Trivy does not detect an AsymmetricPrivateKey in container image when it is scanning for secrets and vulns at the same time #4791
Closed
jiridanek
started this conversation in
False Detection
Replies: 3 comments 8 replies
-
@DmitriyLewen Can you please take a look? Can't we correctly load the configuration file only with |
Beta Was this translation helpful? Give feedback.
0 replies
-
Hello @jiridanek Can you share I can't reproduce you issue:
|
Beta Was this translation helpful? Give feedback.
8 replies
-
Created #4796 |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
IDs
AsymmetricPrivateKey
Description
When I run trivy without the
--scanners
option or when I specify--scanners secret,vuln
, an AsymmetricPrivateKey in my container image is not detected. When I specify--scanners secret
, it is detected.When reading the docs, I figured the key should not be detected in any case, because its location matches an exclusion rule
trivy/pkg/fanal/secret/builtin-allow-rules.go
Lines 19 to 23 in 1b9b9a8
The files in question in the container are
Reproduction Steps
This correctly reports two *.pem private key files.
Changing the above command to also scan for vulnerabilities, that is, the last line to read
causes trivy to not report anything (no vulnerabilities, as of today, and no secrets, which is a bug in my eyes).
Target
Container Image
Scanner
Secret
Target OS
Red Hat UBI 9.2
Debug Output
Version
Checklist
-f json
that shows data sources and confirmed that the security advisory in data sources was correctBeta Was this translation helpful? Give feedback.
All reactions