Table output shows no summary if no vulnerability is detected #4277
Replies: 15 comments
-
|
@bgoareguer thanks for your report! $ docker pull alpine:3.16.1
$ docker run --rm -it --entrypoint /bin/sh alpine:3.16.1
/ # apk list | grep busybox
busybox-1.35.0-r15 x86_64 {busybox} (GPL-2.0-only) [installed]so I think that |
Beta Was this translation helpful? Give feedback.
-
|
also I tested v0.29.2, it works correctly too: $ trivy-29-2 i alpine:3.16.1
2022-07-19T18:52:30.862+0600 INFO Vulnerability scanning is enabled
2022-07-19T18:52:30.862+0600 INFO Secret scanning is enabled
2022-07-19T18:52:30.863+0600 INFO If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2022-07-19T18:52:30.863+0600 INFO Please see also https://aquasecurity.github.io/trivy/v0.29.2/docs/secret/scanning/#recommendation for faster secret detection
2022-07-19T18:52:30.867+0600 INFO Detected OS: alpine
2022-07-19T18:52:30.867+0600 INFO Detecting Alpine vulnerabilities...
2022-07-19T18:52:30.868+0600 INFO Number of language-specific files: 0
alpine:3.16.1 (alpine 3.16.1)
Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 2, CRITICAL: 0)
┌────────────┬────────────────┬──────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
├────────────┼────────────────┼──────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ busybox │ CVE-2022-30065 │ HIGH │ 1.35.0-r15 │ 1.35.0-r17 │ busybox: A use-after-free in Busybox's awk applet leads to │
│ │ │ │ │ │ denial of service... │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-30065 │
├────────────┤ │ │ │ │ │
│ ssl_client │ │ │ │ │ │
│ │ │ │ │ │ │
│ │ │ │ │ │ │
└────────────┴────────────────┴──────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────────┘
|
Beta Was this translation helpful? Give feedback.
-
|
please, feel free reopen this issue, if the issue still exists |
Beta Was this translation helpful? Give feedback.
-
|
@afdesk the problem was not about detecting the vulnerability but simply not showing the summary: |
Beta Was this translation helpful? Give feedback.
-
oh, yes, i understood it now. thanks |
Beta Was this translation helpful? Give feedback.
-
|
We probably removed it by mistake. @afdesk Could you revert it? |
Beta Was this translation helpful? Give feedback.
-
|
yes, sure. I'll do it today. |
Beta Was this translation helpful? Give feedback.
-
|
FYI, alpine linux security db was updated yesterday, and now |
Beta Was this translation helpful? Give feedback.
-
|
@knqyf263 @afdesk I'm on trivy v0.30.3 and I still see no summary with This way it would be much more reassuring: Would you consider reopening and adding this? |
Beta Was this translation helpful? Give feedback.
-
|
@KDMichaelis thanks for your report |
Beta Was this translation helpful? Give feedback.
-
|
I have this as well in 0.30.4 - would be really useful to get a summary showing no issues with an image. |
Beta Was this translation helpful? Give feedback.
-
|
Still present in Trivy 0.38.3 (for |
Beta Was this translation helpful? Give feedback.
-
|
Currently on trivy |
Beta Was this translation helpful? Give feedback.
-
|
On trivy |
Beta Was this translation helpful? Give feedback.
-
|
On version 0.57.0 with trivy fs the output does not print anything if no results are found just like others have said this is frustrating because it's not clear if the scan was run at all. prefer to see the results indicating there arent any vulns |
Beta Was this translation helpful? Give feedback.
-
Description
I scan an image containing only one vulnerability with severity=HIGH.
When I allow Trivy to show all vulnerabilities, the table output shows the summary:
But when I filter out all vulnerabilities (with
--severity=CRITICAL), the table output does not show the summary:What did you expect to happen?
I expected to see a summary showing 0 vulnerabilities as it did in versions prior to 0.30.0.
Here is the output I have with Trivy 0.29.2:
Output of
trivy -v:Additional details (base image name, container registry info...):
The image I am scanning is alpine:3.16.1
Beta Was this translation helpful? Give feedback.
All reactions