CVE-2023-2976 is being detected wrongly flagged , even in runtime 3pp version has the latest patch with vulnerability fixed

[evadivu]

IDs

CVE-2023-2976

Description

Trivy is detective positive for CVE-2023-2976 which is for Google guava . Since its a shaded jar the tool is unable to pick the runtime version correctly

Reproduction Steps

1.Deploy the image
2.run the scanner
3.
...

Target

Container Image

Scanner

Vulnerability

Target OS

RHEL

Debug Output

Container

Version

0.71.0

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[DmitriyLewen]

duplicate of #10809