Maven dependencies not resolved correctly during filesystem scan - properties

[mrjonstrong]

Description

Trivy filesystem scan of a pom.xml with a properties section resolves the wrong version of the dependency. In this example jackson

What did you expect to happen?

Version of dependencies in properties section of pom.xml to be used when trivy lists the packages and looks for matching cves

What happened instead?

Older versions of dependencies used

Output of run with -debug:

For simplicity sake I have removed all but the jackson dependencies

trivy -d fs --security-checks vuln -f json --list-all-pkgs .
2022-05-17T14:22:30.208+0100	DEBUG	Severities: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
2022-05-17T14:22:30.248+0100	DEBUG	cache dir:  /Users/mrjonstrong/Library/Caches/trivy
2022-05-17T14:22:30.248+0100	DEBUG	DB update was skipped because the local DB is the latest
2022-05-17T14:22:30.248+0100	DEBUG	DB Schema: 2, UpdatedAt: 2022-05-17 12:06:28.847448335 +0000 UTC, NextUpdate: 2022-05-17 18:06:28.847447935 +0000 UTC, DownloadedAt: 2022-05-17 13:07:53.138275 +0000 UTC
2022-05-17T14:22:30.249+0100	DEBUG	Vulnerability type:  [os library]
2022-05-17T14:22:30.249+0100	DEBUG	No secret config detected: trivy-secret.yaml
2022-05-17T14:22:30.259+0100	DEBUG	Resolving com.fasterxml.jackson:jackson-bom:2.13.2.20220328...
2022-05-17T14:22:30.294+0100	DEBUG	Resolving com.fasterxml.jackson:jackson-bom:2.13.0...
2022-05-17T14:22:30.307+0100	DEBUG	Resolving com.fasterxml.jackson.core:jackson-databind:2.13.0...
2022-05-17T14:22:30.569+0100	DEBUG	Resolving com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.13.2...
2022-05-17T14:22:30.575+0100	DEBUG	Resolving com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.13.2...
2022-05-17T14:22:30.576+0100	DEBUG	Resolving com.fasterxml.jackson.module:jackson-module-parameter-names:2.13.2...
2022-05-17T14:22:30.587+0100	DEBUG	Resolving com.fasterxml.jackson.core:jackson-annotations:2.13.0...
2022-05-17T14:22:30.615+0100	DEBUG	Resolving com.fasterxml.jackson.core:jackson-core:2.13.0...
2022-05-17T14:22:30.739+0100	DEBUG	OS is not detected.
2022-05-17T14:22:30.739+0100	DEBUG	Detected OS: unknown
2022-05-17T14:22:30.739+0100	INFO	Number of language-specific files: 1
2022-05-17T14:22:30.739+0100	INFO	Detecting pom vulnerabilities...
2022-05-17T14:22:30.739+0100	DEBUG	Detecting library vulnerabilities, type: pom, path: pom.xml

Output of trivy -v:

Version: 0.28.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2022-05-17 12:06:28.847448335 +0000 UTC
  NextUpdate: 2022-05-17 18:06:28.847447935 +0000 UTC
  DownloadedAt: 2022-05-17 13:07:53.138275 +0000 UTC

Additional details (base image name, container registry info...):

Maven dependency tree shows higher versions of jackson

mvn dependency:tree | grep jackson
[INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.13.2:compile
[INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.13.2:compile
[INFO] |  |  \- com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.13.2:compile
[INFO] |  |  +- com.fasterxml.jackson.core:jackson-annotations:jar:2.13.2:compile
[INFO] |  \- com.fasterxml.jackson.core:jackson-databind:jar:2.13.2:compile
[INFO] |     \- com.fasterxml.jackson.core:jackson-core:jar:2.13.2:compile

pom.xml

[mrjonstrong]

@DmitriyLewen let me know if you need anymore info. I thought it was due to the properties section but that was a bit of an assumption.

[DmitriyLewen]

Hello @mrjonstrong
Thanks to your report!

Can i take a look at your pom.xml file to check your problem?

Regards, Dmitriy

[mrjonstrong]

Hi @DmitriyLewen sure thing, here is a link pom.xml let me know it that is no good and I can upload.

[DmitriyLewen]

Thanks a lot!

I will check and write to you.

[DmitriyLewen]

Hello @mrjonstrong
Thanks a lot for your time!

your pom.xml file contains spring-cloud-starter-config v3.1.0(version was sourced from spring-cloud-dependencies v2021.0.0). This package has jackson-databind v2.13.0.

That is why Trivy found jackson-databind v2.13.0 package.

Regards, Dmitriy

[mrjonstrong]

Hi @DmitriyLewen

Thanks for taking a look into this.

The thing is that when I run mvn dependency:tree | grep jackson

I get version jackson-databind v2.13.2 as I think it's picked the higher version from the properties section (or somewhere else at least). So I was thinking that trivy would mirror the dependency tree and identify the higher version.

mvn dependency:tree | grep jackson
[INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.13.2:compile
[INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.13.2:compile
[INFO] |  |  \- com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.13.2:compile
[INFO] |  |  +- com.fasterxml.jackson.core:jackson-annotations:jar:2.13.2:compile
[INFO] |  \- com.fasterxml.jackson.core:jackson-databind:jar:2.13.2:compile
[INFO] |     \- com.fasterxml.jackson.core:jackson-core:jar:2.13.2:compile

Given the higher version in the mvn dependency:tree - can trivy identify it also as the higher version?

[DmitriyLewen]

Hello @mrjonstrong

mvn dependency:tree gets jackson version from jackson-bom.version property.
I checked all related dependencies but didn't find reference to jackson-bom library.
Can you tell me why you added this property to your pom file(it might help me a lot in this investigation)?

[cardoso-thiago]

Hello @DmitriyLewen

In that case, the dependency with the vulnerability would not be packaged inside the jar. We have the same problem here, a certain dependency transitively brings a vulnerable dependency, and even correcting it in the application's pom, Trivy continues to identify the old and vulnerable version, even if it doesn't appear with the mvn dependency:tree. Is this intentional?

pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>
	<parent>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-parent</artifactId>
		<version>2.6.8</version>
		<relativePath/> <!-- lookup parent from repository -->
	</parent>
	<groupId>br.com.cardoso</groupId>
	<artifactId>demo-trivy</artifactId>
	<version>0.0.1-SNAPSHOT</version>
	<name>demo-trivy</name>
	<description>Demo Trivy</description>
	<properties>
		<java.version>11</java.version>
	</properties>
	<dependencies>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-actuator</artifactId>
		</dependency>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-jersey</artifactId>
		</dependency>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-web</artifactId>
		</dependency>
		<dependency>
			<groupId>org.redisson</groupId>
			<artifactId>redisson-spring-boot-starter</artifactId>
			<version>3.15.6</version>
		</dependency>
		<dependency>
			<groupId>net.sf.ehcache</groupId>
			<version>2.10.1</version>
			<artifactId>ehcache</artifactId>
		</dependency>
		<dependency>
			<groupId>com.fasterxml.jackson.core</groupId>
			<artifactId>jackson-databind</artifactId>
			<version>2.13.3</version>
		</dependency>

		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-test</artifactId>
			<scope>test</scope>
		</dependency>
	</dependencies>

	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
			</plugin>
		</plugins>
	</build>

</project>

The report:

The content of the jar:

[DmitriyLewen]

Hello @cardoso-thiago
Thank a lot for your information. This will help research this problem better!

Is this intentional?

No, we are working on fix this bug.

[DmitriyLewen]

@cardoso-thiago
I checked your pom.xml.

Trivy found jackson v2.13.3.

➜  trivy fs -f json --list-all-pkgs ./pom.xml | grep com.fasterxml.jackson.core -A 2 
2022-06-22T10:32:46.522+0600	INFO	Vulnerability scanning is enabled
2022-06-22T10:32:46.522+0600	INFO	Secret scanning is enabled
2022-06-22T10:32:46.522+0600	INFO	If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2022-06-22T10:32:46.522+0600	INFO	Please see also https://aquasecurity.github.io/trivy/v0.29.1/docs/secret/scanning/#recommendation for faster secret detection
2022-06-22T10:33:23.337+0600	INFO	Number of language-specific files: 1
2022-06-22T10:33:23.337+0600	INFO	Detecting pom vulnerabilities...
          "Name": "com.fasterxml.jackson.core:jackson-annotations",
          "Version": "2.13.3",
          "Layer": {}
--
          "Name": "com.fasterxml.jackson.core:jackson-core",
          "Version": "2.13.3",
          "Layer": {}
--
          "Name": "com.fasterxml.jackson.core:jackson-databind",
          "Version": "2.13.3",
          "Layer": {}

What Trivy version are you using?

[cardoso-thiago]

@DmitriyLewen sorry, but I didn't make myself clear.

With the fs my result was the same. We are getting this result with the rootfs pointing to the generated jar.

trivy rootfs target/demo-trivy-0.0.1-SNAPSHOT.jar

Trivy version:

Version: 0.29.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2022-06-22 06:06:46.551413461 +0000 UTC
  NextUpdate: 2022-06-22 12:06:46.551412861 +0000 UTC
  DownloadedAt: 2022-06-22 10:06:30.216952748 +0000 UTC