False detection for CVE-2024-45491 on Red Hat UBI8 and UBI9 #8059
Closed
jhebden-gl
started this conversation in
False Detection
Replies: 2 comments
-
|
@DmitriyLewen Can you please take a look? |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Hello @jhebden-gl Created #8061 and i am already creating fix for that. Regards, Dmitriy |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
IDs
CVE-2024-45491
Description
On both UBI8 and UBI9 (RHEL8 and RHEL9) based images with
expatinstalled, CVE-2024-45491 is being detected on non-vulnerable versions of theexpatpackage.Per Red Hat, the errata for each is:
expat-2.5.0-2.el9_4.1)expat-2.2.5-15.el8_10)I've seen detections showing a status of
StatusWillNotFixfor bothexpat 2.5.0-2.el9_4andexpat 2.2.5-16.el8_10, both of which should carry this fix from Red Hat for these vulnerabilities.I have manually checked the Trivy DB for this information, and it seems correct. Whilst there are
StatusWillNotFixentries for both covering RHEL8 and RHEL9 (which is potentially incorrect?), the presence of linked errata in the Trivy DB should override this given there is aFixedVersionset on both sets of errata. I suspect perhaps Trivy is processing this information incorrectly, or theStatusWillNotFixdata against the CVEs against theexpatpackage is unexpected?The ultimate outcome here would be that these images with these packages would show no detections, as they are not vulnerable.
Reproduction Steps
Target
Container Image
Scanner
Vulnerability
Target OS
Red Hat 8, 9 (UBI8, UBI9)
Debug Output
Version
Checklist
-f jsonthat shows data sources and confirmed that the security advisory in data sources was correctBeta Was this translation helpful? Give feedback.
All reactions