fix: Remove CPE product candidates for opentelemetry and redis Rust crates #3962
Conversation
1e79cb3 to
8a8ac5f
Compare
|
Hey @jayvdb -- this file is generated automatically from a small program here: https://github.com/anchore/syft/blob/main/syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator/main.go so any changes will get overridden when that runs again. That said: this is supposed to be all CPEs that are known from NVD so adding other CPEs are just guesses (probably correct guesses), but we can't be guaranteed NVD will use the same thing. I think it might be more useful to look in this package, where we have a lot of handling specific to ecosystems including overrides for CPEs we know are wrong and need to be corrected, such as: https://github.com/anchore/syft/blob/main/syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type.go#L110 |
Rust crates opentelemetry and redis are being given CPEs that match CVEs such as CVE-2023-45142 and CVE-2022-24735 respectively. The vendor overrides added here prevent that. Signed-off-by: John Vandenberg <jayvdb@gmail.com>
8a8ac5f to
c18f04f
Compare
|
@kzantow thanks for the guidance. I have removed the manual edits to This removes the CPEs from these entries in my SBOM, which is acceptable to me, as I already know they have no entries in NVD, but it feels like it isnt a great solution, as the generated SBOM is permanent, but the NVD data grows and could include CVEs for these crates in the future. If I understood correctly, you do not want me to be using |
* main: (31 commits) remove benchmark utils (#3982) fix: exclude packages with SPDX GENERATED_FROM source package indication (#3981) chore(deps): bump modernc.org/sqlite from 1.37.1 to 1.38.0 (#3979) chore(deps): bump github.com/go-git/go-git/v5 from 5.16.1 to 5.16.2 (#3978) chore(deps): update tools to latest versions (#3977) chore(deps): update CPE dictionary index (#3976) chore(deps): bump golang.org/x/net from 0.40.0 to 0.41.0 (#3970) chore(deps): bump github.com/sergi/go-diff (#3971) Fix Python package dependency detection (#3965) fix: Remove three Rust crate false positive CPE matches (#3967) Harden Container Runtime with Non-Root User (#3941) fix: Remove two Rust crate false positive CPE matches (#3962) chore(deps): bump golang.org/x/mod from 0.24.0 to 0.25.0 (#3963) chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.12 to 0.5.13 (#3964) fix: bump stereoscope to fix symlink performance issue (#3953) chore(deps): bump github.com/go-git/go-git/v5 from 5.16.0 to 5.16.1 (#3960) chore(deps): bump github/codeql-action from 3.28.18 to 3.28.19 (#3952) feat: add syft schema version to version command (#3949) chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.11 to 0.5.12 (#3943) chore(deps): update tools to latest versions (#3945) ... Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Description
Rust crates opentelemetry and redis are being given CPEs that match CVEs such as CVE-2023-45142 and CVE-2022-24735 respectively. The vendor overrides added here prevent that.
Relates to #3956 & #3957 , both of which are broader, while this fixes the immediate false positives.
Type of change
Checklist: