deps: update module github.com/anchore/grype to v0.104.1 [security]#586
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
deps: update module github.com/anchore/grype to v0.104.1 [security]#586renovate[bot] wants to merge 1 commit intomainfrom
renovate[bot] wants to merge 1 commit intomainfrom
Conversation
renovate
bot
added
the
kind/security
Contributor
Author
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
github-actions
bot
added
the
size/XL
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
renovate
bot
changed the title
renovate
bot
deleted the
renovate/go-github.com-anchore-grype-vulnerability
branch
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/go-github.com-anchore-grype-vulnerability
branch
2 times, most recently
from
13fbcd5 to
73031c2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.91.0→v0.104.1GitHub Vulnerability Alerts
CVE-2025-65965
A credential disclosure vulnerability was found in Grype, affecting versions
v0.68.0throughv0.104.0. If registry credentials are defined and the output of grype is written using the--fileor--output json=<file>option, the registry credentials will be included unsanitized in the output file.Impact
In Grype versions
v0.68.0throughv0.104.0, when registry authentication is configured, those credentials can be incorrectly included in the output of a Grype scan (regardless of whether those credentials are actively being used for the current scan). Users that do not have registry authentication configured are not affected by this issue.Registry credentials can be set via the Grype configuration file (e.g.
registry.auth[].username,registry.auth[].password,registry.auth[].token) or environment variables (e.g.,GRYPE_REGISTRY_AUTH_USERNAME,GRYPE_REGISTRY_AUTH_PASSWORD,GRYPE_REGISTRY_AUTH_TOKEN).In order for the authentication details to be improperly included, the Grype file output format must be set to
jsonwith output target set to a file. For example--output json=file.jsonor--output json --file file.json. When these conditions are met, the configured credentials are not sanitized as they should be in the resulting JSON output file.The authentication details could also be leaked via a malformed Grype Template. A Grype Template that includes the
Descriptor.Registry.Authfields would also include the unsanitized registry credentials. There are no known templates that include these fields.Patches
The patch has been released in
v0.104.1.Workaround
Users running affected versions of grype can work around this vulnerability by redirecting stdout to a file instead of using the
--fileor--outputoptions.For example, replacing the command:
with
...results in the same
test.jsonoutput, but the credentials will be properly sanitized.Resources
Patch pull request: https://github.com/anchore/grype/pull/3068
Release Notes
anchore/grype (github.com/anchore/grype)
v0.104.1Compare Source
Bug Fixes
Additional Changes
mholt/archivesinstead of anchore fork [#3036 @joonas](Full Changelog)
v0.104.0Compare Source
Added Features
--fromflag [#3035 @wagoodman]Bug Fixes
Additional Changes
(Full Changelog)
v0.103.0Compare Source
Added Features
(Full Changelog)
v0.102.0Compare Source
Added Features
Bug Fixes
Additional Changes
(Full Changelog)
v0.101.1Compare Source
Bug Fixes
(Full Changelog)
v0.101.0Compare Source
Added Features
grype db searchcan filter by fixed state [#2968 @willmurphyscode]Bug Fixes
Additional Changes
(Full Changelog)
v0.100.0Compare Source
Added Features
(Full Changelog)
v0.99.1Compare Source
Bug Fixes
(Full Changelog)
v0.99.0Compare Source
Added Features
Bug Fixes
Breaking Changes
(Full Changelog)
v0.98.0Compare Source
Added Features
(Full Changelog)
v0.97.2Compare Source
Grype v0.97.2
Added Features
Bug Fixes
(Full Changelog)
v0.97.1Compare Source
Bug Fixes
(Full Changelog)
v0.97.0Compare Source
Added Features
Bug Fixes
Additional Changes
(Full Changelog)
v0.96.1Compare Source
Syft Improvments
Performance Improvements
(Full Changelog)
v0.96.0Compare Source
Added Features
vulnerabilities.ratingsentries [#2695 #2765 @AlinaPodoba]Bug Fixes
go runandgo installbroken due to uselessredirectdirective ingo.mod[#2777 #2780 @stefanb]Additional Changes
(Full Changelog)
v0.95.0Compare Source
Added Features
kb,dpkg, andapkg[#2742 @westonsteimel]Bug Fixes
Additional Changes
(Full Changelog)
v0.94.0Compare Source
Added Features
Bug Fixes
(Full Changelog)
v0.93.0Compare Source
Added Features
Bug Fixes
db searchcommands [#2692 @wagoodman](Full Changelog)
v0.92.2Compare Source
Bug Fixes
Additional Changes
(Full Changelog)
v0.92.1Compare Source
(Full Changelog)
v0.92.0Compare Source
Added Features
Bug Fixes
(Full Changelog)
v0.91.2Compare Source
Bug Fixes
(Full Changelog)
v0.91.1Compare Source
Bug Fixes
db search vuln[#2589 @wagoodman]~in paths in config file [#2024 #2600 @kzantow]2025041[#2593]Additional Changes
(Full Changelog)
Configuration
📅 Schedule: Branch creation - "" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.