Trivy not able to detect graddle exclusions, hence reporting false positives

Description

Trivy not able to detect Gradle exclusions, hence reporting false positives.

Docker images are scanned using Trivy. These images host spring-boot application which uses Gradle for packaging.

There are transitive dependencies which have conflicting versions for certain packages such as gson. However, with


                        force=true

feature of Gradle, we ensure that correct version are overridden

Also our manual validation does confirm that, these vulnerable packages are not present in the packaged docker image.

However trivy falsely detects overridden packages as vulnerable, through pom hirarchy and reports false positives.

Gradle clauses used
implementation( group: "com.google.protobuf", name: "protobuf-java",version:"3.19.2"){ force=true }
implementation( group: "com.google.guava", name: "guava", version:"24.1.1-jre"){ force=true }
implementation( group: "com.google.code.gson", name: "gson", version:"2.9.0"){ force=true }

Snippet of Trivy vulnerability report

Navigation Menu

Trivy not able to detect graddle exclusions, hence reporting false positives #2340

Description

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Trivy not able to detect graddle exclusions, hence reporting false positives #2340

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions