False negative for CVE-2023-29383

Open
#188 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
docker, shell
Domain
cli, security

Research direction

Reproduce the report with docker scout cves python:3.10 --format spdx and compare the shadow package entry with the CVE search result. Start by tracing how the CLI matches Debian package versions to vulnerability records. Done means the reported CVE is correctly represented in the generated SBOM or the false-negative explanation is documented and covered by a regression test.

Written by the indexing model from the issue text.

Description

Shadow 4.13 is vulnerable to CVE-2023-29383. Docker container for python:3.10 comes with shadow 4.13 as a package dependency but the CVE-2023-29383 is not found.

Steps to reproduce:

  1. Verify shadow 4.13 is a package of python:3.10
docker scout cves python:3.10 --format spdx | grep "debian/shadow"
>     "referenceLocator": "pkg:deb/debian/shadow@1:4.13%2Bdfsg1-1?os_distro=bookworm&os_name=debian&os_version=12"
  1. Verify CVE-2023-29383 is not in the SBOM
docker scout cves python:3.10 --format spdx | grep "CVE-2023-29383"

May this be a case of false negative?

Dominant language
Shell
Stars
454
Forks
134
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from docker/scout-cli

All issues in docker/scout-cli

Similar issues

More Shell/Bash issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.