mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-10-19 18:04:17 +00:00
fix(container): bump Trivy to 0.76.0 in SDK and API images (#13064)
This commit is contained in:
Pedro Martín authored and GitHub committed
1 parent
f5aaec21cc
commit
de4db487d5
6 files changed
+8
-170
No files matched your search
-113
@@ -7,119 +7,6 @@
|
||||
|
||||
ignore:
|
||||
|
||||
# Modules compiled into the Trivy binary we ship.
|
||||
# Only a Trivy rebuild by its vendor can change these; the version is pinned in our Dockerfile.
|
||||
# CVE-2026-71556 is the same temporary exception documented in .trivyignore.yaml:
|
||||
# Trivy 0.73.0 still embeds go-git 5.19.1, while the 5.19.2 fix is merged only on
|
||||
# Trivy main. Remove this entry with the Trivy exception by 2026-09-15.
|
||||
# https://github.com/aquasecurity/trivy/blob/v0.73.0/go.mod#L46
|
||||
# https://github.com/aquasecurity/trivy/commit/a2edba9a03987ba0d2ebc8212c1a9a1e6979497b
|
||||
- vulnerability: CVE-2026-71556
|
||||
package:
|
||||
name: github.com/go-git/go-git/v5
|
||||
# CVE-2026-84304 is the same temporary exception documented in .trivyignore.yaml:
|
||||
# Trivy 0.74.0 still embeds grpc 1.82.1, while the 1.83.1 fix is not in any release.
|
||||
# Prowler only runs `trivy image` / `trivy fs`, never client/server mode, so no gRPC
|
||||
# endpoint exists in the image. Pinned to the embedded version so the rule stops
|
||||
# matching on its own once Trivy bumps grpc. Remove with the Trivy exception by 2026-10-15.
|
||||
# https://github.com/aquasecurity/trivy/pull/11176
|
||||
- vulnerability: CVE-2026-84304
|
||||
package:
|
||||
name: google.golang.org/grpc
|
||||
version: v1.82.1
|
||||
# CVE-2026-84445 is the same temporary exception documented in .trivyignore.yaml:
|
||||
# Trivy 0.74.0 still embeds grpc 1.82.1, while the 1.82.2 / 1.83.2 fix is not in any
|
||||
# release. The panic needs a gRPC server built with `xds.NewGRPCServer()`; Prowler only
|
||||
# runs `trivy image` / `trivy fs`, so the image serves no gRPC at all. Pinned to the
|
||||
# embedded version so the rule stops matching on its own once Trivy bumps grpc. Remove
|
||||
# with the Trivy exception by 2026-10-15.
|
||||
# https://github.com/advisories/GHSA-2v4p-qf9q-27wj
|
||||
- vulnerability: CVE-2026-84445
|
||||
package:
|
||||
name: google.golang.org/grpc
|
||||
version: v1.82.1
|
||||
# CVE-2026-56855 / CVE-2026-78662 are the same temporary exception documented in
|
||||
# .trivyignore.yaml: Trivy 0.74.0 still embeds golang.org/x/crypto v0.55.0, while the
|
||||
# 0.56.0 fix (published 2026-09-02) hasn't reached any Trivy release, or even Trivy
|
||||
# main, yet. Pinned to the embedded version so the rule stops matching on its own once
|
||||
# Trivy bumps it. Remove with the Trivy exception by 2026-10-15.
|
||||
- vulnerability: CVE-2026-56855
|
||||
package:
|
||||
name: golang.org/x/crypto
|
||||
version: v0.55.0
|
||||
- vulnerability: CVE-2026-78662
|
||||
package:
|
||||
name: golang.org/x/crypto
|
||||
version: v0.55.0
|
||||
# Go 1.27.1 and golang.org/x/net v0.59.0 in Trivy 0.75.0, the latest release. Fixed in
|
||||
# Go 1.27.2 and x/net 0.60.0, which only Trivy main has. Almost every entry is an HTTP,
|
||||
# HTTP/2 or TLS server path (or Windows-only), and Trivy runs here only as a client. The
|
||||
# two client-side ones are a DoS from a hostile HTTP/2 peer (CVE-2026-78669) and an
|
||||
# unframed CONNECT body sent through a proxy (CVE-2026-56866); Trivy's only peer is the
|
||||
# TLS-authenticated database registry and it never sends CONNECT with a body. Pinned to
|
||||
# the embedded versions. Remove with the Trivy exception by 2026-11-15.
|
||||
- vulnerability: CVE-2026-56857
|
||||
package:
|
||||
name: stdlib
|
||||
version: go1.27.1
|
||||
- vulnerability: CVE-2026-56866
|
||||
package:
|
||||
name: stdlib
|
||||
version: go1.27.1
|
||||
- vulnerability: CVE-2026-78659
|
||||
package:
|
||||
name: stdlib
|
||||
version: go1.27.1
|
||||
- vulnerability: CVE-2026-78660
|
||||
package:
|
||||
name: stdlib
|
||||
version: go1.27.1
|
||||
- vulnerability: CVE-2026-78663
|
||||
package:
|
||||
name: stdlib
|
||||
version: go1.27.1
|
||||
- vulnerability: CVE-2026-78669
|
||||
package:
|
||||
name: stdlib
|
||||
version: go1.27.1
|
||||
- vulnerability: CVE-2026-94439
|
||||
package:
|
||||
name: stdlib
|
||||
version: go1.27.1
|
||||
- vulnerability: CVE-2026-94440
|
||||
package:
|
||||
name: stdlib
|
||||
version: go1.27.1
|
||||
- vulnerability: CVE-2026-97031
|
||||
package:
|
||||
name: stdlib
|
||||
version: go1.27.1
|
||||
- vulnerability: CVE-2026-78659
|
||||
package:
|
||||
name: golang.org/x/net
|
||||
version: v0.59.0
|
||||
- vulnerability: CVE-2026-78660
|
||||
package:
|
||||
name: golang.org/x/net
|
||||
version: v0.59.0
|
||||
- vulnerability: CVE-2026-78663
|
||||
package:
|
||||
name: golang.org/x/net
|
||||
version: v0.59.0
|
||||
- vulnerability: CVE-2026-78669
|
||||
package:
|
||||
name: golang.org/x/net
|
||||
version: v0.59.0
|
||||
- vulnerability: CVE-2026-56852
|
||||
package:
|
||||
name: golang.org/x/text
|
||||
- vulnerability: GHSA-hrxh-6v49-42gf
|
||||
package:
|
||||
name: google.golang.org/grpc
|
||||
- vulnerability: CVE-2026-50151
|
||||
package:
|
||||
name: oras.land/oras-go/v2
|
||||
|
||||
# Shipped inside the PowerShell tarball, in its bundled MicrosoftTeams module.
|
||||
# Not a dependency we declare, and not one we can upgrade independently.
|
||||
- vulnerability: CVE-2026-26127
|
||||
|
||||
@@ -198,40 +198,6 @@ vulnerabilities:
|
||||
- "pkg:npm/%40modelcontextprotocol%2Fsdk@1.27.1"
|
||||
expired_at: 2027-01-31
|
||||
|
||||
# CVE-2026-78667 and CVE-2026-97031 are DoS bugs in the Go standard library: net/http
|
||||
# burns CPU parsing a Range header with a large number of small ranges in FileServer,
|
||||
# ServeContent and ServeFile, and crypto/tls lets a client exhaust server memory with
|
||||
# multiple ECH outer extension references. Both are server-side code paths. Fixed in
|
||||
# Go 1.26.9 and 1.27.2 (released 2026-10-08). Trivy 0.75.0, the latest published
|
||||
# release and the version the images ship, is built with go1.27.1, and Trivy main
|
||||
# still declares `go 1.27.0`:
|
||||
# https://github.com/aquasecurity/trivy/blob/v0.75.0/go.mod
|
||||
# Prowler invokes Trivy exclusively as `trivy fs` and `trivy image` on a local path,
|
||||
# never `trivy server`, so no HTTP or TLS listener ever exists in the image; its only
|
||||
# TLS use is as a client pulling the vulnerability database. The purl is pinned to the
|
||||
# stdlib version so the entry retires itself on the next Trivy bump. Remove this
|
||||
# temporary suppression as soon as a Trivy release is built with Go >= 1.27.2.
|
||||
- id: CVE-2026-78667
|
||||
purls:
|
||||
- "pkg:golang/stdlib@v1.27.1"
|
||||
expired_at: 2026-11-15
|
||||
- id: CVE-2026-97031
|
||||
purls:
|
||||
- "pkg:golang/stdlib@v1.27.1"
|
||||
expired_at: 2026-11-15
|
||||
|
||||
# CVE-2026-78669 is an HTTP/2 DoS in the same Trivy 0.75.0 binary (stdlib 1.27.1 and
|
||||
# golang.org/x/net 0.59.0): a malicious peer burns CPU with many small SETTINGS frames.
|
||||
# Unlike the two above it also hits clients, but Trivy's only HTTP/2 peer here is the
|
||||
# TLS-authenticated registry serving the vulnerability database, and the worst case is
|
||||
# a slow scan. Fixed in Go 1.27.2 and x/net 0.60.0, which Trivy main already pulls in
|
||||
# but no release ships yet. Same retirement rule as above.
|
||||
- id: CVE-2026-78669
|
||||
purls:
|
||||
- "pkg:golang/stdlib@v1.27.1"
|
||||
- "pkg:golang/golang.org/x/net@v0.59.0"
|
||||
expired_at: 2026-11-15
|
||||
|
||||
# Unlike the manifest entries above, this DLL ships in the image:
|
||||
# ExchangeOnlineManagement/3.10.1/netCore/System.Security.Cryptography.Pkcs.dll. It is a
|
||||
# DoS in CMS/PKCS parsing; Prowler only feeds it the tenant's own certificate. 3.10.1 is
|
||||
@@ -241,20 +207,3 @@ vulnerabilities:
|
||||
purls:
|
||||
- "pkg:nuget/System.Security.Cryptography.Pkcs@10.0.0"
|
||||
expired_at: 2026-12-15
|
||||
|
||||
- id: CVE-2026-56852
|
||||
purls:
|
||||
- "pkg:golang/golang.org/x/text"
|
||||
expired_at: 2026-12-31
|
||||
- id: GHSA-hrxh-6v49-42gf
|
||||
purls:
|
||||
- "pkg:golang/google.golang.org/grpc"
|
||||
expired_at: 2026-12-31
|
||||
- id: CVE-2026-50151
|
||||
purls:
|
||||
- "pkg:golang/oras.land/oras-go/v2"
|
||||
expired_at: 2026-12-31
|
||||
- id: CVE-2026-50163
|
||||
purls:
|
||||
- "pkg:golang/oras.land/oras-go/v2"
|
||||
expired_at: 2026-12-31
|
||||
+3
-3
@@ -8,15 +8,15 @@ ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
|
||||
# Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
|
||||
ENV POWERSHELL_TELEMETRY_OPTOUT=1
|
||||
|
||||
ARG TRIVY_VERSION=0.75.0
|
||||
ARG TRIVY_VERSION=0.76.0
|
||||
ENV TRIVY_VERSION=${TRIVY_VERSION}
|
||||
|
||||
ARG ZIZMOR_VERSION=1.24.1
|
||||
ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}
|
||||
|
||||
# Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
|
||||
ARG TRIVY_SHA256_AMD64=c6e65abddb348e25f10549df887045629cf28cc72453cd1c63acb717316b3f3f
|
||||
ARG TRIVY_SHA256_ARM64=a1ee9f6ffb7d112b64ff726a2a0717c21175c1114361391f4a132956751a13b3
|
||||
ARG TRIVY_SHA256_AMD64=e24b1c51293c1b15e4ba8d45bbc7891ba053f90278ec2698f3562c993e145fe7
|
||||
ARG TRIVY_SHA256_ARM64=aab21e677a7b7071fc79f1711480840754c18a1b9d9cefa7ccd06af63a0e8f4c
|
||||
ARG POWERSHELL_SHA256_AMD64=db85ae1f45005ffd20e456890585167257151fa99406ccd7ab344f7cf3a766fd
|
||||
ARG POWERSHELL_SHA256_ARM64=29eb382cd510e4bd246902650ff6cf9f3b56f959d1bd0be75e0a1e425177c831
|
||||
ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
|
||||
|
||||
+3
-3
@@ -7,15 +7,15 @@ ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
|
||||
# Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
|
||||
ENV POWERSHELL_TELEMETRY_OPTOUT=1
|
||||
|
||||
ARG TRIVY_VERSION=0.75.0
|
||||
ARG TRIVY_VERSION=0.76.0
|
||||
ENV TRIVY_VERSION=${TRIVY_VERSION}
|
||||
|
||||
ARG ZIZMOR_VERSION=1.24.1
|
||||
ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}
|
||||
|
||||
# Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
|
||||
ARG TRIVY_SHA256_AMD64=c6e65abddb348e25f10549df887045629cf28cc72453cd1c63acb717316b3f3f
|
||||
ARG TRIVY_SHA256_ARM64=a1ee9f6ffb7d112b64ff726a2a0717c21175c1114361391f4a132956751a13b3
|
||||
ARG TRIVY_SHA256_AMD64=e24b1c51293c1b15e4ba8d45bbc7891ba053f90278ec2698f3562c993e145fe7
|
||||
ARG TRIVY_SHA256_ARM64=aab21e677a7b7071fc79f1711480840754c18a1b9d9cefa7ccd06af63a0e8f4c
|
||||
ARG POWERSHELL_SHA256_AMD64=db85ae1f45005ffd20e456890585167257151fa99406ccd7ab344f7cf3a766fd
|
||||
ARG POWERSHELL_SHA256_ARM64=29eb382cd510e4bd246902650ff6cf9f3b56f959d1bd0be75e0a1e425177c831
|
||||
ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
Trivy from 0.75.0 to 0.76.0 in the API container image, built with Go 1.27.2 and x/net 0.60.0, patching the HTTP/2 and TLS CVEs bundled in Trivy 0.75.0
|
||||
@@ -0,0 +1 @@
|
||||
Trivy from 0.75.0 to 0.76.0 in the SDK container image, built with Go 1.27.2 and x/net 0.60.0, patching the HTTP/2 and TLS CVEs bundled in Trivy 0.75.0
|
||||
Reference in new issue
Block a user