CRITICAL: AWS (aws-access-key-id)

[pete911]

IDs

AWS Access Key ID

Description

Running trivy fs . on go project with aws-sdk-go-v2 imported in vendor fails with CRITICAL: AWS (aws-access-key-id)

AWS Access Key ID

 vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetAccessKeyInfo.go:14

  12   
  13   // Returns the account identifier for the specified access key ID. Access keys
  14 [ // consist of two parts: an access key ID (for example, ******************** ) and
  15   // a secret access key (for example, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY ).

But this is an example access key in the comment - api_op_GetAccessKeyInfo.go

Reproduction Steps

1. Create go project
2. add dependency on github.com/aws/aws-sdk-go-v2/service/sts v1.19.3
3. run go mod vendor
4. run trivy fs .

Target

Filesystem

Scanner

Vulnerability

Target OS

No response

Debug Output

2023-07-14T17:36:56.855+0100    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-07-14T17:36:56.865+0100    DEBUG   cache dir:  /.../trivy
2023-07-14T17:36:56.865+0100    DEBUG   DB update was skipped because the local DB is the latest
2023-07-14T17:36:56.865+0100    DEBUG   DB Schema: 2, UpdatedAt: 2023-07-14 12:12:11.791100143 +0000 UTC, NextUpdate: 2023-07-14 18:12:11.791100043 +0000 UTC, DownloadedAt: 2023-07-14 16:29:10.171388 +0000 UTC
2023-07-14T17:36:56.865+0100    INFO    Vulnerability scanning is enabled
2023-07-14T17:36:56.865+0100    DEBUG   Vulnerability type:  [os library]
2023-07-14T17:36:56.865+0100    INFO    Secret scanning is enabled
2023-07-14T17:36:56.865+0100    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-07-14T17:36:56.865+0100    INFO    Please see also https://aquasecurity.github.io/trivy/v0.43/docs/scanner/secret/#recommendation for faster secret detection
2023-07-14T17:36:56.865+0100    DEBUG   No secret config detected: trivy-secret.yaml
2023-07-14T17:36:56.865+0100    DEBUG   Walk the file tree rooted at '.' in parallel
2023-07-14T17:36:57.971+0100    DEBUG   Unable to identify dependencies of github.com/aws/aws-sdk-go-v2/service/[email protected] as it doesn't support Go modules
2023-07-14T17:36:57.971+0100    DEBUG   Unable to identify dependencies of github.com/aws/aws-sdk-go-v2/internal/[email protected] as it doesn't support Go modules
2023-07-14T17:36:57.971+0100    DEBUG   Loading the default license classifier...
2023-07-14T17:36:58.295+0100    DEBUG   Unable to identify dependencies of github.com/aws/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.298+0100    DEBUG   Unable to identify dependencies of github.com/go-playground/[email protected]+incompatible as it doesn't support Go modules
2023-07-14T17:36:58.298+0100    DEBUG   Unable to identify dependencies of github.com/aws/aws-sdk-go-v2/service/internal/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.298+0100    DEBUG   Unable to identify dependencies of github.com/aws/aws-sdk-go-v2/service/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.313+0100    DEBUG   Unable to identify dependencies of github.com/golang-jwt/[email protected]+incompatible as it doesn't support Go modules
2023-07-14T17:36:58.316+0100    DEBUG   Unable to identify dependencies of github.com/santhosh-tekuri/jsonschema/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.316+0100    DEBUG   Unable to identify dependencies of github.com/aws/aws-sdk-go-v2/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.316+0100    DEBUG   Unable to identify dependencies of github.com/aws/aws-sdk-go-v2/internal/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.325+0100    DEBUG   Unable to identify dependencies of gopkg.in/go-playground/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.325+0100    DEBUG   Unable to identify dependencies of github.com/aws/aws-sdk-go-v2/service/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.327+0100    DEBUG   Unable to identify dependencies of github.com/aws/aws-sdk-go-v2/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.339+0100    DEBUG   Unable to identify dependencies of github.com/aws/aws-sdk-go-v2/service/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.342+0100    DEBUG   Unable to identify dependencies of github.com/aws/aws-sdk-go-v2/internal/endpoints/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.345+0100    DEBUG   Unable to identify dependencies of github.com/valyala/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.353+0100    DEBUG   Unable to identify dependencies of github.com/rs/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.353+0100    DEBUG   Unable to identify dependencies of github.com/aws/aws-sdk-go-v2/feature/ec2/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.355+0100    DEBUG   Unable to identify dependencies of github.com/davecgh/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.359+0100    DEBUG   Unable to identify dependencies of github.com/pmezard/[email protected] as it doesn't support Go modules
2023-07-14T17:36:58.370+0100    DEBUG   OS is not detected.
2023-07-14T17:36:58.370+0100    DEBUG   Detected OS: unknown
2023-07-14T17:36:58.370+0100    INFO    Number of language-specific files: 1
2023-07-14T17:36:58.370+0100    INFO    Detecting gomod vulnerabilities...
2023-07-14T17:36:58.370+0100    DEBUG   Detecting library vulnerabilities, type: gomod, path: go.mod
2023-07-14T17:36:58.371+0100    DEBUG   Secret file: vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetAccessKeyInfo.go

vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetAccessKeyInfo.go (secrets)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)

CRITICAL: AWS (aws-access-key-id)
════════════════════════════════════════════════════════════════════════════════════
AWS Access Key ID
────────────────────────────────────────────────────────────────────────────────────
 vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetAccessKeyInfo.go:14
────────────────────────────────────────────────────────────────────────────────────
  12   
  13   // Returns the account identifier for the specified access key ID. Access keys
  14 [ // consist of two parts: an access key ID (for example, ******************** ) and
  15   // a secret access key (for example, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY ).
─────────────────────────────────────────────────────────────────────────────────────

Version

Version: 0.43.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-07-14 12:12:11.791100143 +0000 UTC
  NextUpdate: 2023-07-14 18:12:11.791100043 +0000 UTC
  DownloadedAt: 2023-07-14 16:29:10.171388 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2023-05-04 00:53:26.2635229 +0000 UTC
  NextUpdate: 2023-05-07 00:53:26.2635224 +0000 UTC
  DownloadedAt: 2023-05-04 10:56:39.464573 +0000 UTC

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[knqyf263]

Thanks. I've created an issue for tracking.
#4826