Mismatch in the Trivy scan output using different machines. #4873

faizu6 · 2023-07-27T07:53:15Z

faizu6
Jul 27, 2023

Question

I am scanning a repository using my local machine and my developer is also scanning the same repository from his machine but we are getting totally different vulnerable package, also the numbers don't match.

                                                        **SCAN FROM MY MACHINE;**

faizu@ABC-BCD:~$ trivy version
Version: 0.43.1
Vulnerability DB:
Version: 2
UpdatedAt: 2023-07-27 06:09:32.049418175 +0000 UTC
NextUpdate: 2023-07-27 12:09:32.049417675 +0000 UTC
DownloadedAt: 2023-07-27 06:49:49.577018082 +0000 UTC

faizu@ABC-BCD:~$ trivy repo --branch GL-8-SpringBoot-Upgrade https://bitbucket.org/xi/data/src/master/
2023-07-27T12:33:57.093+0530 INFO Vulnerability scanning is enabled
2023-07-27T12:33:57.093+0530 INFO Secret scanning is enabled
2023-07-27T12:33:57.093+0530 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-07-27T12:33:57.093+0530 INFO Please see also https://aquasecurity.github.io/trivy/v0.43/docs/scanner/secret/#recommendation for faster secret detection
2023-07-27T12:34:02.299+0530 INFO Number of language-specific files: 1
2023-07-27T12:34:02.299+0530 INFO Detecting pom vulnerabilities...

pom.xml (pom)

Total: 42 (UNKNOWN: 0, LOW: 0, MEDIUM: 11, HIGH: 10, CRITICAL: 21)

┌─────────────────────────────────────────────┬──────────────────┬──────────┬───────────────────┬─────────────────────────────────────────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
├─────────────────────────────────────────────┼──────────────────┼──────────┼───────────────────┼─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ com.fasterxml.jackson.core:jackson-databind │ CVE-2017-15095 │ CRITICAL │ 2.6.4 │ 2.7.9.2, 2.8.10, 2.9.1 │ jackson-databind: Unsafe deserialization due to incomplete │
│ │ │ │ │ │ black list (incomplete fix for CVE-2017-7525)... │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2017-15095 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2017-7525 │ │ │ 2.6.7.1, 2.7.9.1, 2.8.9 │ Deserialization vulnerability via readValue method of │
│ │ │ │ │ │ ObjectMapper │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2017-7525 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2018-11307 │ │ │ 2.7.9.4, 2.8.11.2, 2.9.6 │ jackson-databind: Potential information exfiltration with │
│ │ │ │ │ │ default typing, serialization gadget from MyBatis │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-11307 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2018-14718 │ │ │ 2.6.7.2, 2.9.7 │ jackson-databind: arbitrary code execution in slf4j-ext │
│ │ │ │ │ │ class │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-14718 │
│ ├──────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2018-14719 │ │ │ │ jackson-databind: arbitrary code execution in blaze-ds-opt │
│ │ │ │ │ │ and blaze-ds-core classes │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-14719 │
│ ├──────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2018-14720 │ │ │ │ jackson-databind: exfiltration/XXE in some JDK classes │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-14720 │
│ ├──────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2018-14721 │ │ │ │ jackson-databind: server-side request forgery (SSRF) in │
│ │ │ │ │ │ axis2-jaxws class │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-14721 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2018-19360 │ │ │ 2.6.7.3, 2.7.9.5, 2.8.11.3, 2.9.8 │ jackson-databind: improper polymorphic deserialization in │
│ │ │ │ │ │ axis2-transport-jms class │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-19360 │
│ ├──────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2018-19361 │ │ │ │ jackson-databind: improper polymorphic deserialization in │
│ │ │ │ │ │ openjpa class │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-19361 │
│ ├──────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2018-19362 │ │ │ │ jackson-databind: improper polymorphic deserialization in │
│ │ │ │ │ │ jboss-common-core class │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-19362 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2018-7489 │ │ │ 2.7.9.3, 2.8.11.1, 2.9.5 │ jackson-databind: incomplete fix for CVE-2017-7525 permits │
│ │ │ │ │ │ unsafe serialization via c3p0 libraries │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-7489 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-14540 │ │ │ 2.9.10 │ jackson-databind: Serialization gadgets in │
│ │ │ │ │ │ com.zaxxer.hikari.HikariConfig │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-14540 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-14893 │ │ │ 2.8.11.5, 2.9.10 │ jackson-databind: Serialization gadgets in classes of the │
│ │ │ │ │ │ xalan package │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-14893 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-16335 │ │ │ 2.9.10 │ jackson-databind: Serialization gadgets in │
│ │ │ │ │ │ com.zaxxer.hikari.HikariDataSource │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-16335 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-16942 │ │ │ 2.9.10.1 │ jackson-databind: Serialization gadgets in │
│ │ │ │ │ │ org.apache.commons.dbcp.datasources.* │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-16942 │
│ ├──────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-16943 │ │ │ │ jackson-databind: Serialization gadgets in │
│ │ │ │ │ │ com.p6spy.engine.spy.P6DataSource │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-16943 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-17267 │ │ │ 2.9.10 │ jackson-databind: Serialization gadgets in classes of the │
│ │ │ │ │ │ ehcache package │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-17267 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-17531 │ │ │ 2.9.10.1 │ jackson-databind: Serialization gadgets in │
│ │ │ │ │ │ org.apache.log4j.receivers.db.* │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-17531 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-20330 │ │ │ 2.8.11.5, 2.9.10.2 │ jackson-databind: lacks certain net.sf.ehcache blocking │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-20330 │
│ ├──────────────────┼──────────┤ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2018-5968 │ HIGH │ │ 2.7.9.5, 2.8.11.1, 2.9.4 │ jackson-databind: unsafe deserialization due to incomplete │
│ │ │ │ │ │ blacklist (incomplete fix for CVE-2017-7525 and... │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-5968 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2020-10650 │ │ │ 2.9.10.4 │ A deserialization flaw was discovered in jackson-databind │
│ │ │ │ │ │ through 2.9. ... │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-10650 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2020-10673 │ │ │ 2.6.7.4, 2.9.10.4 │ jackson-databind: mishandles the interaction between │
│ │ │ │ │ │ serialization gadgets and typing which could result... │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-10673 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2020-25649 │ │ │ 2.6.7.4, 2.9.10.7, 2.10.5.1 │ jackson-databind: FasterXML DOMDeserializer insecure entity │
│ │ │ │ │ │ expansion is vulnerable to XML external entity... │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-25649 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2020-35490 │ │ │ 2.9.10.8 │ jackson-databind: mishandles the interaction between │
│ │ │ │ │ │ serialization gadgets and typing, related to │
│ │ │ │ │ │ org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.- │
│ │ │ │ │ │ .. │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-35490 │
│ ├──────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2020-35491 │ │ │ │ jackson-databind: mishandles the interaction between │
│ │ │ │ │ │ serialization gadgets and typing, related to │
│ │ │ │ │ │ org.apache.commons.dbcp2.datasources.SharedPoolDataSource... │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-35491 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2020-36518 │ │ │ 2.12.6.1, 2.13.2.1 │ denial of service via a large depth of nested objects │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-36518 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2022-42003 │ │ │ 2.12.7.1, 2.13.4.1 │ deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-42003 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2022-42004 │ │ │ 2.12.7.1, 2.13.4 │ use of deeply nested arrays │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-42004 │
│ ├──────────────────┼──────────┤ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2018-1000873 │ MEDIUM │ │ 2.9.8 │ jackson-modules-java8: DoS due to an Improper Input │
│ │ │ │ │ │ Validation │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-1000873 │
├─────────────────────────────────────────────┼──────────────────┼──────────┼───────────────────┼─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ org.springframework:spring-beans │ CVE-2022-22965 │ CRITICAL │ 5.2.0.RELEASE │ 5.2.20, 5.3.18 │ RCE via Data Binding on JDK 9+ │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-22965 │
├─────────────────────────────────────────────┤ │ │ │ │ │
│ org.springframework:spring-core │ │ │ │ │ │
│ │ │ │ │ │ │
│ ├──────────────────┼──────────┤ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2021-22118 │ HIGH │ │ 5.2.15, 5.3.7 │ spring-web: (re)creating the temporary storage directory │
│ │ │ │ │ │ could result in a privilege... │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-22118 │
│ ├──────────────────┼──────────┤ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2020-5421 │ MEDIUM │ │ 4.3.29.RELEASE, 5.0.19.RELEASE, 5.1.18.RELEASE, │ springframework: RFD protection bypass via jsessionid │
│ │ │ │ │ 5.2.9.RELEASE │ https://avd.aquasec.com/nvd/cve-2020-5421 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2021-22060 │ │ │ 5.3.14, 5.3.14 │ springframework: Additional Log Injection in Spring │
│ │ │ │ │ │ Framework (follow-up to CVE-2021-22096) │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-22060 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2021-22096 │ │ │ 5.2.18, 5.3.11 │ springframework: malicious input leads to insertion of │
│ │ │ │ │ │ additional log entries │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-22096 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2022-22950 │ │ │ 5.2.20.RELEASE, 5.3.17 │ spring-expression: Denial of service via specially crafted │
│ │ │ │ │ │ SpEL expression │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-22950 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2022-22968 │ │ │ 5.2.21, 5.3.19 │ Spring Framework: Data Binding Rules Vulnerability │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-22968 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2022-22970 │ │ │ 5.2.22.RELEASE, 5.3.20 │ DoS via data binding to multipartFile or servlet part │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-22970 │
│ ├──────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2022-22971 │ │ │ │ DoS with STOMP over WebSocket │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-22971 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2023-20861 │ │ │ 5.3.26, 6.0.7, 5.2.23.RELEASE │ Spring Expression DoS Vulnerability │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-20861 │
│ ├──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2023-20863 │ │ │ 5.3.27, 6.0.8, 5.2.24.RELEASE │ Spring Expression DoS Vulnerability │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-20863 │
├─────────────────────────────────────────────┼──────────────────┤ │ ├─────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ org.springframework:spring-expression │ CVE-2022-22950 │ │ │ 5.2.20, 5.3.16 │ spring-expression: Denial of service via specially crafted │
│ │ │ │ │ │ SpEL expression │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-22950 │
└─────────────────────────────────────────────┴──────────────────┴──────────┴───────────────────┴─────────────────────────────────────────────────┴──────────────────────────────────────────────────────────────┘

                                     **SCAN FROM DEVELOPERS MACHINE;**

maggi@ABC-DEF:~$ trivy --version
Version: 0.43.1
Vulnerability DB:
Version: 2
UpdatedAt: 2023-07-27 06:09:32.049418175 +0000 UTC
NextUpdate: 2023-07-27 12:09:32.049417675 +0000 UTC
DownloadedAt: 2023-07-27 06:52:11.103906291 +0000 UTC
Java DB:
Version: 1
UpdatedAt: 2023-07-24 00:52:18.487469647 +0000 UTC
NextUpdate: 2023-07-27 00:52:18.487469147 +0000 UTC
DownloadedAt: 2023-07-24 08:10:46.475325063 +0000 UTC
Policy Bundle:
Digest: sha256:829832357626da2677955e3b427191212978ba20012b6eaa03229ca28569ae43
DownloadedAt: 2023-07-19 08:19:29.582606785 +0000 UTC

maggi@ABC-DEF:~$ trivy repo --branch GL-8-SpringBoot-Upgrade https://bitbucket.org/xi/data/src/master/
2023-07-27T12:35:45.019+0530 INFO Vulnerability scanning is enabled
2023-07-27T12:35:45.019+0530 INFO Secret scanning is enabled
2023-07-27T12:35:45.019+0530 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-07-27T12:35:45.019+0530 INFO Please see also https://aquasecurity.github.io/trivy/v0.43/docs/scanner/secret/#recommendation for faster secret detection
2023-07-27T12:36:04.055+0530 INFO Number of language-specific files: 1
2023-07-27T12:36:04.056+0530 INFO Detecting pom vulnerabilities...

pom.xml (pom)

Total: 5 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 2, CRITICAL: 1)

┌────────────────────────────────┬──────────────────┬──────────┬───────────────────┬────────────────────────────┬─────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
├────────────────────────────────┼──────────────────┼──────────┼───────────────────┼────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ com.google.guava:guava │ CVE-2023-2976 │ HIGH │ 21.0 │ 32.0.0 │ insecure temporary directory creation │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-2976 │
│ ├──────────────────┼──────────┤ ├────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ │ CVE-2018-10237 │ MEDIUM │ │ 24.1.1-jre, 24.1.1-android │ guava: Unbounded memory allocation in AtomicDoubleArray and │
│ │ │ │ │ │ CompoundOrdering classes allow remote attackers... │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-10237 │
│ ├──────────────────┼──────────┤ ├────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ │ CVE-2020-8908 │ LOW │ │ 30.0 │ guava: local information disclosure via temporary directory │
│ │ │ │ │ │ created with unsafe permissions │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-8908 │
├────────────────────────────────┼──────────────────┼──────────┼───────────────────┼────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ com.h2database:h2 │ CVE-2022-45868 │ HIGH │ 2.1.214 │ 2.2.220 │ The web-based admin console in H2 Database Engine through │
│ │ │ │ │ │ 2.1.214 can ... │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-45868 │
├────────────────────────────────┼──────────────────┼──────────┼───────────────────┼────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ org.springframework:spring-web │ CVE-2016-1000027 │ CRITICAL │ 5.3.27 │ 6.0.0 │ spring: HttpInvokerServiceExporter readRemoteInvocation │
│ │ │ │ │ │ method untrusted java deserialization │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2016-1000027 │

It can also be noticed that the vulnerable packages found are mismatching.
There is a difference in the output of Trivy --version command as shown above;
i don't know the reason for this mismatch and what is the effect of these kindly explain that as well.

Target

Git Repository

Scanner

Vulnerability

Output Format

Table

Mode

Standalone

Operating System

ubuntu 20.04

Version

No response

knqyf263 · 2023-07-27T12:13:42Z

knqyf263
Jul 27, 2023
Maintainer

Could you try mvn install and run Trivy. If you want us to take a deeper look, please share your pom.xml with us. You can mask sensitive info.

2 replies

faizu6 Jul 27, 2023
Author

@knqyf263 I installed the mvn using sudo apt install maven but still the difference is there. Can you please tell me why is there a difference between my trivy --version and developers trivy --version output

my output
faizu@ABC-BCD:~$ trivy version
Version: 0.43.1
Vulnerability DB:
Version: 2
UpdatedAt: 2023-07-27 06:09:32.049418175 +0000 UTC
NextUpdate: 2023-07-27 12:09:32.049417675 +0000 UTC
DownloadedAt: 2023-07-27 06:49:49.577018082 +0000 UTC

developers output
maggi@ABC-DEF:~$ trivy --version
Version: 0.43.1
Vulnerability DB:
Version: 2
UpdatedAt: 2023-07-27 06:09:32.049418175 +0000 UTC
NextUpdate: 2023-07-27 12:09:32.049417675 +0000 UTC
DownloadedAt: 2023-07-27 06:52:11.103906291 +0000 UTC
Java DB:
Version: 1
UpdatedAt: 2023-07-24 00:52:18.487469647 +0000 UTC
NextUpdate: 2023-07-27 00:52:18.487469147 +0000 UTC
DownloadedAt: 2023-07-24 08:10:46.475325063 +0000 UTC
Policy Bundle:
Digest: sha256:829832357626da2677955e3b427191212978ba20012b6eaa03229ca28569ae43
DownloadedAt: 2023-07-19 08:19:29.582606785 +0000 UTC

knqyf263 Jul 30, 2023
Maintainer

It just depends on the local cache. If you run trivy conf, the policy bundle is cached. If you scan JAR applications, you will see the Java DB with --version.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Mismatch in the Trivy scan output using different machines. #4873

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Mismatch in the Trivy scan output using different machines. #4873

Uh oh!

faizu6 Jul 27, 2023

Question

Target

Scanner

Output Format

Mode

Operating System

Version

Replies: 1 comment · 2 replies

Uh oh!

knqyf263 Jul 27, 2023 Maintainer

Uh oh!

faizu6 Jul 27, 2023 Author

Uh oh!

knqyf263 Jul 30, 2023 Maintainer

faizu6
Jul 27, 2023

Replies: 1 comment 2 replies

knqyf263
Jul 27, 2023
Maintainer

faizu6 Jul 27, 2023
Author

knqyf263 Jul 30, 2023
Maintainer