False positive being reported for openssl in debain:9

[nikithaguduru]

Checklist

• I've read the documentation regarding wrong detection.
• I've confirmed that a security advisory in data sources was correct.
  • Run Trivy with -f json that shows data sources and make sure that the security advisory is correct.

Description

Trivy is showing false positive for openssl in debian:9
debian:9 has openssl version 1.1.0l-1~deb9u6.
https://security-tracker.debian.org/tracker/CVE-2022-3602 - As per the info in security tracker, this CVE is not reported for debain:9 ("stretch"). They talked about bookworm, sid, buster and bullseye releases only
This is not the only CVE.. there are other CVEs as well (CVE-2022-2068, CVE-2022-2097, CVE-2022-2274, CVE-2022-3358, CVE-2022-3786) which are reported as false positives in case of debian:9

JSON Output of run with -debug:

{
"VulnerabilityID": "CVE-2022-3602",
"PkgName": "openssl",
"InstalledVersion": "1.1.0f-3+deb9u2",
"Layer": {
"Digest": "sha256:0cd4fcc94b67e5cb256fe4f3b2826ad9bf34104ee479a4c007aa83cfbaab356c",
"DiffID": "sha256:3538e779fb2898bfa017aece266a65a1f90285d0811c0d719bf0a4c0dece3528"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-3602",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "OpenSSL: X.509 Email Address Buffer Overflow",
"Description": "A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).",
"Severity": "HIGH",
"CweIDs": [
"CWE-120"
],
"CVSS": {
"ghsa": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"V3Score": 9.8
},
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"http://packetstormsecurity.com/files/169687/OpenSSL-Security-Advisory-20221101.html",
"http://www.openwall.com/lists/oss-security/2022/11/01/15",
"http://www.openwall.com/lists/oss-security/2022/11/01/16",
"http://www.openwall.com/lists/oss-security/2022/11/01/17",
"http://www.openwall.com/lists/oss-security/2022/11/01/18",
"http://www.openwall.com/lists/oss-security/2022/11/01/19",
"http://www.openwall.com/lists/oss-security/2022/11/01/20",
"http://www.openwall.com/lists/oss-security/2022/11/01/21",
"http://www.openwall.com/lists/oss-security/2022/11/01/24",
"http://www.openwall.com/lists/oss-security/2022/11/02/1",
"http://www.openwall.com/lists/oss-security/2022/11/02/10",
"http://www.openwall.com/lists/oss-security/2022/11/02/11",
"http://www.openwall.com/lists/oss-security/2022/11/02/12",
"http://www.openwall.com/lists/oss-security/2022/11/02/13",
"http://www.openwall.com/lists/oss-security/2022/11/02/14",
"http://www.openwall.com/lists/oss-security/2022/11/02/15",
"http://www.openwall.com/lists/oss-security/2022/11/02/2",
"http://www.openwall.com/lists/oss-security/2022/11/02/3",
"http://www.openwall.com/lists/oss-security/2022/11/02/5",
"http://www.openwall.com/lists/oss-security/2022/11/02/6",
"http://www.openwall.com/lists/oss-security/2022/11/02/7",
"http://www.openwall.com/lists/oss-security/2022/11/02/9",
"http://www.openwall.com/lists/oss-security/2022/11/03/1",
"http://www.openwall.com/lists/oss-security/2022/11/03/10",
"http://www.openwall.com/lists/oss-security/2022/11/03/11",
"http://www.openwall.com/lists/oss-security/2022/11/03/2",
"http://www.openwall.com/lists/oss-security/2022/11/03/3",
"http://www.openwall.com/lists/oss-security/2022/11/03/5",
"http://www.openwall.com/lists/oss-security/2022/11/03/6",
"http://www.openwall.com/lists/oss-security/2022/11/03/7",
"http://www.openwall.com/lists/oss-security/2022/11/03/9",
"https://access.redhat.com/errata/RHSA-2022:7288",
"https://access.redhat.com/security/cve/CVE-2022-3602",
"https://bugzilla.redhat.com/2137723",
"https://bugzilla.redhat.com/2139104",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3602",
"https://errata.almalinux.org/9/ALSA-2022-7288.html",
"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fe3b639dc19b325846f4f6801f2f4604f56e3de3",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fe3b639dc19b325846f4f6801f2f4604f56e3de3",
"https://github.com/advisories/GHSA-8rwr-x37p-mx23",
"https://github.com/alexcrichton/openssl-src-rs/commit/4a31c14f31e1a08c18893a37e304dd1dd4b7daa3",
"https://github.com/openssl/openssl/commit/fe3b639dc19b325846f4f6801f2f4604f56e3de3",
"https://github.com/rustsec/advisory-db/pull/1452",
"https://linux.oracle.com/cve/CVE-2022-3602.html",
"https://linux.oracle.com/errata/ELSA-2022-9968.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63YRPWPUSX3MBHNPIEJZDKQT6YA7UF6S/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWP23EZYOBDJQP7HP4YU7W2ABU2YDITS/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63YRPWPUSX3MBHNPIEJZDKQT6YA7UF6S/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DWP23EZYOBDJQP7HP4YU7W2ABU2YDITS/",
"https://nvd.nist.gov/vuln/detail/CVE-2022-3602",
"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0023",
"https://rustsec.org/advisories/RUSTSEC-2022-0064.html",
"https://security.gentoo.org/glsa/202211-01",
"https://security.netapp.com/advisory/ntap-20221102-0001/",
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a",
"https://ubuntu.com/security/notices/USN-5710-1",
"https://www.kb.cert.org/vuls/id/794340",
"https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/",
"https://www.openssl.org/news/secadv/20221101.txt"
],
"PublishedDate": "2022-11-01T18:15:00Z",
"LastModifiedDate": "2022-11-04T19:49:00Z"
},

(paste your output here)

Output of trivy -v:

(paste your output here)

Additional details (base image name, container registry info...):

[DmitriyLewen]

Hello @nikithaguduru
Thanks for your report.

I created #264 with fix this problem.
After merging this PR and updating Trivy-db (updated every 6 hours) your problem should be resolved.

Regards, Dmitriy

[knqyf263]

Debian 9 reached EOL and Trivy also warns that detected vulnerabilities may be inaccurate. Debian no longer provides security information about Debian 9. We cannot know if CVE-2022-3358 affects Debian 9 or not.
https://security-tracker.debian.org/tracker/CVE-2022-3358

Trivy currently assumes old releases are affected by newly disclosed vulnerabilities. We can adopt another approach, like not detecting new vulnerabilities on old releases. This is a discussion about false positives vs false negatives.

Anyway, deprecated releases should not be used if you need accurate results.

[knqyf263]

Debian 9 reached EOL on June 30, 2022. Detected vulnerabilities disclosed before the date should be correct, while those disclosed after the date, such as CVE-2022-3358, might be wrong. If you don't want to see such vulnerabilities, you can use Rego policies to filter out vulnerabilities by the published date.
https://aquasecurity.github.io/trivy/v0.35/docs/vulnerability/examples/filter/#by-open-policy-agent

[github-actions]

This issue is stale because it has been labeled with inactivity.