search

jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
https://owasp.org/www-project-dependency-check/
Apache License 2.0
6.42k stars 1.28k forks source link

False negative for google protobuf nuget package or .NET DLL #3846

Open kaiboesefeldt opened 2 years ago

kaiboesefeldt commented 2 years ago

Describe the bug The vulnerability ID for google protobuf nuget package is not correctly determined.

Version of dependency-check used The problem occurs using version 6.5.0 of the cli.

Log file n/a

To Reproduce Steps to reproduce the behavior:

  1. Download google protobuf nuget package from https://www.nuget.org/api/v2/package/Google.Protobuf/3.19.1
  2. Copy the downloaded file google.protobuf.3.19.1.nupkg to a separate folder e.g. named test
  3. Call the cli: dependency-check/bin/dependency-check.sh --scan test
  4. Open the generated report file dependency-check-report.html in a web browser
  5. Click on "Showing Vulnerable Dependencies (click to show all)".
  6. The column "Vulnerablility IDs" for the dependency "Google.Protobuf:3.19.1" is empty --> NOT OK

Expected behavior The column "Vulnerablility IDs" for the dependency "Google.Protobuf:3.19.1" should have shown: cpe:2.3:a:google:protobuf:3.19.1:*:*:*:*:*:*:*

Additional context The problem seems to be that the google protobuf library is detected as ecosystem "native", while the nuget package is ecosystem "dotnet". The classification as native seems to come from https://nvd.nist.gov/vuln/detail/CVE-2015-5237. The descrpition of this CVE contains the words "buffer overflow" which leads to classification as "native". If I comment out BUFFER_OVERFLOW and BUFFER_OVERFLOWS in DescriptionKeywordHint.java, the detection works as expected (after deleting and re-importing the CPEs).

Maybe it would be helpful to have an option to either disable consideration of ecosystems at all (which would of course lead to more false positives) or to ignore the ecosystem detection for certain configured eco systems.

The google protobuf lib obviously exists in many ecosystem. In other cases a lib may be a "bridge" providing an interface between an ecosystem like dotnet, python or java and a native implementation. So the "native" ecosystem may play a special role, and it could be helpful to consider this specific property.

carlin-q-scott commented 1 year ago

I believe I have the same issue using the MSBuild scanner with Google.Protobuf:3.12.3 CVE-2021-22570