False Positive: CVE-2021-22118 using spring-core but report to spring framework webflux

[sekveaja]

What happened:

   Using Spring-Core 5.3.3: 
   "package_cpe23": "cpe:2.3:a:springsource-spring-framework:springsource_spring_framework:5.3.3:*:*:*:*:*:*:*",
   "package_path": "...<stripped_path>..../WEB-INF/lib/spring-core-5.3.3.jar",

    Grype reported with CVE-2021-22118  which is related to Spring Webflux, completely different application.
    Therefore, it is a false positive.

What you expected to happen:
Should not report on Spring-Core.

Environment:

• Output of grype version: 0.61.1
• OS (e.g: cat /etc/os-release or similar):
  VERSION="15-SP4"
  VERSION_ID="15.4"

[willmurphyscode]

Hi @sekveaja, thanks for the report!

I'm no longer able to reproduce this issue:

wget 'https://repo1.maven.org/maven2/org/springframework/spring-core/5.3.0/spring-core-5.3.0.jar'
echo "FROM alpine:latest\n\nADD ./spring-core-5.3.0.jar /\n" | docker build -f - . -t testimage
grype -q testimage | grep -e CVE-2021-22118 -e GHSA-gfwj-fwqj-fp3v # the cve or its GHSA alias
# prints nothing

But if I run the match with Java CPE matching turned on, the FP is present:

$ GRYPE_MATCH_JAVA_USING_CPES=true grype -q testimage | grep -e CVE-2021-22118 -e GHSA-gfwj-fwqj-fp3v
spring-core    5.3.0                 java-archive  CVE-2021-22118       High

That means this FP was fixed by the switch from using CPEs to using GHSA language + version data for Java matches by default.

I'll close this issue as completed, since this FP is no longer present in default grype behavior, but please let me know if I've missed something.