Upstream information

CVE-2024-35192 at MITRE

Description

Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access. Systems are not affected if the default credential provider chain is unable to obtain valid credentials. This vulnerability only applies when scanning container images directly from a registry. This vulnerability is fixed in 0.51.2.

SUSE information

Overall state of this security issue: Resolved

This issue is currently not rated by SUSE as it is not affecting the SUSE Enterprise products.

SUSE Bugzilla entry: 1224781 [NEW]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Package Hub 15 SP5
  • trivy >= 0.54.1-bp155.2.3.1
 Patchnames:
openSUSE-2024-268
SUSE Package Hub 15 SP6
  • trivy >= 0.54.1-bp156.2.3.1
 Patchnames:
openSUSE-2024-269
openSUSE Leap 15.5
  • trivy >= 0.54.1-bp155.2.3.1
 Patchnames:
openSUSE-2024-268
openSUSE Leap 15.6
  • trivy >= 0.54.1-bp156.2.3.1
 Patchnames:
openSUSE-2024-269
openSUSE Tumbleweed
  • trivy >= 0.52.0-1.1
 Patchnames:
openSUSE-Tumbleweed-2024-14030

SUSE Timeline for this CVE

CVE page created: Tue May 21 00:00:06 2024
CVE page last modified: Tue Sep 3 19:34:37 2024