search

anchore / grype

A vulnerability scanner for container images and filesystems
Apache License 2.0
8.43k stars 546 forks source link

Grype is catching a false positive on spring-boot-starter-web because it cannot detect inherited version from parent #1012

Open cezapata opened 1 year ago

cezapata commented 1 year ago

What happened: After using the Spring Initializer tool to create a new Spring Boot App (version 2.7.5) with the Spring Web dependency, building, and running Grype to scan for vulnerabilities, we get a vulnerability detected on the following package:

spring-boot-starter-web: GHSA-36p3-wjmg-h94x

image

What you expected to happen:

When installing the dependencies, the spring-boot-starter-web package installs a version that is consistent with its parent artifact (spring-boot-starter-parent) which maps to version 2.7.5

I was expecting grype to detect the version, and note that the vulnerability it indicates does not apply since it was fixed as a prior version (2.5.12). However, the engine does not pick it up, and displays an empty version in use for the package:

image

How to reproduce it (as minimally and precisely as possible): I have set up a repo with a dev container configured to run the repro with instructions here:

https://github.com/cezapata/appconfiguration-sample

You can run the codespace, install the maven dependencies on the app, and then run grype. Among the vulnerabilities detected, we will display GHSA-36p3-wjmg-h94x.

Anything else we need to know?:

Hard-coding the version on the dependencies fixes the problem, but we would like all the dependencies to be controlled by the parent.

Environment:

kzantow commented 1 year ago

Just to add some more context here: Syft is currently a static analysis tool and does not currently look up anything from the internet, so scanning a pom.xml with a parent pom won't have the fidelity it could. We are investigating a number of solutions for this, all of which take Syft outside the realm of strictly a static analysis tool: invoking mvn, looking things up directly against a maven repo. This is definitely an important thing for us to solve 👍

Restage commented 10 months ago

Any news on that? Grype not beeing able to detect inherited versions from a parent seems to be a bigger issue.

willmurphyscode commented 10 months ago

Hi @Restage - no particular update here, but https://github.com/anchore/syft/issues/1562 is a discussion of how to enable Syft to capture more information about this type of dependency relationship so that it can be exposed to Grype.

Wouimbly commented 9 months ago

i'm using lastest spring-boot-starter-parent 3.2.0 with graalvm21 when scanning the image i have the following; NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
spring-boot-starter-web 2.5.12 java-archive GHSA-36p3-wjmg-h94x Critical

i have no forced reference to a version of spring-boot-starter-web. When doing a simple build i only have spring 6.1.1 and springboot 3.2.0 references.... Is it a problem with grype/sbom ? Or i'm missing something ?

Thanks in advance

willmurphyscode commented 9 months ago

Thanks @cezapata for the excellent repro steps and example repository.

I want to try to state the issue as simply as possible so we can try to start working on it.

To reproduce:

git clone git@github.com:cezapata/appconfiguration-sample.git
grype -q appconfiguration-sample | grep GHSA-36p3-wjmg-h94x

Grype still finds the vulnerability.

Looking at the syft output:

syft -q appconfiguration-sample
NAME                                        VERSION  TYPE
azure-spring-cloud-appconfiguration-config  2.9.0    java-archive
maven-wrapper                               3.1.0    java-archive
spring-boot-starter-test                             java-archive
spring-boot-starter-web                              java-archive

Syft doesn't know the version of spring-boot-starter-web because it's not explicitly in the pom.xml.

However, the <relativePath/> directive in the parent node of the pom.xml is enough that syft should know to go ask Maven Central what version of spring-boot-starter-web should be installed for version 2.7.5 of spring-boot-starter-parent. Do I have that right?

kzantow commented 7 months ago

Note to developers: this would need to be implemented in Syft, a couple related issues are:

kzantow commented 1 week ago

Hi, Syft has implemented a fairly large enhancement to the Maven resolution, which allows it to use the network to resolve Maven artifacts much more completely. There currently is no way to enable this in Grype, unfortunately, but you are able to use Syft, and send the output to grype to get more accurate results:

$ git clone git@github.com:cezapata/appconfiguration-sample.git

$ SYFT_JAVA_USE_NETWORK=true syft appconfiguration-sample -o json | grype -o table
No vulnerabilities found