False neg. caused by --only fixed

[mirekphd]

What happened:
Got "No vulnerabilities found" despite having nearly 200 of them in the scanned image (as per Grype's log entry: "INFO found 187 vulnerabilities for 220 packages").

What you expected to happen:
A table listing all vulnerabilities.

How to reproduce it (as minimally and precisely as possible):
$ docker run --rm --name test -v /var/run/docker.sock:/var/run/docker.sock anchore/grype:latest --only-fixed mirekphd/cuda-11.2-cudnn8-devel-ubuntu22.04:20230813

Anything else we need to know?:
Removing --only-fixed works around the problem.
The switch is however generally useful, as it deals automatically with false positives such as these (being false in an Alpine container and reported elsewhere):

redis         5.0.14     CVE-2022-0543   Critical  /usr/local/bin/redis-server
redis         5.0.14     CVE-2022-3734   Critical  /usr/local/bin/redis-server

Environment:

• Output of grype version: 0.65.1
• OS (e.g: cat /etc/os-release or similar): Ubuntu 22.04.2 LTS

[kzantow]

Thanks for the report @mirekphd -- I ran the example you provided, but none of the vulnerabilities show any fixed information (check the FIXED-IN column). --only-fixed will remove any vulnerabilities that do not have a fixed version, which in this case is all vulnerabilities. I believe this is working as expected. What would you expect to happen differently?

[mirekphd]

I'd think the option is too strict in its data requirements. I'd argue it might react to nulls in the fix state more conservatively, and return (not mask) all entries with no data in this field, or else users of this option have much higher false negative rate, with all data gaps treated the same as intentional decisions of the developers not to fix.

Auto-populating all missings in the fix state with "wont-fix" after a "reasonable" fixing timeout would lead to similar results - the only difference is that the timeout is zero when you specify --only-fixed.

[tgerla]

Hi @mirekphd, the purpose of --only-fixed is to only show you vulnerabilities that indeed have a fix available to apply, which might not quite match your use case. Can you elaborate a bit on your use of --only-fixed to deal with false positives? If you find a false positive, we will consider it a bug, and it would be great if you could file an issue with details to reproduce.

There are also some configuration items that might help, if you need to ignore certain matches: https://github.com/anchore/grype#specifying-matches-to-ignore

[tgerla]

Hi @mirekphd, we'll go ahead and close this issue but if you still need any help here, please let us know and we would be happy to discuss. Thanks!