-
Notifications
You must be signed in to change notification settings - Fork 546
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
False Positive: GHSA-248v-346w-9cwc/(CVE-2024-39689) reported for certifi library in python #2013
Comments
Hi @pcreager23, I think this no longer happens on the current version of grype which is 0.79.3. Here's how I tried: Make a dockerfile like this: FROM python:3.12.4-slim-bullseye
RUN pip install certifi==2024.7.4 Run
Scan with syft just to make sure we're really finding the package:
If you still experience this issue with the latest version of grype, please let us know. Thanks! |
Thanks, I will encourage our scanning team to upgrade. |
What happened:
We have Python images with
certifi
version2024.7.4
, but grype is flagging them as vulnerable to CVE-2024-39689 / GHSA-248v-346w-9cwc since the version string does not match "2024.07.04".Per the GHSA (and CVE) advisories, the fixed versions are ≥
2024.7.4
, but grype is marking this vulnerability as applicable for my image:As you can see, the
versionConstraint
is incorrect.What you expected to happen:
grype should not report the patched version as vulnerable.
How to reproduce it (as minimally and precisely as possible):
Scan any python image containing
certifi
version2024.7.4
.Anything else we need to know?:
The lack of leading zeroes in any of these dated versions is standard practice in Python, per canonical PEP 440, so
2024.7.4
is the correct format, and indeed what the certifi devs are using: Release HistoryRef: Version specifiers
We had this same issue occur before: issue 1417
It was supposed to be fixed in #1510.
Environment:
The text was updated successfully, but these errors were encountered: