Trivy supports the following scanners for OS packages.
Please see here for supported versions.
The table below outlines the features offered by Trivy.
Trivy detects packages that have been installed through
Alpine Linux offers its own security advisories, and these are utilized when scanning Alpine for vulnerabilities.
When looking at fixed versions, it's crucial to consider the patches supplied by Alpine.
For example, for CVE-2023-0464, the fixed version for Alpine Linux is listed as
3.1.0-r1 in the secfixes.
Note that this is different from the upstream fixed version, which is
Typically, only the upstream information gets listed on NVD, so it's important not to get confused.
For Alpine vulnerabilities, the severity is determined using the values set by NVD.
Trivy supports the following vulnerability statuses for Alpine.
|Will Not Fix|
|End of Life|
Trivy identifies licenses by examining the metadata of APK packages.