search

docker / scout-cli

Docker Scout CLI
https://docker.com/products/docker-scout
Other
250 stars 60 forks source link

Wrong package version detection for Oracle Linux #110

Closed visortelle closed 3 months ago

visortelle commented 3 months ago

I believe 1:3.0.7-25.0.1.el9_3 and 2:3.0.7-25.0.1.ksplice1.el9_3 are the same version.

Screenshot 2024-03-23 at 1 04 30 PM

Same for 2.34-83.0.2.el9_3.12 > 2:2.34-60.0.3.ksplice1.el9_2.7.

Screenshot 2024-03-23 at 1 06 54 PM

There are a few more packages affected by the same issue.

https://hub.docker.com/layers/library/oraclelinux/9-slim/images/sha256-f1bdd3635b56b12302434d86021141aceb1ca51d79457959cc8193922ee206eb?context=repo&tab=vulnerabilities

Screenshot 2024-03-23 at 1 03 54 PM
cdupuis commented 3 months ago

@visortelle thanks for raising this. It does look like something is not working as desired for oracle rpm packages. We’ll look into it and will report back.

neilprosser commented 3 months ago

@visortelle - we've made some amendments to the way we're checking the vulnerable ranges and the image is showing as free of vulnerabilities now.

Thanks again for reporting.

visortelle commented 3 months ago

@neilprosser - thank you for the fix.