[tractusx-dev] Trivy & Trivy

[Mathias Brunkow Moser <mathias.moser@xxxxxxxxxxxx>]

Dear Eclipse Tractus-X Community,

We have disabled all the Trivy github actions.

There was an attack which was executed not long ago in the trivy version 0.69.4.

Can be found here:

https://opensourcemalware.com/repository/https%3A%2F%2Fgithub.com%2Faquasecurity%2Ftrivy%2F 

Apparently, it may affect us, so we as committers have decided to be cautious and disable all the Trivy workflows in GITHUB.  Until we can confirm if we’re affected or not. Please also check if you have a "fork" if you have executed it with this version or the trivy-actions without the hash.

Here is the story:

https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release#what-happened 

Remember when we said you **must** indicate the commit hash into the workflow. THIS was one of the reasons why. However we have identified that this rule was not followed in several repositories.

What we have not yet identified if we are affected (which did not specify a hashed version) or if there was a run of trivy since monday which was executed via "trivy-actions" which contained a version with malware.

We have informed the eclipse foundation via Help Desk already: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/7297 (private issue)

We have identified that the following repositories are not using the “hashed” workflow version (which may have run since monday a version with the malware):

• https://github.com/eclipse-tractusx/tractusx-edc
• https://github.com/eclipse-tractusx/item-relationship-service
• https://github.com/eclipse-tractusx/managed-simple-data-exchanger-frontend
• https://github.com/eclipse-tractusx/tractusx-edc-kafka-extension
• https://github.com/eclipse-tractusx/sldt-semantic-hub
• https://github.com/eclipse-tractusx/bpdm
• https://github.com/eclipse-tractusx/sd-factory
• https://github.com/eclipse-tractusx/sldt-digital-twin-registry
• https://github.com/eclipse-tractusx/managed-simple-data-exchanger-backend
• https://github.com/eclipse-tractusx/traceability-foss
• https://github.com/eclipse-tractusx/sldt-bpn-discovery
• https://github.com/eclipse-tractusx/bpn-did-resolution-service
• https://github.com/eclipse-tractusx/tractusx-identityhub

We have check most and it looks like it has not happened, but we still need to check it deeper.

Also archived repos have no hash, but they are out of scope:

• https://github.com/eclipse-tractusx/bpdm-certificate-management
• https://github.com/eclipse-tractusx/digital-product-pass
• https://github.com/eclipse-tractusx/policy-hub
• https://github.com/eclipse-tractusx/vas-country-risk
• https://github.com/eclipse-tractusx/vas-country-risk-backend
• https://github.com/eclipse-tractusx/daps-registration-service
• https://github.com/eclipse-tractusx/puris-frontend
• https://github.com/eclipse-tractusx/tractusx-issuerservice
• https://github.com/eclipse-tractusx/traceability-foss-backend
• https://github.com/eclipse-tractusx/managed-identity-wallet
• https://github.com/eclipse-tractusx/managed-identity-wallets-archived

So, this is a call for all committers to NOT enable their Trivy workflow GitHub Actions until we have sorted this out, discussed a way forward and estimated the impact.

Please make sure to update your workflows in the future to use the “hash” and not the “version” of a package, not only for Trivy example:

https://github.com/eclipse-tractusx/industry-core-hub/blob/809b95d8b35751339528688f80fc86381e2b329e/.github/workflows/trivy.yml#L53

Since in this way if the tag is replaced by an attacker, they still will never be able to replace the git commit.

Please take a look on your forks and see if you are also affected in your organization, also internally. Since the impact observed is that the GitHub Actions Secrets may have been leaked.

Thank you for all the persons which supported us and reported this vulnerability. 

Stay safe,

Your Eclipse Tractus-X Project Leads