cvescan: Exclude fails by version

[phlax]

Signed-off-by: Ryan Northey [email protected]

Commit Message:
Additional Description:

This doesnt fix the cve scanner, but does exclude some errors/warnings that have already been updated

We still have this

  CVE ID: CVE-2021-22930
  CVSS v3 score: 9.8
  Severity: CRITICAL
  Published date: 2021-10-07
  Last modified date: 2021-10-18
  Dependencies: com_github_nodejs_http_parser
  Description: Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use
  after free attack where an attacker might be able to exploit the
  memory corruption, to change process behavior.
  Affected CPEs:
  - cpe:2.3:a:nodejs:node.js:*

here https://dev.azure.com/cncf/envoy/_build/results?buildId=92610&view=logs&j=12f1170f-54f2-53f3-20dd-22fc7dff55f9&t=9c939e41-62c2-5605-5e05-fc3554afc9f5&l=116

iirc the proposed solution to that one is to replace the parser altogether

Risk Level:
Testing:
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

[phlax]

cc @moderation @htuch

[moderation]

Switch away from deprecated http_parser to llhttp is being tracked at:

• Switch from http-parser to llhttp #5155
• [http] add llhttp parser implementation #15814

[phlax]

grrr coverage....

lill kick

[phlax]

im tempted to think that the node.js bug is not related to the http parser, and can probably added to the exclude list

[htuch]

Can you leave a slightly more verbose message, i.e. "These are false positives triggered by the inability of cvescan to accurately compute vesion" or something like that? Thanks. Otherwise LGTM.

[phlax]

yep, i have improved the message, and merged the immediately preceding exclusion, which was added for the same reason, and had a ~duplicating message

[phlax]

@htuch shall i add the nodejs cve (posted in PR comment) to the exclusions ?

[htuch]

Reading https://bugzilla.redhat.com/show_bug.cgi?id=1988394, I think the Node.js issue is on their side, rather than nghttp2, so we should allowlist that one.

[phlax]

ill add it this PR now...