NodeJS v16 and v18 false positive #1467
Comments
|
Thanks for the report @ReDemoNBR. I'm not sure how we would be able to fix this -- the NVD data does not appear to have the version range correct, if you look at: https://nvd.nist.gov/vuln/detail/CVE-2023-32003 and https://nvd.nist.gov/vuln/detail/CVE-2023-32004, these both state the affected versions are:
Until the NVD data gets corrected, Grype will continue to show these vulnerabilities on older versions of node. |
|
As an intermediate workaround, you would be able to add to a grype configuration file matches to ignore: https://github.com/anchore/grype#specifying-matches-to-ignore |
kzantow
added
false-positive
vulnerability-data-source
|
I added the ignore rules to whitelist them in my If anyone else is having issues with this, continue reading. I had 2 ideas to handle these findings, one of them is strict and the other is loose. The first is to only whitelist (ignore) the 2 vulnerabilities found, and the other one is more generic. StrictI use this with the official NodeJS image from Docker Hub as a base image. ignore:
- vulnerability: CVE-2023-32003
fix-state: unknown
package:
type: binary
version: 18.17.1 # if you are using dynamic image tags like "lts", then remove this line
- vulnerability: CVE-2023-32003
fix-state: unknown
package:
type: binary
version: 18.17.1 # if you are using dynamic image tags like "lts", then remove this lineThe version must be strict equal and does not support a version range like LooseThis is very generic and we use this config for other projects during Continuous Integration workflows to alert my team on actions required on our end. So the configuration is to ignore issues with the following fix states:
So it would be something like this: ignore:
- fix-state: unknown
- fix-state: wont-fix
- fix-state: not-fixed |
|
If nobody has anything else to add on this, this issue may be closed |
|
I have mailed NVD requesting a change to the CPE versions for these IDs. I'll update the issue once I hear back from them |
|
Hey @joshbressers, I just checked the NVD and it appears as though they have not corrected the "Up to" version info. Have you heard back from your request? |
|
This one has been fixed: with latest grype: |
What happened:
Grype is reporting vulnerabilities
CVE-2023-32003andCVE-2023-32004, which describe being found on new experimental process-based permission model in NodeJS v20, however Grype is reporting the issue also in other versions, like the v16 LTS and v18 LTS, where this feature is not implementedWhat you expected to happen:
Expect the vulnerabilities to be found in NodeJS v20 (
< 20.5.1), not on v18 or v16.I expect the affected version range to be
>=20.0.0 <=20.5.0How to reproduce it (as minimally and precisely as possible):
Anything else we need to know?:
Environment:
grype version:cat /etc/os-releaseor similar):The text was updated successfully, but these errors were encountered: