🛡️ openSUSE-SU-2022:10081-1 — trivy (CVE-2022-1996)
Description
Security update for trivy
This update for trivy fixes the following issues:
trivy was updated to version 0.30.4:
- fix: remove the first arg when running as a plugin (#2595)
- fix: k8s controlplaner scanning (#2593)
- fix(vuln): GitLab report template (#2578)
Update to version 0.30.3:
- fix(server): use a new db worker for hot updates (#2581)
- docs: add trivy with download-db-only flag to Air-Gapped Environment (#2583)
- docs: split commands to download db for different versions of oras (#2582)
- feat(report): export exitcode for license checks (#2564)
- fix: cli can use lowercase for severities (#2565)
- fix: allow subcommands with TRIVY_RUN_AS_PLUGIN (#2577)
- fix: add missing types in TypeOSes and TypeLanguages in analyzer (#2569)
- fix: enable some features of the wasm runtime (#2575)
- fix(k8s): no error logged if trivy can't get docker image in kubernetes mode (#2521)
- docs(sbom): improve sbom attestation documentation (#2566)
Update to version 0.30.2:
- fix(report): show the summary without results (#2548)
- fix(cli): replace '-' to '_' for env vars (#2561)
Update to version 0.30.1:
- chore: remove a test repository (#2551)
- fix(license): lazy loading of classifiers (#2547)
- fix: CVE-2022-1996 in Trivy (#2499)
- docs(sbom): add sbom attestation (#2527)
- feat(rocky): set Rocky Linux 9 EOL (#2543)
- docs: add attributes to the video tag to autoplay demo videos (#2538)
- fix: yaml files with non-string chart name (#2534)
- fix: skip dirs (#2530)
- feat(repo): add support for branch, commit, & tag (#2494)
- fix: remove auto configure environment variables via viper (#2526)
Update to version 0.30.0:
- fix: separating multiple licenses from one line in dpkg copyright files (#2508)
- fix: change a capital letter for
plugin uninstallsubcommand (#2519) - fix: k8s hide empty report when scanning resource (#2517)
- refactor: fix comments (#2516)
- fix: scan vendor dir (#2515)
- feat: Add support for license scanning (#2418)
- chore: add owners for secret scanning (#2485)
- fix: remove dependency-tree flag for image subcommand (#2492)
- fix(k8s): add shorthand for k8s namespace flag (#2495)
- docs: add information about using multiple servers to troubleshooting (#2498)
- ci: add pushing canary build images to registries (#2428)
- feat(dotnet): add support for .Net core .deps.json files (#2487)
- feat(amazon): add support for 2022 version (#2429)
- Type correction bitnami chart (#2415)
- docs: add config file and update CLI references (#2489)
- feat: add support for flag groups (#2488)
- refactor: move from urfave/cli to spf13/cobra (#2458)
- fix: Fix secrets output not containing file/lines (#2467)
- fix: clear output with modules (#2478)
- docs(cbl): distroless 1.0 supported (#2473)
- fix: Fix example dockerfile rego policy (#2460)
- fix(config): add helm to list of config analyzers (#2457)
- feat: k8s resouces scan (#2395)
- feat(sbom): add cyclonedx sbom scan (#2203)
- docs: remove links to removed content (#2431)
- ci: added rpm build for rhel 9 (#2437)
- fix(secret): remove space from asymmetric private key (#2434)
- test(integration): fix golden files for debian 9 (#2435)
- fix(cli): fix version string in docs link when secret scanning is enabled (#2422)
- refactor: move CycloneDX marshaling (#2420)
- docs(nodejs): add docs about pnpm support (#2423)
- docs: improve k8s usage documentation (#2425)
- feat: Make secrets scanning output consistant (#2410)
- ci: create canary build after main branch changes (#1638)
- fix(misconf): skip broken scans (#2396)
- feat(nodejs): add pnpm support (#2414)
- fix: Fix false positive for use of COS images (#2413)
- eliminate nerdctl dependency (#2412)
- Add EOL date for SUSE SLES 15.3, 15.4 and OpenSUSE 15.4 (#2403)
- fix(go): no cast to lowercase go package names (#2401)
- BREAKING(sbom): change 'trivy sbom' to scan SBOM (#2408)
- fix(server): hot update the db from custom repository (#2406)
- feat: added license parser for dpkg (#2381)
- fix(misconf): Update defsec (v0.68.5) to fix docker rego duplicate key (#2400)
- feat: extract stripe publishable and secret keys (#2392)
- feat: rbac support k8s sub-command (#2339)
- feat(ruby): drop platform strings from dependency versions bundled with bundler v2 (#2390)
- docs: Updating README with new CLI command (#2359)
- fix(misconf): Update defsec to v0.68.4 to resolve CF detection bug (#2383)
- chore: add integration label and merge security label (#2316)
Update to version 0.29.2:
- chore: skip Visual Studio Code project folder (#2379)
- fix(helm): handle charts with templated names (#2374)
- docs: redirect operator docs to trivy-operator repo (#2372)
- fix(secret): use secret result when determining Failed status (#2370)
- try removing libdb-dev
- run integration tests in fanal
- use same testing images in fanal
- feat(helm): add support for trivy dbRepository (#2345)
- fix: Fix failing test due to deref lint issue
- test: Fix broken test
- fix: Fix makefile when no previous named ref is visible in a sha
Affected software
openSUSE-SU-2022:10081-1 is recorded against 1 package.
- trivy (fixed in 0.30.4-bp154.2.6.1)
Timeline and source
Published on 6 August 2022 and last revised on 7 May 2025. No public exploit is currently recorded for this entry. Record sourced from OSV.
References
Details
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| trivy | — | 0.30.4-bp154.2.6.1 |
References
Similar Threats
- Unknown CGA-2j38-cxfp-c8p6
- Unknown CGA-2mv5-7p9w-vp27
- Unknown CGA-33qc-7m28-fvwr
- Unknown CGA-37xx-2fqv-rjhr
- Unknown CGA-382c-27vm-3c8m
Free Vulnerability Check
Is your site affected by openSUSE-SU-2022:10081-1?
BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against openSUSE-SU-2022:10081-1 and other known CVE records.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.