False postive on Debian images #5993
Oneiroi
started this conversation in
False Detection
Replies: 1 comment
-
|
This is still an issue with Debian 13, and Apache 2.4.65-2 Using latest Docker version of trivy gives same results |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
IDs
CVE-2001-1534,TEMP-0841856-B18BAF
Description
PHP:8-apache-bookwork false-positives
Within the
trivy image php:8-apache-bookwormwe see reports for example such as:CVE-2001-1534 - mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.On startup it can be observed the image is running Apache 2.4.57
[Wed Jan 24 11:40:26.811835 2024] [mpm_prefork:notice] [pid 1] AH00163: Apache/2.4.57 (Debian) PHP/8.3.2 configured -- resuming normal operationsMoreover reviewing https://nvd.nist.gov/vuln/detail/CVE-2001-1534 see the statement from RedHat:
-f json snippet
-f jsonouput, are unreachable or 404.Debian false-positives
root@9db737b4e3c4:/var/www/html# cat /etc/debian_version
12.4
Debian version is correctly detected by Trivy:
php:8-apache-bookworm (**debian 12.4**)Vulberability TEMP-0841856-B18BAF prently reports 'not found'
Vulnerability TEMP-0000000-F7A20F notes whilst report from for Linux 2.6 Kernel this does not contain the affected code, admittedly the link notes the main
linuxpackage is vulnerable perhaps this accounts for the positive status , seems perhaps upstream debate on this also has not resulted in a positive correction at the time of writing, that and as the Debian tracker link notes the vulnerability as "unimportant" we may never see resolution for this particular issue whether or not this is a false positive seems entirely dependant on the individuals point of view, unsure if we can exclude 'TEMP-' items in the future to account for such ambiguity ?Vulnerability TEMP-0628843-DB-AD28 presently returns "not found" additionlly it is noted
[more related to CVE-2005-4890]seems this may have not been fully merged?On review of CVE-2005-4890 it is noted this is fixed in the Debian version, for the
sudoandshadowpackages, which upon review, neither are present within the container.Additionally Trivy notes that
TEMP-0628843-DBAD28affectedpasswdthe verison of which is installed being:1:4.13+dfsg1-1+b1however theCVE-2005-4890does notpasswdas being affected, liekly a case of stale data in this particular case presuming the now unavailableTEMP-0628843-DBAD28notedpasswdas being affected with theCVE-2005-4890noting instead thatshadowis.TEMP-0517018-A83CE6 appear internal debtae is ongoing on whether or not this is unimportant or
low; maybe not a Trivy issue more an upstream problem showing unpatched and vulnerable at the time of writing.TEMP-0290435-0B57B5 another case of internal debate, seems the tracker shows as vulnerable whilst notes suggest this is not the case.
Reproduction Steps
1. `trivy image php:8-apache-bookworm`Target
Container Image
Scanner
Vulnerability
Target OS
debian 12.4
Debug Output
Version
Checklist
-f jsonthat shows data sources and confirmed that the security advisory in data sources was correctBeta Was this translation helpful? Give feedback.
All reactions