PT-2024-26372 · Docker+3 · Docker+3
Lyoung-Confluent
·
Published
2024-05-20
·
Updated
2024-08-30
·
CVE-2024-35192
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Trivy versions prior to 0.51.2
Description
A malicious actor can trigger Trivy to leak credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR) if the registry is scanned directly using Trivy. These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access. The leakage only occurs when Trivy is able to obtain registry credentials from the default credential provider chain. This issue applies when scanning container images directly from a registry.
Recommendations
For Trivy versions prior to 0.51.2, upgrade to version 0.51.2 or later to resolve the issue.
As a temporary workaround, consider using the
--image-src flag to select which sources you trust, and ensure you only scan images from trusted registries.
Restrict access to the vulnerable functionality by using Docker, containerd, or other runtime to pull images locally and scan them with Trivy, instead of scanning directly from a registry.Exploit
Fix
Insufficiently Protected Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Aws Elastic Container Registry
Azure Container Registry
Docker
Google Cloud Artifact/Container Registry