From 22c26863dab4f89e0259751bb1253f86885c66fa Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Wed, 12 Nov 2025 17:28:31 +0100 Subject: [PATCH 1/7] [trivy] add `trivy-maven-plugin` Signed-off-by: Vincent Potucek --- .github/workflows/ci.yml | 3 +++ .trivyignore | 7 +++++++ boms/pom.xml | 15 +++++++++++++++ pom.xml | 10 ++++++++++ 4 files changed, 35 insertions(+) create mode 100644 .trivyignore diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ada5dd74f089..eec199e20115 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -97,6 +97,9 @@ jobs: - name: Build Keycloak uses: ./.github/actions/build-keycloak + - name: Trivy + run: ./mvnw trivy:trivy-scan + - name: Check for unstaged proto.lock files if: github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release/') run: git diff --name-only --exit-code -- "**/proto.lock" diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 000000000000..bc372c40a69c --- /dev/null +++ b/.trivyignore @@ -0,0 +1,7 @@ +CVE-2015-7501 +CVE-2019-17571 +CVE-2022-23305 +CVE-2022-23307 +CVE-2022-4492 +CVE-2022-45047 +CVE-2024-52046 \ No newline at end of file diff --git a/boms/pom.xml b/boms/pom.xml index a9f5de04ddb8..02a4414b9de1 100644 --- a/boms/pom.xml +++ b/boms/pom.xml @@ -82,6 +82,21 @@ com.diffplug.spotless spotless-maven-plugin ${spotless-plugin.version} + + + + + + + + tech.orla + trivy-maven-plugin + 1.0.1 + + true + CRITICAL + os,library + diff --git a/pom.xml b/pom.xml index d3cabd03cb9f..f616a5a78507 100644 --- a/pom.xml +++ b/pom.xml @@ -1557,6 +1557,16 @@ + + tech.orla + trivy-maven-plugin + 1.0.1 + + true + CRITICAL + os,library + + From c30c7114c8c3e359b2ad4d29f64dcfe5685eecb4 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 11:41:21 +0100 Subject: [PATCH 2/7] [trivy] fix `trivy-analysis` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- .github/workflows/trivy-analysis.yml | 2 +- .trivyignore | 35 ++++++++++++++++++++++++++++ 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 .trivyignore diff --git a/.github/workflows/trivy-analysis.yml b/.github/workflows/trivy-analysis.yml index ce9d38e8dae6..e14ee8654671 100644 --- a/.github/workflows/trivy-analysis.yml +++ b/.github/workflows/trivy-analysis.yml @@ -33,8 +33,8 @@ jobs: format: sarif output: trivy-results.sarif severity: MEDIUM,CRITICAL,HIGH + vulnType: os,library ignore-unfixed: true - version: v0.57.1 timeout: 15m env: TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 000000000000..f06d3b535f3d --- /dev/null +++ b/.trivyignore @@ -0,0 +1,35 @@ +__CVE-2015-6420 # commons-collections:commons-collections +__CVE-2015-7501 # commons-collections:commons-collections +__CVE-2019-17571 # log4j:log4j +__CVE-2020-11022 # jquery +__CVE-2020-11023 # jquery +__CVE-2020-15522 # org.bouncycastle:bcprov-jdk15on +__CVE-2020-35510 # org.jboss.remoting:jboss-remoting +__CVE-2021-4104 # log4j:log4j +__CVE-2021-41973 # org.apache.mina:mina-core +__CVE-2022-23302 # log4j:log4j +__CVE-2022-23305 # log4j:log4j +__CVE-2022-23307 # log4j:log4j +__CVE-2022-4065 # org.testng:testng +__CVE-2023-1973 # io.undertow:undertow-core +__CVE-2023-26464 # log4j:log4j +__CVE-2023-33201 # org.bouncycastle:bcprov-jdk15on +__CVE-2023-33202 # org.bouncycastle:bcprov-jdk15on +__CVE-2023-4639 # io.undertow:undertow-core +__CVE-2023-5685 # org.jboss.xnio:xnio-api +__CVE-2024-1459 # io.undertow:undertow-core +__CVE-2024-1635 # io.undertow:undertow-core +__CVE-2024-29857 # org.bouncycastle:bcprov-jdk15on +__CVE-2024-30171 # org.bouncycastle:bcprov-jdk15on +__CVE-2024-3653 # io.undertow:undertow-core +__CVE-2024-52046 # org.apache.mina:mina-core +__CVE-2024-5971 # io.undertow:undertow-core +__CVE-2024-6162 # io.undertow:undertow-core +__CVE-2024-6485 # bootstrap +__CVE-2024-7885 # io.undertow:undertow-core +__CVE-2025-11965 # io.vertx:vertx-web +__CVE-2025-1647 # bootstrap +__CVE-2025-48924 # commons-lang:commons-lang +__CVE-2025-5731 # org.infinispan:infinispan-cli-client +__CVE-2025-59250 # com.microsoft.sqlserver:mssql-jdbc +__CVE-2025-9784 # io.undertow:undertow-core \ No newline at end of file From 9c01f076d3fbaed6f1adc76fbdb2aeba03b28f56 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 15:05:36 +0100 Subject: [PATCH 3/7] [trivy] fix `trivy-scan` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- .github/workflows/trivy-analysis.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/trivy-analysis.yml b/.github/workflows/trivy-analysis.yml index e14ee8654671..1be1b3b9fd7c 100644 --- a/.github/workflows/trivy-analysis.yml +++ b/.github/workflows/trivy-analysis.yml @@ -45,3 +45,6 @@ jobs: with: sarif_file: trivy-results.sarif category: ${{ matrix.container }} + + - name: trivy-scan + run: ./mvnw trivy:trivy-scan From b58e57f8ad8bee8f5721d1378a66dfe26b902262 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 15:08:12 +0100 Subject: [PATCH 4/7] [trivy] fix `trivy-scan` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- .github/workflows/ci.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index eec199e20115..ada5dd74f089 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -97,9 +97,6 @@ jobs: - name: Build Keycloak uses: ./.github/actions/build-keycloak - - name: Trivy - run: ./mvnw trivy:trivy-scan - - name: Check for unstaged proto.lock files if: github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release/') run: git diff --name-only --exit-code -- "**/proto.lock" From 45d0ecfc087b1e81e73b70404e9de1822148d31c Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 15:09:06 +0100 Subject: [PATCH 5/7] [trivy] fix `trivy-scan` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- .github/workflows/trivy-analysis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/trivy-analysis.yml b/.github/workflows/trivy-analysis.yml index 1be1b3b9fd7c..2345d598de40 100644 --- a/.github/workflows/trivy-analysis.yml +++ b/.github/workflows/trivy-analysis.yml @@ -33,7 +33,7 @@ jobs: format: sarif output: trivy-results.sarif severity: MEDIUM,CRITICAL,HIGH - vulnType: os,library + vuln-type: os,library ignore-unfixed: true timeout: 15m env: From 6e6edba3d5af1b0464217433797c7214d03f7aef Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 15:12:14 +0100 Subject: [PATCH 6/7] [trivy] fix `trivy-scan` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- .github/workflows/trivy-analysis.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/trivy-analysis.yml b/.github/workflows/trivy-analysis.yml index 2345d598de40..7785900b55d6 100644 --- a/.github/workflows/trivy-analysis.yml +++ b/.github/workflows/trivy-analysis.yml @@ -29,13 +29,13 @@ jobs: - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1 with: - image-ref: quay.io/keycloak/${{ matrix.container }}:nightly format: sarif + ignore-unfixed: true + image-ref: quay.io/keycloak/${{ matrix.container }}:nightly output: trivy-results.sarif severity: MEDIUM,CRITICAL,HIGH - vuln-type: os,library - ignore-unfixed: true timeout: 15m + vuln-type: os,library env: TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db From 5ed64a7c91e337cf2db646954e5e099d30fbbe6a Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 15:13:49 +0100 Subject: [PATCH 7/7] [trivy] fix `vuln-type` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- .github/workflows/trivy-analysis.yml | 8 +++----- boms/pom.xml | 15 --------------- pom.xml | 10 ---------- 3 files changed, 3 insertions(+), 30 deletions(-) diff --git a/.github/workflows/trivy-analysis.yml b/.github/workflows/trivy-analysis.yml index 7785900b55d6..b72c9008b88f 100644 --- a/.github/workflows/trivy-analysis.yml +++ b/.github/workflows/trivy-analysis.yml @@ -29,11 +29,12 @@ jobs: - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1 with: - format: sarif - ignore-unfixed: true image-ref: quay.io/keycloak/${{ matrix.container }}:nightly + format: sarif output: trivy-results.sarif severity: MEDIUM,CRITICAL,HIGH + ignore-unfixed: true + version: v0.57.1 timeout: 15m vuln-type: os,library env: @@ -45,6 +46,3 @@ jobs: with: sarif_file: trivy-results.sarif category: ${{ matrix.container }} - - - name: trivy-scan - run: ./mvnw trivy:trivy-scan diff --git a/boms/pom.xml b/boms/pom.xml index 02a4414b9de1..a9f5de04ddb8 100644 --- a/boms/pom.xml +++ b/boms/pom.xml @@ -82,21 +82,6 @@ com.diffplug.spotless spotless-maven-plugin ${spotless-plugin.version} - - - - - - - - tech.orla - trivy-maven-plugin - 1.0.1 - - true - CRITICAL - os,library - diff --git a/pom.xml b/pom.xml index f616a5a78507..d3cabd03cb9f 100644 --- a/pom.xml +++ b/pom.xml @@ -1557,16 +1557,6 @@ - - tech.orla - trivy-maven-plugin - 1.0.1 - - true - CRITICAL - os,library - -