Trivy is downloading the Java DB on scan of every new Java image and ignores the cached DB #7587

DanHam · 2024-09-24T17:54:40Z

DanHam
Sep 24, 2024

Description

Trivy downloads the Java DB every time it scans a new Java image.

It ignores the cached Java DB even when the DB was downloaded less than 3 days ago (default cache timeout period).

This is leading to occasional failures due to rate-limiting:

FATAL	Fatal error	init error: DB error: failed to download vulnerability DB: database download error: oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-db/blobs/sha256:02c8a2c0546a06b51c094eddd6c5073c044cf723b9616e084d6763641d5e398d: TOOMANYREQUESTS: retry-after: 1.009941ms, allowed: 44000/minute

Desired Behavior

Trivy should not download the Java DB every time it scans a new Java image. It should use the cached DB for 3 days.

Actual Behavior

If I scan a new Java image, Trivy downloads the Java DB.

$ trivy image --severity=MEDIUM,HIGH,CRITICAL docker.io/library/eclipse-temurin:11
2024-09-24T18:12:28+01:00       INFO    [vuln] Vulnerability scanning is enabled
2024-09-24T18:12:28+01:00       INFO    [secret] Secret scanning is enabled
2024-09-24T18:12:28+01:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-09-24T18:12:28+01:00       INFO    [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-09-24T18:12:32+01:00       INFO    Java DB Repository      repository=ghcr.io/aquasecurity/trivy-java-db:1
2024-09-24T18:12:32+01:00       INFO    Downloading the Java DB...
645.33 MiB / 645.33 MiB [------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 7.73 MiB p/s 1m24s
2024-09-24T18:13:57+01:00       INFO    The Java DB is cached for 3 days. If you want to update the database more frequently, "trivy clean --java-db" command clears the DB cache.
2024-09-24T18:13:57+01:00       INFO    Detected OS     family="ubuntu" version="24.04"
2024-09-24T18:13:57+01:00       INFO    [ubuntu] Detecting vulnerabilities...   os_version="24.04" pkg_num=121
2024-09-24T18:13:57+01:00       INFO    Number of language-specific files       num=0

If I scan the same image again, Trivy uses the cached DB as expected.

$ trivy image --severity=MEDIUM,HIGH,CRITICAL docker.io/library/eclipse-temurin:11
2024-09-24T18:14:20+01:00       INFO    [vuln] Vulnerability scanning is enabled
2024-09-24T18:14:20+01:00       INFO    [secret] Secret scanning is enabled
2024-09-24T18:14:20+01:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-09-24T18:14:20+01:00       INFO    [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-09-24T18:14:21+01:00       INFO    Detected OS     family="ubuntu" version="24.04"
2024-09-24T18:14:21+01:00       INFO    [ubuntu] Detecting vulnerabilities...   os_version="24.04" pkg_num=121
2024-09-24T18:14:21+01:00       INFO    Number of language-specific files       num=0

However, if I then scan another 'new' Java image (one that hasn't been scanned before), Trivy downloads the 650MB Java DB all over again! Clearly, it should be using the cached Java DB downloaded in step 1

$ trivy image --severity=MEDIUM,HIGH,CRITICAL docker.io/library/eclipse-temurin:17
2024-09-24T18:14:39+01:00       INFO    [vuln] Vulnerability scanning is enabled
2024-09-24T18:14:39+01:00       INFO    [secret] Secret scanning is enabled
2024-09-24T18:14:39+01:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-09-24T18:14:39+01:00       INFO    [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-09-24T18:14:59+01:00       INFO    Java DB Repository      repository=ghcr.io/aquasecurity/trivy-java-db:1
2024-09-24T18:14:59+01:00       INFO    Downloading the Java DB...
645.33 MiB / 645.33 MiB [------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 7.77 MiB p/s 1m23s
2024-09-24T18:16:23+01:00       INFO    The Java DB is cached for 3 days. If you want to update the database more frequently, "trivy clean --java-db" command clears the DB cache.
2024-09-24T18:16:23+01:00       INFO    Detected OS     family="ubuntu" version="24.04"
2024-09-24T18:16:23+01:00       INFO    [ubuntu] Detecting vulnerabilities...   os_version="24.04" pkg_num=130
2024-09-24T18:16:23+01:00       INFO    Number of language-specific files       num=0

This appears to be causing occasional failures due to rate limiting:

FATAL	Fatal error	init error: DB error: failed to download vulnerability DB: database download error: oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-db/blobs/sha256:02c8a2c0546a06b51c094eddd6c5073c044cf723b9616e084d6763641d5e398d: TOOMANYREQUESTS: retry-after: 1.009941ms, allowed: 44000/minute

Reproduction Steps

See steps in 'Actual Behaviour'

Target

Container Image

Scanner

Vulnerability

Output Format

Table

Mode

Standalone

Debug Output

$ trivy image --severity=MEDIUM,HIGH,CRITICAL docker.io/library/eclipse-temurin:11 --debug
2024-09-24T18:37:53+01:00       DEBUG   No plugins loaded
2024-09-24T18:37:53+01:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2024-09-24T18:37:53+01:00       DEBUG   Cache dir       dir="/home/dan/.cache/trivy"
2024-09-24T18:37:53+01:00       DEBUG   Cache dir       dir="/home/dan/.cache/trivy"
2024-09-24T18:37:53+01:00       DEBUG   Parsed severities       severities=[MEDIUM HIGH CRITICAL]
2024-09-24T18:37:53+01:00       DEBUG   Ignore statuses statuses=[]
2024-09-24T18:37:53+01:00       DEBUG   There is no valid metadata file err="unable to open a file: open /home/dan/.cache/trivy/db/metadata.json: no such file or directory"
2024-09-24T18:37:53+01:00       INFO    [db] Need to update DB
2024-09-24T18:37:53+01:00       INFO    [db] Downloading DB...  repository="ghcr.io/aquasecurity/trivy-db:2"
2024-09-24T18:37:53+01:00       DEBUG   No metadata file
53.61 MiB / 53.61 MiB [---------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 7.13 MiB p/s 7.7s
2024-09-24T18:38:01+01:00       DEBUG   Updating database metadata...
2024-09-24T18:38:01+01:00       DEBUG   DB info schema=2 updated_at=2024-09-24T17:02:14.822846635Z next_update=2024-09-24T23:02:14.822846485Z downloaded_at=2024-09-24T17:38:01.996573386Z
2024-09-24T18:38:01+01:00       DEBUG   [pkg] Package types     types=[os library]
2024-09-24T18:38:01+01:00       DEBUG   [pkg] Package relationships     relationships=[unknown root direct indirect]
2024-09-24T18:38:01+01:00       INFO    [vuln] Vulnerability scanning is enabled
2024-09-24T18:38:01+01:00       INFO    [secret] Secret scanning is enabled
2024-09-24T18:38:01+01:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-09-24T18:38:01+01:00       INFO    [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-09-24T18:38:01+01:00       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-09-24T18:38:01+01:00       DEBUG   Initializing scan cache...      type="fs"
2024-09-24T18:38:02+01:00       DEBUG   [secret] No secret config detected      config_path="trivy-secret.yaml"
2024-09-24T18:38:02+01:00       DEBUG   [secret] No secret config detected      config_path="trivy-secret.yaml"
2024-09-24T18:38:02+01:00       DEBUG   [image] Detected image ID       image_id="sha256:9ddc615e14e7d993a9d328ab41fddd5d0ecf63d120c68b4b17c4f27bfb90f858"
2024-09-24T18:38:02+01:00       DEBUG   [image] Detected diff ID        diff_ids=[sha256:b15b682e901dd27efdf436ce837a94c729c0b78c44431d5b5ca3ccca1bed40da sha256:233f93770e00e41b7302fd22cd8cd6dc131971c2cb4a09fd7b3fd3de88b169cd sha256:12242de71f916d1c683ba3a51508b555ac359821a61e1a85842b41987284a64a sha256:4c5a471e3dd410a4502ce9621113256499cbe485d405ae3120245c3e108b988a sha256:3d38c60c2e623b69daff55107f0735d460d2dad3be5e736f9d83403a94244dc1]
2024-09-24T18:38:02+01:00       DEBUG   [image] Detected base layers    diff_ids=[sha256:b15b682e901dd27efdf436ce837a94c729c0b78c44431d5b5ca3ccca1bed40da]
2024-09-24T18:38:02+01:00       DEBUG   [image] Missing image ID in cache       image_id="sha256:9ddc615e14e7d993a9d328ab41fddd5d0ecf63d120c68b4b17c4f27bfb90f858"
2024-09-24T18:38:02+01:00       DEBUG   [image] Missing diff ID in cache        diff_id="sha256:b15b682e901dd27efdf436ce837a94c729c0b78c44431d5b5ca3ccca1bed40da"
2024-09-24T18:38:02+01:00       DEBUG   [image] Missing diff ID in cache        diff_id="sha256:233f93770e00e41b7302fd22cd8cd6dc131971c2cb4a09fd7b3fd3de88b169cd"
2024-09-24T18:38:02+01:00       DEBUG   [image] Missing diff ID in cache        diff_id="sha256:3d38c60c2e623b69daff55107f0735d460d2dad3be5e736f9d83403a94244dc1"
2024-09-24T18:38:02+01:00       DEBUG   [image] Missing diff ID in cache        diff_id="sha256:12242de71f916d1c683ba3a51508b555ac359821a61e1a85842b41987284a64a"
2024-09-24T18:38:02+01:00       DEBUG   [image] Missing diff ID in cache        diff_id="sha256:4c5a471e3dd410a4502ce9621113256499cbe485d405ae3120245c3e108b988a"
2024-09-24T18:38:05+01:00       INFO    Java DB Repository      repository=ghcr.io/aquasecurity/trivy-java-db:1
2024-09-24T18:38:05+01:00       INFO    Downloading the Java DB...
2024-09-24T18:38:06+01:00       DEBUG   [dpkg] Unable to parse the available file       file_path="var/lib/dpkg/available" err="file open error: open var/lib/dpkg/available: file does not exist"
645.33 MiB / 645.33 MiB [------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 7.78 MiB p/s 1m23s
2024-09-24T18:39:29+01:00       INFO    The Java DB is cached for 3 days. If you want to update the database more frequently, "trivy clean --java-db" command clears the DB cache.
2024-09-24T18:39:29+01:00       DEBUG   [jar] Parsing Java artifacts... file_path="opt/java/openjdk/lib/jrt-fs.jar"
2024-09-24T18:39:29+01:00       DEBUG   [jar] No such POM in the central repositories   file="jrt-fs.jar"
2024-09-24T18:39:29+01:00       DEBUG   No secrets found in container image config
2024-09-24T18:39:29+01:00       INFO    Detected OS     family="ubuntu" version="24.04"
2024-09-24T18:39:29+01:00       INFO    [ubuntu] Detecting vulnerabilities...   os_version="24.04" pkg_num=121
2024-09-24T18:39:29+01:00       INFO    Number of language-specific files       num=0
2024-09-24T18:39:29+01:00       DEBUG   [vex] VEX filtering is disabled

docker.io/library/eclipse-temurin:11 (ubuntu 24.04)

Total: 6 (MEDIUM: 6, HIGH: 0, CRITICAL: 0)

┌──────────────────┬────────────────┬──────────┬──────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────┐
│     Library      │ Vulnerability  │ Severity │  Status  │ Installed Version │ Fixed Version │                       Title                       │
├──────────────────┼────────────────┼──────────┼──────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────┤
│ libgcrypt20      │ CVE-2024-2236  │ MEDIUM   │ affected │ 1.10.3-2build1    │               │ libgcrypt: vulnerable to Marvin Attack            │
│                  │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2024-2236         │
├──────────────────┼────────────────┤          │          ├───────────────────┼───────────────┼───────────────────────────────────────────────────┤
│ libgssapi-krb5-2 │ CVE-2024-26462 │          │          │ 1.20.1-6ubuntu2.1 │               │ krb5: Memory leak at /krb5/src/kdc/ndr.c          │
│                  │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2024-26462        │
├──────────────────┤                │          │          │                   ├───────────────┤                                                   │
│ libk5crypto3     │                │          │          │                   │               │                                                   │
│                  │                │          │          │                   │               │                                                   │
├──────────────────┤                │          │          │                   ├───────────────┤                                                   │
│ libkrb5-3        │                │          │          │                   │               │                                                   │
│                  │                │          │          │                   │               │                                                   │
├──────────────────┤                │          │          │                   ├───────────────┤                                                   │
│ libkrb5support0  │                │          │          │                   │               │                                                   │
│                  │                │          │          │                   │               │                                                   │
├──────────────────┼────────────────┤          │          ├───────────────────┼───────────────┼───────────────────────────────────────────────────┤
│ wget             │ CVE-2021-31879 │          │          │ 1.21.4-1ubuntu4.1 │               │ wget: authorization header disclosure on redirect │
│                  │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2021-31879        │
└──────────────────┴────────────────┴──────────┴──────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────┘

--------------------------------------

$ trivy image --severity=MEDIUM,HIGH,CRITICAL docker.io/library/eclipse-temurin:17 --debug
2024-09-24T18:40:43+01:00       DEBUG   No plugins loaded
2024-09-24T18:40:43+01:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2024-09-24T18:40:43+01:00       DEBUG   Cache dir       dir="/home/dan/.cache/trivy"
2024-09-24T18:40:43+01:00       DEBUG   Cache dir       dir="/home/dan/.cache/trivy"
2024-09-24T18:40:43+01:00       DEBUG   Parsed severities       severities=[MEDIUM HIGH CRITICAL]
2024-09-24T18:40:43+01:00       DEBUG   Ignore statuses statuses=[]
2024-09-24T18:40:43+01:00       DEBUG   DB update was skipped because the local DB is the latest
2024-09-24T18:40:43+01:00       DEBUG   DB info schema=2 updated_at=2024-09-24T17:02:14.822846635Z next_update=2024-09-24T23:02:14.822846485Z downloaded_at=2024-09-24T17:38:01.996573386Z
2024-09-24T18:40:43+01:00       DEBUG   [pkg] Package types     types=[os library]
2024-09-24T18:40:43+01:00       DEBUG   [pkg] Package relationships     relationships=[unknown root direct indirect]
2024-09-24T18:40:43+01:00       INFO    [vuln] Vulnerability scanning is enabled
2024-09-24T18:40:43+01:00       INFO    [secret] Secret scanning is enabled
2024-09-24T18:40:43+01:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-09-24T18:40:43+01:00       INFO    [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-09-24T18:40:43+01:00       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-09-24T18:40:43+01:00       DEBUG   Initializing scan cache...      type="fs"
2024-09-24T18:40:44+01:00       DEBUG   [secret] No secret config detected      config_path="trivy-secret.yaml"
2024-09-24T18:40:44+01:00       DEBUG   [secret] No secret config detected      config_path="trivy-secret.yaml"
2024-09-24T18:40:44+01:00       DEBUG   [image] Detected image ID       image_id="sha256:b8b5be42735217ab8abcf55ea37387e6962c047d3aa195a973b71d3ca45bd438"
2024-09-24T18:40:44+01:00       DEBUG   [image] Detected diff ID        diff_ids=[sha256:b15b682e901dd27efdf436ce837a94c729c0b78c44431d5b5ca3ccca1bed40da sha256:a81b71600146cd92ba7e549e2a9ba2f697545bc4f8ba1c259301b4f345f0711c sha256:7b73a7485596cb3eed095c192e5a29e0a17d495398fda6484bf88554fb30a6a9 sha256:f0390b2d6d593e0c83f98491b20a261f693bc759b8305b250a3032c8a48923a9 sha256:bc5be03a5568d53110f989822a165d4dd32bfe529593a7b6515c9852ef72bf58]
2024-09-24T18:40:44+01:00       DEBUG   [image] Detected base layers    diff_ids=[sha256:b15b682e901dd27efdf436ce837a94c729c0b78c44431d5b5ca3ccca1bed40da]
2024-09-24T18:40:44+01:00       DEBUG   [image] Missing image ID in cache       image_id="sha256:b8b5be42735217ab8abcf55ea37387e6962c047d3aa195a973b71d3ca45bd438"
2024-09-24T18:40:44+01:00       DEBUG   [image] Missing diff ID in cache        diff_id="sha256:7b73a7485596cb3eed095c192e5a29e0a17d495398fda6484bf88554fb30a6a9"
2024-09-24T18:40:44+01:00       DEBUG   [image] Missing diff ID in cache        diff_id="sha256:a81b71600146cd92ba7e549e2a9ba2f697545bc4f8ba1c259301b4f345f0711c"
2024-09-24T18:40:44+01:00       DEBUG   [image] Missing diff ID in cache        diff_id="sha256:f0390b2d6d593e0c83f98491b20a261f693bc759b8305b250a3032c8a48923a9"
2024-09-24T18:40:44+01:00       DEBUG   [image] Missing diff ID in cache        diff_id="sha256:bc5be03a5568d53110f989822a165d4dd32bfe529593a7b6515c9852ef72bf58"
2024-09-24T18:40:50+01:00       DEBUG   [dpkg] Unable to parse the available file       file_path="var/lib/dpkg/available" err="file open error: open var/lib/dpkg/available: file does not exist"
2024-09-24T18:41:03+01:00       INFO    Java DB Repository      repository=ghcr.io/aquasecurity/trivy-java-db:1
2024-09-24T18:41:03+01:00       INFO    Downloading the Java DB...
645.33 MiB / 645.33 MiB [-------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 3.59 MiB p/s 3m0s
2024-09-24T18:44:04+01:00       INFO    The Java DB is cached for 3 days. If you want to update the database more frequently, "trivy clean --java-db" command clears the DB cache.
2024-09-24T18:44:04+01:00       DEBUG   [jar] Parsing Java artifacts... file_path="opt/java/openjdk/lib/jrt-fs.jar"
2024-09-24T18:44:04+01:00       DEBUG   [jar] No such POM in the central repositories   file="jrt-fs.jar"
2024-09-24T18:44:04+01:00       DEBUG   No secrets found in container image config
2024-09-24T18:44:04+01:00       INFO    Detected OS     family="ubuntu" version="24.04"
2024-09-24T18:44:04+01:00       INFO    [ubuntu] Detecting vulnerabilities...   os_version="24.04" pkg_num=130
2024-09-24T18:44:04+01:00       INFO    Number of language-specific files       num=0
2024-09-24T18:44:04+01:00       DEBUG   [vex] VEX filtering is disabled

docker.io/library/eclipse-temurin:17 (ubuntu 24.04)

Total: 6 (MEDIUM: 6, HIGH: 0, CRITICAL: 0)

┌──────────────────┬────────────────┬──────────┬──────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────┐
│     Library      │ Vulnerability  │ Severity │  Status  │ Installed Version │ Fixed Version │                       Title                       │
├──────────────────┼────────────────┼──────────┼──────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────┤
│ libgcrypt20      │ CVE-2024-2236  │ MEDIUM   │ affected │ 1.10.3-2build1    │               │ libgcrypt: vulnerable to Marvin Attack            │
│                  │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2024-2236         │
├──────────────────┼────────────────┤          │          ├───────────────────┼───────────────┼───────────────────────────────────────────────────┤
│ libgssapi-krb5-2 │ CVE-2024-26462 │          │          │ 1.20.1-6ubuntu2.1 │               │ krb5: Memory leak at /krb5/src/kdc/ndr.c          │
│                  │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2024-26462        │
├──────────────────┤                │          │          │                   ├───────────────┤                                                   │
│ libk5crypto3     │                │          │          │                   │               │                                                   │
│                  │                │          │          │                   │               │                                                   │
├──────────────────┤                │          │          │                   ├───────────────┤                                                   │
│ libkrb5-3        │                │          │          │                   │               │                                                   │
│                  │                │          │          │                   │               │                                                   │
├──────────────────┤                │          │          │                   ├───────────────┤                                                   │
│ libkrb5support0  │                │          │          │                   │               │                                                   │
│                  │                │          │          │                   │               │                                                   │
├──────────────────┼────────────────┤          │          ├───────────────────┼───────────────┼───────────────────────────────────────────────────┤
│ wget             │ CVE-2021-31879 │          │          │ 1.21.4-1ubuntu4.1 │               │ wget: authorization header disclosure on redirect │
│                  │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2021-31879        │
└──────────────────┴────────────────┴──────────┴──────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────┘

Operating System

Fedora GNU/Linux 39

Version

$ trivy --version
Version: 0.55.2
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-09-24 17:02:14.822846635 +0000 UTC
  NextUpdate: 2024-09-24 23:02:14.822846485 +0000 UTC
  DownloadedAt: 2024-09-24 17:38:01.996573386 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-09-20 01:06:28.762321776 +0000 UTC
  NextUpdate: 2024-09-23 01:06:28.762321626 +0000 UTC
  DownloadedAt: 2024-09-24 17:44:04.108162824 +0000 UTC

Checklist

Run trivy clean --all
Read the troubleshooting

DanHam · 2024-09-24T18:06:50Z

DanHam
Sep 24, 2024
Author

Additional info:

$ ls -ltr ~/.cache/trivy/java-db/
total 1069196
-rw-r--r--. 1 dan dan 1094852608 Sep 20 02:06 trivy-java.db
-rw-r--r--. 1 dan dan        153 Sep 24 19:04 metadata.json

$ cat ~/.cache/trivy/java-db/metadata.json --plain
{"Version":1,"NextUpdate":"2024-09-23T01:06:28.762321626Z","UpdatedAt":"2024-09-20T01:06:28.762321776Z","DownloadedAt":"2024-09-24T18:04:58.417200561Z"}

4 replies

knqyf263 Sep 25, 2024
Maintainer

We're looking into this issue now.
aquasecurity/trivy-java-db#34

akirilltikhonov Oct 21, 2024

Hello @knqyf263,

We experience the same problem. What is the current status of this issue? I see a long chain of closed/merged tickets by your link and it is not clear if it is solved or not.

Is this problem fixed? Is there any information if it will be fixed in the nearest Trivy release?

knqyf263 Oct 21, 2024
Maintainer

It was fixed and shipped.

DanielHamiltonHOD Oct 21, 2024

@akirilltikhonov

This went out with 0.56.0

See the list of bug fixes: HERE

The fix for this issue is the 2nd one from the top

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Trivy is downloading the Java DB on scan of every new Java image and ignores the cached DB #7587

{{title}}

Replies: 1 comment 4 replies

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

Trivy is downloading the Java DB on scan of every new Java image and ignores the cached DB #7587

DanHam Sep 24, 2024

Description

Desired Behavior

Actual Behavior

Reproduction Steps

Target

Scanner

Output Format

Mode

Debug Output

Operating System

Version

Checklist

Replies: 1 comment · 4 replies

DanHam Sep 24, 2024 Author

knqyf263 Sep 25, 2024 Maintainer

akirilltikhonov Oct 21, 2024

knqyf263 Oct 21, 2024 Maintainer

DanielHamiltonHOD Oct 21, 2024

DanHam
Sep 24, 2024

Replies: 1 comment 4 replies

DanHam
Sep 24, 2024
Author

knqyf263 Sep 25, 2024
Maintainer

knqyf263 Oct 21, 2024
Maintainer