CVE-2024-35192 Trivy possibly leaks registry credential when scanning images from malicious registries

Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry ECR, Google Cloud Artifact/Contain...

CVE-2024-35192

CVE-2024-35192 affects Trivy prior to 0.51.2. Triggering image scans from a crafted malicious registry could leak credentials for registries (e.g., AWS ECR, Google Artifact/Container Registry, Azure ACR) to the user running Trivy. The tokens could be used to push/pull images from registries the u...

CVE-2024-35192 Trivy possibly leaks registry credential when scanning images from malicious registries

Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry ECR, Google Cloud Artifact/Contain...

CVE-2024-35192 Trivy possibly leaks registry credential when scanning images from malicious registries

Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry ECR, Google Cloud Artifact/Contain...

GHSA-XCQ4-M2R3-CMRJ Trivy possibly leaks registry credential when scanning images from malicious registries

Impact If a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry ECR, Google Cloud Artifact/Container Registry, or Azure Container Registr...

Trivy possibly leaks registry credential when scanning images from malicious registries

Impact If a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry ECR, Google Cloud Artifact/Container Registry, or Azure Container Registr...

PT-2024-26372 · Docker +3 · Docker +3

Name of the Vulnerable Software and Affected Versions: Trivy versions prior to 0.51.2 Description: A malicious actor can trigger Trivy to leak credentials for legitimate registries such as AWS Elastic Container Registry ECR, Google Cloud Artifact/Container Registry, or Azure Container Registry AC...

Aqua Security Trivy 安全漏洞

Aqua Security Trivy is a comprehensive and versatile security scanner from Aqua Security. A security vulnerability exists in Aqua Security Trivy versions prior to 0.51.2, which stems from a potential leak of registry credentials when scanning images from a malicious registry...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: helm-operator, wavefront-collector-for-kubernetes, dive, kube-bench, cert-manager-webhook-pdns, litefs, addon-resizer-fips, cert-exporter, kubernetes-dashboard-fips, boring-registry, dynamic-localpv-provisioner, prometheus-alertmanager, croc, frp, prometheus-adapter,...

Exploit for Embedded Malicious Code in Tukaani Xz

CVE-2024-3094 Malicious code was discovered in the upstream ta...

Exploit for Embedded Malicious Code in Tukaani Xz

CVE-2024-3094 Malicious code was discovered in the upstream ta...

CVE-2024-29018 vulnerabilities

Vulnerabilities for packages: cilium-cli, wolfictl, aactl, grype, ko, spire-server, tkn, zot, crossplane, spire-server-fips, cadvisor, buildkitd, conftest-fips, ctop, conftest, docker-compose, kubescape, dagger, syft, kargo, buf, prometheus, melange, up, cadvisor-fips, trivy, kaniko, loki...

GHSA-MQ39-4GV4-MVPX vulnerabilities

Vulnerabilities for packages: cilium-cli, wolfictl, aactl, grype, ko, spire-server, tkn, zot, crossplane, spire-server-fips, cadvisor, buildkitd, conftest-fips, ctop, conftest, docker-compose, kubescape, dagger, syft, kargo, buf, prometheus, melange, up, cadvisor-fips, trivy, kaniko, loki...

openSUSE: Security Advisory for trivy (openSUSE-SU-2022:10022-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for trivy (openSUSE-SU-2023:0064-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for trivy (openSUSE-SU-2022:10081-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-R53H-JV2G-VPX6 vulnerabilities

Vulnerabilities for packages: helm-operator, kubescape, cilium-cli, kots, chartmuseum, helm-push, flux-source-controller, k8sgpt, kubevela, eksctl, k9s, up, zot, trivy, zarf, flux-helm-controller...

GHSA-V53G-5GJP-272R vulnerabilities

Vulnerabilities for packages: k9s, k8sgpt, helm-operator, kubevela, kubescape, cilium-cli, trivy, flux-source-controller, helm-push, zarf, zot, flux-helm-controller, up, kots, chartmuseum, eksctl...

CVE-2024-25620 vulnerabilities

Vulnerabilities for packages: helm-operator, kubescape, cilium-cli, kots, chartmuseum, helm-push, flux-source-controller, k8sgpt, kubevela, eksctl, k9s, up, zot, trivy, zarf, flux-helm-controller...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: helm-operator, aactl, kots, helm-operator-fips, vexctl, pulumi, zot, policy-controller, zarf, cadvisor, buildkitd, k3s, helm, cosign-fips, policy-controller-fips, chartmuseum, ctop, k8sgpt, flux-image-reflector-controller, k3d, skaffold, guac, flux, helm-fips, gitsig...