Replies: 2 comments 9 replies
-
|
I also hope to get an answer to this question🙏🙏🙏 |
Beta Was this translation helpful? Give feedback.
-
|
Hello @zangcc @RexHarrr
Trivy doesn't scan
This is strange case...
I think you see same problem for Regards, Dmitriy |
Beta Was this translation helpful? Give feedback.
-
|
Since github cannot submit files in jar format, I will send you the official download link.
https://repo1.maven.org/maven2/org/apache/velocity/velocity/1.7/velocity-1.7.pom
|
Beta Was this translation helpful? Give feedback.
-
|
I asked the development engineers and they believed that the reason why Trivy scanned
But in the logic of the jar, the dependencies in the Therefore, my suggestion is that when detecting jar packages, only detect the jar version in the BOOT-INF.lib directory. I don’t know if you think my suggestion is feasible. I look forward to your reply. |
Beta Was this translation helpful? Give feedback.
-
|
hello @zangcc
➜ auto-value-1.0 cat ./META-INF/maven/commons-collections/commons-collections/pom.properties
#Generated by Maven
#Fri Apr 11 15:38:41 BST 2008
version=3.2.1
groupId=commons-collections
artifactId=commons-collectionsMaven creates this file to show that jar contains source code of this artifact: ➜ auto-value-1.0 ls -hl org/apache/commons/collections
total 120
-rw-r--r-- 1 work staff 200B Jan 5 2015 BoundedMap.class
-rw-r--r-- 1 work staff 1.2K Jan 5 2015 ExtendedProperties$PropertiesReader.class
-rw-r--r-- 1 work staff 1.3K Jan 5 2015 ExtendedProperties$PropertiesTokenizer.class
-rw-r--r-- 1 work staff 19K Jan 5 2015 ExtendedProperties.class
-rw-r--r-- 1 work staff 226B Jan 5 2015 IterableMap.class
-rw-r--r-- 1 work staff 187B Jan 5 2015 KeyValue.class
-rw-r--r-- 1 work staff 341B Jan 5 2015 MapIterator.class
-rw-r--r-- 1 work staff 238B Jan 5 2015 OrderedIterator.class
-rw-r--r-- 1 work staff 408B Jan 5 2015 OrderedMap.class
-rw-r--r-- 1 work staff 322B Jan 5 2015 OrderedMapIterator.class
-rw-r--r-- 1 work staff 196B Jan 5 2015 ResettableIterator.class
drwxr--r-- 7 work staff 224B Jan 5 2015 iterators
drwxr--r-- 20 work staff 640B Jan 5 2015 mapThat is why Trivy detects
We don't scan pom file from |
Beta Was this translation helpful? Give feedback.
-
|
Now I still have a question. The dependency in web.jar is commons-collections-3.2.2, but the scan results show commons-collections-3.2.1 among three layers of nested dependencies. So what is the real dependency in my actual project? Will it be affected by commons-collections-3.2.1? |
Beta Was this translation helpful? Give feedback.
-
|
I investigated more: ➜ mvn dependency:tree
[INFO] Scanning for projects...
[INFO]
[INFO] ------------------< com.google.auto.value:auto-value >------------------
[INFO] Building AutoValue 1.0
[INFO] from pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- dependency:3.6.1:tree (default-cli) @ auto-value ---
[INFO] com.google.auto.value:auto-value:jar:1.0
[INFO] +- com.google.guava:guava-testlib:jar:17.0:test
[INFO] | \- com.google.guava:guava:jar:17.0:test
[INFO] +- com.google.testing.compile:compile-testing:jar:0.6:test
[INFO] +- junit:junit:jar:4.11:test
[INFO] \- com.google.truth:truth:jar:0.25:test
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 0.543 s
[INFO] Finished at: 2024-04-25T13:59:09+06:00
[INFO] ------------------------------------------------------------------------But ➜ ls -hl auto-value-1.0/org/apache/commons/collections/
total 120
-rw-r--r-- 1 work staff 200B Jan 5 2015 BoundedMap.class
-rw-r--r-- 1 work staff 1.2K Jan 5 2015 ExtendedProperties$PropertiesReader.class
-rw-r--r-- 1 work staff 1.3K Jan 5 2015 ExtendedProperties$PropertiesTokenizer.class
-rw-r--r--@ 1 work staff 19K Jan 5 2015 ExtendedProperties.class
-rw-r--r-- 1 work staff 226B Jan 5 2015 IterableMap.class
-rw-r--r-- 1 work staff 187B Jan 5 2015 KeyValue.class
-rw-r--r-- 1 work staff 341B Jan 5 2015 MapIterator.class
-rw-r--r-- 1 work staff 238B Jan 5 2015 OrderedIterator.class
-rw-r--r-- 1 work staff 408B Jan 5 2015 OrderedMap.class
-rw-r--r-- 1 work staff 322B Jan 5 2015 OrderedMapIterator.class
-rw-r--r-- 1 work staff 196B Jan 5 2015 ResettableIterator.class
drwxr--r-- 7 work staff 224B Jan 5 2015 iterators
drwxr--r-- 20 work staff 640B Jan 5 2015 map
➜ cat auto-value-1.0/META-INF/maven/commons-collections/commons-collections/pom.properties
#Generated by Maven
#Fri Apr 11 15:38:41 BST 2008
version=3.2.1
groupId=commons-collections
artifactId=commons-collections
➜ cat auto-value-1.0/META-INF/maven/commons-collections/commons-collections/pom.xml| grep "<groupId>commons-collections</groupId>" -A 2
<groupId>commons-collections</groupId>
<artifactId>commons-collections</artifactId>
<version>3.2.1</version>But i checked source code:
But Maven should have update But Trivy doesn't parse |
Beta Was this translation helpful? Give feedback.
-
Description
commons-collections: The version of commons-collections in the actual code project is 3.2.2, but trivy scans it as 3.2.1. The scan results are inconsistent with the actual version.
I hope trivy can print out the delivery relationship of the dependency tree during docker image scanning or jar package scanning. In this false positive, our users can only see commons-collections:commons-collections (web.jar) 3.2.1 in the scan results.
Desired Behavior
Can correctly display the commons-collections:commons-collections version in the code project.
Actual Behavior
commons-collections: The version of commons-collections in the actual code project is 3.2.2, but trivy scans it as 3.2.1. The scan results are inconsistent with the actual version.
1.trivy uses the fs parameter to scan, and the commons-collections dependency does not appear in the scan results.
The command I used is:
trivy_0.48.3_macOS-64bit/trivy fs {repo_path} -o {output_file} --dependency-tree --offline-scan --timeout 999mcode_fs.txt
Commons-collections-3.2.1.jar does not exist in this scan result.
2.Package this code project into a jar package, and then scan it with the rootfs parameter. It is found that the Commons-collections-3.2.1 version appears in the scan results.
The packaging command I use is:
mvn -gs /root/tools/apache-maven-3.9.2/settings.xml clean package -Dmaven.test.skip -Dmaven.repo.local=/root/.m2/repositoryThen use the rootfs parameter to scan the jar package:
trivy rootfs --skip-db-update --offline-scan --dependency-tree --timeout 999m /root/code/codeproject-web/target/xxxxxxxx-web.jar -o xxxxxxx_trivy_resule_jar.txt20240422_jar_2.txt
In the actual code project, we are obviously using the 3.2.2 version of commons-collections:commons-collections.jar, and there is no 3.2.1 version of commons-collections:commons-collections.jar.
3.The results of the docker image scan are similar to the jar package, but the wrong version - 3.2.1 is still displayed.
docker cp temp_container:/opt/project/web.jar local_directoryjar tf web.jar | grep "3.2.2"jar tf web.jar | grep "3.2.1"trivy image imageid -o docker_result.txt --timeout 9999mdocker_result.txt
Reproduction Steps
Target
None
Scanner
None
Output Format
None
Mode
None
Debug Output
Operating System
GNU/Linux
Version
Checklist
trivy image --resetBeta Was this translation helpful? Give feedback.
All reactions