Trivy: a config row is a check, not a CVE

Two result shapes

Trivy can report vulnerabilities against packages and misconfiguration checks against files such as Terraform or a Dockerfile. A vulnerability row has a package, an installed version, and an advisory id. A config row has a check id and a location in a file. The words in the summary line are not enough if you do not say which shape you copied.

A check id is the control the file failed or passed in that scan. It is not a CVE, and it does not mean a package version was found, unless that row is actually a vulnerability row.

The file location is the evidence for a check

Quote the file and the line or resource the config result names. That is what the check looked at. Do not attach an image digest to a Terraform finding and call it an image CVE. Do not attach a package name that the config row never listed.

If the paste does not show whether the row is a check or a vulnerability, write “row kind not recorded” and do not invent a CVE id.

What to file

For a config row, file the check id, the file, the scan time, and the severity label as the check’s label. For a vulnerability row, file the package, the version, and the advisory. Do not mix the columns. A gate that failed on a check is a file change, not a package upgrade, unless you have both kinds of rows and you cite both.

Worked case: a check id filed as a library CVE

A lab trivy config run on infra/storage.tf reports check AVD-AWS-0089 at a bucket resource, severity high. A draft says the image contains a vulnerable library CVE-AVD-AWS-0089 and should be upgraded. There is no package and no installed version on the row.

The note says this is a config check, quotes the check id and the file, and does not create a CVE or a package version. The work, if any, is the Terraform resource. An image scan, if one exists, is a different report.

Snippet

kind: config check
check id: AVD-AWS-0089
file: infra/storage.tf
severity: high (label on the check)
package and installed version: not on this row
not: a library CVE and not an image upgrade

Diagram

A config check and a vulnerability row

The columns tell you which one you have.

Config check

Names. A check id and a file location

Means. That file failed or hit the check

Fix shape. A change to the file, if you accept the check

Vulnerability row

Names. A package, a version, and an advisory id

Means. That version was matched to the advisory

Fix shape. An upgrade or an exception, cited as that row

Check yourself

1. A result has check id AVD-AWS-0089 and a Terraform file, and no package. What is it?

2. Why not put a CVE prefix on the check id?

3. An image vulnerability report exists as a second file. How do you cite it?