CVE-2022-28946

An issue in ast.Parser in Open Policy Agent causes the application to incorrectly interpret expressions, allowing a Denial of Service (DoS) via triggering out-of-range memory access.

This update for trivy fixes the following issues:

trivy was updated to version 0.28.0 (boo#1199760, CVE-2022-28946):

• fix: remove Highlighted from json output (#2131)
• fix: remove trivy-kubernetes replace (#2132)
• docs: Add Operator docs under Kubernetes section (#2111)
• fix(k8s): security-checks panic (#2127)
• ci: added k8s scope (#2130)
• docs: Update misconfig output in examples (#2128)
• fix(misconf): Fix coloured output in Goland terminal (#2126)
• docs(secret): Fix default value of --security-checks in docs (#2107)
• refactor(report): move colorize function from trivy-db (#2122)
• feat: k8s resource scanning (#2118)
• chore: add CODEOWNERS (#2121)
• feat(image): add --server option for remote scans (#1871)
• refactor: k8s (#2116)
• refactor: export useful APIs (#2108)
• docs: fix k8s doc (#2114)
• feat(kubernetes): Add report flag for summary (#2112)
• fix: Remove problematic advanced rego policies (#2113)
• feat(misconf): Add special output format for misconfigurations (#2100)
• feat: add k8s subcommand (#2065)
• chore: fix make lint version (#2102)
• fix(java): handle relative pom modules (#2101)
• fix(misconf): Add missing links for non-rego misconfig results (#2094)
• feat(misconf): Added fs.FS based scanning via latest defsec (#2084)
• chore(deps): bump trivy-issue-action to v0.0.4 (#2091)
• chore(deps): bump github.com/twitchtv/twirp (#2077)
• chore(deps): bump github.com/urfave/cli/v2 from 2.4.0 to 2.5.1 (#2074)
• chore(os): updated fanal version and alpine distroless test (#2086)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.5.1 to 0.5.2 (#2075)
• chore(deps): bump github.com/samber/lo from 1.16.0 to 1.19.0 (#2076)
• feat(report): add support for SPDX (#2059)
• chore(deps): bump actions/setup-go from 2 to 3 (#2073)
• chore(deps): bump actions/cache from 3.0.1 to 3.0.2 (#2071)
• chore(deps): bump golang from 1.18.0 to 1.18.1 (#2069)
• chore(deps): bump actions/stale from 4 to 5 (#2070)
• chore(deps): bump sigstore/cosign-installer from 2.0.0 to 2.3.0 (#2072)
• chore(deps): bump github.com/open-policy-agent/opa from 0.39.0 to 0.40.0 (#2079)
• chore: app version 0.27.0 (#2046)
• fix(misconf): added to skip conf files if their scanning is not enabled (#2066)
• docs(secret) fix rule path in docs (#2061)
• docs: change from go.sum to go.mod (#2056)

Update to version 0.27.1:

• chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.5.0 to 0.5.1 (#1926)
• refactor(fs): scanner options (#2050)
• feat(secret): truncate long line (#2052)
• docs: fix a broken bullets (#2042)
• feat(ubuntu): add 22.04 approx eol date (#2044)
• docs: update installation.md (#2027)
• docs: add Containerfile (#2032)

Update to version 0.27.0:

• fix(go): fixed panic to scan gomod without version (#2038)
• docs(mariner): confirm it works with Mariner 2.0 VM (#2036)
• feat(secret): support enable rules (#2035)
• chore: app version 26.0 (#2030)
• docs(secret): add a demo movie (#2031)
• feat: support cache TTL in Redis (#2021)
• fix(go): skip system installed binaries (#2028)
• fix(go): check if go.sum is nil (#2029)
• feat: add secret scanning (#1901)
• chore: gh publish only with push the tag release (#2025)
• fix(fs): ignore permission errors (#2022)
• test(mod): using correct module inside test go.mod (#2020)
• feat(server): re-add proxy support for client/server communications (#1995)
• fix(report): truncate a description before escaping in ASFF template (#2004)
• fix(cloudformation): correct margin removal for empty lines (#2002)
• fix(template): correct check of old sarif template files (#2003)

Update to version 0.26.0:

• feat(alpine): warn mixing versions (#2000)
• Update ASFF template (#1914)
• chore(deps): replace containerd/containerd version to fix CVE-2022-23648 (#1994)
• chore(deps): bump alpine from 3.15.3 to 3.15.4 (#1993)
• test(go): add integration tests for gomod (#1989)
• fix(python): fixed panic when scan .egg archive (#1992)
• fix(go): set correct go modules type (#1990)
• feat(alpine):…

This update for trivy fixes the following issues:

Update to version 0.30.4:

• fix: remove the first arg when running as a plugin (#2595)
• fix: k8s controlplaner scanning (#2593)
• fix(vuln): GitLab report template (#2578)

Update to version 0.30.3:

• fix(server): use a new db worker for hot updates (#2581)
• docs: add trivy with download-db-only flag to Air-Gapped Environment (#2583)
• docs: split commands to download db for different versions of oras (#2582)
• feat(report): export exitcode for license checks (#2564)
• fix: cli can use lowercase for severities (#2565)
• fix: allow subcommands with TRIVY_RUN_AS_PLUGIN (#2577)
• fix: add missing types in TypeOSes and TypeLanguages in analyzer (#2569)
• fix: enable some features of the wasm runtime (#2575)
• fix(k8s): no error logged if trivy can't get docker image in kubernetes mode (#2521)
• docs(sbom): improve sbom attestation documentation (#2566)

Update to version 0.30.2:

• fix(report): show the summary without results (#2548)
• fix(cli): replace '-' to '_' for env vars (#2561)

Update to version 0.30.1:

• chore: remove a test repository (#2551)
• fix(license): lazy loading of classifiers (#2547)
• fix: CVE-2022-1996 in Trivy (#2499)
• docs(sbom): add sbom attestation (#2527)
• feat(rocky): set Rocky Linux 9 EOL (#2543)
• docs: add attributes to the video tag to autoplay demo videos (#2538)
• fix: yaml files with non-string chart name (#2534)
• fix: skip dirs (#2530)
• feat(repo): add support for branch, commit, & tag (#2494)
• fix: remove auto configure environment variables via viper (#2526)

Update to version 0.30.0:

• fix: separating multiple licenses from one line in dpkg copyright files (#2508)
• fix: change a capital letter for plugin uninstall subcommand (#2519)
• fix: k8s hide empty report when scanning resource (#2517)
• refactor: fix comments (#2516)
• fix: scan vendor dir (#2515)
• feat: Add support for license scanning (#2418)
• chore: add owners for secret scanning (#2485)
• fix: remove dependency-tree flag for image subcommand (#2492)
• fix(k8s): add shorthand for k8s namespace flag (#2495)
• docs: add information about using multiple servers to troubleshooting (#2498)
• ci: add pushing canary build images to registries (#2428)
• feat(dotnet): add support for .Net core .deps.json files (#2487)
• feat(amazon): add support for 2022 version (#2429)
• Type correction bitnami chart (#2415)
• docs: add config file and update CLI references (#2489)
• feat: add support for flag groups (#2488)
• refactor: move from urfave/cli to spf13/cobra (#2458)
• fix: Fix secrets output not containing file/lines (#2467)
• fix: clear output with modules (#2478)
• docs(cbl): distroless 1.0 supported (#2473)
• fix: Fix example dockerfile rego policy (#2460)
• fix(config): add helm to list of config analyzers (#2457)
• feat: k8s resouces scan (#2395)
• feat(sbom): add cyclonedx sbom scan (#2203)
• docs: remove links to removed content (#2431)
• ci: added rpm build for rhel 9 (#2437)
• fix(secret): remove space from asymmetric private key (#2434)
• test(integration): fix golden files for debian 9 (#2435)
• fix(cli): fix version string in docs link when secret scanning is enabled (#2422)
• refactor: move CycloneDX marshaling (#2420)
• docs(nodejs): add docs about pnpm support (#2423)
• docs: improve k8s usage documentation (#2425)
• feat: Make secrets scanning output consistant (#2410)
• ci: create canary build after main branch changes (#1638)
• fix(misconf): skip broken scans (#2396)
• feat(nodejs): add pnpm support (#2414)
• fix: Fix false positive for use of COS images (#2413)
• eliminate nerdctl dependency (#2412)
• Add EOL date for SUSE SLES 15.3, 15.4 and OpenSUSE 15.4 (#2403)
• fix(go): no cast to lowercase go package names (#2401)
• BREAKING(sbom): change 'trivy sbom' to scan SBOM (#2408)
• fix(server): hot update the db from custom repository (#2406)
• feat: added license parser for dpkg (#2381)
• fix(misconf): Update defsec (v0.68.5) to fix docker rego duplicate…

These are all security issues fixed in the trivy-0.28.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the starboard-0.15.6-1.1 package on the GA media of openSUSE Tumbleweed.