False positive on openSUSE Tumbleweed tack: SUSE CVRF fixed version belongs to a different source package (CVE-2022-29458)

[SonnyRR]

False positive on openSUSE Tumbleweed tack: SUSE CVRF fixed version belongs to a different source package

Description

Trivy reports the tack package in openSUSE Tumbleweed images as having a fixable vulnerability with FixedVersion: 6.3.20220416-16.1. That fixed version can never be satisfied by Tumbleweed's tack, because it is in fact the fixed EVR of the ncurses source package lineage: in SLE, the binary tack RPM is a subpackage built from the ncurses source package, so its EVR tracks ncurses (5.9-78.1, 6.1-150000.5.12.1, 6.3.20220416-16.1, ...).

openSUSE Tumbleweed ships a separate, standalone tack package (Thomas Dickey's terminfo/keyboard-assessment tool), currently at 1.11.20251210-116.1. Since rpmvercmp orders 1.11... < 6.3..., the installed 1.x package is flagged as vulnerable and fixable.

The finding is CVE-2022-29458 — an out-of-bounds read in ncurses' terminfo library (tinfo/read_entry.c, convert_strings), not in the tack tool itself. Tumbleweed's ncurses has been patched for years, and the standalone tack binary is not affected (tack >= 6.3.20220416-16.1 appears in the advisory only because SLE's tack subpackage was rebuilt against patched ncurses).

SUSE's CVE page (below) lists the fixed version set for the openSUSE Tumbleweed row as:

ncurses-utils >= 6.3.20220416-16.1
...
tack >= 6.3.20220416-16.1

That row was correct historically, when Tumbleweed's tack was a subpackage of ncurses. tack has since been repackaged in Tumbleweed as an independent project with its own version scheme, and the DB's name → fixed-version mapping now attaches an unattainable ncurses-style EVR to it.

This is the same class of problem as #3193 (wrong SUSE CVRF FixedVersion mapping).

Impact

Automated remediation tools driving patches from the Trivy report hard-fail instead of fixing anything. Example: Copacetic (Copa) ran the following against a Tumbleweed image (base snapshot 2026-11-05/06):

$ zypper --non-interactive --installroot <chroot> up --no-recommends tack
No update candidate for 'tack-1.11.20251210-116.1.x86_64'. The highest available version is already installed.
level=error msg="downloaded package tack version 1.11.20251210-116.1 lower than required 6.3.20220416-16.1 for update"
Error: Patch Failed

The installed tack is already the highest version Tumbleweed publishes; the fixed version 6.3.x does not exist in any Tumbleweed repository, so the "fixable" finding is unresolvable and Copa fail-closes instead of patching.

Reproduction

Query of the Tumbleweed OSS repository (via zypper, read-only):

$ zypper se -s tack
i | tack | package | 1.11.20251210-116.1 | x86_64 | openSUSE-Tumbleweed-Oss

Only tack-1.11.20251210-116.1.x86_64.rpm is published — no ncurses-lineage tack version exists there:
https://download.opensuse.org/tumbleweed/repo/oss/x86_64/

The version ordering that drives the false "fixable" classification, using the same rpmvercmp logic the ecosystem relies on:

$ rpm --eval '%{lua: print(rpm.vercmp("1.11.20251210", "6.3.20220416"))}'
-1

References

• SUSE CVE-2022-29458 page with the tack >= 6.3.20220416-16.1 fixed version for Tumbleweed:
  https://www.suse.com/security/cve/CVE-2022-29458.html
• Prior SUSE CVRF mapping issue: False positive: SUSE-SU-2022:2260-1 and SUSE-SU-2022:3795-1 have wrong Fixed Version #3193

Environment

• Trivy version: v0.76.2 (via aquasecurity/trivy-action v0.36.0 in GitHub Actions; reproduced over multiple runs on different days)
• DB: trivy vulnerability database (SUSE CVRF feed)
• Target: openSUSE Tumbleweed base image, tack-1.11.20251210-116.1.x86_64, ncurses already patched (>= 6.5)

Desired behavior

A SUSE/openSUSE CVRF entry whose fixed EVR belongs to a different packaging lineage than the binary package in the scanned distro should not be classified as fixable. Since SLE's tack subpackage EVR equals the ncurses source package EVR, mapping by source-package-aware metadata (binary → source) would resolve this case; the same pre-repackaging conflation likely affects other subpackages that later moved to standalone packaging.

Happy to provide more logs or the full Trivy JSON report if useful — note the two example runs in the Copacetic log excerpt above are from runs filed at https://github.com/SonnyRR/devcontainers (workflows that patch Tumbleweed images with Copa using this report).