SB2024052091 - Insufficiently protected credentials in trivy

Description

This security bulletin contains information about 1 security vulnerability.

1) Insufficiently protected credentials (CVE-ID: CVE-2024-35192)

The vulnerability allows a remote attacker to disclose sensitive credentials.

The vulnerability exists due to insufficiently protected credentials in the registry scanning functionality when scanning container images from a crafted malicious registry. A remote attacker can trigger Trivy to scan a malicious registry image to disclose sensitive credentials.

This only applies when scanning container images directly from a registry, and user interaction is required to initiate the scan.

Remediation

Install update from vendor's website.

References

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-xcq4-m2r3-cmrj
• https://github.com/advisories/GHSA-xcq4-m2r3-cmrj