False positive on sentry and other libs

[anandgia]

What happened:

We scanned an amazon linux image which has a sentry client jar. This found a bunch of false positive CVEs like these which are in mobileiron and sentry. It appears underling os is not being looked at properly.

sentry 1.7.27 CVE-2014-1409 Critical
sentry 1.7.27 CVE-2018-8028 High
sentry 1.7.27 CVE-2013-7287 Critical
sentry 1.7.27 CVE-2020-8887 High
sentry 1.7.27 CVE-2020-15506 Critical
sentry 1.7.27 CVE-2020-15507 High
sentry 1.7.27 CVE-2013-7286 High

What you expected to happen:

No CVEs should be reported against sentry

How to reproduce it (as minimally and precisely as possible):

Run an amazon linux docker with sentry client jar bundled.

Anything else we need to know?:

Environment:

• Output of grype version:

$ grype version
Application:          grype
Version:              0.9.0
BuildDate:            2021-03-26T12:16:56Z
GitCommit:            7ce9ef647ed415334920538fdaeb451876e52f4c
GitTreeState:         clean
Platform:             darwin/amd64
GoVersion:            go1.14.15
Compiler:             gc
Supported DB Schema:  1

• OS (e.g: cat /etc/os-release or similar):

sh-4.2# cat /etc/os-release
NAME="Amazon Linux"
VERSION="2"
ID="amzn"
ID_LIKE="centos rhel fedora"
VERSION_ID="2"
PRETTY_NAME="Amazon Linux 2"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"
HOME_URL="https://amazonlinux.com/"
sh-4.2# find . -name sentry*
./home/appuser/app/lib/sentry-log4j2-1.7.27.jar
./home/appuser/app/lib/sentry-1.7.27.jar

[luhring]

Hi @anandgia, thanks for the issue!

Adding my own steps to reproduce:

I used this Dockerfile:

FROM amazonlinux:latest

RUN yum install -y maven

WORKDIR /app
COPY ./pom.xml ./

RUN mvn dependency:sources

Using this pom.xml:

<project>
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.mycompany.app</groupId>
  <artifactId>my-app</artifactId>
  <version>1</version>
  <dependencies>
    <dependency>
      <groupId>io.sentry</groupId>
      <artifactId>sentry</artifactId>
      <version>4.4.0-alpha.2</version>
    </dependency>
  </dependencies>
</project>

I'm seeing similar results. Here's one example CPE that leads to a match: "cpe:2.3:a:*:sentry:4.4.0-alpha.2-sources:*:*:*:*:java:*:*".

[luhring]

Hi @anandgia — could you try this again using the latest release of Grype? I find I'm no longer able to reproduce this, but I'm curious what you're seeing.

[anandgia]

Looks fine now @luhring thanks !