False-Positive: CVE-2020-14343

[almaz045]

PURL of wrongly matched component

pkg:pypi/PyYAML@6.0.1

Depscan findings

██████╗ ███████╗██████╗ ███████╗ ██████╗ █████╗ ███╗   ██╗
██╔══██╗██╔════╝██╔══██╗██╔════╝██╔════╝██╔══██╗████╗  ██║
██║  ██║█████╗  ██████╔╝███████╗██║     ███████║██╔██╗ ██║
██║  ██║██╔══╝  ██╔═══╝ ╚════██║██║     ██╔══██║██║╚██╗██║
██████╔╝███████╗██║     ███████║╚██████╗██║  ██║██║ ╚████║
╚═════╝ ╚══════╝╚═╝     ╚══════╝ ╚═════╝╚═╝  ╚═╝╚═╝  ╚═══╝

╭─────────────────── Risk Audit Capability ───────────────────╮
│ Depscan supports OSS Risk audit for this project.           │
│ To enable set the environment variable ENABLE_OSS_RISK=true │
╰─────────────────────────────────────────────────────────────╯
INFO [2024-03-29 14:13:12,409] Performing regular scan for /PYTHON/django-DefectDojo-master using plugin pypi

                         Dependency Scan Results (PYPI)                         
╔═══════════════════════╤═════════════════════╤═════════════╤══════════╤═══════╗
║ CVE                   │ Insights            │ Fix Version │ Severity │ Score ║
╟───────────────────────┼─────────────────────┼─────────────┼──────────┼───────╢
║ pyyaml@6.0.1 ⬅        │ 🧾 Vendor Confirmed │             │ LOW      │   2.0 ║
║ CVE-2020-14343        │                     │             │          │       ║
╟───────────────────────┼─────────────────────┼─────────────┼──────────┼───────╢
║ pyyaml@6.0.1 ⬅        │ 🧾 Vendor Confirmed │             │ LOW      │   2.0 ║
║ CVE-2017-18342        │                     │             │          │       ║
╚═══════════════════════╧═════════════════════╧═════════════╧══════════╧═══════╝
╭────────────── Recommendation ───────────────╮
│ ✅ No package requires immediate attention. │
╰─────────────────────────────────────────────╯

[prabhu]

VDB version compare is incorrectly saying that 6.0.1 is within 3.01 and 5.4b2. Will work on a fix this weekend.

['4969711542_4969759212', 'pypi', 'pyyaml', '6.0.1'] 3.01 5.4b2 None None True

[prabhu]

Fixed with vdb 5.6.6. PR to bump depscan is coming.

python depscan/cli.py --no-banner --purl "pkg:pypi/PyYAML@6.0.1" --reports-dir /tmp/reports --no-suggest                           ok  4s  depscan py
╭─────────────────── Risk Audit Capability ───────────────────╮
│ Depscan supports OSS Risk audit for this project.           │
│ To enable set the environment variable ENABLE_OSS_RISK=true │
╰─────────────────────────────────────────────────────────────╯
INFO [2024-03-29 22:20:57,636] Performing regular scan for /mnt/work/owasp-depscan/dep-scan using plugin pypi
INFO [2024-03-29 22:20:57,643] No oss vulnerabilities detected ✅

[prabhu]

@almaz045 could you kindly test with PR #282?

[almaz045]

@almaz045 could you kindly test with PR #282?

dep-scan-feature-use-vdbxz/depscan$ python3 cli.py --no-banner --purl "pkg:pypi/PyYAML@6.0.1" --reports-dir temp_test --no-suggest
╭─────────────────── Risk Audit Capability ───────────────────╮
│ Depscan supports OSS Risk audit for this project.           │
│ To enable set the environment variable ENABLE_OSS_RISK=true │
╰─────────────────────────────────────────────────────────────╯
INFO [2024-04-01 10:10:29,707] Performing regular scan for dep-scan-feature-use-vdbxz/depscan using plugin pypi

                         Dependency Scan Results (PYPI)                         
╔═══════════════════════╤═════════════════════╤═════════════╤══════════╤═══════╗
║ CVE                   │ Insights            │ Fix Version │ Severity │ Score ║
╟───────────────────────┼─────────────────────┼─────────────┼──────────┼───────╢
║ pyyaml@6.0.1 ⬅        │ 🧾 Vendor Confirmed │             │ LOW      │   2.0 ║
║ CVE-2020-14343        │                     │             │          │       ║
╟───────────────────────┼─────────────────────┼─────────────┼──────────┼───────╢
║ pyyaml@6.0.1 ⬅        │ 🧾 Vendor Confirmed │             │ LOW      │   2.0 ║
║ CVE-2017-18342        │                     │             │          │       ║
╚═══════════════════════╧═════════════════════╧═════════════╧══════════╧═══════╝
╭────────────── Recommendation ───────────────╮
│ ✅ No package requires immediate attention. │
╰─────────────────────────────────────────────╯

[prabhu]

@almaz045 could you uninstall any existing depscan or set PYTHONPATH to the cloned directory?

[almaz045]

@almaz045 could you uninstall any existing depscan or set PYTHONPATH to the cloned directory?

I've deleted depscan binary file from path:

depscan
bash: /home/user/.local/bin/depscan: No such file or directory

I've added PYTHONPATH to feature-branch

export PYTHONPATH="/home/user/Desktop/Programs/dep-scan-feature-use-vdbxz:$PYTHONPATH"

~/Desktop/Programs/dep-scan-feature-use-vdbxz$ python3 depscan/cli.py --no-banner --purl "pkg:pypi/PyYAML@6.0.1" --reports-dir temp_test --no-suggest
╭─────────────────── Risk Audit Capability ───────────────────╮
│ Depscan supports OSS Risk audit for this project.           │
│ To enable set the environment variable ENABLE_OSS_RISK=true │
╰─────────────────────────────────────────────────────────────╯
INFO [2024-04-01 17:55:25,318] Performing regular scan for /home/user/Desktop/Programs/dep-scan-feature-use-vdbxz using plugin pypi

                         Dependency Scan Results (PYPI)                         
╔═══════════════════════╤═════════════════════╤═════════════╤══════════╤═══════╗
║ CVE                   │ Insights            │ Fix Version │ Severity │ Score ║
╟───────────────────────┼─────────────────────┼─────────────┼──────────┼───────╢
║ pyyaml@6.0.1 ⬅        │ 🧾 Vendor Confirmed │             │ LOW      │   2.0 ║
║ CVE-2017-18342        │                     │             │          │       ║
╟───────────────────────┼─────────────────────┼─────────────┼──────────┼───────╢
║ pyyaml@6.0.1 ⬅        │ 🧾 Vendor Confirmed │             │ LOW      │   2.0 ║
║ CVE-2020-14343        │                     │             │          │       ║
╚═══════════════════════╧═════════════════════╧═════════════╧══════════╧═══════╝
╭────────────── Recommendation ───────────────╮
│ ✅ No package requires immediate attention. │
╰─────────────────────────────────────────────╯

[prabhu]

@almaz045 can you also do?

pip uninstall appthreat-vulnerability-db

[almaz045]

@prabhu
Yes, the problem was in old vdb version:

$ pip uninstall appthreat-vulnerability-db
Found existing installation: appthreat-vulnerability-db 5.6.4
Uninstalling appthreat-vulnerability-db-5.6.4:

pip install -e .

python3 depscan/cli.py --no-banner --purl "pkg:pypi/PyYAML@6.0.1" --reports-dir temp_test --no-suggest
╭─────────────────── Risk Audit Capability ───────────────────╮
│ Depscan supports OSS Risk audit for this project.           │
│ To enable set the environment variable ENABLE_OSS_RISK=true │
╰─────────────────────────────────────────────────────────────╯
INFO [2024-04-01 19:00:14,048] Performing regular scan for /home/user/Desktop/Programs/dep-scan-feature-use-vdbxz using plugin pypi
INFO [2024-04-01 19:00:14,052] No oss vulnerabilities detected ✅

Thanks!

[prabhu]

@almaz045, will rework PR #282 without including the xz change and let you know once it's ready.