ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-08-19 09:30:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(security): migrate suppressions to .trivyignore.yaml (PROWLER-2327) (#12314)

Browse Source
This commit is contained in:
César Arroba
2026-08-04 11:13:16 +02:00
committed by GitHub
parent 94254555a4
commit 681be7537d
5 changed files with 77 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/actions/trivy-scan/action.yml
+4
View File
@@ -64,6 +64,8 @@ runs:
scanners: 'vuln'
timeout: '5m'
version: 'v0.71.2'
# Explicit: Trivy only auto-loads the classic .trivyignore, never the YAML one.
trivyignores: '.trivyignore.yaml'
- name: Run Trivy vulnerability scan (SARIF)
if: inputs.upload-sarif == 'true' && github.event_name == 'push'
@@ -77,6 +79,8 @@ runs:
scanners: 'vuln'
timeout: '5m'
version: 'v0.71.2'
# Explicit: Trivy only auto-loads the classic .trivyignore, never the YAML one.
trivyignores: '.trivyignore.yaml'
- name: Upload Trivy results to GitHub Security tab
if: inputs.upload-sarif == 'true' && github.event_name == 'push'
.trivyignore
-58
View File
@@ -1,58 +0,0 @@
# Trivy ignore file for the prowlercloud/prowler SDK and API container images.
# Each entry below documents (a) the affected package and why it ships in the
# image, (b) why the CVE is not exploitable in Prowler's runtime, and (c) the
# upstream fix status. Entries carry an expiry so they auto-force re-review.
# The `pkg:` selector on each line is documentation only. Trivy's classic
# .trivyignore format parses the CVE ID and ignores the rest, so each entry
# suppresses its CVE across every package in the image, not just the one named.
# Verified against Trivy 0.65.0: an entry written `pkg:zlib1g` still suppressed
# the finding on perl-base. Real per-package scoping needs .trivyignore.yaml
# with purls — tracked in PROWLER-2327.
# `exp:` IS honoured: an entry dated in the past correctly lapses.
#
# Keep expiries staggered, and only suppress packages the images actually install.
#
# Scanned by: .github/actions/trivy-scan via .github/workflows/sdk-container-checks.yml
# and .github/workflows/api-container-checks.yml
# perl-base is Debian "Essential: yes". Trivy spreads src:perl CVEs across every
# binary package, so perl-base gets flagged for modules only perl-modules-5.40 ships.
# Neither image installs perl-modules-5.40, and nothing in either invokes perl.
#
# Why these four cannot be fixed rather than accepted (reviewed 2026-07-31):
#
# 1. No fix exists. All four report no fixed version on perl-base 5.40.1-6.
# Debian's tracker marks CVE-2026-42496 "fix_deferred" and the other three
# "affected". Updating the base image, apt upgrade, or moving to a newer
# Debian release changes nothing, because Debian has not shipped a fix.
# 2. The package cannot be removed. "Essential: yes" means removal needs
# dpkg --force-remove-essential, which also breaks apt for anything built
# downstream from these images.
# 3. Changing base distribution was evaluated and rejected. Alpine removes
# perl entirely, but PowerShell publishes no linux-musl-arm64 build in any
# release, so M365 scanning would break on arm64 — which is what we run in
# production. Wolfi keeps glibc and drops perl, but pinnable versioned tags
# are a paid tier, so builds would not be reproducibly pinnable.
#
# Not-invoked claim verified by sweeping both images for: files with a perl
# shebang, shell/python callers of perl, ELF binaries containing "perl", and
# .pl/.pm files or perl subprocess calls anywhere in site-packages. The only
# consumers found are dpkg/debconf/adduser/pam tooling, none of which runs at
# runtime, plus one build-time script inside the ExchangeOnlineManagement
# PowerShell module that is never invoked (it generates that module's manifest,
# and lives in its netFramework/ path, while Linux loads netCore/).
# Archive::Tar path traversal. Not installed: `perl -MArchive::Tar -e1` cannot locate it.
CVE-2026-42496 pkg:perl-base exp:2027-01-31
# Storable integer overflow. Not installed: `perl -MStorable -e1` cannot locate it.
CVE-2026-57433 pkg:perl-base exp:2027-01-31
# Regex heap overflow on 32-bit builds only; both published arches are 64-bit.
CVE-2026-8376 pkg:perl-base exp:2027-01-31
# Regex trie bug giving silently wrong matches above 65535 alternation branches. Now on
# perl 5.40.1, which is in range (the 5.36-predates-it argument no longer applies), so this
# rests on nothing invoking perl. Short expiry to force a re-look.
# Ref: https://github.com/Perl/perl5/issues/23388
CVE-2026-13221 pkg:perl-base exp:2026-11-30
.trivyignore.yaml
+63
View File
@@ -0,0 +1,63 @@
# Trivy suppressions for the prowlercloud/prowler SDK and API container images.
#
# This file replaces the classic .trivyignore, which parsed only the CVE id: the
# `pkg:` selector written on each line was documentation and the entry suppressed
# its CVE across every package in the image. The `purls` field below is honoured,
# so each entry is scoped to the package it names. Verified against Trivy 0.71.2:
# an entry given the wrong purl leaves the finding reported, where the classic
# format suppressed it.
#
# `expired_at` forces re-review. Keep the dates staggered.
#
# perl-base is Debian "Essential: yes". Trivy spreads src:perl CVEs across every
# binary package built from that source, so perl-base is flagged for modules only
# perl-modules-* ships. Neither image installs those, and nothing in either
# invokes perl.
#
# Why these four are accepted rather than fixed (reviewed 2026-07-31):
#
# 1. No fix exists. All four report no fixed version on perl-base 5.40.1-6.
# Debian marks CVE-2026-42496 "fix_deferred" and the other three "affected".
# A newer base image, apt upgrade, or a newer Debian release changes nothing.
# 2. The package cannot be removed. "Essential: yes" means removal needs
# dpkg --force-remove-essential, which breaks apt for anything built
# downstream from these images.
# 3. Changing base distribution was evaluated and rejected. Alpine drops perl
# entirely, but PowerShell publishes no linux-musl-arm64 build in any
# release, so M365 scanning would break on arm64 -- which is what we run in
# production. Wolfi keeps glibc and drops perl, but pinnable versioned tags
# are a paid tier, so builds would not be reproducibly pinnable.
#
# Not-invoked claim verified by sweeping both images for files with a perl
# shebang, shell/python callers of perl, ELF binaries containing "perl", and
# .pl/.pm files or perl subprocess calls anywhere in site-packages. The only
# consumers found are dpkg/debconf/adduser/pam tooling, none of which runs at
# runtime, plus one build-time script inside the ExchangeOnlineManagement
# PowerShell module that is never invoked.
vulnerabilities:
# Archive::Tar path traversal. Not installed: `perl -MArchive::Tar -e1` cannot locate it.
- id: CVE-2026-42496
purls:
- "pkg:deb/debian/perl-base"
expired_at: 2027-01-31
# Storable integer overflow. Not installed: `perl -MStorable -e1` cannot locate it.
- id: CVE-2026-57433
purls:
- "pkg:deb/debian/perl-base"
expired_at: 2027-01-31
# Regex heap overflow on 32-bit builds only; both published arches are 64-bit.
- id: CVE-2026-8376
purls:
- "pkg:deb/debian/perl-base"
expired_at: 2027-01-31
# Regex trie bug giving silently wrong matches above 65535 alternation branches.
# perl 5.40.1 is in range, so this rests on nothing invoking perl. Short expiry
# to force a re-look. Ref: https://github.com/Perl/perl5/issues/23388
- id: CVE-2026-13221
purls:
- "pkg:deb/debian/perl-base"
expired_at: 2026-11-30
docs/security/software-security.mdx
+9 -3
View File
@@ -181,7 +181,7 @@ Container images get scanned twice: once in CI before they push to a registry, a
### Pre-Publish (CI)
- **Trivy** scans for OS-package and application-dependency vulnerabilities. Runs on every pull request and push that touches an image or its dependencies. Trivy uploads SARIF to the GitHub Security tab and posts a summary on the PR. Builds fail on any critical finding that is not explicitly accepted. Accepted findings live in [`.trivyignore`](https://github.com/prowler-cloud/prowler/blob/master/.trivyignore), each carrying a reason and an expiry date, the same policy `osv-scanner.toml` follows. A local `trivy image` run applies the same suppressions whenever it is launched from a directory containing `.trivyignore`, which Trivy loads automatically. To see the unsuppressed set, run it from elsewhere or point `--ignorefile` at an empty file.
- **Trivy** scans for OS-package and application-dependency vulnerabilities. Runs on every pull request and push that touches an image or its dependencies. Trivy uploads SARIF to the GitHub Security tab and posts a summary on the PR. Builds fail on any critical finding that is not explicitly accepted. Accepted findings live in [`.trivyignore.yaml`](https://github.com/prowler-cloud/prowler/blob/master/.trivyignore.yaml), each carrying a reason and an expiry date, the same policy `osv-scanner.toml` follows. A local `trivy image` run does not apply these suppressions unless you pass `--ignorefile .trivyignore.yaml`: Trivy auto-loads only the classic `.trivyignore` format, never the YAML one.
- **Hadolint** validates Dockerfile syntax and structure against secure-build best practices. Runs in pre-commit and alongside the image scans above.
### Post-Publish (Registries)
@@ -194,14 +194,20 @@ Container images get scanned twice: once in CI before they push to a registry, a
A small number of findings remain in the published images and cannot be resolved by Prowler: the upstream project has released no fix, the package cannot be removed without breaking the image, or the finding comes from a vendored SBOM rather than from a package that is actually installed. Alternative base distributions have been evaluated and none currently satisfies both the vulnerability profile and the runtime requirements of every supported provider.
Each suppression is recorded in [`.trivyignore`](https://github.com/prowler-cloud/prowler/blob/master/.trivyignore) with the reason it cannot be fixed, why it is not exploitable in Prowler's runtime, and an expiry date that forces re-review. Nothing is suppressed without that rationale, and a build fails on any critical finding that is not listed there.
Each suppression is recorded in [`.trivyignore.yaml`](https://github.com/prowler-cloud/prowler/blob/master/.trivyignore.yaml) with the reason it cannot be fixed, why it is not exploitable in Prowler's runtime, and an expiry date that forces re-review. Nothing is suppressed without that rationale, and a build fails on any critical finding that is not listed there.
To see the current set for any image, scan it directly:
To see the current set for any image, scan it directly. This reports everything, including the accepted findings above, because Trivy does not read `.trivyignore.yaml` unless it is named:
```bash
trivy image prowlercloud/prowler:latest
```
To see only what is *not* already accepted, point Trivy at the suppression file:
```bash
trivy image --ignorefile .trivyignore.yaml prowlercloud/prowler:latest
```
## Secrets Detection
- **[TruffleHog](https://github.com/trufflesecurity/trufflehog)** scans the codebase and git history on every push and pull request. Detects high-entropy strings, API keys, tokens, and credentials, and reports verified and unknown findings.
prowler/changelog.d/trivyignore-yaml-migration.changed.md
+1
View File
@@ -0,0 +1 @@
Moved the Trivy suppressions from the classic `.trivyignore` to `.trivyignore.yaml`, so each entry is scoped to the package it names instead of suppressing its CVE across the whole image