fix: using SrcVersion instead of Version for echo detector

[orizerah]

Description

Fixed a bug with echo detection where we use SrcVersion instead of Version

Related issues

• Close Echo detector uses the package Version field instead of SrcVersion for detecting vulnerabilities #9551

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[Nathansh14]

it will be great to have this fix in release v0.67.1 as this PR fixes a lot of false-positives when using trivy to scan images.

[knqyf263]

it will be great to have this fix in release v0.67.1 as this PR fixes a lot of false-positives when using trivy to scan images.

The correct source version should be used, but I haven’t seen many other vendors producing so many false positives just because of that difference. Could you tell us in what cases these false positives are occurring?

[orizerah]

@knqyf263
The samba os library installs packages with the version 2:2.4.3+samba4.22.4+dfsg-1~deb13u1, but the CVEs' fixed versions are the samba version, which is 4.22.4. So since 2.4.3 < 4.22.4, we get a false positive. It's the first time we encountered this issue, but we can assume it happens for more packages.

[DmitriyLewen]

@aqua-bot backport release/v0.67

[aqua-bot]

Backport PR created: #9629