Python 3.6.8 Pip 9.0.3 vulnerabilities not detected

[matjawor]

IDs

CVE-2022-48565,CVE-2022-37454,CVE-2021-3177,CVE-2020-27619,CVE-2019-9948,CVE-2019-9636,CVE-2019-10160

Description

Trivy Version 0.47.0 scanned an image based on Rocky Linux 8.5 and python core packages in version below:

python 3.6.8
pip 9.0.3

Both python core packages installed by dnf package installer. Critical vulnerabilities listed in IDs section weren't detected by Trivy image scan.

Reproduction Steps

1. Build image based on Rocky Linux 8.5.
2. Install inside python core packages in above-mentioned versions.
- dnf install python
- dnf install pip
3. Run trivy image scanning
4. Get familiar with a report. Above-mentioned vulnerabilities will not be detected
...

Target

Container Image

Scanner

Vulnerability

Target OS

Rocky Linux 8.5

Debug Output

Inluded in the Description section.

Version

0.47.0

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[DmitriyLewen]

Hello @matjawor
Thanks for your report!

For packages installed from package manager we use Vendor OS database - https://aquasecurity.github.io/trivy/v0.47/docs/scanner/vulnerability/#data-source-selection

It looks like Rocky database doesn't have these CVEs or there are fixes for python38 or python27.

Regards, Dmitriy