Skip to content

Commit 78e3304

Browse files
simar7nikpivkin
simar7
and
nikpivkin
authored
chore(deps): Bump trivy-checks (#8934)
Signed-off-by: nikpivkin <[email protected]> Co-authored-by: nikpivkin <[email protected]>
1 parent 22f040f commit 78e3304

File tree

6 files changed

+392
-24
lines changed

6 files changed

+392
-24
lines changed

‎go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ require (
2323
github.com/aquasecurity/table v1.10.0
2424
github.com/aquasecurity/testdocker v0.0.0-20240730042311-4642e94c7fc8
2525
github.com/aquasecurity/tml v0.6.1
26-
github.com/aquasecurity/trivy-checks v1.10.0
26+
github.com/aquasecurity/trivy-checks v1.11.2-0.20250529074512-7afea1b738c4
2727
github.com/aquasecurity/trivy-db v0.0.0-20250529093513-a12dfc204b6e
2828
github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48
2929
github.com/aquasecurity/trivy-kubernetes v0.9.0

‎go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -800,8 +800,8 @@ github.com/aquasecurity/testdocker v0.0.0-20240730042311-4642e94c7fc8 h1:b43UVqY
800800
github.com/aquasecurity/testdocker v0.0.0-20240730042311-4642e94c7fc8/go.mod h1:wXA9k3uuaxY3yu7gxrxZDPo/04FEMJtwyecdAlYrEIo=
801801
github.com/aquasecurity/tml v0.6.1 h1:y2ZlGSfrhnn7t4ZJ/0rotuH+v5Jgv6BDDO5jB6A9gwo=
802802
github.com/aquasecurity/tml v0.6.1/go.mod h1:OnYMWY5lvI9ejU7yH9LCberWaaTBW7hBFsITiIMY2yY=
803-
github.com/aquasecurity/trivy-checks v1.10.0 h1:Q0FWsYy/uwvr/icRSOzNu55yDZ1ME8hZlpglNs62ZfE=
804-
github.com/aquasecurity/trivy-checks v1.10.0/go.mod h1:/b633SOFNp8RjkxSq+FOg4SgxjklUp+BIQEyTWCnN1k=
803+
github.com/aquasecurity/trivy-checks v1.11.2-0.20250529074512-7afea1b738c4 h1:Njp9YEU+4vqmtcb21lWfivrbiLsdYreohmWQX3+KHiU=
804+
github.com/aquasecurity/trivy-checks v1.11.2-0.20250529074512-7afea1b738c4/go.mod h1:nT69xgRcBD4NlHwTBpWMYirpK5/Zpl8M+XDOgmjMn2k=
805805
github.com/aquasecurity/trivy-db v0.0.0-20250529093513-a12dfc204b6e h1:+B/in1DQDGwQbKhW5pWL8XxBgnZKxXhUznylJ2NCyvs=
806806
github.com/aquasecurity/trivy-db v0.0.0-20250529093513-a12dfc204b6e/go.mod h1:4zd4qZcjhNAHASz5I0O7qapv5h5gSJzSEaZXv/IPOGc=
807807
github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48 h1:JVgBIuIYbwG+ekC5lUHUpGJboPYiCcxiz06RCtz8neI=

‎integration/testdata/helm.json.golden

Lines changed: 126 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@
2121
"Class": "config",
2222
"Type": "helm",
2323
"MisconfSummary": {
24-
"Successes": 78,
25-
"Failures": 20
24+
"Successes": 79,
25+
"Failures": 21
2626
},
2727
"Misconfigurations": [
2828
{
@@ -1321,8 +1321,131 @@
13211321
"CauseMetadata": {
13221322
"Provider": "Kubernetes",
13231323
"Service": "general",
1324+
"StartLine": 19,
1325+
"EndLine": 22,
13241326
"Code": {
1325-
"Lines": null
1327+
"Lines": [
1328+
{
1329+
"Number": 19,
1330+
"Content": " - name: nginx",
1331+
"IsCause": true,
1332+
"Annotation": "",
1333+
"Truncated": false,
1334+
"Highlighted": " - \u001b[38;5;33mname\u001b[0m: nginx",
1335+
"FirstCause": true,
1336+
"LastCause": false
1337+
},
1338+
{
1339+
"Number": 20,
1340+
"Content": " image: nginx:1.14.2",
1341+
"IsCause": true,
1342+
"Annotation": "",
1343+
"Truncated": false,
1344+
"Highlighted": " \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
1345+
"FirstCause": false,
1346+
"LastCause": false
1347+
},
1348+
{
1349+
"Number": 21,
1350+
"Content": " ports:",
1351+
"IsCause": true,
1352+
"Annotation": "",
1353+
"Truncated": false,
1354+
"Highlighted": " \u001b[38;5;33mports\u001b[0m:",
1355+
"FirstCause": false,
1356+
"LastCause": false
1357+
},
1358+
{
1359+
"Number": 22,
1360+
"Content": " - containerPort: 80",
1361+
"IsCause": true,
1362+
"Annotation": "",
1363+
"Truncated": false,
1364+
"Highlighted": " - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
1365+
"FirstCause": false,
1366+
"LastCause": true
1367+
}
1368+
]
1369+
},
1370+
"RenderedCause": {}
1371+
}
1372+
},
1373+
{
1374+
"Type": "Helm Security Check",
1375+
"ID": "KSV118",
1376+
"AVDID": "AVD-KSV-0118",
1377+
"Title": "Default security context configured",
1378+
"Description": "Security context controls the allocation of security parameters for the pod/container/volume, ensuring the appropriate level of protection. Relying on default security context may expose vulnerabilities to potential attacks that rely on privileged access.",
1379+
"Message": "deployment nginx-deployment in default namespace is using the default security context, which allows root privileges",
1380+
"Namespace": "builtin.kubernetes.KSV118",
1381+
"Query": "data.builtin.kubernetes.KSV118.deny",
1382+
"Resolution": "To enhance security, it is strongly recommended not to rely on the default security context. Instead, it is advisable to explicitly define the required security parameters (such as runAsNonRoot, capabilities, readOnlyRootFilesystem, etc.) within the security context.",
1383+
"Severity": "HIGH",
1384+
"PrimaryURL": "https://avd.aquasec.com/misconfig/ksv118",
1385+
"References": [
1386+
"https://kubernetes.io/docs/tasks/configure-pod-container/security-context/",
1387+
"https://avd.aquasec.com/misconfig/ksv118"
1388+
],
1389+
"Status": "FAIL",
1390+
"Layer": {},
1391+
"CauseMetadata": {
1392+
"Provider": "Kubernetes",
1393+
"Service": "general",
1394+
"StartLine": 18,
1395+
"EndLine": 22,
1396+
"Code": {
1397+
"Lines": [
1398+
{
1399+
"Number": 18,
1400+
"Content": " containers:",
1401+
"IsCause": true,
1402+
"Annotation": "",
1403+
"Truncated": false,
1404+
"Highlighted": " \u001b[38;5;33mcontainers\u001b[0m:",
1405+
"FirstCause": true,
1406+
"LastCause": false
1407+
},
1408+
{
1409+
"Number": 19,
1410+
"Content": " - name: nginx",
1411+
"IsCause": true,
1412+
"Annotation": "",
1413+
"Truncated": false,
1414+
"Highlighted": " - \u001b[38;5;33mname\u001b[0m: nginx",
1415+
"FirstCause": false,
1416+
"LastCause": false
1417+
},
1418+
{
1419+
"Number": 20,
1420+
"Content": " image: nginx:1.14.2",
1421+
"IsCause": true,
1422+
"Annotation": "",
1423+
"Truncated": false,
1424+
"Highlighted": " \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
1425+
"FirstCause": false,
1426+
"LastCause": false
1427+
},
1428+
{
1429+
"Number": 21,
1430+
"Content": " ports:",
1431+
"IsCause": true,
1432+
"Annotation": "",
1433+
"Truncated": false,
1434+
"Highlighted": " \u001b[38;5;33mports\u001b[0m:",
1435+
"FirstCause": false,
1436+
"LastCause": false
1437+
},
1438+
{
1439+
"Number": 22,
1440+
"Content": " - containerPort: 80",
1441+
"IsCause": true,
1442+
"Annotation": "",
1443+
"Truncated": false,
1444+
"Highlighted": " - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
1445+
"FirstCause": false,
1446+
"LastCause": true
1447+
}
1448+
]
13261449
},
13271450
"RenderedCause": {}
13281451
}

‎integration/testdata/helm_testchart.json.golden

Lines changed: 130 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
"Type": "helm",
2323
"MisconfSummary": {
2424
"Successes": 90,
25-
"Failures": 8
25+
"Failures": 9
2626
},
2727
"Misconfigurations": [
2828
{
@@ -923,6 +923,135 @@
923923
},
924924
"RenderedCause": {}
925925
}
926+
},
927+
{
928+
"Type": "Helm Security Check",
929+
"ID": "KSV118",
930+
"AVDID": "AVD-KSV-0118",
931+
"Title": "Default security context configured",
932+
"Description": "Security context controls the allocation of security parameters for the pod/container/volume, ensuring the appropriate level of protection. Relying on default security context may expose vulnerabilities to potential attacks that rely on privileged access.",
933+
"Message": "deployment testchart in default namespace is using the default security context, which allows root privileges",
934+
"Namespace": "builtin.kubernetes.KSV118",
935+
"Query": "data.builtin.kubernetes.KSV118.deny",
936+
"Resolution": "To enhance security, it is strongly recommended not to rely on the default security context. Instead, it is advisable to explicitly define the required security parameters (such as runAsNonRoot, capabilities, readOnlyRootFilesystem, etc.) within the security context.",
937+
"Severity": "HIGH",
938+
"PrimaryURL": "https://avd.aquasec.com/misconfig/ksv118",
939+
"References": [
940+
"https://kubernetes.io/docs/tasks/configure-pod-container/security-context/",
941+
"https://avd.aquasec.com/misconfig/ksv118"
942+
],
943+
"Status": "FAIL",
944+
"Layer": {},
945+
"CauseMetadata": {
946+
"Provider": "Kubernetes",
947+
"Service": "general",
948+
"StartLine": 24,
949+
"EndLine": 57,
950+
"Code": {
951+
"Lines": [
952+
{
953+
"Number": 24,
954+
"Content": " serviceAccountName: testchart",
955+
"IsCause": true,
956+
"Annotation": "",
957+
"Truncated": false,
958+
"Highlighted": " \u001b[38;5;33mserviceAccountName\u001b[0m: testchart",
959+
"FirstCause": true,
960+
"LastCause": false
961+
},
962+
{
963+
"Number": 25,
964+
"Content": " securityContext:",
965+
"IsCause": true,
966+
"Annotation": "",
967+
"Truncated": false,
968+
"Highlighted": " \u001b[38;5;33msecurityContext\u001b[0m:",
969+
"FirstCause": false,
970+
"LastCause": false
971+
},
972+
{
973+
"Number": 26,
974+
"Content": " {}",
975+
"IsCause": true,
976+
"Annotation": "",
977+
"Truncated": false,
978+
"Highlighted": " {}",
979+
"FirstCause": false,
980+
"LastCause": false
981+
},
982+
{
983+
"Number": 27,
984+
"Content": " containers:",
985+
"IsCause": true,
986+
"Annotation": "",
987+
"Truncated": false,
988+
"Highlighted": " \u001b[38;5;33mcontainers\u001b[0m:",
989+
"FirstCause": false,
990+
"LastCause": false
991+
},
992+
{
993+
"Number": 28,
994+
"Content": " - name: testchart",
995+
"IsCause": true,
996+
"Annotation": "",
997+
"Truncated": false,
998+
"Highlighted": " - \u001b[38;5;33mname\u001b[0m: testchart",
999+
"FirstCause": false,
1000+
"LastCause": false
1001+
},
1002+
{
1003+
"Number": 29,
1004+
"Content": " securityContext:",
1005+
"IsCause": true,
1006+
"Annotation": "",
1007+
"Truncated": false,
1008+
"Highlighted": " \u001b[38;5;33msecurityContext\u001b[0m:",
1009+
"FirstCause": false,
1010+
"LastCause": false
1011+
},
1012+
{
1013+
"Number": 30,
1014+
"Content": " capabilities:",
1015+
"IsCause": true,
1016+
"Annotation": "",
1017+
"Truncated": false,
1018+
"Highlighted": " \u001b[38;5;33mcapabilities\u001b[0m:",
1019+
"FirstCause": false,
1020+
"LastCause": false
1021+
},
1022+
{
1023+
"Number": 31,
1024+
"Content": " drop:",
1025+
"IsCause": true,
1026+
"Annotation": "",
1027+
"Truncated": false,
1028+
"Highlighted": " \u001b[38;5;33mdrop\u001b[0m:",
1029+
"FirstCause": false,
1030+
"LastCause": false
1031+
},
1032+
{
1033+
"Number": 32,
1034+
"Content": " - ALL",
1035+
"IsCause": true,
1036+
"Annotation": "",
1037+
"Truncated": false,
1038+
"Highlighted": " - ALL",
1039+
"FirstCause": false,
1040+
"LastCause": true
1041+
},
1042+
{
1043+
"Number": 33,
1044+
"Content": "",
1045+
"IsCause": false,
1046+
"Annotation": "",
1047+
"Truncated": true,
1048+
"FirstCause": false,
1049+
"LastCause": false
1050+
}
1051+
]
1052+
},
1053+
"RenderedCause": {}
1054+
}
9261055
}
9271056
]
9281057
},

0 commit comments

Comments
 (0)