False positive for commons-io #7673
Replies: 4 comments 3 replies
-
|
Bump. Having the same false positive. It got thoroughly checked that the image has commons-io version 2.15.1 and no sign of anything with 2.8.0, however the report says the same thing as author's - 2.8.0. |
Beta Was this translation helpful? Give feedback.
-
|
We are seeing an FP as well, but our tooling is not Trivy, so I suspect the problem is upstream somewhere - like a bad CPE. In our case |
Beta Was this translation helpful? Give feedback.
-
|
Trivy relies on Also, a |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for pointing this out, I must have missed that in the docs. I'll recheck as soon as I'm able to. |
Beta Was this translation helpful? Give feedback.
-
|
Problem solved after upgrading velocity-engine-core to 2.4 |
Beta Was this translation helpful? Give feedback.
-
|
The JAR file path is shown in the JSON report @jankoh shared. It would be appreciated if you look at the report next time. |
Beta Was this translation helpful? Give feedback.
-
|
I confirm upgrading velocity-engine-core to 2.4 fixes the problem. My main source of confusion was, that we did neither see a finding using So all is fine, trivy is not in fault, I'm closing the report. Thanks again for the help! Best, Jan |
Beta Was this translation helpful? Give feedback.
-
IDs
CVE-2024-47554
Description
A scan of a containerised java applications having commons-io-2.16.1 as a dependency results is a finding claiming there is a vulnerable commons-io version 2.8.0; the issue being fixed in 2.14.0. Doing a fs scan of the sourcecode (we use gradle lockfiles) does not show this issue.
Here's the output of
trivy -f json:{ "SchemaVersion": 2, "CreatedAt": "2024-10-08T15:14:12.365392431+02:00", "ArtifactName": "registry.n4group.eu/team-elster/rv-tool/backend:VER_3_5", "ArtifactType": "container_image", "Metadata": { "OS": { "Family": "alpine", "Name": "3.19.4" }, "ImageID": "sha256:068c6bd762321a7a92e2b54e0d27f3858ac78c268d63d037d825054209488eee", "DiffIDs": [ "sha256:94b0f5987cb71badf41e0e98ad0305e7ae36e2f5a4c92c26f6a7b42eb2303ba2", "sha256:a1f950a5054ea8abc6613cea4de982d71f7f6fab543769b568b20ece2e50e4e9", "sha256:da4a9f8735bda1c841564a29ea6ce974047608aa4031fe60e09ba25e5ef00032", "sha256:17efa9c71e8390b10c5897933a2119b9bfeff4c61e195fb0c6d4a773d23d5d9b", "sha256:f1bf4e083069b5866d4047c82f6e86d188821e259454ae3867bd8781e2868be9", "sha256:a159145c3b7f9bc7301ef8e1e2bee43a7b1f745f36664b03a74c6372db6ad5b6", "sha256:0e6bc27e7814f42697626616f8e1b31fb5fabc6677196357e43d61218dcec162" ], "RepoTags": [ "registry.n4group.eu/team-elster/rv-tool/backend:VER_3_5" ], "RepoDigests": [ "registry.n4group.eu/team-elster/rv-tool/backend@sha256:e437b3cdf467e407295c8f52a770661e8457a2b3bebb720ab44a18507d4f8764" ], "ImageConfig": { "architecture": "amd64", "created": "2024-10-04T10:27:45.431318679Z", "history": [ { "created": "2024-07-16T22:56:42Z", "created_by": "/bin/sh -c #(nop) ADD file:9e193d6fff4bce11c0ee715ad87def9ef40e9608d4be84cf73391edd45b2810e in / " }, { "created": "2024-07-16T22:56:42Z", "created_by": "/bin/sh -c #(nop) CMD [\"/bin/sh\"]", "empty_layer": true }, { "created": "2024-07-16T22:56:42Z", "created_by": "ARG version=21.0.4.7.1", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2024-07-16T22:56:42Z", "created_by": "RUN |1 version=21.0.4.7.1 /bin/sh -c wget -O /THIRD-PARTY-LICENSES-20200824.tar.gz https://corretto.aws/downloads/resources/licenses/alpine/THIRD-PARTY-LICENSES-20200824.tar.gz \u0026\u0026 echo \"82f3e50e71b2aee21321b2b33de372feed5befad6ef2196ddec92311bc09becb /THIRD-PARTY-LICENSES-20200824.tar.gz\" | sha256sum -c - \u0026\u0026 tar x -ovzf THIRD-PARTY-LICENSES-20200824.tar.gz \u0026\u0026 rm -rf THIRD-PARTY-LICENSES-20200824.tar.gz \u0026\u0026 wget -O /etc/apk/keys/amazoncorretto.rsa.pub https://apk.corretto.aws/amazoncorretto.rsa.pub \u0026\u0026 SHA_SUM=\"6cfdf08be09f32ca298e2d5bd4a359ee2b275765c09b56d514624bf831eafb91\" \u0026\u0026 echo \"${SHA_SUM} /etc/apk/keys/amazoncorretto.rsa.pub\" | sha256sum -c - \u0026\u0026 echo \"https://apk.corretto.aws\" \u003e\u003e /etc/apk/repositories \u0026\u0026 apk add --no-cache amazon-corretto-21=$version-r0 \u0026\u0026 rm -rf /usr/lib/jvm/java-21-amazon-corretto/lib/src.zip # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2024-07-16T22:56:42Z", "created_by": "ENV LANG=C.UTF-8", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2024-07-16T22:56:42Z", "created_by": "ENV JAVA_HOME=/usr/lib/jvm/default-jvm", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2024-07-16T22:56:42Z", "created_by": "ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/jvm/default-jvm/bin", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "0001-01-01T00:00:00Z", "created_by": "RUN apk -U --no-cache upgrade" }, { "created": "0001-01-01T00:00:00Z", "created_by": "COPY docker-entrypoint.sh /usr/local/bin/" }, { "created": "0001-01-01T00:00:00Z", "created_by": "COPY backend.jar /usr/local/rvtool/" }, { "created": "0001-01-01T00:00:00Z", "created_by": "COPY doc /usr/local/rvtool/documentation/" }, { "created": "0001-01-01T00:00:00Z", "created_by": "COPY fontconfig.properties /usr/lib/jvm/default-jvm/lib/" } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:94b0f5987cb71badf41e0e98ad0305e7ae36e2f5a4c92c26f6a7b42eb2303ba2", "sha256:a1f950a5054ea8abc6613cea4de982d71f7f6fab543769b568b20ece2e50e4e9", "sha256:da4a9f8735bda1c841564a29ea6ce974047608aa4031fe60e09ba25e5ef00032", "sha256:17efa9c71e8390b10c5897933a2119b9bfeff4c61e195fb0c6d4a773d23d5d9b", "sha256:f1bf4e083069b5866d4047c82f6e86d188821e259454ae3867bd8781e2868be9", "sha256:a159145c3b7f9bc7301ef8e1e2bee43a7b1f745f36664b03a74c6372db6ad5b6", "sha256:0e6bc27e7814f42697626616f8e1b31fb5fabc6677196357e43d61218dcec162" ] }, "config": { "Entrypoint": [ "/usr/local/bin/docker-entrypoint.sh" ], "Env": [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/jvm/default-jvm/bin", "LANG=C.UTF-8", "JAVA_HOME=/usr/lib/jvm/default-jvm" ], "User": "1000", "WorkingDir": "/usr/local/rvtool" } } }, "Results": [ { "Target": "registry.n4group.eu/team-elster/rv-tool/backend:VER_3_5 (alpine 3.19.4)", "Class": "os-pkgs", "Type": "alpine" }, { "Target": "Java", "Class": "lang-pkgs", "Type": "jar", "Vulnerabilities": [ { "VulnerabilityID": "CVE-2024-47554", "PkgName": "commons-io:commons-io", "PkgPath": "usr/local/rvtool/backend.jar/BOOT-INF/lib/velocity-engine-core-2.3.jar", "PkgIdentifier": { "PURL": "pkg:maven/commons-io/[email protected]", "UID": "46186da97fec212e" }, "InstalledVersion": "2.8.0", "FixedVersion": "2.14.0", "Status": "fixed", "Layer": { "DiffID": "sha256:f1bf4e083069b5866d4047c82f6e86d188821e259454ae3867bd8781e2868be9" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-47554", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Maven", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "Title": "apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader", "Description": "Uncontrolled Resource Consumption vulnerability in Apache Commons IO.\n\nThe org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.\n\n\nThis issue affects Apache Commons IO: from 2.0 before 2.14.0.\n\nUsers are recommended to upgrade to version 2.14.0 or later, which fixes the issue.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "ghsa": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 4.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-47554", "https://github.com/apache/commons-io", "https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1", "https://nvd.nist.gov/vuln/detail/CVE-2024-47554", "https://www.cve.org/CVERecord?id=CVE-2024-47554" ], "PublishedDate": "2024-10-03T12:15:02.613Z", "LastModifiedDate": "2024-10-04T13:50:43.727Z" } ] } ] }Reproduction Steps
Target
Container Image
Scanner
Vulnerability
Target OS
Alpine 3.19
Debug Output
Version
Checklist
-f jsonthat shows data sources and confirmed that the security advisory in data sources was correctBeta Was this translation helpful? Give feedback.
All reactions