DependencyTrack / DependencyTrack/dependency-track
Multiple false positives are found for curl, openssl and perl of debian docker image
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
We use trivy to scan Jenkins docker image, which is from Debian image. And we upload the CycloneDX json file into dependency track to create a project, and DT reported many vulnerabilities, the top ones are from curl, openssl and perl. But when we checked the details of the vulnerabilities, many of them are actually fixed in the image already. Here is an example of curl. All the highlighted CVEs are fixed and included in the changelog from debian: [https://metadata.ftp-master.debian.org/changelogs//main/c/curl/curl_7.88.1-10+deb12u12_changelog](https://metadata.ftp-master.debian.org/changelogs/main/c/curl/curl_7.88.1-10+deb12u12_changelog).
If DT only recognized the 7.88.1 version number, which was included in Debian on Mon, 20 Feb 2023 22:35:53 +0000, then it can explain why there are so many false positives, because all the fixes are after Feb 2023.
This false positives issue happens to openssl and perl as well.
### Steps to Reproduce
1. Get an Jenkins docker image from docker.io/jenkins/jenkins:2.492.2
2. Use trivy to scan it and generate .json file
3. Upload the json into DT
4. Go to components tab and sort by Risk Score descending
### Expected Behavior
All fixed CVEs should be detected and risk score of the DT project should be much lower. The issue maybe relate with other issues reported recently about semantic version check, especially those versions from Debian. In terms of database, when I check the vulnerability details, I found the Debian version was included in OSV database already, so OSV database itself should have no issue. But the Debian version was not included in NVD. https://nvd.nist.gov/vuln/detail/CVE-2023-38545
Here is an example for CVE-2023-38545 in DT 'Affected Components' tab of its vulnerability details page.
pkg:deb/debian/curl?arch=source (<7.88.1-10+deb12u4) | OSV
-- | --
### Dependency-Track Version
4.12.x
### Dependency-Track Distribution
Executable WAR
### Database Server
PostgreSQL
### Database Server Version
_No response_
### Browser
Google Chrome
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.