DependencyTrack / DependencyTrack/dependency-track

Multiple false positives are found for curl, openssl and perl of debian docker image

Open
#4,835 2 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

We use trivy to scan Jenkins docker image, which is from Debian image. And we upload the CycloneDX json file into dependency track to create a project, and DT reported many vulnerabilities, the top ones are from curl, openssl and perl. But when we checked the details of the vulnerabilities, many of them are actually fixed in the image already. Here is an example of curl. All the highlighted CVEs are fixed and included in the changelog from debian: [https://metadata.ftp-master.debian.org/changelogs//main/c/curl/curl_7.88.1-10+deb12u12_changelog](https://metadata.ftp-master.debian.org/changelogs/main/c/curl/curl_7.88.1-10+deb12u12_changelog).
Image

If DT only recognized the 7.88.1 version number, which was included in Debian on Mon, 20 Feb 2023 22:35:53 +0000, then it can explain why there are so many false positives, because all the fixes are after Feb 2023.

This false positives issue happens to openssl and perl as well.

### Steps to Reproduce

1. Get an Jenkins docker image from docker.io/jenkins/jenkins:2.492.2
2. Use trivy to scan it and generate .json file
3. Upload the json into DT
4. Go to components tab and sort by Risk Score descending

### Expected Behavior

All fixed CVEs should be detected and risk score of the DT project should be much lower. The issue maybe relate with other issues reported recently about semantic version check, especially those versions from Debian. In terms of database, when I check the vulnerability details, I found the Debian version was included in OSV database already, so OSV database itself should have no issue. But the Debian version was not included in NVD. https://nvd.nist.gov/vuln/detail/CVE-2023-38545
Here is an example for CVE-2023-38545 in DT 'Affected Components' tab of its vulnerability details page.

pkg:deb/debian/curl?arch=source (<7.88.1-10+deb12u4) | OSV
-- | --

### Dependency-Track Version

4.12.x

### Dependency-Track Distribution

Executable WAR

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.