False positive on poetry.lock? My package is above the vulnerable version

[vlad-ds]

I am running:

trivy fs poetry.lock 

I recently updated pyspark. But I still get this flag:

{"VulnerabilityID": "CVE-2018-11760",
"PkgName": "pyspark",
"InstalledVersion": "3.1.3",
"FixedVersion": "2.3.2, 2.2.3",
"Layer": {},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-11760",
"DataSource": {
"ID": "osv",
"Name": "Python Packaging Advisory Database",
"URL": "https://github.com/pypa/advisory-db"}

It seems that it should not happen because I have a superior version. Am I missing anything?

[afdesk]

@vlad-ds thanks for your report!
yes, you're right. it looks like a bug, we need to investigate it...

[afdesk]

@vlad-ds could you create the same issue?

[vlad-ds]

Thanks @afdesk, I created here: #2227