False negative for CVE-2023-29383
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
Reproduce the report with docker scout cves python:3.10 --format spdx and compare the shadow package entry with the CVE search result. Start by tracing how the CLI matches Debian package versions to vulnerability records. Done means the reported CVE is correctly represented in the generated SBOM or the false-negative explanation is documented and covered by a regression test.
Written by the indexing model from the issue text.
Description
Shadow 4.13 is vulnerable to CVE-2023-29383. Docker container for python:3.10 comes with shadow 4.13 as a package dependency but the CVE-2023-29383 is not found.
Steps to reproduce:
- Verify shadow 4.13 is a package of python:3.10
docker scout cves python:3.10 --format spdx | grep "debian/shadow"
> "referenceLocator": "pkg:deb/debian/shadow@1:4.13%2Bdfsg1-1?os_distro=bookworm&os_name=debian&os_version=12"
- Verify CVE-2023-29383 is not in the SBOM
docker scout cves python:3.10 --format spdx | grep "CVE-2023-29383"
May this be a case of false negative?
- Dominant language
- Shell
- Stars
- 454
- Forks
- 134
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker/scout-cli
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
allstar
Difficulty 2/5 1-3 hours Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
panic: nil deref in createVCS() scanning multi-arch image by tag when no attestation sidecar exists Open
Difficulty 4/5 3-5 days Newbie friendliness 64/100
All issues in docker/scout-cli
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
community-scripts/ProxmoxVE#17425 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
danielmiessler/LifeOS#2218 ·
-
docs(agents): strengthen the no-backslash-escaped-backticks rule with an issue-creation example Open
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
technical-debt
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
ll7/robot_sf_ll7#9560 ·
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
oSoWoSo/vOid_Community_repOsitory#148 · 1 comment ·