"Exception while attaching findings to engagement" error in Persistence-defectdojo about securecodebox HOT 6 OPEN

All of the (3 I think) recent trivy+DefectDojo issues should be fixed by the changes outlined here 😊 #2364 (comment)

With it the issue would not occur anymore as we'd DD handle the trivy format and it wouldn't encounter these malformed uris.

We should still fix the underlying parser for both the trivy-k8s and trivy-image types to produce valid uris though.

from securecodebox.

Hi @danil-smirnov,

thanks for submitting this issue. We'll investigate this.

from securecodebox.

This seems to be a duplicate of #2324

from securecodebox.

Why do you think so @Weltraumschaf ? The error is completely different

from securecodebox.

My assumtion:

• It is the same scanner (Trivy).
• It is also malformed URL error.
• The message complains about "latest" is not a port number and use "debian:latest" in the YAML.

So, my educated guess is that the URL is something like "...debian:latest..." which is not valid.

from securecodebox.