Trivy rootfs vuln scanner always returning the same result for OS and LIBRARY vulnerabilities #8011

Thesohan · 2024-11-29T04:38:14Z

Thesohan
Nov 29, 2024

Description

Logs of latest run, I'm using latest version of trivy: 0.57.1

evel=info msg="(i-09c705306d25f0e72) scanning instance for library vulnerabilities" Nov 29 03:56:37 outposts: 2024-11-29T03:56:37Z DEBUG DB update was skipped because the local DB is the latest Nov 29 03:56:37 outposts: 2024-11-29T03:56:37Z DEBUG DB info schema=2 updated_at=2024-11-29T00:22:44.888105691Z next_update=2024-11-30T00:22:44.88810529Zdownloaded_at=2024-11-29T03:10:30.318570819Z Nov 29 03:56:37 outposts: 2024-11-29T03:56:37Z INFO [vuln] Vulnerability scanning is enabled Nov 29 03:56:37 outposts: 2024-11-29T03:56:37Z DEBUG Enabling misconfiguration scanners scanners=[] Nov 29 03:56:37 outposts: 2024-11-29T03:56:37Z DEBUG Initializing scan cache... type="fs" Nov 29 03:56:37 outposts: 2024-11-29T03:56:37Z DEBUG Skipping path path="dev" Nov 29 03:56:37 outposts: 2024-11-29T03:56:37Z DEBUG Skipping path path="proc" Nov 29 03:56:38 outposts: 2024-11-29T03:56:38Z DEBUG Skipping path path="sys" Nov 29 03:56:46 outposts: 2024-11-29T03:56:46Z DEBUG [gobinary] Unable to detect main module's dependency version - (devel)is used dependency="github.com/snapcore/snapd" Nov 29 03:56:46 outposts: 2024-11-29T03:56:46Z DEBUG [gobinary] Parsing dependency's build info settings dependency="github.com/snapcore/snapd" -ldflags=[-w] Nov 29 03:56:46 outposts: 2024-11-29T03:56:46Z DEBUG [gobinary] Unable to detect dependency version.-ldflagsbuild info settings don't contain version flag. Empty version used. dependency="github.com/snapcore/snapd" Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z DEBUG [analyzer] Analysis error err="go binary (filepath: usr/lib/klibc/bin/cat) parse error: failed to parse usr/lib/klibc/bin/cat: failed to parse usr/lib/klibc/bin/cat: EOF" Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z DEBUG [analyzer] Analysis error err="go binary (filepath: usr/lib/klibc/bin/kill) parse error: failed to parse usr/lib/klibc/bin/kill: failed to parse usr/lib/klibc/bin/kill: EOF" Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z DEBUG [analyzer] Analysis error err="go binary (filepath: usr/lib/klibc/bin/losetup) parse error: failed to parse usr/lib/klibc/bin/losetup: failed to parse usr/lib/klibc/bin/losetup: EOF" Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z DEBUG [analyzer] Analysis error err="go binary (filepath: usr/lib/klibc/bin/minips) parse error: failed toparse usr/lib/klibc/bin/minips: failed to parse usr/lib/klibc/bin/minips: EOF" Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z DEBUG [analyzer] Analysis error err="go binary (filepath: usr/lib/klibc/bin/mkdir) parse error: failed to parse usr/lib/klibc/bin/mkdir: failed to parse usr/lib/klibc/bin/mkdir: EOF" Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z DEBUG [analyzer] Analysis error err="go binary (filepath: usr/lib/klibc/bin/mkfifo) parse error: failed toparse usr/lib/klibc/bin/mkfifo: failed to parse usr/lib/klibc/bin/mkfifo: EOF" Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z DEBUG [analyzer] Analysis error err="go binary (filepath: usr/lib/klibc/bin/mknod) parse error: failed to parse usr/lib/klibc/bin/mknod: failed to parse usr/lib/klibc/bin/mknod: EOF" Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z DEBUG [analyzer] Analysis error err="go binary (filepath: usr/lib/klibc/bin/mount) parse error: failed to parse usr/lib/klibc/bin/mount: failed to parse usr/lib/klibc/bin/mount: EOF" Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z DEBUG [analyzer] Analysis error err="go binary (filepath: usr/lib/klibc/bin/readlink) parse error: failed to parse usr/lib/klibc/bin/readlink: failed to parse usr/lib/klibc/bin/readlink: EOF" Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z DEBUG [analyzer] Analysis error err="go binary (filepath: usr/lib/klibc/bin/resume) parse error: failed toparse usr/lib/klibc/bin/resume: failed to parse usr/lib/klibc/bin/resume: EOF" Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z DEBUG [analyzer] Analysis error err="go binary (filepath: usr/lib/klibc/bin/umount) parse error: failed toparse usr/lib/klibc/bin/umount: failed to parse usr/lib/klibc/bin/umount: EOF" Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Unable to detect main module's dependency version -(devel)is used dependency="github.com/snapcore/snapd" Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Parsing dependency's build info settings dependency="github.com/snapcore/snapd" -ldflags=[-w] Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Unable to detect dependency version.-ldflagsbuild info settings don't contain version flag. Empty version used. dependency="github.com/snapcore/snapd" Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Unable to detect main module's dependency version -(devel)is used dependency="github.com/snapcore/snapd" Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Parsing dependency's build info settings dependency="github.com/snapcore/snapd" -ldflags=[] Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Unable to detect dependency version.-ldflagsbuild info settings don't contain version flag. Empty version used. dependency="github.com/snapcore/snapd" Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Unable to detect main module's dependency version -(devel)is used dependency="github.com/snapcore/snapd" Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Parsing dependency's build info settings dependency="github.com/snapcore/snapd" -ldflags=[-w] Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Unable to detect dependency version.-ldflagsbuild info settings don't contain version flag. Empty version used. dependency="github.com/snapcore/snapd" Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Unable to detect main module's dependency version -(devel)is used dependency="github.com/snapcore/snapd" Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Parsing dependency's build info settings dependency="github.com/snapcore/snapd" -ldflags=[-w] Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Unable to detect dependency version.-ldflagsbuild info settings don't contain version flag. Empty version used. dependency="github.com/snapcore/snapd" Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Unable to detect main module's dependency version -(devel)is used dependency="github.com/snapcore/snapd" Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Parsing dependency's build info settings dependency="github.com/snapcore/snapd" -ldflags=[-w] Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Unable to detect dependency version.-ldflagsbuild info settings don't contain version flag. Empty version used. dependency="github.com/snapcore/snapd" Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Unable to detect main module's dependency version -(devel)is used dependency="github.com/snapcore/snapd" Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Parsing dependency's build info settings dependency="github.com/snapcore/snapd" -ldflags=[-w] Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Unable to detect dependency version.-ldflagsbuild info settings don't contain version flag. Empty version used. dependency="github.com/snapcore/snapd" Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Unable to detect main module's dependency version -(devel)is used dependency="github.com/snapcore/snapd" Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Parsing dependency's build info settings dependency="github.com/snapcore/snapd" -ldflags=[-w] Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z DEBUG [gobinary] Unable to detect dependency version.-ldflagsbuild info settings don't contain version flag. Empty version used. dependency="github.com/snapcore/snapd" Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z DEBUG [gobinary] Unable to detect main module's dependency version -(devel)is used dependency="github.com/snapcore/snapd" Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z DEBUG [gobinary] Parsing dependency's build info settings dependency="github.com/snapcore/snapd" -ldflags=[] Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z DEBUG [gobinary] Unable to detect dependency version.-ldflagsbuild info settings don't contain version flag. Empty version used. dependency="github.com/snapcore/snapd" Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z DEBUG [gobinary] Unable to detect main module's dependency version -(devel)is used dependency="github.com/snapcore/snapd" Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z DEBUG [gobinary] Parsing dependency's build info settings dependency="github.com/snapcore/snapd" -ldflags=[-extldflags "-static"] Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z DEBUG [gobinary] Unable to detect dependency version.-ldflagsbuild info settings don't contain version flag. Empty version used. dependency="github.com/snapcore/snapd" Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z DEBUG [gobinary] Unable to detect main module's dependency version -(devel)is used dependency="github.com/snapcore/snapd" Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z DEBUG [gobinary] Parsing dependency's build info settings dependency="github.com/snapcore/snapd" -ldflags=[] Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z DEBUG [gobinary] Unable to detect dependency version.-ldflagsbuild info settings don't contain version flag. Empty version used. dependency="github.com/snapcore/snapd" Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z DEBUG [gobinary] Unable to detect main module's dependency version -(devel)is used dependency="github.com/snapcore/snapd" Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z DEBUG [gobinary] Parsing dependency's build info settings dependency="github.com/snapcore/snapd" -ldflags=[-w] Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z DEBUG [gobinary] Unable to detect dependency version.-ldflagsbuild info settings don't contain version flag. Empty version used. dependency="github.com/snapcore/snapd" Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z DEBUG [gobinary] Unable to detect main module's dependency version -(devel)is used dependency="github.com/snapcore/snapd" Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z DEBUG [gobinary] Parsing dependency's build info settings dependency="github.com/snapcore/snapd" -ldflags=[-w] Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z DEBUG [gobinary] Unable to detect dependency version.-ldflagsbuild info settings don't contain version flag. Empty version used. dependency="github.com/snapcore/snapd" Nov 29 03:57:20 outposts: 2024-11-29T03:57:20Z DEBUG [gobinary] Unable to detect main module's dependency version -(devel)is used dependency="github.com/aws/amazon-ssm-agent" Nov 29 03:57:20 outposts: 2024-11-29T03:57:20Z DEBUG [gobinary] Unable to detect main module's dependency version -(devel)is used dependency="./extra/aws-sdk-go" Nov 29 03:57:20 outposts: 2024-11-29T03:57:20Z DEBUG [gobinary] Unable to detect main module's dependency version -(devel) is used dependency="./extra/lockfile" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z DEBUG [javadb] Java DB update was skipped because the local Java DB is the latest Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z DEBUG [jar] Parsing Java artifacts... file_path="usr/share/apport/apport.jar" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z DEBUG [jar] Parsing Java artifacts... file_path="usr/share/apport/testsuite/crash.jar" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z DEBUG [jar] No such POM in the central repositories file="apport.jar" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z DEBUG [jar] Parsing Java artifacts... file_path="usr/share/java/libintl-0.21.jar" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z DEBUG [jar] No such POM in the central repositories file="crash.jar" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z DEBUG [jar] No such POM in the central repositories file="libintl-0.21.jar" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="Automat"version="20.2.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="Babel" version="2.8.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="Jinja2" version="3.0.3" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="MarkupSafe" version="2.0.1" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="PyGObject" version="3.42.1" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="PyHamcrest" version="2.0.2" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="PyJWT" version="2.3.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="PyYAML" version="5.4.1" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="SecretStorage" version="3.3.1" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="attrs" version="21.2.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="bcrypt" version="3.2.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="blinker"version="1.4" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="certifi"version="2020.6.20" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="chardet"version="4.0.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="click" version="8.0.3" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="colorama" version="0.4.4" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="configobj" version="5.0.6" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="constantly" version="15.1.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="cryptography" version="3.4.8" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="dbus-python" version="1.2.18" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="distro" version="1.7.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="ec2-hibinit-agent" version="1.0.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="hibagent" version="1.0.1" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="httplib2" version="0.20.2" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="hyperlink" version="21.0.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="idna" version="3.3" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="importlib-metadata" version="4.6.4" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="incremental" version="21.3.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="jsonpatch" version="1.32" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="jsonpointer" version="2.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="jsonschema" version="3.2.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="keyring"version="23.5.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="launchpadlib" version="1.10.16" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="lazr.restfulclient" version="0.14.4" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="lazr.uri" version="1.0.6" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="more-itertools" version="8.10.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="netifaces" version="0.11.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="oauthlib" version="3.2.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="pexpect"version="4.8.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="pyOpenSSL" version="21.0.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="pyasn1" version="0.4.8" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="pyasn1-modules" version="0.2.1" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="pyparsing" version="2.4.7" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="pyrsistent" version="0.18.1" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="pyserial" version="3.5" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="python-debian" version="0.1.43ubuntu1" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="python-magic" version="0.4.24" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="pytz" version="2022.1" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="requests" version="2.25.1" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="service-identity" version="18.1.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="setuptools" version="59.6.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="six" version="1.16.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="systemd-python" version="234" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="urllib3"version="1.26.5" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="wadllib"version="1.3.6" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="zipp" version="1.0.0" Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z INFO [python] License acquired from METADATA classifiers may be subject to additional terms name="zope.interface" version="5.4.0" Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z INFO Number of language-specific files num=1 Nov 29 03:57:24 outposts: time="2024-11-29 03:57:24" level=info msg="(i-09c705306d25f0e72) no library vulnerabilities" Nov 29 03:57:24 outposts: time="2024-11-29 03:57:24" level=info msg="(2864eb40-ee58-4c20-9ed7-6f1db1fcff92) scanning status: inprogress, message: scanning done by library_vulnerabilities, err: i-09c705306d25f0e72%!(EXTRA string=no %s vulnerabilities, string=library), container_id: , instance_id: i-09c705306d25f0e72" Nov 29 03:57:24 outposts: time="2024-11-29 03:57:24" level=info msg="(i-09c705306d25f0e72) scanning instance for os vulnerabilities" Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z DEBUG DB update was skipped because the local DB is the latest Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z DEBUG DB info schema=2 updated_at=2024-11-29T00:22:44.888105691Z next_update=2024-11-30T00:22:44.88810529Zdownloaded_at=2024-11-29T03:10:30.318570819Z Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z INFO [vuln] Vulnerability scanning is enabled Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z DEBUG Enabling misconfiguration scanners scanners=[] Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z DEBUG Initializing scan cache... type="fs" Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z DEBUG Skipping path path="dev" Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z DEBUG Skipping path path="proc" Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z DEBUG Skipping path path="sys" Nov 29 03:57:26 outposts: 2024-11-29T03:57:26Z INFO Detected OS family="ubuntu" version="22.04" Nov 29 03:57:26 outposts: 2024-11-29T03:57:26Z INFO [ubuntu] Detecting vulnerabilities... os_version="22.04" pkg_num=0 Nov 29 03:57:26 outposts: time="2024-11-29 03:57:26" level=info msg="(i-09c705306d25f0e72) found os vulnerabilities: 1"

Desired Behavior

OS and LIbrary vulnerabilities should be detected

Actual Behavior

Same result (no os/libary vulnerabilities detected) for any rootfs scanning

Reproduction Steps

1. Create trivy options as follows:
func createTrivyOptions() *flag.Options {
	tlog.InitLogger(true, false)

	fsFlags := &flag.Flags{
		CacheFlagGroup:         flag.NewCacheFlagGroup(),
		DBFlagGroup:            flag.NewDBFlagGroup(),
		LicenseFlagGroup:       flag.NewLicenseFlagGroup(),
		MisconfFlagGroup:       flag.NewMisconfFlagGroup(),
		RemoteFlagGroup:        nil,
		RegoFlagGroup:          flag.NewRegoFlagGroup(),
		ReportFlagGroup:        flag.NewReportFlagGroup(),
		ScanFlagGroup:          flag.NewScanFlagGroup(),
		SecretFlagGroup:        flag.NewSecretFlagGroup(),
		VulnerabilityFlagGroup: flag.NewVulnerabilityFlagGroup(),
	}

	options, err := fsFlags.ToOptions([]string{})
	if err != nil {
		log.Errorf("%v", err)
	}

	options.GlobalOptions.CacheDir = cacheDir
	options.GlobalOptions.Debug = true
	options.GlobalOptions.Quiet = false

	options.DBOptions.SkipDBUpdate = false
	options.DBOptions.SkipJavaDBUpdate = false

	options.ScanOptions.OfflineScan = true
	options.Debug = true
	return &options
}
func (t *Vulners) scan(id string, dir *string, callback DataCallback) error {
	dst := ""
	if dir != nil {
		dst = *dir
	}
vulnOptions = createTrivyOptions()
      vulnOptions.ScanOptions.Scanners = []types.Scanner{"vuln"}
	vulnOptions.ScanOptions.Target = dst
	vulnOptions.PkgTypes = []string{t.vulnType}

	runner, err := artifact.NewRunner(context.TODO(), *vulnOptions)
	if err != nil {
		log.Errori(id, "%v", err)
		return fmt.Errorf(id, "%v", err)
	}
	defer func() {
		if err := runner.Close(context.TODO()); err != nil {
			log.Warni(id, "error closing scanner: %v", err)
		}
	}()

	report, err := runner.ScanRootfs(context.TODO(), *vulnOptions)
	if err != nil {
		log.Errori(id, "error scanning: %v", err)
		return fmt.Errorf(id, "error scanning: %v", err)
	}

	if len(report.Results) < 1 {
		log.Infoi(id, "no %s vulnerabilities", t.vulnType)
		return fmt.Errorf(id, "no %s vulnerabilities", t.vulnType)
	}

	log.Infoi(id, "found %s vulnerabilities: %d", t.vulnType, len(report.Results))
	if t.vulnType == types.PkgTypeLibrary {
		results := getLibraryVulns(id, report)
		callback("library_vulnerabilities", results)
	} else {
		results := getOSVulns(id, report)
		callback("os_vulnerabilities", results)
	}
	return nil
}

Target

Filesystem

Scanner

Vulnerability

Output Format

JSON

Mode

Standalone

Debug Output

Logs of latest run, I'm using latest version of trivy: 0.57.1

`evel=info msg="(i-09c705306d25f0e72) scanning instance for library vulnerabilities"
Nov 29 03:56:37 outposts: 2024-11-29T03:56:37Z        DEBUG        DB update was skipped because the local DB is the latest
Nov 29 03:56:37 outposts: 2024-11-29T03:56:37Z        DEBUG        DB info        schema=2 updated_at=2024-11-29T00:22:44.888105691Z next_update=2024-11-30T00:22:44.88810529Zdownloaded_at=2024-11-29T03:10:30.318570819Z
Nov 29 03:56:37 outposts: 2024-11-29T03:56:37Z        INFO        [vuln] Vulnerability scanning is enabled
Nov 29 03:56:37 outposts: 2024-11-29T03:56:37Z        DEBUG        Enabling misconfiguration scanners        scanners=[]
Nov 29 03:56:37 outposts: 2024-11-29T03:56:37Z        DEBUG        Initializing scan cache...        type="fs"
Nov 29 03:56:37 outposts: 2024-11-29T03:56:37Z        DEBUG        Skipping path        path="dev"
Nov 29 03:56:37 outposts: 2024-11-29T03:56:37Z        DEBUG        Skipping path        path="proc"
Nov 29 03:56:38 outposts: 2024-11-29T03:56:38Z        DEBUG        Skipping path        path="sys"
Nov 29 03:56:46 outposts: 2024-11-29T03:56:46Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="github.com/snapcore/snapd"
Nov 29 03:56:46 outposts: 2024-11-29T03:56:46Z        DEBUG        [gobinary] Parsing dependency's build info settings        dependency="github.com/snapcore/snapd" -ldflags=[-w]
Nov 29 03:56:46 outposts: 2024-11-29T03:56:46Z        DEBUG        [gobinary] Unable to detect dependency version. `-ldflags` build info settings don't contain version flag. Empty version used.        dependency="github.com/snapcore/snapd"
Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z        DEBUG        [analyzer] Analysis error        err="go binary (filepath: usr/lib/klibc/bin/cat) parse error: failed to parse usr/lib/klibc/bin/cat: failed to parse usr/lib/klibc/bin/cat: EOF"
Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z        DEBUG        [analyzer] Analysis error        err="go binary (filepath: usr/lib/klibc/bin/kill) parse error: failed to parse usr/lib/klibc/bin/kill: failed to parse usr/lib/klibc/bin/kill: EOF"
Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z        DEBUG        [analyzer] Analysis error        err="go binary (filepath: usr/lib/klibc/bin/losetup) parse error: failed to parse usr/lib/klibc/bin/losetup: failed to parse usr/lib/klibc/bin/losetup: EOF"
Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z        DEBUG        [analyzer] Analysis error        err="go binary (filepath: usr/lib/klibc/bin/minips) parse error: failed toparse usr/lib/klibc/bin/minips: failed to parse usr/lib/klibc/bin/minips: EOF"
Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z        DEBUG        [analyzer] Analysis error        err="go binary (filepath: usr/lib/klibc/bin/mkdir) parse error: failed to parse usr/lib/klibc/bin/mkdir: failed to parse usr/lib/klibc/bin/mkdir: EOF"
Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z        DEBUG        [analyzer] Analysis error        err="go binary (filepath: usr/lib/klibc/bin/mkfifo) parse error: failed toparse usr/lib/klibc/bin/mkfifo: failed to parse usr/lib/klibc/bin/mkfifo: EOF"
Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z        DEBUG        [analyzer] Analysis error        err="go binary (filepath: usr/lib/klibc/bin/mknod) parse error: failed to parse usr/lib/klibc/bin/mknod: failed to parse usr/lib/klibc/bin/mknod: EOF"
Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z        DEBUG        [analyzer] Analysis error        err="go binary (filepath: usr/lib/klibc/bin/mount) parse error: failed to parse usr/lib/klibc/bin/mount: failed to parse usr/lib/klibc/bin/mount: EOF"
Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z        DEBUG        [analyzer] Analysis error        err="go binary (filepath: usr/lib/klibc/bin/readlink) parse error: failed to parse usr/lib/klibc/bin/readlink: failed to parse usr/lib/klibc/bin/readlink: EOF"
Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z        DEBUG        [analyzer] Analysis error        err="go binary (filepath: usr/lib/klibc/bin/resume) parse error: failed toparse usr/lib/klibc/bin/resume: failed to parse usr/lib/klibc/bin/resume: EOF"
Nov 29 03:56:52 outposts: 2024-11-29T03:56:52Z        DEBUG        [analyzer] Analysis error        err="go binary (filepath: usr/lib/klibc/bin/umount) parse error: failed toparse usr/lib/klibc/bin/umount: failed to parse usr/lib/klibc/bin/umount: EOF"
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="github.com/snapcore/snapd"
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Parsing dependency's build info settings        dependency="github.com/snapcore/snapd" -ldflags=[-w]
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Unable to detect dependency version. `-ldflags` build info settings don't contain version flag. Empty version used.        dependency="github.com/snapcore/snapd"
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="github.com/snapcore/snapd"
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Parsing dependency's build info settings        dependency="github.com/snapcore/snapd" -ldflags=[]
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Unable to detect dependency version. `-ldflags` build info settings don't contain version flag. Empty version used.        dependency="github.com/snapcore/snapd"
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="github.com/snapcore/snapd"
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Parsing dependency's build info settings        dependency="github.com/snapcore/snapd" -ldflags=[-w]
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Unable to detect dependency version. `-ldflags` build info settings don't contain version flag. Empty version used.        dependency="github.com/snapcore/snapd"
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="github.com/snapcore/snapd"
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Parsing dependency's build info settings        dependency="github.com/snapcore/snapd" -ldflags=[-w]
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Unable to detect dependency version. `-ldflags` build info settings don't contain version flag. Empty version used.        dependency="github.com/snapcore/snapd"
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="github.com/snapcore/snapd"
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Parsing dependency's build info settings        dependency="github.com/snapcore/snapd" -ldflags=[-w]
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Unable to detect dependency version. `-ldflags` build info settings don't contain version flag. Empty version used.        dependency="github.com/snapcore/snapd"
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="github.com/snapcore/snapd"
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Parsing dependency's build info settings        dependency="github.com/snapcore/snapd" -ldflags=[-w]
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Unable to detect dependency version. `-ldflags` build info settings don't contain version flag. Empty version used.        dependency="github.com/snapcore/snapd"
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="github.com/snapcore/snapd"
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Parsing dependency's build info settings        dependency="github.com/snapcore/snapd" -ldflags=[-w]
Nov 29 03:56:55 outposts: 2024-11-29T03:56:55Z        DEBUG        [gobinary] Unable to detect dependency version. `-ldflags` build info settings don't contain version flag. Empty version used.        dependency="github.com/snapcore/snapd"
Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="github.com/snapcore/snapd"
Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z        DEBUG        [gobinary] Parsing dependency's build info settings        dependency="github.com/snapcore/snapd" -ldflags=[]
Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z        DEBUG        [gobinary] Unable to detect dependency version. `-ldflags` build info settings don't contain version flag. Empty version used.        dependency="github.com/snapcore/snapd"
Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="github.com/snapcore/snapd"
Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z        DEBUG        [gobinary] Parsing dependency's build info settings        dependency="github.com/snapcore/snapd" -ldflags=[-extldflags "-static"]
Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z        DEBUG        [gobinary] Unable to detect dependency version. `-ldflags` build info settings don't contain version flag. Empty version used.        dependency="github.com/snapcore/snapd"
Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="github.com/snapcore/snapd"
Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z        DEBUG        [gobinary] Parsing dependency's build info settings        dependency="github.com/snapcore/snapd" -ldflags=[]
Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z        DEBUG        [gobinary] Unable to detect dependency version. `-ldflags` build info settings don't contain version flag. Empty version used.        dependency="github.com/snapcore/snapd"
Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="github.com/snapcore/snapd"
Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z        DEBUG        [gobinary] Parsing dependency's build info settings        dependency="github.com/snapcore/snapd" -ldflags=[-w]
Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z        DEBUG        [gobinary] Unable to detect dependency version. `-ldflags` build info settings don't contain version flag. Empty version used.        dependency="github.com/snapcore/snapd"
Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="github.com/snapcore/snapd"
Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z        DEBUG        [gobinary] Parsing dependency's build info settings        dependency="github.com/snapcore/snapd" -ldflags=[-w]
Nov 29 03:56:56 outposts: 2024-11-29T03:56:56Z        DEBUG        [gobinary] Unable to detect dependency version. `-ldflags` build info settings don't contain version flag. Empty version used.        dependency="github.com/snapcore/snapd"
Nov 29 03:57:20 outposts: 2024-11-29T03:57:20Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="github.com/aws/amazon-ssm-agent"
Nov 29 03:57:20 outposts: 2024-11-29T03:57:20Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="./extra/aws-sdk-go"
Nov 29 03:57:20 outposts: 2024-11-29T03:57:20Z        DEBUG        [gobinary] Unable to detect main module's dependency version - `(devel)` is used        dependency="./extra/lockfile"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        DEBUG        [javadb] Java DB update was skipped because the local Java DB is the latest
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        DEBUG        [jar] Parsing Java artifacts...        file_path="usr/share/apport/apport.jar"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        DEBUG        [jar] Parsing Java artifacts...        file_path="usr/share/apport/testsuite/crash.jar"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        DEBUG        [jar] No such POM in the central repositories        file="apport.jar"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        DEBUG        [jar] Parsing Java artifacts...        file_path="usr/share/java/libintl-0.21.jar"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        DEBUG        [jar] No such POM in the central repositories        file="crash.jar"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        DEBUG        [jar] No such POM in the central repositories        file="libintl-0.21.jar"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="Automat"version="20.2.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="Babel" version="2.8.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="Jinja2" version="3.0.3"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="MarkupSafe" version="2.0.1"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="PyGObject" version="3.42.1"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="PyHamcrest" version="2.0.2"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="PyJWT" version="2.3.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="PyYAML" version="5.4.1"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="SecretStorage" version="3.3.1"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="attrs" version="21.2.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="bcrypt" version="3.2.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="blinker"version="1.4"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="certifi"version="2020.6.20"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="chardet"version="4.0.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="click" version="8.0.3"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="colorama" version="0.4.4"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="configobj" version="5.0.6"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="constantly" version="15.1.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="cryptography" version="3.4.8"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="dbus-python" version="1.2.18"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="distro" version="1.7.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="ec2-hibinit-agent" version="1.0.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="hibagent" version="1.0.1"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="httplib2" version="0.20.2"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="hyperlink" version="21.0.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="idna" version="3.3"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="importlib-metadata" version="4.6.4"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="incremental" version="21.3.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="jsonpatch" version="1.32"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="jsonpointer" version="2.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="jsonschema" version="3.2.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="keyring"version="23.5.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="launchpadlib" version="1.10.16"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="lazr.restfulclient" version="0.14.4"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="lazr.uri" version="1.0.6"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="more-itertools" version="8.10.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="netifaces" version="0.11.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="oauthlib" version="3.2.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="pexpect"version="4.8.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="pyOpenSSL" version="21.0.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="pyasn1" version="0.4.8"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="pyasn1-modules" version="0.2.1"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="pyparsing" version="2.4.7"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="pyrsistent" version="0.18.1"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="pyserial" version="3.5"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="python-debian" version="0.1.43ubuntu1"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="python-magic" version="0.4.24"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="pytz" version="2022.1"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="requests" version="2.25.1"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="service-identity" version="18.1.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="setuptools" version="59.6.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="six" version="1.16.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="systemd-python" version="234"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="urllib3"version="1.26.5"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="wadllib"version="1.3.6"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="zipp" version="1.0.0"
Nov 29 03:57:22 outposts: 2024-11-29T03:57:22Z        INFO        [python] License acquired from METADATA classifiers may be subject to additional terms        name="zope.interface" version="5.4.0"
Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z        INFO        Number of language-specific files        num=1
Nov 29 03:57:24 outposts: time="2024-11-29 03:57:24" level=info msg="(i-09c705306d25f0e72) no library vulnerabilities"
Nov 29 03:57:24 outposts: time="2024-11-29 03:57:24" level=info msg="(2864eb40-ee58-4c20-9ed7-6f1db1fcff92) scanning status: inprogress, message: scanning done by library_vulnerabilities, err: i-09c705306d25f0e72%!(EXTRA string=no %s vulnerabilities, string=library), container_id: , instance_id: i-09c705306d25f0e72"
Nov 29 03:57:24 outposts: time="2024-11-29 03:57:24" level=info msg="(i-09c705306d25f0e72) scanning instance for os vulnerabilities"
Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z        DEBUG        DB update was skipped because the local DB is the latest
Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z        DEBUG        DB info        schema=2 updated_at=2024-11-29T00:22:44.888105691Z next_update=2024-11-30T00:22:44.88810529Zdownloaded_at=2024-11-29T03:10:30.318570819Z
Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z        INFO        [vuln] Vulnerability scanning is enabled
Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z        DEBUG        Enabling misconfiguration scanners        scanners=[]
Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z        DEBUG        Initializing scan cache...        type="fs"
Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z        DEBUG        Skipping path        path="dev"
Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z        DEBUG        Skipping path        path="proc"
Nov 29 03:57:24 outposts: 2024-11-29T03:57:24Z        DEBUG        Skipping path        path="sys"
Nov 29 03:57:26 outposts: 2024-11-29T03:57:26Z        INFO        Detected OS        family="ubuntu" version="22.04"
Nov 29 03:57:26 outposts: 2024-11-29T03:57:26Z        INFO        [ubuntu] Detecting vulnerabilities...        os_version="22.04" pkg_num=0
Nov 29 03:57:26 outposts: time="2024-11-29 03:57:26" level=info msg="(i-09c705306d25f0e72) found os vulnerabilities: 1"`

Operating System

linux

Version

v0.57.1

Checklist

Run trivy clean --all
Read the troubleshooting

DmitriyLewen · 2024-11-29T06:37:24Z

DmitriyLewen
Nov 29, 2024
Maintainer

Hello @Thesohan

According to the log, Trivy finds packages, but doesn't find vulnerabilities in them.
Try using the list-all-pkgs flag to see which packages Trivy finds.

If Trivy does'not find the expected package, send the related file and we will examine it.
If Trivy correctly detects packages, tell us which CVE you expected to see.

Regards, Dmitriy

2 replies

Thesohan Nov 29, 2024
Author

@DmitriyLewen Thanks for the response,

As per the logs [ubuntu] Detecting vulnerabilities... os_version="22.04" pkg_num=0
pkg_num = 0, and hence vulnerabilities are not detected.
I'm still debugging it,
can be be because of the missing flag PackageFlagGroup: flag.NewPackageFlagGroup() in createTrivyOptions ---> fsFlags?

DmitriyLewen Nov 29, 2024
Maintainer

can be be because of the missing flag PackageFlagGroup: flag.NewPackageFlagGroup() in createTrivyOptions ---> fsFlags?

hmm... maybe that's it. Try it.

My advice is to check with a debugger that dpkg analyzer works correctly.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Trivy rootfs vuln scanner always returning the same result for OS and LIBRARY vulnerabilities #8011

{{title}}

Replies: 1 comment 2 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

Select a reply

Trivy rootfs vuln scanner always returning the same result for OS and LIBRARY vulnerabilities #8011

Thesohan Nov 29, 2024

Description

Desired Behavior

Actual Behavior

Reproduction Steps

Target

Scanner

Output Format

Mode

Debug Output

Operating System

Version

Checklist

Replies: 1 comment · 2 replies

DmitriyLewen Nov 29, 2024 Maintainer

Thesohan Nov 29, 2024 Author

DmitriyLewen Nov 29, 2024 Maintainer

Thesohan
Nov 29, 2024

Replies: 1 comment 2 replies

DmitriyLewen
Nov 29, 2024
Maintainer

Thesohan Nov 29, 2024
Author

DmitriyLewen Nov 29, 2024
Maintainer