anchore / anchore-engine

A service that analyzes docker images and scans for vulnerabilities
Apache License 2.0
1.58k stars 271 forks source link

False positive against openssh*-7.4p1-22.0.1.el7_9_fips #1357

Open prabhakarp-dev opened 2 years ago

prabhakarp-dev commented 2 years ago

Similar to closed issue #1237 for openssl on OL8, there are actually two versions of openssh for Oracle Linux 7; the latest versions are:

Logic is needed to differentiate these; only the ELSA advisories for the already-installed flavor should be checked. The FIPS version of openssh has "_fips" suffixed to the version string.