grype not reporting issues present in GHSA for System.Data.SqlClient 4.8.5

[vishwesh-sharma]

What happened: When scanning dotnet sdk 8.0 image, 15 medium vulnerabilities are reported

What you expected to happen: Since System.Data.SqlClient 4.8.5 is being used in the image, GHSA-98g6-xh36-x2p7 which is a high severity exploit should have been reported. Additionally, System.Data.SqlClient 4.700.22.51706 is also being used for which GHSA-8g2p-5pqh-5jmc should have been reported

How to reproduce it (as minimally and precisely as possible):

syft mcr.microsoft.com/dotnet/sdk:8.0-cbl-mariner2.0-arm64v8  --select-catalogers "+sbom-cataloger" --scope all-layers | grep SqlClient
System.Data.SqlClient                                           4.700.22.51706                                                                                  dotnet          
System.Data.SqlClient                                           4.8.5                                                                                           UnknownPackage  
runtime.native.System.Data.SqlClient.sni                        4.7.0                                                                                           UnknownPackage  
runtime.win-arm64.runtime.native.System.Data.SqlClient.sni      4.4.0                                                                                           UnknownPackage  
runtime.win-x64.runtime.native.System.Data.SqlClient.sni        4.4.0                                                                                           UnknownPackage  
runtime.win-x86.runtime.native.System.Data.SqlClient.sni        4.4.0                                                                                           UnknownPackage 

grype mcr.microsoft.com/dotnet/sdk:8.0-cbl-mariner2.0-arm64v8  --scope all-layers --add-cpes-if-none
 ✔ Vulnerability DB                [no update available]  
 ✔ Loaded image                                                                                                                                                                                     mcr.microsoft.com/dotnet/sdk:8.0-cbl-mariner2.0-arm64v8
 ✔ Parsed image                                                                                                                                                                     sha256:7107677203df209f07f528a2ff74aececd3181be0c3950245ed951548b8ec4d0
 ✔ Cataloged contents                                                                                                                                                                      0393ffb214ec0589cc8ebe31c02ff532d04b4ac8b277870b04fe6c2658ef0bf7
   ├── ✔ Packages                        [3,993 packages]  
   ├── ✔ File digests                    [10,869 files]  
   └── ✔ File metadata                   [10,869 locations]  
 ✔ Scanned for vulnerabilities     [15 vulnerability matches]  
   ├── by severity: 0 critical, 0 high, 15 medium, 0 low, 0 negligible
   └── by status:   15 fixed, 0 not-fixed, 0 ignored 
NAME                                   INSTALLED                                                   FIXED-IN        TYPE    VULNERABILITY        SEVERITY 
Microsoft.IdentityModel.JsonWebTokens  7.0.3.41017013651.bb354ceabed19189245e075abb864f327b6c14ad  7.1.2           dotnet  GHSA-8g9c-28fc-mcx2  Medium    
Microsoft.IdentityModel.JsonWebTokens  7.0.3.41017013651.bb354ceabed19189245e075abb864f327b6c14ad  7.1.2           dotnet  GHSA-59j7-ghrg-fj52  Medium    
System.IdentityModel.Tokens.Jwt        7.0.3.41017013651.bb354ceabed19189245e075abb864f327b6c14ad  7.1.2           dotnet  GHSA-8g9c-28fc-mcx2  Medium    
System.IdentityModel.Tokens.Jwt        7.0.3.41017013651.bb354ceabed19189245e075abb864f327b6c14ad  7.1.2           dotnet  GHSA-59j7-ghrg-fj52  Medium    
curl                                   8.3.0-2.cm2                                                 0:8.5.0-1.cm2   rpm     CVE-2023-46219       Medium    
curl                                   8.3.0-2.cm2                                                 0:8.5.0-1.cm2   rpm     CVE-2023-46218       Medium    
curl-libs                              8.3.0-2.cm2                                                 0:8.5.0-1.cm2   rpm     CVE-2023-46219       Medium    
curl-libs                              8.3.0-2.cm2                                                 0:8.5.0-1.cm2   rpm     CVE-2023-46218       Medium    
openssh                                8.9p1-2.cm2                                                 0:8.9p1-3.cm2   rpm     CVE-2023-51385       Medium    
openssh                                8.9p1-2.cm2                                                 0:8.9p1-3.cm2   rpm     CVE-2023-51384       Medium    
openssh-clients                        8.9p1-2.cm2                                                 0:8.9p1-3.cm2   rpm     CVE-2023-51385       Medium    
openssh-clients                        8.9p1-2.cm2                                                 0:8.9p1-3.cm2   rpm     CVE-2023-51384       Medium    
openssh-server                         8.9p1-2.cm2                                                 0:8.9p1-3.cm2   rpm     CVE-2023-51385       Medium    
openssh-server                         8.9p1-2.cm2                                                 0:8.9p1-3.cm2   rpm     CVE-2023-51384       Medium    
sqlite-libs                            3.39.2-2.cm2                                                0:3.39.2-3.cm2  rpm     CVE-2023-7104        Medium

Anything else we need to know?:

Environment:

• Output of grype version:
  Application: grype
  Version: 0.74.4
  BuildDate: 2024-01-31T17:32:28Z
  GitCommit: brew
  GitDescription: [not provided]
  Platform: darwin/arm64
  GoVersion: go1.21.6
  Compiler: gc
  Syft Version: v0.103.1
  Supported DB Schema: 5
• OS (e.g: cat /etc/os-release or similar):
  Darwin LYxxxxxxxx 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:31:00 PST 2023; root:xnu-10002.81.5~7/RELEASE_ARM64_T6020 arm64

[westonsteimel]

Hi @vishwesh-sharma , thanks for the report! Yeah, unfortunately there are some issues with the dotnet ecosystem because the vulnerability data is based solely on the nuget package versions (which makes sense), but syft is extracting the information from the installed portable executables and the assembly versions in those do not at all align with the nuget versions. So 4.700.22.51706 is actually the assembly version reported for the 4.8.5 nuget package

Using the nuget package explorer: https://nuget.info/packages/System.Data.SqlClient/4.8.5

You can force it to work somewhat better now by forcing it to use the dotnet-deps-cataloger instead

syft --select-catalogers "+dotnet-deps-cataloger" -o json mcr.microsoft.com/dotnet/sdk:8.0-cbl-mariner2.0-arm64v8 | grype | grep SqlClient
 ✔ Loaded image                                                                                                                                mcr.microsoft.com/dotnet/sdk:8.0-cbl-mariner2.0-arm64v8
 ✔ Parsed image                                                                                                                sha256:f5ec8c2c272f38d9b65acc40349ff44ec4b3a7886d74987f29cb6012a87f7384
 ✔ Cataloged contents                                                                                                                 95796dfb903b23eba3760ea6b0e7a9da2dd379f511f822836e084c14f4913cf1
   ├── ✔ Packages                        [4,841 packages]
   ├── ✔ File digests                    [10,873 files]
   └── ✔ File metadata                   [10,873 locations]
[0023]  WARN cataloger failed cataloger=dotnet-deps-cataloger error=unable to determine root package from deps.json file: /usr/share/dotnet/sdk/8.0.101/FSharp/fsc.deps.json location=/usr/share/dotnet/
[0023]  WARN cataloger failed cataloger=dotnet-deps-cataloger error=unable to determine root package from deps.json file: /usr/share/dotnet/sdk/8.0.101/FSharp/fsi.deps.json location=/usr/share/dotnet/
[0023]  WARN cataloger failed cataloger=dotnet-deps-cataloger error=unable to determine root package from deps.json file: /usr/share/dotnet/sdk/8.0.101/MSBuild.deps.json location=/usr/share/dotnet/sdk
[0023]  WARN cataloger failed cataloger=dotnet-deps-cataloger error=unable to determine root package from deps.json file: /usr/share/dotnet/sdk/8.0.101/NuGet.CommandLine.XPlat.deps.json location=/usr/
[0023]  WARN cataloger failed cataloger=dotnet-deps-cataloger error=unable to determine root package from deps.json file: /usr/share/dotnet/sdk/8.0.101/dotnet.deps.json location=/usr/share/dotnet/sdk/
[0023]  WARN cataloger failed cataloger=dotnet-deps-cataloger error=unable to determine root package from deps.json file: /usr/share/dotnet/shared/Microsoft.AspNetCore.App/8.0.1/Microsoft.AspNetCore.A
[0023]  WARN cataloger failed cataloger=dotnet-deps-cataloger error=unable to determine root package from deps.json file: /usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.1/Microsoft.NETCore.App.dep
System.Data.SqlClient             4.8.5      4.8.6     dotnet  GHSA-98g6-xh36-x2p7  High

[vishwesh-sharma]

@westonsteimel even in the case of System.Data.SqlClient there is a open GHSA GHSA-98g6-xh36-x2p7 which should have been reported. It is incorrect to tag this issue as a false-negative.

[westonsteimel]

false-negative is a label which means that grype misses a vulnerability that should have been reported, they are quite important to us

[vishwesh-sharma]

@westonsteimel , thanks for the clarification. Are there plans to change the options which are used by grype when it calls syft internally?

[westonsteimel]

The team will be discussing that possibility. I expect there will likely be some change made to the default cataloging options for images in syft to better account for this, and then grype will make use of those new defaults; however, I am not certain at this time what that will exactly look like.

[wagoodman]

Based off of the recent refactor of the .NET cataloger in syft, it looks that this has been fixed; given an SBOM that has a vulnerable version of this dependency:

{
  "id": "500f014f33608c18",
  "name": "System.Data.SqlClient",
  "version": "4.8.5",
  "type": "dotnet",
  "foundBy": "dotnet-deps-binary-cataloger",
  "locations": [
    {
      "path": "/usr/share/powershell/.store/powershell.linux.arm64/7.4.7/powershell.linux.arm64/7.4.7/tools/net8.0/any/pwsh.deps.json",
      "layerID": "sha256:f18cf3849817aa1d451c98fae82bd1ba3036632c0a263f960bc754ed68911c69",
      "accessPath": "/usr/share/powershell/.store/powershell.linux.arm64/7.4.7/powershell.linux.arm64/7.4.7/tools/net8.0/any/pwsh.deps.json",
      "annotations": {
        "evidence": "primary"
      }
    },
    {
      "path": "/usr/share/powershell/.store/powershell.linux.arm64/7.4.7/powershell.linux.arm64/7.4.7/tools/net8.0/any/System.Data.SqlClient.dll",
      "layerID": "sha256:f18cf3849817aa1d451c98fae82bd1ba3036632c0a263f960bc754ed68911c69",
      "accessPath": "/usr/share/powershell/.store/powershell.linux.arm64/7.4.7/powershell.linux.arm64/7.4.7/tools/net8.0/any/System.Data.SqlClient.dll",
      "annotations": {
        "evidence": "supporting"
      }
    }
  ],
  "licenses": [],
  "language": "dotnet",
  "cpes": [
    {
      "cpe": "cpe:2.3:a:microsoft_corporation:system_data_sqlclient_.net:4.8.5:*:*:*:*:*:*:*",
      "source": "syft-generated"
    },
    {
      "cpe": "cpe:2.3:a:system_data_sqlclient:system_data_sqlclient_.net:4.8.5:*:*:*:*:*:*:*",
      "source": "syft-generated"
    },
    {
      "cpe": "cpe:2.3:a:microsoft_corporation:system_data_sqlclient:4.8.5:*:*:*:*:*:*:*",
      "source": "syft-generated"
    },
    {
      "cpe": "cpe:2.3:a:system_data_sqlclient:system_data_sqlclient:4.8.5:*:*:*:*:*:*:*",
      "source": "syft-generated"
    }
  ],
  "purl": "pkg:nuget/System.Data.SqlClient@4.8.5",
  "metadataType": "dotnet-deps-entry",
  "metadata": {
    "name": "System.Data.SqlClient",
    "version": "4.8.5",
    "path": "system.data.sqlclient/4.8.6",
    "sha512": "sha512-2Ij/LCaTQRyAi5lAv7UUTV9R2FobC8xN9mE0fXBZohum/xLl8IZVmE98Rq5ugQHjCgTBRKqpXRb4ORulRdA6Ig==",
    "hashPath": "system.data.sqlclient.4.8.6.nupkg.sha512",
    "executables": {
      "lib/netcoreapp2.1/System.Data.SqlClient.dll": {
        "assemblyVersion": "4.6.1.6",
        "legalCopyright": "© Microsoft Corporation. All rights reserved.",
        "comments": "System.Data.SqlClient",
        "internalName": "System.Data.SqlClient.dll",
        "companyName": "Microsoft Corporation",
        "productName": "Microsoft® .NET Core",
        "productVersion": "3.1.39+fa27c9f378dde822f9ebe5af1f0dfd22be1778b1"
      }
    }
  }
}

Then grype will find this:

grype sbom.json
 ✔ Scanned for vulnerabilities     [3 vulnerability matches]
   ├── by severity: 0 critical, 1 high, 1 medium, 1 low, 0 negligible
   └── by status:   3 fixed, 0 not-fixed, 0 ignored
NAME                   INSTALLED  FIXED-IN        TYPE    VULNERABILITY        SEVERITY
System.Data.SqlClient  4.8.5      4.8.6           dotnet  GHSA-98g6-xh36-x2p7  High
...

If you are not seeing this resolved please shout out on a new issue, thanks!