{
  "cveId": "CVE-2024-35192",
  "url": "https://patchblox.com/security/cve/CVE-2024-35192",
  "summary": "CVE-2024-35192 is fixed in trivy on 1 platform by OPENSUSE-SU-2024:0269-1 (version 0.54.1-bp156.2.3.1), released August 30, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "trivy: trivy was updated to fix the following issues:\n\nUpdate to version 0.54.1:\n\n* fix(flag): incorrect behavior for deprec...",
  "description": "trivy was updated to fix the following issues:\n\nUpdate to version 0.54.1:\n\n* fix(flag): incorrect behavior for deprected flag \u0060--clear-cache\u0060 [backport: release/v0.54] (#7285)\n* fix(java): Return error when trying to find a remote pom to avoid segfault [backport: release/v0.54] (#7283)\n* fix(plugin): do not call GitHub content API for releases and tags [backport: release/v0.54] (#7279)\n* release: v0.54.0 [main] (#7075)\n* docs: update ecosystem page reporting with plopsec.com app (#7262)\n* feat(vex): retrieve VEX attestations from OCI registries (#7249)\n* feat(sbom): add image labels into \u0060SPDX\u0060 and \u0060CycloneDX\u0060 reports (#7257)\n* refactor(flag): return error if both \u0060--download-db-only\u0060 and \u0060--download-java-db-only\u0060 are specified (#7259)\n* fix(nodejs): detect direct dependencies when using \u0060latest\u0060 version for files \u0060yarn.lock\u0060 \u002B \u0060package.json\u0060 (#7110)\n* chore: show VEX notice for OSS maintainers in CI environments (#7246)\n* feat(vuln): add \u0060--pkg-relationships\u0060 (#7237)\n* docs: show VEX cli pages \u002B update config file page for VEX flags (#7244)\n* fix(dotnet): show \u0060nuget package dir not found\u0060 log only when checking \u0060nuget\u0060 packages (#7194)\n* feat(vex): VEX Repository support (#7206)\n* fix(secret): skip regular strings contain secret patterns (#7182)\n* feat: share build-in rules (#7207)\n* fix(report): hide empty table when all secrets/license/misconfigs are ignored (#7171)\n* fix(cli): error on missing config file (#7154)\n* fix(secret): update length of \u0060hugging-face-access-token\u0060 (#7216)\n* feat(sbom): add vulnerability support for SPDX formats (#7213)\n* fix(secret): trim excessively long lines (#7192)\n* chore(vex): update subcomponents for CVE-2023-42363/42364/42365/42366 (#7201)\n* fix(server): pass license categories to options (#7203)\n* feat(mariner): Add support for Azure Linux (#7186)\n* docs: updates config file (#7188)\n* refactor(fs): remove unused field for CompositeFS (#7195)\n* fix: add missing platform and type to spec (#7149)\n* feat(misconf): enabled China configuration for ACRs (#7156)\n* fix: close file when failed to open gzip (#7164)\n* docs: Fix PR documentation to use GitHub Discussions, not Issues (#7141)\n* docs(misconf): add info about limitations for terraform plan json (#7143)\n* chore: add VEX for Trivy images (#7140)\n* chore: add VEX document and generator for Trivy  (#7128)\n* fix(misconf): do not evaluate TF when a load error occurs (#7109)\n* feat(cli): rename \u0060--vuln-type\u0060 flag to \u0060--pkg-types\u0060 flag (#7104)\n* refactor(secret): move warning about file size after \u0060IsBinary\u0060 check (#7123)\n* feat: add openSUSE tumbleweed detection and scanning (#6965)\n* test: add missing advisory details for integration tests database (#7122)\n* fix: Add dependencyManagement exclusions to the child exclusions (#6969)\n* fix: ignore nodes when listing permission is not allowed (#7107)\n* fix(java): use \u0060go-mvn-version\u0060 to remove \u0060Package\u0060 duplicates (#7088)\n* refactor(secret): add warning about large files (#7085)\n* feat(nodejs): add license parser to pnpm analyser (#7036)\n* refactor(sbom): add sbom prefix \u002B filepaths for decode log messages (#7074)\n* feat: add \u0060log.FilePath()\u0060 function for logger (#7080)\n* chore: bump golangci-lint from v1.58 to v1.59 (#7077)\n* perf(debian): use \u0060bytes.Index\u0060 in \u0060emptyLineSplit\u0060 to cut allocation (#7065)\n* refactor: pass DB dir to trivy-db (#7057)\n* docs: navigate to the release highlights and summary (#7072)\n\nUpdate to version 0.53.0 (bsc#1227022, CVE-2024-6257):\n* release: v0.53.0 [main] (#6855)\n* feat(conda): add licenses support for \u0060environment.yml\u0060 files (#6953)\n* fix(sbom): fix panic when scanning SBOM file without root component into SBOM format (#7051)\n* feat: add memory cache backend (#7048)\n* fix(sbom): use package UIDs for uniqueness (#7042)\n* feat(php): add installed.json file support (#4865)\n* docs: \u2728 Updated ecosystem docs with reference to new community app (#7041)\n* fix: use embedded when command path not found (#7037)\n* refactor: use google/wire for cache (#7024)\n* fix(cli): show info message only when --scanners is available (#7032)\n* chore: enable float-compare rule from testifylint (#6967)\n* docs: Add sudo on commands, chmod before mv on install docs (#7009)\n* fix(plugin): respect \u0060--insecure\u0060 (#7022)\n* feat(k8s)!: node-collector dynamic commands support (#6861)\n* fix(sbom): take pkg name from \u0060purl\u0060 for maven pkgs (#7008)\n* feat!: add clean subcommand (#6993)\n* chore: use \u0060!\u0060 for breaking changes (#6994)\n* feat(aws)!: Remove aws subcommand (#6995)\n* refactor: replace global cache directory with parameter passing (#6986)\n* fix(sbom): use \u0060purl\u0060 for \u0060bitnami\u0060 pkg names (#6982)\n* chore: bump Go toolchain version (#6984)\n* refactor: unify cache implementations (#6977)\n* docs: non-packaged and sbom clarifications (#6975)\n* BREAKING(aws): Deprecate \u0060trivy aws\u0060 as subcmd in favour of a plugin (#6819)\n* docs: delete unknown URL (#6972)\n* refactor: use version-specific URLs for documentation references (#6966)\n* refactor: delete db mock (#6940)\n* refactor: add warning if severity not from vendor (or NVD or GH) is used (#6726)\n* feat: Add local ImageID to SARIF metadata (#6522)\n* fix(suse): Add SLES 15.6 and Leap 15.6 (#6964)\n* feat(java): add support for sbt projects using sbt-dependency-lock (#6882)\n* feat(java): add support for \u0060maven-metadata.xml\u0060 files for remote snapshot repositories. (#6950)\n* fix(purl): add missed os types (#6955)\n* fix(cyclonedx): trim non-URL info for \u0060advisory.url\u0060 (#6952)\n* fix(c): don\u0027t skip conan files from \u0060file-patterns\u0060 and scan \u0060.conan2\u0060 cache dir (#6949)\n* fix(image): parse \u0060image.inspect.Created\u0060 field only for non-empty values (#6948)\n* fix(misconf): handle source prefix to ignore (#6945)\n* fix(misconf): fix parsing of engine links and frameworks (#6937)\n* feat(misconf): support of selectors for all providers for Rego (#6905)\n* fix(license): return license separation using separators  \u0060,\u0060, \u0060or\u0060, etc. (#6916)\n* feat(misconf): add support for AWS::EC2::SecurityGroupIngress/Egress (#6755)\n* BREAKING(misconf): flatten recursive types (#6862)\n* test: bump docker API to 1.45  (#6914)\n* feat(sbom): migrate to \u0060CycloneDX v1.6\u0060 (#6903)\n* feat(image): Set User-Agent header for Trivy container registry requests (#6868)\n* fix(debian): take installed files from the origin layer (#6849)\n* fix(nodejs): fix infinite loop when package link from \u0060package-lock.json\u0060 file is broken (#6858)\n* feat(misconf): API Gateway V1 support for CloudFormation (#6874)\n* feat(plugin): add support for nested archives (#6845)\n* fix(sbom): don\u0027t overwrite \u0060srcEpoch\u0060 when decoding SBOM files (#6866)\n* fix(secret): \u0060Asymmetric Private Key\u0060 shouldn\u0027t start with space (#6867)\n* chore: auto label discussions (#5259)\n* docs: explain how VEX is applied (#6864)\n* fix(python): compare pkg names from \u0060poetry.lock\u0060 and \u0060pyproject.toml\u0060 in lowercase (#6852)\n* fix(nodejs): fix infinity loops for \u0060pnpm\u0060 with cyclic imports (#6857)\n* feat(dart): use first version of constraint for dependencies using SDK version (#6239)\n* fix(misconf): parsing numbers without fraction as int (#6834)\n* fix(misconf): fix caching of modules in subdirectories (#6814)\n* feat(misconf): add metadata to Cloud schema (#6831)\n* test: replace embedded Git repository with dynamically created repository (#6824)\n\nUpdate to version 0.52.2:\n\n* test: bump docker API to 1.45  [backport: release/v0.52] (#6922)\n* fix(debian): take installed files from the origin layer [backport: release/v0.52] (#6892)\n\nUpdate to version 0.52.1:\n\n* release: v0.52.1 [release/v0.52] (#6877)\n* fix(nodejs): fix infinite loop when package link from \u0060package-lock.json\u0060 file is broken [backport: release/v0.52] (#6888)\n* fix(sbom): don\u0027t overwrite \u0060srcEpoch\u0060 when decoding SBOM files [backport: release/v0.52] (#6881)\n* fix(python): compare pkg names from \u0060poetry.lock\u0060 and \u0060pyproject.toml\u0060 in lowercase [backport: release/v0.52] (#6878)\n* docs: explain how VEX is applied (#6864)\n* fix(nodejs): fix infinity loops for \u0060pnpm\u0060 with cyclic imports (#6857)\n\nUpdate to version 0.52.0 (bsc#1224781, CVE-2024-35192):\n\n* release: v0.52.0 [main] (#6809)\n* fix(plugin): initialize logger (#6836)\n* fix(cli): always output fatal errors to stderr (#6827)\n* fix: close testfile (#6830)\n* docs(julia): add scanner table (#6826)\n* feat(python): add license support for \u0060requirement.txt\u0060 files (#6782)\n* docs: add more workarounds for out-of-disk (#6821)\n* chore: improve error message for image not found (#6822)\n* fix(sbom): fix panic for \u0060convert\u0060 mode when scanning json file derived from sbom file (#6808)\n* fix: clean up golangci lint configuration (#6797)\n* fix(python): add package name and version validation for \u0060requirements.txt\u0060 files. (#6804)\n* feat(vex): improve relationship support in CSAF VEX (#6735)\n* chore(alpine): add eol date for Alpine 3.20 (#6800)\n* docs(plugin): add missed \u0060plugin\u0060 section (#6799)\n* fix: include packages unless it is not needed (#6765)\n* feat(misconf): support for VPC resources for inbound/outbound rules (#6779)\n* chore: replace interface{} with any (#6751)\n* fix: close settings.xml (#6768)\n* refactor(go): add priority for gobinary module versions from \u0060ldflags\u0060 (#6745)\n* build: use main package instead of main.go (#6766)\n* feat(misconf): resolve tf module from OpenTofu compatible registry (#6743)\n* docs: add info on adding compliance checks (#6275)\n* docs: Add documentation for contributing additional checks to the trivy policies repo (#6234)\n* feat(nodejs): add v9 pnpm lock file support (#6617)\n* feat(vex): support non-root components for products in OpenVEX (#6728)\n* feat(python): add line number support for \u0060requirement.txt\u0060 files (#6729)\n* chore: respect timeout value in .golangci.yaml (#6724)\n* fix: node-collector high and critical cves (#6707)\n* Merge pull request from GHSA-xcq4-m2r3-cmrj\n* chore: auto-bump golang patch versions (#6711)\n* fix(misconf): don\u0027t shift ignore rule related to code (#6708)\n* feat(plugin): specify plugin version (#6683)\n* chore: enforce golangci-lint version (#6700)\n* fix(go): include only \u0060.version\u0060|\u0060.ver\u0060 (no prefixes) ldflags for \u0060gobinaries\u0060 (#6705)\n* fix(go): add only non-empty root modules for \u0060gobinaries\u0060 (#6710)\n* refactor: unify package addition and vulnerability scanning (#6579)\n* fix: Golang version parsing from binaries w/GOEXPERIMENT (#6696)\n* feat(misconf): Add support for deprecating a check (#6664)\n* feat: Add Julia language analyzer support (#5635)\n* feat(misconf): register builtin Rego funcs from trivy-checks (#6616)\n* fix(report): hide empty tables if all vulns has been filtered (#6352)\n* feat(report): Include licenses and secrets filtered by rego to ModifiedFindings (#6483)\n* feat: add support for plugin index (#6674)\n* docs: add support table for client server mode (#6498)\n* fix: close APKINDEX archive file (#6672)\n* fix(misconf): skip Rego errors with a nil location (#6666)\n* refactor: move artifact types under artifact package to avoid import cycles (#6652)\n* refactor(misconf): remove extrafs (#6656)\n* refactor: re-define module structs for serialization (#6655)\n* chore(misconf): Clean up iac logger (#6642)\n* feat(misconf): support symlinks inside of Helm archives (#6621)\n* feat(misconf): add Terraform \u0027removed\u0027 block to schema (#6640)\n* refactor: unify Library and Package structs (#6633)\n* fix: use of specified context to obtain cluster name (#6645)\n* perf(misconf): parse rego input once (#6615)\n* fix(misconf): skip Rego errors with a nil location (#6638)\n* docs: link warning to both timeout config options (#6620)\n* docs: fix usage of image-config-scanners (#6635)\n\nUpdate to version 0.51.1:\n\n* fix(fs): handle default skip dirs properly (#6628)\n* fix(misconf): load cached tf modules (#6607)\n* fix(misconf): do not use semver for parsing tf module versions (#6614)\n* refactor: move setting scanners when using compliance reports to flag parsing (#6619)\n* feat: introduce package UIDs for improved vulnerability mapping (#6583)\n* perf(misconf): Improve cause performance (#6586)\n* docs: trivy-k8s new experiance remove un-used section (#6608)\n* docs: remove mention of GitLab Gold because it doesn\u0027t exist anymore (#6609)\n* feat(misconf): Use updated terminology for misconfiguration checks (#6476)\n* docs: use \u0060generic\u0060 link from \u0060trivy-repo\u0060 (#6606)\n* docs: update trivy k8s with new experience (#6465)\n* feat: support \u0060--skip-images\u0060 scanning flag (#6334)\n* BREAKING: add support for k8s \u0060disable-node-collector\u0060 flag (#6311)\n* feat: add ubuntu 23.10 and 24.04 support (#6573)\n* docs(go): add stdlib (#6580)\n* feat(go): parse main mod version from build info settings (#6564)\n* feat: respect custom exit code from plugin (#6584)\n* docs: add asdf and mise installation method (#6063)\n* feat(vuln): Handle scanning conan v2.x lockfiles (#6357)\n* feat: add support \u0060environment.yaml\u0060 files (#6569)\n* fix: close plugin.yaml (#6577)\n* fix: trivy k8s avoid deleting non-default node collector namespace  (#6559)\n* BREAKING: support exclude \u0060kinds/namespaces\u0060 and include \u0060kinds/namespaces\u0060 (#6323)\n* feat(go): add main module (#6574)\n* feat: add relationships (#6563)\n* docs: mention \u0060--show-suppressed\u0060 is available in table (#6571)\n* chore: fix sqlite to support loong64 (#6511)\n* fix(debian): sort dpkg info before parsing due to exclude directories (#6551)\n* docs: update info about config file (#6547)\n* docs: remove RELEASE_VERSION from trivy.repo (#6546)\n* fix(sbom): change error to warning for multiple OSes (#6541)\n* fix(vuln): skip empty versions (#6542)\n* feat(c): add license support for conan lock files (#6329)\n* fix(terraform): Attribute and fileset fixes (#6544)\n* refactor: change warning if no vulnerability details are found (#6230)\n* refactor(misconf): improve error handling in the Rego scanner (#6527)\n* feat(go): parse main module of go binary files (#6530)\n* refactor(misconf): simplify the retrieval of module annotations (#6528)\n* docs(nodejs): add info about supported versions of pnpm lock files (#6510)\n* feat(misconf): loading embedded checks as a fallback (#6502)\n* fix(misconf): Parse JSON k8s manifests properly (#6490)\n* refactor: remove parallel walk (#5180)\n* fix: close pom.xml (#6507)\n* fix(secret): convert severity for custom rules (#6500)\n* fix(java): update logic to detect \u0060pom.xml\u0060 file snapshot artifacts from remote repositories (#6412)\n* fix: typo (#6283)\n* docs(k8s,image): fix command-line syntax issues (#6403)\n* fix(misconf): avoid panic if the scheme is not valid (#6496)\n* feat(image): goversion as stdlib (#6277)\n* fix: add color for error inside of log message (#6493)\n* docs: fix links to OPA docs (#6480)\n* refactor: replace zap with slog (#6466)\n* docs: update links to IaC schemas (#6477)\n* chore: bump Go to 1.22 (#6075)\n* refactor(terraform): sync funcs with Terraform (#6415)\n* feat(misconf): add helm-api-version and helm-kube-version flag (#6332)\n* fix(terraform): eval submodules (#6411)\n* refactor(terraform): remove unused options (#6446)\n* refactor(terraform): remove unused file (#6445)\n* fix(misconf): Escape template value correctly (#6292)\n* feat(misconf): add support for wildcard ignores (#6414)\n* fix(cloudformation): resolve \u0060DedicatedMasterEnabled\u0060 parsing issue (#6439)\n* refactor(terraform): remove metrics collection (#6444)\n* feat(cloudformation): add support for logging and endpoint access for EKS (#6440)\n* fix(db): check schema version for image name only (#6410)\n* feat(misconf): Support private registries for misconf check bundle (#6327)\n* feat(cloudformation): inline ignore support for YAML templates (#6358)\n* feat(terraform): ignore resources by nested attributes (#6302)\n* perf(helm): load in-memory files (#6383)\n* feat(aws): apply filter options to result (#6367)\n* feat(aws): quiet flag support (#6331)\n* fix(misconf): clear location URI for SARIF (#6405)\n* test(cloudformation): add CF tests (#6315)\n* fix(cloudformation): infer type after resolving a function (#6406)\n* fix(sbom): fix error when parent of SPDX Relationships is not a package. (#6399)\n* docs: add info about support for package license detection in \u0060fs\u0060/\u0060repo\u0060 modes (#6381)\n* fix(nodejs): add support for parsing \u0060workspaces\u0060 from \u0060package.json\u0060 as an object (#6231)\n* fix: use \u00600600\u0060 perms for tmp files for post analyzers (#6386)\n* fix(helm): scan the subcharts once (#6382)\n* docs(terraform): add file patterns for Terraform Plan (#6393)\n* fix(terraform): \u0441hecking SSE encryption algorithm validity (#6341)\n* fix(java): parse modules from \u0060pom.xml\u0060 files once (#6312)\n* fix(server): add Locations for \u0060Packages\u0060 in client/server mode (#6366)\n* fix(sbom): add check for \u0060CreationInfo\u0060 to nil when detecting SPDX created using Trivy (#6346)\n* fix(report): don\u0027t include empty strings in \u0060.vulnerabilities[].identifiers[].url\u0060 when \u0060gitlab.tpl\u0060 is used (#6348)\n* chore(ubuntu): Add Ubuntu 22.04 EOL date (#6371)\n* feat(java): add support licenses and graph for gradle lock files (#6140)\n* feat(vex): consider root component for relationships (#6313)\n* fix: increase the default buffer size for scanning dpkg status files by 2 times (#6298)\n* chore: updates wazero to v1.7.0 (#6301)\n* feat(sbom): Support license detection for SBOM scan (#6072)\n* refactor(sbom): use intermediate representation for SPDX (#6310)\n* docs(terraform): improve documentation for filtering by inline comments (#6284)\n* fix(terraform): fix policy document retrieval (#6276)\n* refactor(terraform): remove unused custom error (#6303)\n* refactor(sbom): add intermediate representation for BOM (#6240)\n* fix(amazon): check only major version of AL to find advisories (#6295)\n* fix(db): use schema version as tag only for \u0060trivy-db\u0060 and \u0060trivy-java-db\u0060 registries by default (#6219)\n* fix(nodejs): add name validation for package name from \u0060package.json\u0060  (#6268)\n* docs: Added install instructions for FreeBSD (#6293)\n* feat(image): customer podman host or socket option (#6256)\n* feat(java): mark dependencies from \u0060maven-invoker-plugin\u0060 integration tests pom.xml files as \u0060Dev\u0060 (#6213)\n* fix(license): reorder logic of how python package licenses are acquired (#6220)\n* test(terraform): skip cached modules (#6281)\n* feat(secret): Support for detecting Hugging Face Access Tokens (#6236)\n* fix(cloudformation): support of all SSE algorithms for s3 (#6270)\n* feat(terraform): Terraform Plan snapshot scanning support (#6176)\n* fix: typo function name and comment optimization (#6200)\n* fix(java): don\u0027t ignore runtime scope for pom.xml files (#6223)\n* fix(license): add FilePath to results to allow for license path filtering via trivyignore file (#6215)\n* test(k8s): use test-db for k8s integration tests (#6222)\n* fix(terraform): fix root module search (#6160)\n* test(parser): squash test data for yarn (#6203)\n* fix(terraform): do not re-expand dynamic blocks (#6151)\n* docs: update ecosystem page reporting with db app (#6201)\n* fix: k8s summary separate infra and user finding results (#6120)\n* fix: add context to target finding on k8s table view (#6099)\n* fix: Printf format err (#6198)\n* refactor: better integration of the parser into Trivy (#6183)\n* feat(terraform): Add hyphen and non-ASCII support for domain names in credential extraction (#6108)\n* fix(vex): CSAF filtering should consider relationships (#5923)\n* refactor(report): Replacing \u0060source_location\u0060 in \u0060github\u0060 report when scanning an image (#5999)\n* feat(vuln): ignore vulnerabilities by PURL (#6178)\n* feat(java): add support for fetching packages from repos mentioned in pom.xml (#6171)\n* feat(k8s): rancher rke2 version support (#5988)\n* docs: update kbom distribution for scanning (#6019)\n* chore: update CODEOWNERS (#6173)\n* fix(swift): try to use branch to resolve version (#6168)\n* fix(terraform): ensure consistent path handling across OS (#6161)\n* fix(java): add only valid libs from \u0060pom.properties\u0060 files from \u0060jars\u0060 (#6164)\n* fix(sbom): skip executable file analysis if Rekor isn\u0027t a specified SBOM source (#6163)\n* docs(report): add remark about \u0060path\u0060 to filter licenses using \u0060.trivyignore.yaml\u0060 file (#6145)\n* docs: update template path for gitlab-ci tutorial (#6144)\n* feat(report): support for filtering licenses and secrets via rego policy files (#6004)\n* fix(cyclonedx): move root component from scanned cyclonedx file to output cyclonedx file (#6113)\n* docs: add SecObserve in CI/CD and reporting (#6139)\n* fix(alpine): exclude empty licenses for apk packages (#6130)\n* docs: add docs tutorial on custom policies with rego (#6104)\n* fix(nodejs): use project dir when searching for workspaces for Yarn.lock files (#6102)\n* feat(vuln): show suppressed vulnerabilities in table (#6084)\n* docs: rename governance to principles (#6107)\n* docs: add governance (#6090)\n* feat(java): add dependency location support for \u0060gradle\u0060 files (#6083)\n* fix(misconf): get \u0060user\u0060 from \u0060Config.User\u0060 (#6070)\n\nUpdate to version 0.49.1:\n\n* fix: check unescaped \u0060BomRef\u0060 when matching \u0060PkgIdentifier\u0060 (#6025)\n* docs: Fix broken link to \u0027pronunciation\u0027 (#6057)\n* fix: fix cursor usage in Redis Clear function (#6056)\n* fix(nodejs): add local packages support for \u0060pnpm-lock.yaml\u0060 files (#6034)\n* test: fix flaky \u0060TestDockerEngine\u0060 (#6054)\n* fix(java): recursive check all nested depManagements with import scope for pom.xml files (#5982)\n* fix(cli): inconsistent behavior across CLI flags, environment variables, and config files (#5843)\n* feat(rust): Support workspace.members parsing for Cargo.toml analysis (#5285)\n* docs: add note about Bun (#6001)\n* fix(report): use \u0060AWS_REGION\u0060 env for secrets in \u0060asff\u0060 template (#6011)\n* fix: check returned error before deferring f.Close() (#6007)\n* feat(misconf): add support of buildkit instructions when building dockerfile from image config (#5990)\n* feat(vuln): enable \u0060--vex\u0060 for all targets (#5992)\n* docs: update link to data sources (#6000)\n* feat(java): add support for line numbers for pom.xml files (#5991)\n* refactor(sbom): use new \u0060metadata.tools\u0060 struct for CycloneDX (#5981)\n* docs: Update troubleshooting guide with image not found error (#5983)\n* style: update band logos (#5968)\n* docs: update cosign tutorial and commands, update kyverno policy (#5929)\n* docs: update command to scan go binary (#5969)\n* fix: handle non-parsable images names (#5965)\n* fix(amazon): save system files for pkgs containing \u0060amzn\u0060 in src (#5951)\n* fix(alpine): Add EOL support for alpine 3.19. (#5938)\n* feat: allow end-users to adjust K8S client QPS and burst (#5910)\n* fix(nodejs): find licenses for packages with slash (#5836)\n* fix(sbom): use \u0060group\u0060 field for pom.xml and nodejs files for CycloneDX reports (#5922)\n* fix: ignore no init containers (#5939)\n* docs: Fix documentation of ecosystem (#5940)\n* docs(misconf): multiple ignores in comment (#5926)\n* fix(secret): find aws secrets ending with a comma or dot (#5921)\n* docs: \u2728 Updated ecosystem docs with reference to new community app (#5918)\n* fix(java): check if a version exists when determining GAV by file name for \u0060jar\u0060 files (#5630)\n* feat(vex): add PURL matching for CSAF VEX (#5890)\n* fix(secret): \u0060AWS Secret Access Key\u0060 must include only secrets with \u0060aws\u0060 text. (#5901)\n* revert(report): don\u0027t escape new line characters for sarif format (#5897)\n* docs: improve filter by rego (#5402)\n* docs: add_scan2html_to_trivy_ecosystem (#5875)\n* fix(vm): update ext4-filesystem fix reading groupdescriptor in 32bit mode (#5888)\n* feat(vex): Add support for CSAF format (#5535)\n* feat(python): parse licenses from dist-info folder (#4724)\n* feat(nodejs): add yarn alias support (#5818)\n* refactor: propagate time through context values (#5858)\n* refactor: move PkgRef under PkgIdentifier (#5831)\n* fix(cyclonedx): fix unmarshal for licenses (#5828)\n* feat(vuln): include pkg identifier on detected vulnerabilities (#5439)\n\nUpdate to version 0.48.1:\n\n* fix(bitnami): use a different comparer for detecting vulnerabilities (#5633)\n* refactor(sbom): disable html escaping for CycloneDX (#5764)\n* refactor(purl): use \u0060pub\u0060 from \u0060package-url\u0060 (#5784)\n* docs(python): add note to using \u0060pip freeze\u0060 for \u0060compatible releases\u0060 (#5760)\n* fix(report): use OS information for OS packages purl in \u0060github\u0060 template (#5783)\n* fix(report): fix error if miconfigs are empty (#5782)\n* refactor(vuln): don\u0027t remove VendorSeverity in JSON report (#5761)\n* fix(report): don\u0027t mark misconfig passed tests as failed in junit.tpl (#5767)\n* docs(k8s): replace --scanners config with --scanners misconfig in docs (#5746)\n* fix(report): update Gitlab template (#5721)\n* feat(secret): add support of GitHub fine-grained tokens (#5740)\n* fix(misconf): add an image misconf to result (#5731)\n* feat(secret): added support of Docker registry credentials (#5720)\n\nUpdate to version 0.48.0:\n\n* feat: filter k8s core components vuln results (#5713)\n* feat(vuln): remove duplicates in Fixed Version (#5596)\n* feat(report): output plugin (#4863)\n* docs: typo in modules.md (#5712)\n* feat: Add flag to configure node-collector image ref (#5710)\n* feat(misconf): Add \u0060--misconfig-scanners\u0060 option (#5670)\n* chore: bump Go to 1.21 (#5662)\n* feat: Packagesprops support (#5605)\n* docs: update adopters discussion template (#5632)\n* docs: terraform tutorial links updated to point to correct loc (#5661)\n* fix(secret): add \u0060sec\u0060 and space to secret prefix for \u0060aws-secret-access-key\u0060 (#5647)\n* fix(nodejs): support protocols for dependency section in yarn.lock files (#5612)\n* fix(secret): exclude upper case before secret for \u0060alibaba-access-key-id\u0060 (#5618)\n* docs: Update Arch Linux package URL in installation.md (#5619)\n* chore: add prefix to image errors (#5601)\n* docs(vuln): fix link anchor (#5606)\n* docs: Add Dagger integration section and cleanup Ecosystem CICD docs page (#5608)\n* fix: k8s friendly error messages kbom non cluster scans (#5594)\n* feat: set InstalledFiles for DEB and RPM packages (#5488)\n* fix(report): use time.Time for CreatedAt (#5598)\n* test: retry containerd initialization (#5597)\n* feat(misconf): Expose misconf engine debug logs with \u0060--debug\u0060 option (#5550)\n* test: mock VM walker (#5589)\n* chore: bump node-collector v0.0.9 (#5591)\n* feat(misconf): Add support for \u0060--cf-params\u0060 for CFT (#5507)\n* feat(flag): replace \u0027--slow\u0027 with \u0027--parallel\u0027 (#5572)\n* fix(report): add escaping for Sarif format (#5568)\n* chore: show a deprecation notice for \u0060--scanners config\u0060 (#5587)\n* feat(report): Add CreatedAt to the JSON report. (#5542) (#5549)\n* test: mock RPM DB (#5567)\n* feat: add aliases to \u0027--scanners\u0027 (#5558)\n* refactor: reintroduce output writer (#5564)\n* chore: not load plugins for auto-generating docs (#5569)\n* chore: sort supported AWS services (#5570)\n* fix: no schedule toleration (#5562)\n* fix(cli): set correct \u0060scanners\u0060 for \u0060k8s\u0060 target (#5561)\n* fix(sbom): add \u0060FilesAnalyzed\u0060 and \u0060PackageVerificationCode\u0060 fields for SPDX (#5533)\n* refactor(misconf): Update refactored dependencies (#5245)\n* feat(secret): add built-in rule for JWT tokens (#5480)\n* fix: trivy k8s parse ecr image with arn (#5537)\n* fix: fail k8s resource scanning (#5529)\n* refactor(misconf): don\u0027t remove Highlighted in json format (#5531)\n* docs(k8s): fix link in kubernetes.md (#5524)\n* docs(k8s): fix whitespace in list syntax (#5525)\n\nUpdate to version 0.47.0:\n\n* docs: add info that license scanning supports file-patterns flag (#5484)\n* docs: add Zora integration into Ecosystem session (#5490)\n* fix(sbom): Use UUID as BomRef for packages with empty purl (#5448)\n* fix: correct error mismatch causing race in fast walks (#5516)\n* docs: k8s vulnerability scanning (#5515)\n* docs: remove glad for java datasources (#5508)\n* chore: remove unused logger attribute in amazon detector (#5476)\n* fix: correct error mismatch causing race in fast walks (#5482)\n* fix(server): add licenses to \u0060BlobInfo\u0060 message (#5382)\n* feat: scan vulns on k8s core component apps (#5418)\n* fix(java): fix infinite loop when \u0060relativePath\u0060 field points to \u0060pom.xml\u0060 being scanned (#5470)\n* fix(sbom): save digests for package/application when scanning SBOM files (#5432)\n* docs: fix the broken link (#5454)\n* docs: fix error when installing \u0060PyYAML\u0060 for gh pages (#5462)\n* fix(java): download java-db once (#5442)\n* docs(misconf): Update \u0060--tf-exclude-downloaded-modules\u0060 description (#5419)\n* feat(misconf): Support \u0060--ignore-policy\u0060 in config scans (#5359)\n* docs(misconf): fix broken table for \u0060Use container image\u0060 section (#5425)\n* feat(dart): add graph support (#5374)\n* refactor: define a new struct for scan targets (#5397)\n* fix(sbom): add missed \u0060primaryURL\u0060 and \u0060source severity\u0060 for CycloneDX (#5399)\n* fix: correct invalid MD5 hashes for rpms ending with one or more zero bytes (#5393)\n* docs: remove --scanners none (#5384)\n* docs: Update container_image.md #5182 (#5193)\n* feat(report): Add \u0060InstalledFiles\u0060 field to Package (#4706)\n* feat(k8s): add support for vulnerability detection (#5268)\n* fix(python): override BOM in \u0060requirements.txt\u0060 files (#5375)\n* docs: add kbom documentation (#5363)\n* test: use maximize build space for VM tests (#5362)\n* fix(report): add escaping quotes in misconfig Title for asff template (#5351)\n* fix: Report error when os.CreateTemp fails (to be consistent with other uses) (#5342)\n* fix: add config files to FS for post-analyzers (#5333)\n* fix: fix MIME warnings after updating to Go 1.20 (#5336)\n* build: fix a compile error with Go 1.21 (#5339)\n* feat: added \u0060Metadata\u0060 into the k8s resource\u0027s scan report (#5322)\n* chore: update adopters template (#5330)\n* fix(sbom): use PURL or Group and Name in case of Java  (#5154)\n* docs: add buildkite repository to ecosystem page (#5316)\n* chore: enable go-critic (#5302)\n* close java-db client (#5273)\n* fix(report): removes git::http from uri in sarif (#5244)\n* Improve the meaning of  sentence (#5301)\n* add app nil check (#5274)\n* typo: in secret.md (#5281)\n* docs: add info about \u0060github\u0060 format (#5265)\n* feat(dotnet): add license support for NuGet (#5217)\n* docs: correctly export variables (#5260)\n* chore: Add line numbers for lint output (#5247)\n* chore(cli): disable java-db flags in server mode (#5263)\n* feat(db): allow passing registry options (#5226)\n* refactor(purl): use TypeApk from purl (#5232)\n* chore: enable more linters (#5228)\n* Fix typo on ide.md (#5239)\n* refactor: use defined types (#5225)\n* fix(purl): skip local Go packages (#5190)\n* docs: update info about license scanning in Yarn projects (#5207)\n* fix link (#5203)\n* fix(purl): handle rust types (#5186)\n* chore: auto-close issues (#5177)\n* fix(k8s): kbom support addons labels (#5178)\n* test: validate SPDX with the JSON schema (#5124)\n* chore: bump trivy-kubernetes-latest (#5161)\n* docs: add \u0027Signature Verification\u0027 guide (#4731)\n* docs: add image-scanner-with-trivy for ecosystem (#5159)\n* fix(fs): assign the absolute path to be inspected to ROOTPATH when filesystem (#5158)\n* Update filtering.md (#5131)\n* chaging adopters discussion tempalte (#5091)\n* docs: add Bitnami (#5078)\n* feat(docker): add support for scanning Bitnami components (#5062)\n* feat: add support for .trivyignore.yaml (#5070)\n* fix(terraform): improve detection of terraform files (#4984)\n* feat: filter artifacts on --exclude-owned flag (#5059)\n* fix(sbom): cyclonedx advisory should omit \u0060null\u0060 value (#5041)\n* build: maximize build space for build tests (#5072)\n* feat: improve kbom component name (#5058)\n* fix(pom): add licenses for pom artifacts (#5071)\n* chore: bump Go to \u00601.20\u0060 (#5067)\n* feat: PURL matching with qualifiers in OpenVEX (#5061)\n* feat(java): add graph support for pom.xml (#4902)\n* feat(swift): add vulns for cocoapods (#5037)\n* fix: support image pull secret for additional workloads (#5052)\n* fix: #5033 Superfluous double quote in html.tpl (#5036)\n* docs(repo): update trivy repo usage and example (#5049)\n* perf: Optimize Dockerfile for reduced layers and size (#5038)\n* feat: scan K8s Resources Kind with --all-namespaces (#5043)\n* fix: vulnerability typo (#5044)\n* docs: adding a terraform tutorial to the docs (#3708)\n* feat(report): add licenses to sarif format (#4866)\n* feat(misconf): show the resource name in the report (#4806)\n* chore: update alpine base images (#5015)\n* feat: add Package.resolved swift files support (#4932)\n* feat(nodejs): parse licenses in yarn projects (#4652)\n* fix: k8s private registries support (#5021)\n* bump github.com/testcontainers/testcontainers-go from 0.21.0 to 0.23.0 (#5018)\n* feat(vuln): support last_affected field from osv (#4944)\n* feat(server): add version endpoint (#4869)\n* feat: k8s private registries support (#4987)\n* fix(server): add indirect prop to package (#4974)\n* docs: add coverage (#4954)\n* feat(c): add location for lock file dependencies. (#4994)\n* docs: adding blog post on ec2 (#4813)\n* revert 32bit bins (#4977)",
  "published": "2024-08-30T08:00:45Z",
  "severity": "",
  "epss": 0.0019,
  "epssPercentile": 0.08716,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "trivy",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "0.54.1-bp156.2.3.1",
      "fix": "OPENSUSE-SU-2024:0269-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2024-0269-1",
      "released": "2024-08-30T08:00:45Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}