Insufficiently Protected Credentials Affecting github.com/aquasecurity/trivy/pkg/fanal/image/registry/google package, versions <0.51.2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMAQUASECURITYTRIVYPKGFANALIMAGEREGISTRYGOOGLE-6928919
- published 21 May 2024
- disclosed 20 May 2024
- credit Luke Young
Introduced: 20 May 2024
CVE-2024-35192 Open this link in a new tabHow to fix?
Upgrade github.com/aquasecurity/trivy/pkg/fanal/image/registry/google to version 0.51.2 or higher.
Overview
Affected versions of this package are vulnerable to Insufficiently Protected Credentials when scanning container images from a crafted malicious registry. An attacker can cause the leakage of credentials for legitimate registries by triggering the scan.
Notes:
- For AWS, the leakage only occurs when Trivy is able to transparently obtain registry credentials from the default credential provider chain. You are affected if Trivy is executed in any of the following situations:
a) The environment variables contain static AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) that have access to ECR.
b) Within a Pod running on an EKS cluster that has been assigned a role with access to ECR using an IAM Roles for Service Accounts (IRSA) annotation.
You are not affected if the default credential provider chain is unable to obtain valid credentials. The same applies to GCP and Azure.
This vulnerability only applies when scanning container images directly from a registry. If you use Docker, containerd or other runtime to pull images locally and scan them with Trivy, you are not affected. To enforce this behavior, you can use the --image-src flag to select which sources you trust.