False positive for CVE-2024-52308 when gh (GitHub CLI) version 2.62.0 and above is installed

[benglewis]

IDs

CVE-2024-52308

Description

Trivy incorrect reports that the gh CLI installed from the GitHub official apt repository is vulnerable to GHSA-p2h2-3vg9-4p87 despite it being a more recent version than 2.62.0 which is marked as the fix version in the official GitHub Security Advisory . It looks like this is because the affected software is incorrectly only labelled as being Cli when installed from GitHub and not Gh on Ubuntu (which when installed from the official apt repository is safe).

Please fix this

Reproduction Steps

1. Install `gh` CLI in an Ubuntu OS container either via the official `apt` repository or the official `.deb` published on GitHub
2. Scan the Docker image produced with Trivy's GitHub Actions integration

Target

Container Image

Scanner

Vulnerability

Target OS

Ubuntu 24.04

Debug Output

I don't have an easy way to run this given that the I am running Trivy in GitHub Actions

(The documentation link about wrong detection below is broken BTW)

Version

v0.56.1

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[DmitriyLewen]

Hello @benglewis
Please read about data source selection:
https://trivy.dev/docs/latest/guide/scanner/vulnerability/#data-source-selection

Which Ubuntu version are you using for the image?
Ubuntu doesn’t have a fix for 25.04 and 25.10 yet:
https://ubuntu.com/security/CVE-2024-52308

Regards, Dmitriy

[benglewis]

I am not using the Ubuntu apt repository, but instead the official gh CLI apt repository

[knqyf263]

I guess you installed gh from the GitHub deb repository. Please let me know if I'm wrong. Anyway, I created #9916.

[benglewis]

This solution looks great. It sounds like you have understood the issue and that it is wider than my specific example and you have found a solution that should fix many other potential false-positives. Thank you! 🤩

[knqyf263]

This is a known issue, but we haven't found a good solution. My solution is still not the best, but it should work.