Replies: 2 comments 11 replies
-
|
Hello @fmulero You are right. Trivy creates duplicate packages:
Problem with SPDX file, more precisely with This component doesn't have info about After that Trivy thinks that these are 2 different targets (different filepaths). Unfortunately, SPDX format does not have regulations for such cases - we cannot handle all possible cases. hi @juan131! sorry for the ping. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks @DmitriyLewen for the explanation. I am trying to understand where is the problem, but I don't see it clearly. With simpler image with a gobinary we see the following: $ trivy image bitnami/harbor-exporter:2.13.0 --table-mode summary
2025-05-27T18:11:26+02:00 INFO [vuln] Vulnerability scanning is enabled
2025-05-27T18:11:26+02:00 INFO [secret] Secret scanning is enabled
2025-05-27T18:11:26+02:00 INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-05-27T18:11:26+02:00 INFO [secret] Please see also https://trivy.dev/v0.62/docs/scanner/secret#recommendation for faster secret detection
2025-05-27T18:11:28+02:00 INFO Detected OS family="debian" version="12.11"
2025-05-27T18:11:28+02:00 INFO [debian] Detecting vulnerabilities... os_version="12" pkg_num=116
2025-05-27T18:11:28+02:00 INFO Number of language-specific files num=3
2025-05-27T18:11:28+02:00 INFO [bitnami] Detecting vulnerabilities...
2025-05-27T18:11:28+02:00 INFO [gobinary] Detecting vulnerabilities...
2025-05-27T18:11:28+02:00 WARN Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/v0.62/docs/scanner/vulnerability#severity-selection for details.
Report Summary
┌────────────────────────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│ Target │ Type │ Vulnerabilities │ Secrets │
├────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ bitnami/harbor-exporter:2.13.0 (debian 12.11) │ debian │ 110 │ - │
├────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ opt/bitnami/harbor-exporter │ bitnami │ 0 │ - │
├────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ opt/bitnami/harbor-exporter/.spdx-harbor-exporter.spdx │ gobinary │ 3 │ - │
├────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ opt/bitnami/harbor-exporter/bin/harbor_exporter │ gobinary │ 3 │ - │
└────────────────────────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)
Other weird example, in this case without gobinaries, is this one: $ trivy image bitnami/cassandra-exporter --table-mode summary
2025-05-27T18:37:10+02:00 INFO [vuln] Vulnerability scanning is enabled
2025-05-27T18:37:10+02:00 INFO [secret] Secret scanning is enabled
2025-05-27T18:37:10+02:00 INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-05-27T18:37:10+02:00 INFO [secret] Please see also https://trivy.dev/v0.62/docs/scanner/secret#recommendation for faster secret detection
2025-05-27T18:37:12+02:00 INFO Detected OS family="debian" version="12.11"
2025-05-27T18:37:12+02:00 INFO [debian] Detecting vulnerabilities... os_version="12" pkg_num=116
2025-05-27T18:37:12+02:00 INFO Number of language-specific files num=3
2025-05-27T18:37:12+02:00 INFO [bitnami] Detecting vulnerabilities...
2025-05-27T18:37:12+02:00 INFO [jar] Detecting vulnerabilities...
2025-05-27T18:37:12+02:00 WARN Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/v0.62/docs/scanner/vulnerability#severity-selection for details.
Report Summary
┌───────────────────────────────────────────────────────┬─────────┬─────────────────┬─────────┐
│ Target │ Type │ Vulnerabilities │ Secrets │
├───────────────────────────────────────────────────────┼─────────┼─────────────────┼─────────┤
│ bitnami/cassandra-exporter (debian 12.11) │ debian │ 110 │ - │
├───────────────────────────────────────────────────────┼─────────┼─────────────────┼─────────┤
│ opt/bitnami/cassandra-exporter/cassandra_exporter.jar │ jar │ 12 │ - │
├───────────────────────────────────────────────────────┼─────────┼─────────────────┼─────────┤
│ opt/bitnami/cassandra-exporter │ bitnami │ 0 │ - │
├───────────────────────────────────────────────────────┼─────────┼─────────────────┼─────────┤
│ opt/bitnami/java │ bitnami │ 0 │ - │
└───────────────────────────────────────────────────────┴─────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)All the affected libraries in |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Description
Bitnami member here. In bitnami images with gobinaries we can see the spdx analyzed as gobinary file and the the CVEs are reported twice. Not sure if there is any kind of error in the bitnami sbom file, the issue only happens if the image has gobinaries.
Desired Behavior
CVEs over the same binary file are reported just once.
Actual Behavior
In the json report we can see thinks like this:
In the sbom file
opt/bitnami/common/.spdx-wait-for-port.spdxwe can see this:Reproduction Steps
Target
Container Image
Scanner
Vulnerability
Output Format
None
Mode
None
Debug Output
Operating System
macOS Sonoma
Version
Checklist
trivy clean --allBeta Was this translation helpful? Give feedback.
All reactions