Replies: 2 comments 3 replies
-
|
It seems that other ELF binaries cannot be scanned either. $ curl -sL https://github.com/future-architect/vuls/releases/download/v0.33.4/vuls_0.33.4_linux_amd64.tar.gz | tar zxf - vuls
$ ./trivy rootfs vuls
2025-09-05T16:55:45+09:00 INFO [vuln] Vulnerability scanning is enabled
2025-09-05T16:55:45+09:00 INFO [secret] Secret scanning is enabled
2025-09-05T16:55:45+09:00 INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-09-05T16:55:45+09:00 INFO [secret] Please see https://trivy.dev/v0.66/docs/scanner/secret#recommendation for faster secret detection
2025-09-05T16:55:45+09:00 INFO Number of language-specific files num=1
2025-09-05T16:55:45+09:00 INFO [gobinary] Detecting vulnerabilities...
2025-09-05T16:55:45+09:00 WARN Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/v0.66/docs/scanner/vulnerability#severity-selection for details.
Report Summary
┌────────┬──────────┬─────────────────┬─────────┐
│ Target │ Type │ Vulnerabilities │ Secrets │
├────────┼──────────┼─────────────────┼─────────┤
│ vuls │ gobinary │ 2 │ - │
└────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)
vuls (gobinary)
Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 1, CRITICAL: 0)
┌─────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├─────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼────────────────────────────────────────────────────────┤
│ github.com/ulikunitz/xz │ CVE-2025-58058 │ MEDIUM │ fixed │ v0.5.12 │ 0.5.15 │ github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks │
│ │ │ │ │ │ │ memory │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-58058 │
├─────────────────────────┼────────────────┼──────────┤ ├───────────────────┼─────────────────┼────────────────────────────────────────────────────────┤
│ stdlib │ CVE-2025-47907 │ HIGH │ │ v1.24.4 │ 1.23.12, 1.24.6 │ database/sql: Postgres Scan Race Condition │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-47907 │
└─────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴────────────────────────────────────────────────────────┘PS C:\Users\vagrant\Downloads> cmd.exe /c 'curl.exe -sL https://github.com/future-architect/vuls/releases/download/v0.33.4/vuls_0.33.4_linux_amd64.tar.gz | tar.exe zxf - vuls'
PS C:\Users\vagrant\Downloads> .\trivy.exe rootfs vuls
2025-09-05T01:04:39-07:00 INFO [vulndb] Need to update DB
2025-09-05T01:04:39-07:00 INFO [vulndb] Downloading vulnerability DB...
2025-09-05T01:04:39-07:00 INFO [vulndb] Downloading artifact... repo="mirror.gcr.io/aquasec/trivy-db:2"
69.97 MiB / 69.97 MiB [-----------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 4.76 MiB p/s 15s
2025-09-05T01:04:58-07:00 INFO [vulndb] Artifact successfully downloaded repo="mirror.gcr.io/aquasec/trivy-db:2"
2025-09-05T01:04:58-07:00 INFO [vuln] Vulnerability scanning is enabled
2025-09-05T01:04:58-07:00 INFO [secret] Secret scanning is enabled
2025-09-05T01:04:58-07:00 INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-09-05T01:04:58-07:00 INFO [secret] Please see https://trivy.dev/v0.66/docs/scanner/secret#recommendation for faster secret detection
2025-09-05T01:04:58-07:00 INFO Number of language-specific files num=0
2025-09-05T01:04:58-07:00 WARN [report] Supported files for scanner(s) not found. scanners=[vuln]
2025-09-05T01:04:58-07:00 INFO [report] No issues detected with scanner(s). scanners=[secret]
Report Summary
┌────────┬──────┬─────────────────┬─────────┐
│ Target │ Type │ Vulnerabilities │ Secrets │
├────────┼──────┼─────────────────┼─────────┤
│ - │ - │ - │ - │
└────────┴──────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected) |
Beta Was this translation helpful? Give feedback.
-
|
Hello @MaineK00n Trivy detects only trivy/pkg/fanal/utils/utils.go Lines 48 to 63 in a19e0aa IIUC mode.Perm()&0o111 != 0 doesn't work in windows.
It looks like we can use |
Beta Was this translation helpful? Give feedback.
-
|
How can we detect executable files? Analyzing all files could be expensive. |
Beta Was this translation helpful? Give feedback.
-
|
Yes, I’m also concerned about this. We already have many flags, but we could consider creating a flag to enable/disable costly scanning. Although we could start with opening a discussion about it. |
Beta Was this translation helpful? Give feedback.
-
|
I can’t think of any common use cases at the moment, so we can wait for feedback. As a workaround, even if it’s an ELF file, I believe it will be scanned if the extension is |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Description
While scanning trivy itself with trivy, I found that trivy.exe (Windows binary) fails to scan trivy (ELF binary).
I have confirmed that scanning trivy (ELF) works correctly when using either:
The issue only occurs when trivy.exe tries to scan trivy (ELF).
Desired Behavior
trivy.exe should be able to scan trivy (ELF).
Actual Behavior
trivy.exe fails to scan trivy (ELF).
Reproduction Steps
Linux
Windows
Target
Filesystem
Scanner
Vulnerability
Output Format
None
Mode
Standalone
Debug Output
Operating System
windows 11 24H2
Version
Checklist
trivy clean --allBeta Was this translation helpful? Give feedback.
All reactions