Does Trivy vulnearbility scanner report the vulnerabilities that were removed on subsequent layers?

[smgtkn]

Question

I observed that, for image bash@sha256:acb6b1dac293f32d2673de93ab3ddc2fcffcf22b353c654b72de7c34409a57f5,
trivy does not list the vulnerability 'CVE-2017-15650' from the package musl version 1.1.16-r9.

The bash image uses an alpine image with following digest: alpine@sha256:aeda406ee461d9837b9f402187a83bad22d7d8d55f5a91d4e28ccd7146f96d3b For this image, trivy lists the vulnerability.

Dockerfile of the specified bash image for reference

In that case, I assume trivy doesn't list the vulnerabilities that are removed on later layers.

When I experiment manually with a Dockerfile I created myself, even if I remove the vulnerable package on the same layer, trivy still lists the vulnerability:

FROM node:14

WORKDIR /app

RUN npm install [email protected] && \
    npm uninstall [email protected]

json-schema prior to version 0.4.0 has critical CVE-2021-3918, and it is listed on the image built with the Dockerfile above, base image node:14 scan does not include the vulnerability, so it is not inherited either. I'd appreciate if you can explain the reason for this behaviour. Thanks!

Target

Container Image

Scanner

Vulnerability

Output Format

None

Mode

None

Operating System

No response

Version

0.46.1

[knqyf263]

json-schema is not removed from node_moduels after npm uninstall.

$ docker build -t test .
$ docker run --rm -it test cat package-lock.json
{
  "requires": true,
  "lockfileVersion": 1,
  "dependencies": {
    "json-schema": {
      "version": "0.3.0",
      "resolved": "https://registry.npmjs.org/json-schema/-/json-schema-0.3.0.tgz",
      "integrity": "sha512-TYfxx36xfl52Rf1LU9HyWSLGPdYLL+SQ8/E/0yVyKG8wCCDaSrhPap0vEdlsZWRaS6tnKKLPGiEJGiREVC8kxQ=="
    }
  }
}

I think you need npm uninstall --save.

[smgtkn]

@knqyf263 Thank you, I was able to verify that trivy does not report the json-schema vulnerability for the image built from the following Dockerfile:

FROM node:22
RUN npm init -y && \
    npm install [email protected] && \
    npm uninstall json-schema 

but the answer is still unclear for me. Can you verify the following statements:

1- Trivy does not report the vulnerability that was installed on a layer and removed on a later layer.
2-Trivy does not report the vulnerabilities that are installed and removed on the same layer (my Dockerfile example verifies this), if they are not build dependencies (based on #112)

[knqyf263]

True