Replies: 2 comments 11 replies
-
|
Hello @fmulero You are right. Trivy creates duplicate packages:
Problem with SPDX file, more precisely with This component doesn't have info about After that Trivy thinks that these are 2 different targets (different filepaths). Unfortunately, SPDX format does not have regulations for such cases - we cannot handle all possible cases. hi @juan131! sorry for the ping. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks @DmitriyLewen for the explanation. I am trying to understand where is the problem, but I don't see it clearly. With simpler image with a gobinary we see the following: $ trivy image bitnami/harbor-exporter:2.13.0 --table-mode summary
2025-05-27T18:11:26+02:00 INFO [vuln] Vulnerability scanning is enabled
2025-05-27T18:11:26+02:00 INFO [secret] Secret scanning is enabled
2025-05-27T18:11:26+02:00 INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-05-27T18:11:26+02:00 INFO [secret] Please see also https://trivy.dev/v0.62/docs/scanner/secret#recommendation for faster secret detection
2025-05-27T18:11:28+02:00 INFO Detected OS family="debian" version="12.11"
2025-05-27T18:11:28+02:00 INFO [debian] Detecting vulnerabilities... os_version="12" pkg_num=116
2025-05-27T18:11:28+02:00 INFO Number of language-specific files num=3
2025-05-27T18:11:28+02:00 INFO [bitnami] Detecting vulnerabilities...
2025-05-27T18:11:28+02:00 INFO [gobinary] Detecting vulnerabilities...
2025-05-27T18:11:28+02:00 WARN Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/v0.62/docs/scanner/vulnerability#severity-selection for details.
Report Summary
┌────────────────────────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│ Target │ Type │ Vulnerabilities │ Secrets │
├────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ bitnami/harbor-exporter:2.13.0 (debian 12.11) │ debian │ 110 │ - │
├────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ opt/bitnami/harbor-exporter │ bitnami │ 0 │ - │
├────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ opt/bitnami/harbor-exporter/.spdx-harbor-exporter.spdx │ gobinary │ 3 │ - │
├────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ opt/bitnami/harbor-exporter/bin/harbor_exporter │ gobinary │ 3 │ - │
└────────────────────────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)
Other weird example, in this case without gobinaries, is this one: $ trivy image bitnami/cassandra-exporter --table-mode summary
2025-05-27T18:37:10+02:00 INFO [vuln] Vulnerability scanning is enabled
2025-05-27T18:37:10+02:00 INFO [secret] Secret scanning is enabled
2025-05-27T18:37:10+02:00 INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-05-27T18:37:10+02:00 INFO [secret] Please see also https://trivy.dev/v0.62/docs/scanner/secret#recommendation for faster secret detection
2025-05-27T18:37:12+02:00 INFO Detected OS family="debian" version="12.11"
2025-05-27T18:37:12+02:00 INFO [debian] Detecting vulnerabilities... os_version="12" pkg_num=116
2025-05-27T18:37:12+02:00 INFO Number of language-specific files num=3
2025-05-27T18:37:12+02:00 INFO [bitnami] Detecting vulnerabilities...
2025-05-27T18:37:12+02:00 INFO [jar] Detecting vulnerabilities...
2025-05-27T18:37:12+02:00 WARN Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/v0.62/docs/scanner/vulnerability#severity-selection for details.
Report Summary
┌───────────────────────────────────────────────────────┬─────────┬─────────────────┬─────────┐
│ Target │ Type │ Vulnerabilities │ Secrets │
├───────────────────────────────────────────────────────┼─────────┼─────────────────┼─────────┤
│ bitnami/cassandra-exporter (debian 12.11) │ debian │ 110 │ - │
├───────────────────────────────────────────────────────┼─────────┼─────────────────┼─────────┤
│ opt/bitnami/cassandra-exporter/cassandra_exporter.jar │ jar │ 12 │ - │
├───────────────────────────────────────────────────────┼─────────┼─────────────────┼─────────┤
│ opt/bitnami/cassandra-exporter │ bitnami │ 0 │ - │
├───────────────────────────────────────────────────────┼─────────┼─────────────────┼─────────┤
│ opt/bitnami/java │ bitnami │ 0 │ - │
└───────────────────────────────────────────────────────┴─────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)All the affected libraries in |
Beta Was this translation helpful? Give feedback.
-
|
Sorry, I think I messed up. I am going back to the beginning.
Why did I say twice? Because if we analyse other containers like $ trivy image bitnami/cassandra-exporter:2.3.8-debian-12-r48 -q --pkg-types library --table-mode summary
Report Summary
┌───────────────────────────────────────────────────────┬─────────┬─────────────────┬─────────┐
│ Target │ Type │ Vulnerabilities │ Secrets │
├───────────────────────────────────────────────────────┼─────────┼─────────────────┼─────────┤
│ opt/bitnami/cassandra-exporter/cassandra_exporter.jar │ jar │ 12 │ - │
├───────────────────────────────────────────────────────┼─────────┼─────────────────┼─────────┤
│ opt/bitnami/cassandra-exporter │ bitnami │ 0 │ - │
├───────────────────────────────────────────────────────┼─────────┼─────────────────┼─────────┤
│ opt/bitnami/java │ bitnami │ 0 │ - │
└───────────────────────────────────────────────────────┴─────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)If we analyse only the SPDX file from the container we can see exactly the same CVEs reported for jar file: $ docker create --name cass bitnami/cassandra-exporter:2.3.8-debian-12-r48
7253acc96a65b5f6568f2078f0c5429452e26834e0934d96bf9065687cadaa90
$ docker cp cass:/opt/bitnami/cassandra-exporter/.spdx-cassandra-exporter.spdx /tmp/spdx-cassandra-exporter.spdx
Successfully copied 28.2kB to /tmp/spdx-cassandra-exporter.spdx
$ trivy sbom /tmp/spdx-cassandra-exporter.spdx -q --pkg-types library --table-mode summary
Report Summary
┌────────────────────────┬─────────┬─────────────────┐
│ Target │ Type │ Vulnerabilities │
├────────────────────────┼─────────┼─────────────────┤
│ │ bitnami │ 0 │
├────────────────────────┼─────────┼─────────────────┤
│ cassandra_exporter.jar │ jar │ 12 │
└────────────────────────┴─────────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)I assume that's the correct behavior but please amend me if I am wrong. In the case of containers with gobinaries, we are facing the problem exposed: $ trivy image bitnami/harbor-exporter:2.13.0 -q --pkg-types library --table-mode summary
Report Summary
┌────────────────────────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│ Target │ Type │ Vulnerabilities │ Secrets │
├────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ opt/bitnami/harbor-exporter │ bitnami │ 0 │ - │
├────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ opt/bitnami/harbor-exporter/.spdx-harbor-exporter.spdx │ gobinary │ 3 │ - │
├────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ opt/bitnami/harbor-exporter/bin/harbor_exporter │ gobinary │ 3 │ - │Said that, it seems the problem is in both sides: The Bitnami SPDX file is not correct and there are some issues in Trivy. From Btinami side, I'll try to analyse what changes we can do and I'll back to you. |
Beta Was this translation helpful? Give feedback.
-
|
@fmulero Thanks for the |
Beta Was this translation helpful? Give feedback.
-
|
I was playing a little building the SPDX with trivy directly and it works fine thanks to the annotations, there is no file element pointing to the gobinary and related to the application package: {
"name": "opt/bitnami/harbor-exporter/bin/harbor_exporter",
"SPDXID": "SPDXRef-Application-2a5527f1cdd2ada4",
"downloadLocation": "NONE",
"filesAnalyzed": false,
"primaryPackagePurpose": "APPLICATION",
"annotations": [
{
"annotator": "Tool: trivy-0.62.1",
"annotationDate": "2025-06-05T09:47:42Z",
"annotationType": "OTHER",
"comment": "Class: lang-pkgs"
},
{
"annotator": "Tool: trivy-0.62.1",
"annotationDate": "2025-06-05T09:47:42Z",
"annotationType": "OTHER",
"comment": "Type: gobinary"
}
]
},If we add the annotation with the comment ...
{
"name": "opt/bitnami/harbor-exporter/bin/harbor_exporter",
"SPDXID": "SPDXRef-Application-c958679d1b6f5088-harbor-exporter",
"downloadLocation": "NONE",
"filesAnalyzed": false,
"primaryPackagePurpose": "APPLICATION",
"copyrightText": "NOASSERTION",
"licenseConcluded": "NOASSERTION",
"licenseDeclared": "NOASSERTION",
"annotations": [
{
"annotator": "Person: Fran Mulero",
"annotationDate": "2025-06-05T09:47:42Z",
"annotationType": "OTHER",
"comment": "Type: gobinary"
}
]
},
...
Everything works fine:
```console
$ trivy image -q --pkg-types library bitnami/harbor-exporter:framu
Report Summary
┌─────────────────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│ Target │ Type │ Vulnerabilities │ Secrets │
├─────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ opt/bitnami/harbor-exporter │ bitnami │ 0 │ - │
├─────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ opt/bitnami/harbor-exporter/bin/harbor_exporter │ gobinary │ 3 │ - │
└─────────────────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)
opt/bitnami/harbor-exporter/bin/harbor_exporter (gobinary)
Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 0, CRITICAL: 0)
┌────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net (harbor-exporter) │ CVE-2025-22872 │ MEDIUM │ fixed │ v0.37.0 │ 0.38.0 │ golang.org/x/net/html: Incorrect Neutralization of Input │
│ │ │ │ │ │ │ During Web Page Generation in x/net in... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-22872 │
├────────────────────────────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ helm.sh/helm/v3 (harbor-exporter) │ CVE-2025-32386 │ │ │ v3.17.2 │ 3.17.3 │ helm.sh/helm/v3: Helm Allows A Specially Crafted Chart │
│ │ │ │ │ │ │ Archive To Cause Out Of... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-32386 │
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2025-32387 │ │ │ │ │ helm.sh/helm/v3: Helm Allows A Specially Crafted JSON Schema │
│ │ │ │ │ │ │ To Cause A Stack... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-32387 │
└────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘So it seems the file element and the relationships are not really needed. |
Beta Was this translation helpful? Give feedback.
-
|
I apologize. But as you correctly noted - SPDX doesn't need Trivy prefix. |
Beta Was this translation helpful? Give feedback.
-
|
Hello @fmulero
Is there any news about these changes? We got similar issue from user for |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Description
Bitnami member here. In bitnami images with gobinaries we can see the spdx analyzed as gobinary file and the the CVEs are reported twice. Not sure if there is any kind of error in the bitnami sbom file, the issue only happens if the image has gobinaries.
Desired Behavior
CVEs over the same binary file are reported just once.
Actual Behavior
In the json report we can see thinks like this:
In the sbom file
opt/bitnami/common/.spdx-wait-for-port.spdxwe can see this:Reproduction Steps
Target
Container Image
Scanner
Vulnerability
Output Format
None
Mode
None
Debug Output
Operating System
macOS Sonoma
Version
Checklist
trivy clean --allBeta Was this translation helpful? Give feedback.
All reactions