Azure Linux (CBL-Mariner)
CBL-Mariner was rebranded to Azure Linux for version 3.0 onwards.
Trivy supports the following scanners for OS packages.
| Version | SBOM | Vulnerability | License |
|---|---|---|---|
| 1.0 | ✔ | ✔ | ✔ |
| 1.0 (Distroless) | ✔ | ✔ | |
| 2.0 | ✔ | ✔ | ✔ |
| 2.0 (Distroless) | ✔ | ✔ | |
| 3.0 | ✔ | ✔ | ✔ |
| 3.0 (Distroless) | ✔ | ✔ |
The following table provides an outline of the targets Trivy supports.
| Version | Container image | Virtual machine | Arch |
|---|---|---|---|
| 1.0 | ✔ | ✔ | amd64, arm64 |
| 2.0 | ✔ | ✔ | amd64, arm64 |
| 3.0 | ✔ | ✔ | amd64, arm64 |
The table below outlines the features offered by Trivy.
| Feature | Supported |
|---|---|
| Detect unfixed vulnerabilities | ✓ |
| Dependency graph | ✓ |
SBOM
Trivy detects packages that have been installed through package managers such as tdnf, dnf and yum.
Vulnerability
Azure Linux offers its own security advisories, and these are utilized when scanning Azure Linux for vulnerabilities.
Data Source
See here.
Fixed Version
Trivy takes fixed versions from Azure Linux OVAL.
Severity
Trivy calculates the severity of an issue based on the severity provided in Azure Linux OVAL.
Status
Trivy supports the following vulnerability statuses for Azure Linux.
| Status | Supported |
|---|---|
| Fixed | ✓ |
| Affected | ✓ |
| Under Investigation | |
| Will Not Fix | |
| Fix Deferred | |
| End of Life |
License
Trivy identifies licenses by examining the metadata of RPM packages.
Note
License detection is not supported for Azure Linux Distroless images.