v0.18.0

[aqua-bot]

🚀 What's new? 🚀

Support go.sum 🌞

Trivy looks for all go.sum files on container images, filesystems, and git repositories to detect vulnerabilities.

$ trivy fs ./github.com/aquasecurity/trivy
...

go.sum
======
Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 1, CRITICAL: 0)

+-----------------------------+------------------+----------+--------------------+--------------------------------+-----------------------------------------+
|           LIBRARY           | VULNERABILITY ID | SEVERITY | INSTALLED VERSION  |         FIXED VERSION          |                  TITLE                  |
+-----------------------------+------------------+----------+--------------------+--------------------------------+-----------------------------------------+
| github.com/dgrijalva/jwt-go | CVE-2020-26160   | HIGH     | 3.2.0+incompatible |                                | jwt-go: access restriction              |
|                             |                  |          |                    |                                | bypass vulnerability                    |
|                             |                  |          |                    |                                | -->avd.aquasec.com/nvd/cve-2020-26160   |
+-----------------------------+------------------+----------+--------------------+--------------------------------+-----------------------------------------+
| k8s.io/client-go            | CVE-2019-11250   | MEDIUM   | 0.19.0             | 1.15.4, 1.16.1-beta.0          | kubernetes: Bearer tokens               |
|                             |                  |          |                    |                                | written to logs at high                 |
|                             |                  |          |                    |                                | verbosity levels (>= 7)...              |
|                             |                  |          |                    |                                | -->avd.aquasec.com/nvd/cve-2019-11250   |
+-----------------------------+------------------+          +--------------------+--------------------------------+-----------------------------------------+
| k8s.io/kubernetes           | CVE-2019-1002101 |          | 1.13.0             | 1.11.9, 1.12.7, 1.13.5,        | kubernetes: Mishandling of              |
|                             |                  |          |                    | 1.14.1-beta.0                  | symlinks allows for arbitrary           |
|                             |                  |          |                    |                                | file write via `kubectl cp`...          |
|                             |                  |          |                    |                                | -->avd.aquasec.com/nvd/cve-2019-1002101 |
+-----------------------------+------------------+----------+--------------------+--------------------------------+-----------------------------------------+

🐞 Bug fixes 🐛

Unique vulnerabilities from different data sources (#984)

Changelog

https://github.com/aquasecurity/trivy/releases/tag/v0.18.0

Docker images

• docker pull aquasec/trivy:0.18.0
• docker pull ghcr.io/aquasecurity/trivy:0.18.0
• docker pull public.ecr.aws/aquasecurity/trivy:0.18.0
• docker pull aquasec/trivy:latest
• docker pull ghcr.io/aquasecurity/trivy:latest
• docker pull public.ecr.aws/aquasecurity/trivy:latest

---

This discussion was created from the release v0.18.0.