False positive CVE-2015-5237 for protobuf-go #558
Comments
|
Match from grype -o json |
|
Thanks for reporting the issue @xtreme-conor-nosal - I'll take a look and see if we can resolve this so that this is no longer being reported as a false positive. |
|
Do you please have some news? This one is blocking my CI... |
|
This also seems to be a false-positive with https://animal.uk.oracle.com/CVE-2021-22570. Same symptoms. Do we need a separate bug for that? |
|
We can keep this under this bug thanks for the follow-up! |
|
👍 thanks |
|
I can confirm this is still the case - we are experiencing the same for flux cli: $ curl -sSfL https://github.com/fluxcd/flux2/releases/download/v0.28.4/flux_0.28.4_sbom.spdx.json | grype
NAME INSTALLED FIXED-IN VULNERABILITY SEVERITY
google.golang.org/protobuf v1.27.1 CVE-2015-5237 High
google.golang.org/protobuf v1.27.1 CVE-2021-22570 High |
|
Same false positive with google.golang.org/protobuf v1.28.0 ... any hope for a fix ? |
spiffcs
moved this from In Progress (Actively Resolving)
to Triage (Comments or Progress Made)
in OSS
|
@avermeer we're working on a solution to factor this out, however, you can also be sure that grype is not executing the vulnerable code on any of its paths and that the related libraries are pulled in as a transitive dependency. At no time do we expose any kind of protobuff interface for authentication or generate any proto file during grype operations: Vulnerability details below for CVE-2021-22570 |
This reverts commit 3f7c4e9. This CVE is a false positive anchore/grype#558 The CVE links to protocolbuffers/protobuf#760 , which is not the same as google.golang.org/protobuf
This reverts commit 3f7c4e9. This CVE is a false positive anchore/grype#558 The CVE links to protocolbuffers/protobuf#760 , which is not the same as google.golang.org/protobuf
|
is there any update on this. This is still being flagged widely by grype. |
|
We also spot the same issue CVE-2015-5237 detected for protobuf-go as google.golang.org/protobuf for different golang apps. |
|
So what we are planning to do here is to eventually disable CPE-based matching by default. @wagoodman is currently working on getting a quality check implemented within Grype so that on each commit we can understand the difference in detection of false-positives and ensure there aren't any false-negatives introduced as part of a change. We are also working on bringing in an additional source of vulnerability data from GitLab's Community Advisory Database to provide additional coverage for some ecosystems (java Maven in particular). We believe that with both of those in place we can safely turn off the CPE-based matching by default without introducing many false-negatives that would have been found by the CPE-based matches and eliminate the flood of false-positives that it generates |
|
How can we disable CPE matching right now? |
|
You can disable per matcher in the config file https://github.com/anchore/grype#configuration by setting match:
# sets the matchers below to use cpes when trying to find
# vulnerability matches. The stock matcher is the default
# when no primary matcher can be identified
java:
using-cpes: true
python:
using-cpes: true
javascript:
using-cpes: true
ruby:
using-cpes: true
dotnet:
using-cpes: true
golang:
using-cpes: true
stock:
using-cpes: true |
|
you can also control it with env variables if that's easier for you, example for golang export GRYPE_MATCH_GOLANG_USING_CPES=false |
|
Thanks, this works! Worried if this will result in False negatives though. |
|
We encountered the same issue on the following environment
Consul
Solr
|
|
If you all are open to a hard-coded fix for this in the meantime, I'm happy to submit a PR! |
|
much appreciated @luhring -- I think a hard coded fix for this one is worth it given the number of folks impacted by this. Thanks in advance 🙏 ! |
This reverts commit 3f7c4e9. This CVE is a false positive anchore/grype#558 The CVE links to protocolbuffers/protobuf#760 , which is not the same as google.golang.org/protobuf
What happened:
Our go.mod dependency of
google.golang.org/[email protected](a.k.a https://github.com/protocolbuffers/protobuf-go) is detected by syft/grype ascpe:2.3:a:google:protobuf:v1.27.1:*:*:*:*:*:*:*and grype matches CVE-2015-5237 based oncpe:2.3:a:google:protobuf:*:*:*:*:*:*:*:* <= 3.1.0but 1.27.1 is the latest version.The CVE links to protocolbuffers/protobuf#760 which is a different project (protobuf language spec vs the golang runtime).
What you expected to happen:
Distinguish between google.golang.org/protobuf and github.com/protocolbuffers/protobuf
How to reproduce it (as minimally and precisely as possible):
Anything else we need to know?:
https://github.com/golang/vuln/blob/master/triaged-cve-list marks CVE-2015-5237 as a false postive - but I'm not sure what package/version that refers to.
Environment:
grype version:cat /etc/os-releaseor similar):MacOS Big Sur 11.6.2
The text was updated successfully, but these errors were encountered: