Replies: 2 comments 1 reply
-
|
Hello @Orrimp The debug log shows that Trivy detects If the table is empty - these packages are not vulnerable. Please scan your
Regards, Dmitriy |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Hi,
Thank you for your reply.
From my view the scan is aborted.
There is no Table and even no list of iffent CVE severity's like trivy
image. I would be happy to have an output with
CVEs(0) or HIGH(0).
The list of packages is filled with your output.
…On Mon, 16 Dec 2024, 11:09 DmitriyLewen, ***@***.***> wrote:
Hello @Orrimp <https://github.com/Orrimp>
Thanks for your interest to Trivy!
The debug log shows that Trivy detects Packages of your pom.xml file.
If the table is empty - these packages are not vulnerable.
Please scan your pom.xml file with the -f json --list-all-pkgs flag.
- if Trivy does not detect a package - send me a test pom.xml file for
investigation.
- if Trivy does not detect a vulnerability for a package - tell me the
package, version and CVE number for this vulnerability.
Regards, Dmitriy
—
Reply to this email directly, view it on GitHub
<#8097 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ABTESONOS7ZUGKHCLNT55IT2F2RENAVCNFSM6AAAAABTSGYP5CVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCNJXHEZDQNI>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
1 reply
-
|
Trivy shows empty table on for OS packages - #2548 (comment) If Trivy fails, it will return an exit code. |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Description
As of https://trivy.dev/v0.58/docs/coverage/language/#supported-languages there is support for pom.xml files and even JAR files.
With the latest version of Trivy 0.58 I am unable to get any CVEs based on pom.xml dependencies.
What have I tried:
trivy sbomWe are using Trivy for Image Scan and for JAR or FS Scan to have both reports. Image CVE scanning works fine, but we are unable to check pom.xml or JARs for vulnerabilities.
I am doing something fundamentally wrong here?
Desired Behavior
A table (even empty) with CVEs found in the dependencies of my pom.xml file. I expect the same view as in
trivy imagewith all the CVEs in the image but for my filesystem or JAR (rootfs)Actual Behavior
trivy fsagainst a Spring Boot Maven Project with Web dependency:For me, it seems like the Trivy breaks when scanning pom or JAR files and does not really execute the scan. It's way too fast.
Reproduction Steps
Target
Filesystem
Scanner
Vulnerability
Output Format
None
Mode
Standalone
Debug Output
Operating System
macOS and Windows
Version
Checklist
trivy clean --allBeta Was this translation helpful? Give feedback.
All reactions