.trivyignore.yaml not allow to ignore multiple vulnerabilities ids in the same path

[aurochs108]

Description

Hello

Desired Behavior

All of the ids should be ignored.

Actual Behavior

Trivy ignores only one of those ids, rest of them are still visible in raport.

Reproduction Steps

What was used:
- trivy scan fs
- https://trivy.dev/v0.54/docs/coverage/language/swift/
- https://trivy.dev/v0.54/docs/coverage/language/ruby/

.trivyignore.yaml configuration:

  - id: CVE-2023-22796
    paths:
      - "SPM_Sources/checkouts/Cuckoo/Gemfile.lock"
  - id: CVE-2022-21223
    paths:
      - "SPM_Sources/checkouts/Cuckoo/Gemfile.lock"
  - id: CVE-2022-24440
    paths:
      - "SPM_Sources/checkouts/Cuckoo/Gemfile.lock"
  - id: CVE-2022-32511
    paths:
      - "SPM_Sources/checkouts/Cuckoo/Gemfile.lock"
  - id: CVE-2024-49761
    paths:
      - "SPM_Sources/checkouts/Cuckoo/Gemfile.lock"
  - id: CVE-2024-47220
    paths:
      - "SPM_Sources/checkouts/Cuckoo/Gemfile.lock"

### Target

Filesystem

### Scanner

Vulnerability

### Output Format

None

### Mode

None

### Debug Output

```bash
SPM_Sources/checkouts/Cuckoo/Gemfile.lock (bundler)
===================================================
Total: 5 (HIGH: 4, CRITICAL: 1)

┌──────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────────────────────────────────────────┬─────────────────────────────────────────────────────────────┐
│       Library        │ Vulnerability  │ Severity │ Status │ Installed Version │                      Fixed Version                      │                            Title                            │
├──────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ activesupport        │ CVE-2023-22796 │ HIGH     │ fixed  │ 6.1.4.1           │ ~> 5.2.8, >= 5.2.8.15, ~> 6.1.7, >= 6.1.7.1, >= 7.0.4.1 │ rubygem-activesupport: Regular Expression Denial of Service │
│                      │                │          │        │                   │                                                         │ https:***avd.aquasec.com/nvd/cve-2023-22796                  │
├──────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ cocoapods-downloader │ CVE-2022-21223 │          │        │ 1.5.1             │ >= 1.6.2                                                │ Command injection in cocoapods-downloader                   │
│                      │                │          │        │                   │                                                         │ https:***avd.aquasec.com/nvd/cve-2022-21223                  │
│                      ├────────────────┤          │        │                   ├─────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                      │ CVE-2022-24440 │          │        │                   │ = 1.6.0, >= 1.6.3                                       │ Command injection in cocoapods-downloader                   │
│                      │                │          │        │                   │                                                         │ https:***avd.aquasec.com/nvd/cve-2022-24440                  │
├──────────────────────┼────────────────┼──────────┤        ├───────────────────┼─────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ jmespath             │ CVE-2022-32511 │ CRITICAL │        │ 1.4.0             │ >= 1.6.1                                                │ jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses       │
│                      │                │          │        │                   │                                                         │ JSON.load in a s...                                         │
│                      │                │          │        │                   │                                                         │ https:***avd.aquasec.com/nvd/cve-2022-32511                  │
├──────────────────────┼────────────────┼──────────┤        ├───────────────────┼─────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ webrick              │ CVE-2024-47220 │ HIGH     │        │ 1.7.0             │ >= 1.8.2                                                │ WEBrick: HTTP request smuggling                             │
│                      │                │          │        │                   │                                                         │ https:***avd.aquasec.com/nvd/cve-2024-47220                  │
└──────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────────────────────────────────┴─────────────────────────────────────────────────────────────┘

Operating System

MacOS 15

Version

v0.57.1

Checklist

• Run trivy clean --all
• Read the troubleshooting

[simar7]

hi @aurochs108 can you give us a test input for which we can try to reproduce this issue? The way you've passed in the ignore file seems correct to me.

For example:

$ cat .trivyignore.yaml
vulnerabilities:
  - id: CVE-2022-40897
    paths:
      - "usr/local/lib/python3.9/site-packages/setuptools-58.1.0.dist-info/METADATA"
    statement: Accept the risk
  - id: CVE-2023-2650
  - id: CVE-2023-3446
  - id: CVE-2023-3817
    purls:
      - "pkg:deb/debian/libssl1.1"
  - id: CVE-2023-29491
    expired_at: 2023-09-01