🛡️ openSUSE-SU-2024:0268-1 — trivy (CVE-2023-42363 +2 more)
Description
Security update for trivy
trivy was updated to fix the following issues:
Update to version 0.54.1:
- fix(flag): incorrect behavior for deprected flag
--clear-cache[backport: release/v0.54] (#7285) - fix(java): Return error when trying to find a remote pom to avoid segfault [backport: release/v0.54] (#7283)
- fix(plugin): do not call GitHub content API for releases and tags [backport: release/v0.54] (#7279)
- docs: update ecosystem page reporting with plopsec.com app (#7262)
- feat(vex): retrieve VEX attestations from OCI registries (#7249)
- feat(sbom): add image labels into
SPDXandCycloneDXreports (#7257) - refactor(flag): return error if both
--download-db-onlyand--download-java-db-onlyare specified (#7259) - fix(nodejs): detect direct dependencies when using
latestversion for filesyarn.lock+package.json(#7110) - chore: show VEX notice for OSS maintainers in CI environments (#7246)
- feat(vuln): add
--pkg-relationships(#7237) - docs: show VEX cli pages + update config file page for VEX flags (#7244)
- fix(dotnet): show
nuget package dir not foundlog only when checkingnugetpackages (#7194) - feat(vex): VEX Repository support (#7206)
- fix(secret): skip regular strings contain secret patterns (#7182)
- feat: share build-in rules (#7207)
- fix(report): hide empty table when all secrets/license/misconfigs are ignored (#7171)
- fix(cli): error on missing config file (#7154)
- fix(secret): update length of
hugging-face-access-token(#7216) - feat(sbom): add vulnerability support for SPDX formats (#7213)
- fix(secret): trim excessively long lines (#7192)
- chore(vex): update subcomponents for CVE-2023-42363/42364/42365/42366 (#7201)
- fix(server): pass license categories to options (#7203)
- feat(mariner): Add support for Azure Linux (#7186)
- docs: updates config file (#7188)
- refactor(fs): remove unused field for CompositeFS (#7195)
- fix: add missing platform and type to spec (#7149)
- feat(misconf): enabled China configuration for ACRs (#7156)
- fix: close file when failed to open gzip (#7164)
- docs: Fix PR documentation to use GitHub Discussions, not Issues (#7141)
- docs(misconf): add info about limitations for terraform plan json (#7143)
- chore: add VEX for Trivy images (#7140)
- chore: add VEX document and generator for Trivy (#7128)
- fix(misconf): do not evaluate TF when a load error occurs (#7109)
- feat(cli): rename
--vuln-typeflag to--pkg-typesflag (#7104) - refactor(secret): move warning about file size after
IsBinarycheck (#7123) - feat: add openSUSE tumbleweed detection and scanning (#6965)
- test: add missing advisory details for integration tests database (#7122)
- fix: Add dependencyManagement exclusions to the child exclusions (#6969)
- fix: ignore nodes when listing permission is not allowed (#7107)
- fix(java): use
go-mvn-versionto removePackageduplicates (#7088) - refactor(secret): add warning about large files (#7085)
- feat(nodejs): add license parser to pnpm analyser (#7036)
- refactor(sbom): add sbom prefix + filepaths for decode log messages (#7074)
- feat: add
log.FilePath()function for logger (#7080) - chore: bump golangci-lint from v1.58 to v1.59 (#7077)
- perf(debian): use
bytes.IndexinemptyLineSplitto cut allocation (#7065) - refactor: pass DB dir to trivy-db (#7057)
- docs: navigate to the release highlights and summary (#7072)
Update to version 0.53.0 (bsc#1227022, CVE-2024-6257):
- feat(conda): add licenses support for
environment.ymlfiles (#6953) - fix(sbom): fix panic when scanning SBOM file without root component into SBOM format (#7051)
- feat: add memory cache backend (#7048)
- fix(sbom): use package UIDs for uniqueness (#7042)
- feat(php): add installed.json file support (#4865)
- docs: ✨ Updated ecosystem docs with reference to new community app (#7041)
- fix: use embedded when command path not found (#7037)
- refactor: use google/wire for cache (#7024)
- fix(cli): show info message only when --scanners is available (#7032)
- chore: enable float-compare rule from testifylint (#6967)
- docs: Add sudo on commands, chmod before mv on install docs (#7009)
- fix(plugin): respect
--insecure(#7022) - feat(k8s)!: node-collector dynamic commands support (#6861)
- fix(sbom): take pkg name from
purlfor maven pkgs (#7008) - feat!: add clean subcommand (#6993)
- chore: use
!for breaking changes (#6994) - feat(aws)!: Remove aws subcommand (#6995)
- refactor: replace global cache directory with parameter passing (#6986)
- fix(sbom): use
purlforbitnamipkg names (#6982) - chore: bump Go toolchain version (#6984)
- refactor: unify cache implementations (#6977)
- docs: non-packaged and sbom clarifications (#6975)
- BREAKING(aws): Deprecate
trivy awsas subcmd in favour of a plugin (#6819) - docs: delete unknown URL (#6972)
- refactor: use version-specific URLs for documentation references (#6966)
- refactor: delete db mock (#6940)
- refactor: add warning if severity not from vendor (or NVD or
Affected software
openSUSE-SU-2024:0268-1 is recorded against 1 package.
- trivy (fixed in 0.54.1-bp155.2.3.1)
Timeline and source
Published on 30 August 2024 and last revised on 4 February 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.
References
lists.opensuse.org (Advisory)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
www.suse.com (Web)
www.suse.com (Web)
www.suse.com (Web)
Details
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| trivy | — | 0.54.1-bp155.2.3.1 |
Similar Threats
- Unknown CGA-2j38-cxfp-c8p6
- Unknown CGA-2mv5-7p9w-vp27
- Unknown CGA-33qc-7m28-fvwr
- Unknown CGA-37xx-2fqv-rjhr
- Unknown CGA-382c-27vm-3c8m
Free Vulnerability Check
Is your site affected by openSUSE-SU-2024:0268-1?
BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against openSUSE-SU-2024:0268-1 and other known CVE records.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.