🛡️ openSUSE-SU-2024:0268-1 — trivy (CVE-2023-42363 +2 more)

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Security update for trivy

trivy was updated to fix the following issues:

Update to version 0.54.1:

  • fix(flag): incorrect behavior for deprected flag --clear-cache [backport: release/v0.54] (#7285)
  • fix(java): Return error when trying to find a remote pom to avoid segfault [backport: release/v0.54] (#7283)
  • fix(plugin): do not call GitHub content API for releases and tags [backport: release/v0.54] (#7279)
  • docs: update ecosystem page reporting with plopsec.com app (#7262)
  • feat(vex): retrieve VEX attestations from OCI registries (#7249)
  • feat(sbom): add image labels into SPDX and CycloneDX reports (#7257)
  • refactor(flag): return error if both --download-db-only and --download-java-db-only are specified (#7259)
  • fix(nodejs): detect direct dependencies when using latest version for files yarn.lock + package.json (#7110)
  • chore: show VEX notice for OSS maintainers in CI environments (#7246)
  • feat(vuln): add --pkg-relationships (#7237)
  • docs: show VEX cli pages + update config file page for VEX flags (#7244)
  • fix(dotnet): show nuget package dir not found log only when checking nuget packages (#7194)
  • feat(vex): VEX Repository support (#7206)
  • fix(secret): skip regular strings contain secret patterns (#7182)
  • feat: share build-in rules (#7207)
  • fix(report): hide empty table when all secrets/license/misconfigs are ignored (#7171)
  • fix(cli): error on missing config file (#7154)
  • fix(secret): update length of hugging-face-access-token (#7216)
  • feat(sbom): add vulnerability support for SPDX formats (#7213)
  • fix(secret): trim excessively long lines (#7192)
  • chore(vex): update subcomponents for CVE-2023-42363/42364/42365/42366 (#7201)
  • fix(server): pass license categories to options (#7203)
  • feat(mariner): Add support for Azure Linux (#7186)
  • docs: updates config file (#7188)
  • refactor(fs): remove unused field for CompositeFS (#7195)
  • fix: add missing platform and type to spec (#7149)
  • feat(misconf): enabled China configuration for ACRs (#7156)
  • fix: close file when failed to open gzip (#7164)
  • docs: Fix PR documentation to use GitHub Discussions, not Issues (#7141)
  • docs(misconf): add info about limitations for terraform plan json (#7143)
  • chore: add VEX for Trivy images (#7140)
  • chore: add VEX document and generator for Trivy (#7128)
  • fix(misconf): do not evaluate TF when a load error occurs (#7109)
  • feat(cli): rename --vuln-type flag to --pkg-types flag (#7104)
  • refactor(secret): move warning about file size after IsBinary check (#7123)
  • feat: add openSUSE tumbleweed detection and scanning (#6965)
  • test: add missing advisory details for integration tests database (#7122)
  • fix: Add dependencyManagement exclusions to the child exclusions (#6969)
  • fix: ignore nodes when listing permission is not allowed (#7107)
  • fix(java): use go-mvn-version to remove Package duplicates (#7088)
  • refactor(secret): add warning about large files (#7085)
  • feat(nodejs): add license parser to pnpm analyser (#7036)
  • refactor(sbom): add sbom prefix + filepaths for decode log messages (#7074)
  • feat: add log.FilePath() function for logger (#7080)
  • chore: bump golangci-lint from v1.58 to v1.59 (#7077)
  • perf(debian): use bytes.Index in emptyLineSplit to cut allocation (#7065)
  • refactor: pass DB dir to trivy-db (#7057)
  • docs: navigate to the release highlights and summary (#7072)

Update to version 0.53.0 (bsc#1227022, CVE-2024-6257):

  • feat(conda): add licenses support for environment.yml files (#6953)
  • fix(sbom): fix panic when scanning SBOM file without root component into SBOM format (#7051)
  • feat: add memory cache backend (#7048)
  • fix(sbom): use package UIDs for uniqueness (#7042)
  • feat(php): add installed.json file support (#4865)
  • docs: ✨ Updated ecosystem docs with reference to new community app (#7041)
  • fix: use embedded when command path not found (#7037)
  • refactor: use google/wire for cache (#7024)
  • fix(cli): show info message only when --scanners is available (#7032)
  • chore: enable float-compare rule from testifylint (#6967)
  • docs: Add sudo on commands, chmod before mv on install docs (#7009)
  • fix(plugin): respect --insecure (#7022)
  • feat(k8s)!: node-collector dynamic commands support (#6861)
  • fix(sbom): take pkg name from purl for maven pkgs (#7008)
  • feat!: add clean subcommand (#6993)
  • chore: use ! for breaking changes (#6994)
  • feat(aws)!: Remove aws subcommand (#6995)
  • refactor: replace global cache directory with parameter passing (#6986)
  • fix(sbom): use purl for bitnami pkg names (#6982)
  • chore: bump Go toolchain version (#6984)
  • refactor: unify cache implementations (#6977)
  • docs: non-packaged and sbom clarifications (#6975)
  • BREAKING(aws): Deprecate trivy aws as subcmd in favour of a plugin (#6819)
  • docs: delete unknown URL (#6972)
  • refactor: use version-specific URLs for documentation references (#6966)
  • refactor: delete db mock (#6940)
  • refactor: add warning if severity not from vendor (or NVD or

Affected software

openSUSE-SU-2024:0268-1 is recorded against 1 package.

  • trivy (fixed in 0.54.1-bp155.2.3.1)

Timeline and source

Published on 30 August 2024 and last revised on 4 February 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

lists.opensuse.org (Advisory)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
www.suse.com (Web)
www.suse.com (Web)
www.suse.com (Web)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2024-08-30
Updated 2026-08-20
Modified 2026-02-04
Fix URL N/A

Affected Packages

Software From version Fixed in
trivy 0.54.1-bp155.2.3.1

Similar Threats

Free Vulnerability Check

Is your site affected by openSUSE-SU-2024:0268-1?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against openSUSE-SU-2024:0268-1 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesSUSESUSE 2024