TYPO in a dependency fixed version

[Mati-Q-A]

Description

i'm using ch.qos.logback:logback-core in a project, and trivy detected a vulnerabilty, that's right, but the fixed version in the database is wrong, the final fixed version in maven central is 1.5.13 (https://mvnrepository.com/artifact/ch.qos.logback/logback-core/1.5.13) but trivy is looking for 1.15.13.

Pipeline log

Desired Behavior

Trivy must look for 1.5.13 fixed version

Actual Behavior

Trivy is looking for 1.15.13 fixed version

Reproduction Steps

1.
2.
3.
...

Target

Container Image

Scanner

Vulnerability

Output Format

Table

Mode

Client/Server

Debug Output

-

Operating System

linux

Version

0.55.2-1

Checklist

• Run trivy clean --all
• Read the troubleshooting

[angelmunozh]

The correct library is "1.5.13"
https://secalerts.co/vulnerability/GHSA-6v67-2wr5-gvf4

[DmitriyLewen]

Hello @Mati-Q-A @angelmunozh
GitHub database contains typo.
I already fixed - github/advisory-database@d7926d4#diff-000306eca21b602c732b2ef7fcf8981feba8463c01767ca94dfba763a0f080af

➜ trivy -q rootfs ./logback-core-1.5.12.jar 

Java (jar)

Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌───────────────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────┐
│                        Library                        │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                          Title                           │
├───────────────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ ch.qos.logback:logback-core (logback-core-1.5.12.jar) │ CVE-2024-12798 │ MEDIUM   │ fixed  │ 1.5.12            │ 1.5.13        │ logback-core: arbitrary code execution via               │
│                                                       │                │          │        │                   │               │ JaninoEventEvaluator                                     │
│                                                       │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-12798               │
│                                                       ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────┤
│                                                       │ CVE-2024-12801 │ LOW      │        │                   │               │ logback-core: SaxEventRecorder vulnerable to Server-Side │
│                                                       │                │          │        │                   │               │ Request Forgery (SSRF) attacks                           │
│                                                       │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-12801               │
└───────────────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────┘

Regards, Dmitriy

[Mati-Q-A]

Thanks a lot @DmitriyLewen

[knqyf263]

@angelmunozh @Mati-Q-A It would be appreciated if you follow this guideline next time when you find something wrong in advisories.

[Mati-Q-A]

Okey @knqyf263 first time, sorry!