Trivy doesn not detect CVE-2023-31419 for elasticsearch-7.10.2.jar #5577
Replies: 5 comments 15 replies
-
|
Hello @navzen2000 I downloaded elasticsearch-7.10.2.jar from maven reposirty and Trivy correct detected CVE-2023-31419 for this jar: ➜ wget https://repo1.maven.org/maven2/org/elasticsearch/elasticsearch/7.10.2/elasticsearch-7.10.2.jar
--2023-11-14 16:04:04-- https://repo1.maven.org/maven2/org/elasticsearch/elasticsearch/7.10.2/elasticsearch-7.10.2.jar
Resolving repo1.maven.org (repo1.maven.org)... 146.75.116.209
Connecting to repo1.maven.org (repo1.maven.org)|146.75.116.209|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 13052737 (12M) [application/java-archive]
Saving to: ‘elasticsearch-7.10.2.jar’
elasticsearch-7.10. 100%[===================>] 12,45M 17,2MB/s in 0,7s
2023-11-14 16:04:05 (17,2 MB/s) - ‘elasticsearch-7.10.2.jar’ saved [13052737/13052737]
➜ trivy -d rootfs ./elasticsearch-7.10.2.jar
...
Java (jar)
Total: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 5, HIGH: 1, CRITICAL: 0)
┌────────────────────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├────────────────────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼──────────────────────────────────────────────────────────────┤
│ org.elasticsearch:elasticsearch (elasticsearch-7.10.2.jar) │ CVE-2023-31418 │ HIGH │ fixed │ 7.10.2 │ 7.17.13, 8.9.0 │ elasticsearch: uncontrolled resource consumption │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-31418 │
│ ├────────────────┼──────────┤ │ ├────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2021-22134 │ MEDIUM │ │ │ 7.11.0 │ elasticsearch: requests do not properly apply security │
│ │ │ │ │ │ │ permissions when executing a query... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-22134 │
│ ├────────────────┤ │ │ ├────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2021-22135 │ │ │ │ 7.11.2, 6.8.15 │ elasticsearch: Document disclosure flaw in the Elasticsearch │
│ │ │ │ │ │ │ suggester │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-22135 │
│ ├────────────────┤ │ │ ├────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2021-22144 │ │ │ │ 6.8.17, 7.13.3 │ uncontrolled recursion in Grok parser │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-22144 │
│ ├────────────────┤ │ │ ├────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2023-31417 │ │ │ │ 7.17.13, 8.9.2 │ Sensitive information in audit logs │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-31417 │
│ ├────────────────┤ │ │ ├────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2023-31419 │ │ │ │ 7.17.13, 8.9.1 │ elasticsearch: StackOverflow vulnerability │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-31419 │
└────────────────────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────┴──────────────────────────────────────────────────────────────┘Are you sure your image contains correct version of elasticsearch-7.10.2.jar? Regards, Dmitriy |
Beta Was this translation helpful? Give feedback.
-
|
@DmitriyLewen Thanks for you response. Trivy 0.46.1 trivy -d rootfs ./elasticsearch-7.10.2.jar Grype 0.65.2 This elasticsearch jar was built from source, and other FOSS tools like Grype was able to detect signature (for comparison), while Trivy failed to do so. Can you please tell us what are you exactly looking inside the jar file to detect the signature. |
Beta Was this translation helpful? Give feedback.
-
|
We check Can you tell me how you build this jar? |
Beta Was this translation helpful? Give feedback.
-
|
Here is the MANIFEST.MF file inside META-INF folder (obfuscated) |
Beta Was this translation helpful? Give feedback.
-
|
We check the following fields: - https://github.com/aquasecurity/go-dep-parser/blob/d61bf8be0f05d23b62b065b5861d8cba14a83aa2/pkg/java/jar/parse.go#L313-L333 |
Beta Was this translation helpful? Give feedback.
-
|
@DmitriyLewen I think there is more to this check, simply replacing the MANIFEST file with maven one does not work with detection |
Beta Was this translation helpful? Give feedback.
-
|
we try to find GroupID by ArtifactID and Version. E.g. there are cases when version is set in BOM files and all products use this version. |
Beta Was this translation helpful? Give feedback.
-
|
@DmitriyLewen In order to get coverage for locally built jars from same source, atleast cpe match can be done against name of the jar itself if GAV cannot be ascertained. In our case, jar name(elasticsearch-7.10.2.jar) matches NVD cpe. Please let me know your thoughts. My concern here is other tools like Grype can identify it, so why Trivy can not. |
Beta Was this translation helpful? Give feedback.
-
|
We try to find by file name: But I got an idea how we can improve our logic. I'll make changes and write to you. |
Beta Was this translation helpful? Give feedback.
-
|
@navzen2000 FYI - created #5627 |
Beta Was this translation helpful? Give feedback.
-
|
Thank you @DmitriyLewen for your kind consideration! |
Beta Was this translation helpful? Give feedback.
-
|
I'm closing this question because #5627 consolidates the issues in this discussion. |
Beta Was this translation helpful? Give feedback.
-
Description
Trivy does not report CVE-2023-31419 for elasticsearch-7.10.2.jar when scanned against docker image
Desired Behavior
CVE-2023-31419 to be reported for elasticsearch-7.10.2.jar
Actual Behavior
CVE-2023-31419 not reported for elasticsearch-7.10.2.jar
Reproduction Steps
Target
Container Image
Scanner
Vulnerability
Output Format
None
Mode
Standalone
Debug Output
Operating System
linux
Version
Checklist
trivy image --resetBeta Was this translation helpful? Give feedback.
All reactions