Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

security(trivy) - fix IAC vulnerabilities found by trivy job in the code #351

Open
abhisheksr01 opened this issue Dec 26, 2024 · 0 comments
Labels
vulnerabilities Something in the repository is a security vulnerability.

Comments

@abhisheksr01
Copy link
Owner

abhisheksr01 commented Dec 26, 2024

Vulnerability Description

The Dockerfile, kubernetes and helm configs are failing when trivy config is executed in CI using the marketplace action.

Steps to Reproduce

  1. Commit a change to the repository
  2. The GHA CI pipeline executes and the sast-iac-trivy-hadolint job executes which scans the IAC for security vulnerabilities
  3. CI Execution fails since vulnerabilites of different severities are found

Impact

The pipeline fails because of vulnerabiliteis which imposes secutity risk.

Suggested Mitigation or Fix

Fix the code to mitigate static infra code analysis found by trivy.

CVSS Score (Optional):

Available in the CI execution

@abhisheksr01 abhisheksr01 added the vulnerabilities Something in the repository is a security vulnerability. label Dec 26, 2024
@abhisheksr01 abhisheksr01 changed the title [security(scope)] - [Brief description of the vulnerability] security(trivy) - trivy iac job found vulnerabilities in the code Dec 26, 2024
@abhisheksr01 abhisheksr01 changed the title security(trivy) - trivy iac job found vulnerabilities in the code security(trivy) - fix IAC vulnerabilities found by trivy job in the code Dec 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
vulnerabilities Something in the repository is a security vulnerability.
Projects
None yet
Development

No branches or pull requests

1 participant