Version comparison incorrect

[Djelibeybi]

Clair seems to think that our oraclelinux:6 has a vulnerability:

Clair report for image 175adfa05e40 (2016-07-21 21:20:35.75494941 +0000 UTC)
ELSA-2015-1699 (Medium)
    [3.14.3-23] - Pick up upstream freebl patch for CVE-2015-2730 - Check for P == Q
    or P ==-Q before adding P and Q

    Package:       nss-softokn @ 3.14.3-23.3.el6_8
    Fixed version: 3.14.3-23.el6_7
    Link:          http://linux.oracle.com/errata/ELSA-2015-1699.html
    Layer:         c83ca52f4077a59c5406bf6ba5f1eea85a1dd1c453da8e1c6e7db2680a5f72d0

However, if we check the RPM version inside the image:

$ docker run --rm -t -i oraclelinux:6 rpm -q --queryformat "%{NAME}-%{VERSION}-%{RELEASE}\n" nss-softokn
nss-softokn-3.14.3-23.3.el6_8

The version is actually greater in the image and thus not vulnerable.

The false positive is possibly due to the weirdness of the nss-softoken release versioning, as the increment in the release is el6_7 to el6_8. However, the installed release is still higher (-23.3.el6_8 vs -23.el6_7).

[Quentin-M]

Hi,

Thanks for the report.
Just encountered the issue too with 3.10.0-327.28.3.el7 < 3.10.0-327.el7.

[jzelinskie]

I think we're going to have to introduce version parsing for different data sources because while Debian's standard is super flexible, it clearly isn't handling everything.

[Djelibeybi]

Now that #290 is merged, Quay.io is showing false positives because of this comparison bug: https://quay.io/repository/djelibeybi/oraclelinux/image/7b31330a68b63825b93ef774e79bbe32332d2f3fbd02da7508f27ce92411a697?tab=vulnerabilities

[Djelibeybi]

BTW, I found a blog post on how RPM actually does version comparisons: http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/

[Djelibeybi]

(Adding this to the issue so it's not lost to IRC history)

It seems the only way that we can get this to work is a schema change on the features to store which detector was used to find each feature. That way, the comparison can be done with a feature-specific algorithm, i.e. the existing Debian one for dpkg/apk and a new RPM one for rpms.