuracy tuning #7288

knqyf263 commented Aug 1, 2024 •

edited

Loading

DmitriyLewen left a comment

DmitriyLewen Aug 2, 2024

knqyf263 Aug 2, 2024

knqyf263 Aug 2, 2024

DmitriyLewen Aug 2, 2024

knqyf263 Aug 2, 2024

DmitriyLewen Aug 2, 2024

knqyf263 Aug 2, 2024

DmitriyLewen Aug 2, 2024

DmitriyLewen left a comment

feat(vuln): Add --detection-priority flag for accuracy tuning #7288

feat(vuln): Add --detection-priority flag for accuracy tuning #7288

Conversation

knqyf263 commented Aug 1, 2024 • edited Loading

Description

Red Hat UBI 8

--detection-priority precise

--detection-priority comprehensive

cgr.dev/chainguard/argocd

--detection-priority precise

--detection-priority comprehensive

Notes

Key changes

Implementation details

Terminology

Related issues

Related PRs

Checklist

DmitriyLewen left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DmitriyLewen left a comment

Choose a reason for hiding this comment

feat(vuln): Add `--detection-priority` flag for accuracy tuning #7288

feat(vuln): Add `--detection-priority` flag for accuracy tuning #7288

knqyf263 commented Aug 1, 2024 •

edited

Loading

`--detection-priority precise`

`--detection-priority comprehensive`

`--detection-priority precise`

`--detection-priority comprehensive`