False Negative CVE-2007-4559

[spiffcs]

What happened:
Scanning python:slim with grype does not surface CVE-2007-4559.

What you expected to happen:
CVE-2007-4559 should be surfaced for all python versions at the moment

How to reproduce it (as minimally and precisely as possible):
grype python:slim

CVE-2007-4559 does not appear in the results

Anything else we need to know?:
Small context here

Environment:

• Output of grype version: 0.50.2
• OS (e.g: cat /etc/os-release or similar): darwin/amd64

[captn3m0]

Unless Python is planning to fix this, reporting this en-masse will cause needless false positives.

[westonsteimel]

We are working on a labelling effort to help with understanding changes in grype matching quality and this serves as a good candidate for the case where we don't catch things because we don't know about the binaries at all since they aren't installed by a package manager. We created this specifically so we don't forget to capture those cases

[captn3m0]

See anchore/syft#1197 for detection problems on binaries installed outside of package manager (includes python:slim).

[tgerla]

The latest version of grype successfully identifies this CVE so I'll go ahead and close this issue.