Trivy integration does not report vulnerabilities for Golang components

[mawl]

Current Behavior

First of all, we are excited to see that Trivy has made its way into Dependency-Track - so that developers get the same vulnerabilities in their CI pipelines and in Dependency-Track.

But currently, it doesn't show vulnerabilities for Golang dependencies like pkg:golang/github.com/nats-io/nkeys@0.4.4.

Sonatype OSS Index finds the vulnerability:

But It seems, that the Trivy integration currently works only for other package managers like npm or nuget:

Steps to Reproduce

1. Add Trivy as a service to docker-compose file
2. Enable Trivy in Dependency-Track
3. Create a new project
4. Import following SBOM:

{
  "bomFormat" : "CycloneDX",
  "specVersion" : "1.5",
  "serialNumber" : "urn:uuid:250397f0-20bd-476d-b411-6147a52427fb",
  "version" : 1,
  "metadata" : {
    "timestamp" : "2024-11-14T11:09:02Z",
    "tools" : [
      {
        "vendor" : "OWASP",
        "name" : "Dependency-Track",
        "version" : "4.12.1"
      }
    ],
    "component" : {
      "type" : "application",
      "bom-ref" : "2d4a12eb-32d4-41e7-99c9-8201d8150aae",
      "name" : "nkeys",
      "version" : ""
    }
  },
  "components" : [
    {
      "type" : "library",
      "bom-ref" : "509cecee-5f04-4f56-a9fd-47f36d37fbc5",
      "name" : "github.com/nats-io/nkeys",
      "version" : "0.4.4",
      "purl" : "pkg:golang/github.com/nats-io/nkeys@0.4.4"
    }
  ],
  "dependencies" : [
    {
      "ref" : "2d4a12eb-32d4-41e7-99c9-8201d8150aae",
      "dependsOn" : [ ]
    },
    {
      "ref" : "509cecee-5f04-4f56-a9fd-47f36d37fbc5",
      "dependsOn" : [ ]
    }
  ]
}

trivy.log

trivy-1  | 2024-11-14T11:11:34Z DEBUG   OS is not detected.
trivy-1  | 2024-11-14T11:11:34Z DEBUG   Detected OS: unknown
trivy-1  | 2024-11-14T11:11:34Z INFO    Number of language-specific files       num=1
trivy-1  | 2024-11-14T11:11:34Z INFO    [gobinary] Detecting vulnerabilities...
trivy-1  | 2024-11-14T11:11:34Z DEBUG   [gobinary] Scanning packages for vulnerabilities        file_path=""

Expected Behavior

Golang vulnerabilities, that the trivy cli has found, should also be part of the results in Dependency-Track.

% trivy sbom nkeys.json
2024-11-14T12:22:55.489+0100	INFO	Vulnerability scanning is enabled
2024-11-14T12:22:55.489+0100	INFO	Detected SBOM format: cyclonedx-json
2024-11-14T12:22:55.490+0100	WARN	Third-party SBOM may lead to inaccurate vulnerability detection
2024-11-14T12:22:55.490+0100	WARN	Recommend using Trivy to generate SBOMs
2024-11-14T12:22:55.490+0100	WARN	Ignore the OS package as no OS information is found.
2024-11-14T12:22:55.496+0100	INFO	Number of language-specific files: 1
2024-11-14T12:22:55.496+0100	INFO	Detecting gobinary vulnerabilities...

 (gobinary)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

┌──────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────┐
│         Library          │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                        Title                        │
├──────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────┤
│ github.com/nats-io/nkeys │ CVE-2023-46129 │ HIGH     │ fixed  │ 0.4.4             │ 0.4.6         │ nkeys: xkeys Seal encryption used fixed key for all │
│                          │                │          │        │                   │               │ encryption                                          │
│                          │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-46129          │
└──────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────┘

Dependency-Track Version

4.12.1

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

No response

Browser

Apple Safari

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[nscuro]

What version of Trivy are you using?

[mawl]

@nscuro: It's trivy v0.57.0:

  trivy:
    image: aquasec/trivy:0.57.0
    command:
    - server
    - --listen
    - :9090
    - --token
    - my_token
    - --db-repository
    - public.ecr.aws/aquasecurity/trivy-db
    - --debug
    volumes:
    - "trivy-cache:/root/.cache/trivy"
    restart: unless-stopped

https://docs.dependencytrack.org/datasources/trivy/

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.