Bug 1224781 (CVE-2024-35192)

Summary:	VUL-0: CVE-2024-35192: trivy: credential leak via malicious registry
Product:	[openSUSE] openSUSE Distribution	Reporter:	SMASH SMASH <smash_bz>
Component:	Security	Assignee:	Security Team bot <security-team>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	carlos.lopez, meissner
Version:	Leap 15.6
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/406773/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-05-21 08:26:04 UTC

Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access. Systems are not affected if the default credential provider chain is unable to obtain valid credentials. This vulnerability only applies when scanning container images directly from a registry. This vulnerability is fixed in 0.51.2.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35192
https://www.cve.org/CVERecord?id=CVE-2024-35192
https://github.com/aquasecurity/trivy/commit/e7f14f729de259551203f313e57d2d9d3aa2ff87
https://github.com/aquasecurity/trivy/security/advisories/GHSA-xcq4-m2r3-cmrj

Comment 1 Dirk Mueller 2024-06-07 06:56:30 UTC

https://build.opensuse.org/request/show/1179019

Comment 2 Dirk Mueller 2024-07-11 15:54:30 UTC

submitted for packagehub 15.5+ and is already in factory.