trivy v0.32.1 releases: A Simple and Comprehensive Vulnerability Scanner for Containers, Suitable for CI
trivy
A Simple and Comprehensive Vulnerability Scanner for Containers, Suitable for CI
Trivy (tri pronounced like trigger, vy pronounced like envy) is a simple and comprehensive vulnerability scanner for containers. Trivy detects vulnerabilities of OS packages (Alpine, RHEL, CentOS, etc.) and application dependencies (Bundler, Composer, npm, yarn, etc.). Trivy is easy to use. Just install the binary and you’re ready to scan. All you need to do for scanning is to specify an image name of the container.
It is considered to be used in CI. Before pushing to a container registry, you can scan your local container image easily.
Features
- Detect comprehensive vulnerabilities
- OS packages (Alpine, Red Hat Universal Base Image, Red Hat Enterprise Linux, CentOS, Debian, and Ubuntu)
- Application dependencies (Bundler, Composer, Pipenv, npm, yarn, and Cargo)
- Simple
- Specify only an image name
- See Quick Start and Examples
- Easy installation
- No need for pre-requirements such as the installation of DB, libraries, etc.
apt-get install,yum installandbrew installis possible (See Installation)
- High accuracy
- Especially Alpine Linux and RHEL/CentOS (See Comparison with other scanners)
- Other OSes are also high
- DevSecOps
- Suitable for CI such as Travis CI, CircleCI, Jenkins, etc.
- See CI Example
Vulnerability Detection
OS Packages
The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution.
| OS | Supported Versions | Target Packages | Detection of unfixed vulnerabilities |
|---|---|---|---|
| Alpine Linux | 2.2 – 2.7, 3.0 – 3.10 | Installed by apk | NO |
| Red Hat Universal Base Image | 7, 8 | Installed by yum/rpm | YES |
| Red Hat Enterprise Linux | 6, 7, 8 | Installed by yum/rpm | YES |
| CentOS | 6, 7 | Installed by yum/rpm | YES |
| Debian GNU/Linux | wheezy, jessie, stretch, buster | Installed by apt/apt-get/dpkg | YES |
| Ubuntu | 12.04, 14.04, 16.04, 18.04, 18.10, 19.04 | Installed by apt/apt-get/dpkg | YES |
Changelog v0.32.1
- 8b1cee8 fix(java): use fields of dependency from dependencyManagement from upper pom.xml to parse deps (#2943)
- f5cbbb3 chore: expat lib and go binary deps vulns (#2940)
- 6882bdf wasm: Removes accidentally exported memory (#2950)
- 6ea9a61 fix(sbom): fix package name separation for gradle (#2906)
- 3ee4c96 docs(readme.md): fix broken integrations link (#2931)
- 5745961 fix(image): handle images with single layer in rescan mergedLayers cache (#2927)
- e01253d fix(cli): split env values with ‘,’ for slice flags (#2926)
- 0c1a42d fix(cli): config/helm: also take into account files with
.yml(#2928) - 237b8dc fix(flag): add file-patterns flag for config subcommand (#2925)
- 047a0b3 chore(deps): bump github.com/open-policy-agent/opa from 0.43.0 to 0.43.1 (#2902)
Install && Use
Copyright (C) 2019 Teppei Fukuda (knqyf263)
