Trivy is crashing with "panic: runtime error: invalid memory address or nil pointer dereference" when scanning for HIGH/CRIT vulnerabilities #8537
Replies: 4 comments 36 replies
-
|
@DmitriyLewen trivy/pkg/report/table/summary.go Line 266 in 67d95a9 |
Beta Was this translation helpful? Give feedback.
-
|
@knqyf263 I can't create a good PoC when the output contains vulnerabilities but doesn't contain packages. Anyway - I think Trivy shouldn't panic in these cases. That's why I created #8549. Take a look when you have time and let me know your opinion, please. |
Beta Was this translation helpful? Give feedback.
-
|
I think we can hold it until we replicate the error. Meanwhile, what if we just handle the non-existence key? or simply |
Beta Was this translation helpful? Give feedback.
-
|
I thought about that, but in this case we will just skip aggregated packages in summary table. I thought it would be better to show at least something |
Beta Was this translation helpful? Give feedback.
-
|
Then, what if displaying a warning message? |
Beta Was this translation helpful? Give feedback.
-
|
I used your logic and updated a bit (to avoid case when we skip aggregated package) - #8549 take a look new tests - i showed questionable cases |
Beta Was this translation helpful? Give feedback.
-
|
Hello @gregory-hive Unfortunately, i can't reproduce your case. Also i see that you use client/server mode. Did you update Trivy server? |
Beta Was this translation helpful? Give feedback.
-
|
Hello @gregory-hive Maybe you can make some test image so we can figure out what the error is? |
Beta Was this translation helpful? Give feedback.
-
|
Hi @DmitriyLewen, Steps to reproduce:
Hope this helps! |
Beta Was this translation helpful? Give feedback.
-
|
It doesn't help. Your example works for me: |
Beta Was this translation helpful? Give feedback.
-
|
What kind of server settings can be useful besides the ones I've already provided? |
Beta Was this translation helpful? Give feedback.
-
|
I need commands how you install (helm commands) and run |
Beta Was this translation helpful? Give feedback.
-
|
Hi there! Chiming in from the side as I just tried to create an issue for this without properly reading the contribution guidelines 😅 This results in the following error message: In GitHub Actions, I get this problem when running the action as follows: Setting the environment variable |
Beta Was this translation helpful? Give feedback.
-
|
I only execute the scan once. The two following commands are convert commands. My report is only about the convert command failing when |
Beta Was this translation helpful? Give feedback.
-
|
in order for the conversion to be performed correctly, your json file ( |
Beta Was this translation helpful? Give feedback.
-
|
Then why is this command working just fine? The resulting table contains all the found vulnerabilities. No |
Beta Was this translation helpful? Give feedback.
-
in other words - you forcibly turn off all scanners. In this case, Trivi does not draw the total error and you do not see the error. |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
I encountered the same panic few days ago. |
Beta Was this translation helpful? Give feedback.
-
|
Do you have any information on how the Trivy server is running? |
Beta Was this translation helpful? Give feedback.
-
|
I don't have the detail information but the server must be started by the trivy helm-chart in this site: |
Beta Was this translation helpful? Give feedback.
-
|
I installed Trivy from ➜ ~ trivy -q image --server http://localhost:4954 python:3.11-slim --table-mode summary
Report Summary
┌─────────────────────────────────────────────────────────────────────────────┬────────────┬─────────────────┬─────────┐
│ Target │ Type │ Vulnerabilities │ Secrets │
├─────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┼─────────┤
│ python:3.11-slim (debian 12.10) │ debian │ 98 │ - │
├─────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┼─────────┤
│ usr/local/lib/python3.11/site-packages/pip-24.0.dist-info/METADATA │ python-pkg │ 0 │ - │
├─────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┼─────────┤
│ usr/local/lib/python3.11/site-packages/setuptools-65.5.1.dist-info/METADATA │ python-pkg │ 1 │ - │
├─────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┼─────────┤
│ usr/local/lib/python3.11/site-packages/wheel-0.45.1.dist-info/METADATA │ python-pkg │ 0 │ - │
└─────────────────────────────────────────────────────────────────────────────┴────────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)
|
Beta Was this translation helpful? Give feedback.
-
|
The following is the client command lines we are using. Hope this helps... |
Beta Was this translation helpful? Give feedback.
-
|
The problem is that the Trivy server returns |
Beta Was this translation helpful? Give feedback.
-
Description
One of my builds with Trivy scans has started to crash with:
panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x58 pc=0x3c77dbb].When it is run with "--severity HIGH,CRITICAL" flag, while the previous step with "--severity LOW,MEDIUM" works just fine.
There were no change in the application code/dependencies list, it crashes with the same error even for the build which successfully passed last week (latest success on the 7th of March)
Desired Behavior
Successful scan
Actual Behavior
Runtime error
Reproduction Steps
Target
Container Image
Scanner
Vulnerability
Output Format
Table
Mode
Standalone
Debug Output
Operating System
Ubuntu 22.04
Version
Checklist
trivy clean --allBeta Was this translation helpful? Give feedback.
All reactions