-
Notifications
You must be signed in to change notification settings - Fork 546
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
False negatives on Java org.webjars/bootstrap and org.webjars/jquery #2014
Comments
Looking at the affected versions in the corresponding GHSA entry GHSA-mhpp-875w-9cpv: ![]() So AFAIU, Grype correctly didn't report this dep. |
👋 Hey @metametadata thanks for the report on the false negatives. For the first 3: It looks like they're all sitting as unreviewed in both NVD and GHSA. Because of this there are no entries in the grype database yet that would allow us to match based on PURL or CPE (cpe matching is turned off by default for java and we rely on GHSA's published analysis for PURL matching): For CVE-2016-10707 it looks like there is a small naming issue that needs to be resolved between what the package manager is resolving and what the vulnerability is being sourced against. Here are the two different pacakges in maven The one included in the SBOM is NOT vulnerable: The vulnerable PURL would be: note the |
Got it, thanks! I wonder how other scanners are able to match these CVEs then 🤔
Good catch!
They are different, even though somewhere inside they contain exactly the same jQuery JS code. Conclusion:
|
What happened:
Vulns in Java dep
pkg:maven/org.webjars/bootstrap@3.4.1
are not detected:CVE-2016-10707 in Java dep
pkg:maven/org.webjars/jquery@1.11.1
is not detected.What you expected to happen:
The vulns are detected.
How to reproduce it (as minimally and precisely as possible):
Maven POM file
pom.xml
:Click me
SBOM file
cycl.json
generated frompom.xml
viamvn -DoutputDirectory=. -DoutputFormat=json -DoutputName=cycl org.cyclonedx:cyclonedx-maven-plugin:2.8.0:makeBom -f pom.xml
:Click me
Grype config
config.yaml
:Finally, Grype
grype -c config.yaml sbom:cycl.json
output:Anything else we need to know?:
The listed CVEs can be found by nvd-clojure (a wrapper for OWASP Dependency-Check which takes a Java classpath as an input) and Sonatype OSS Index analyzer in OWASP Dependency-Track (after uploading
cycl.json
SBOM):Screenshot
AWS Inspector detects the mentioned Bootstrap vulns but misses the jQuery one.
The mentioned vulns are not displayed at mvnrepository.com artifact pages (https://mvnrepository.com/artifact/org.webjars/bootstrap/3.4.1, https://mvnrepository.com/artifact/org.webjars/jquery/1.11.1).
I'm using CycloneDX plugin to generate SBOMs as Grype/Syft is not reliable enough, specifically, looks like it doesn't respect transitive deps.
I'm new to this so I may miss something obvious.
Environment:
grype version
:The text was updated successfully, but these errors were encountered: