False positive on io.minio 8.5.2?

[prabutdr]

What happened:
Scanned io.minio.minio 8.5.2 and Grype reported below vulnerabilities -

1. CVE-2018-1000538 (High)
   https://nvd.nist.gov/vuln/detail/CVE-2018-1000538
   security: fix write-to-RAM DoS vulnerability minio/minio#5957

2. CVE-2020-11012 (High)
   https://nvd.nist.gov/vuln/detail/CVE-2020-11012
   fix: Add missing return in admin requests auth minio/minio#9422

3. CVE-2021-21287 (High)
   https://nvd.nist.gov/vuln/detail/CVE-2021-21287
   https://github.com/minio/minio/releases/tag/RELEASE.2021-01-30T00-20-58Z

4. CVE-2021-43858 (High)
   https://nvd.nist.gov/vuln/detail/CVE-2021-43858
   https://github.com/minio/minio/releases/tag/RELEASE.2021-12-27T07-23-18Z

5. CVE-2021-21362 (Medium)

6. CVE-2021-21390 (Medium)

7. CVE-2022-35919 (Low)

What you expected to happen:
When did the detail analysis of the above vulnerabilities (refer the links provided each vulnerabilities above), looks like they were already fixed in certain releases and the latest minio (8.5.2) should not show these vulnerabilities. Initially grype reported on minio 8.3.7, but after that we upgraded so many new versions and currently have latest minio 8.5.2, but still grype shows these vulnerabilities. Please check and confirm whether these are False Positives?

How to reproduce it (as minimally and precisely as possible):
Download and scan io.minio 8.5.2 runtime using Anchore Grype

https://mvnrepository.com/artifact/io.minio/minio

Environment:
Anchore Grype version: 0.60.0
OS (e.g: cat /etc/os-release or similar): SUSE 15.4

[prabutdr]

As per the fix provided for each vulnerability, it seems, the above vulnerabilities are applicable only on -
MinIO Server:- https://github.com/minio/minio

Not applicable to -
Minio java client:- https://github.com/minio/minio-java

Please confirm, whether these are false positives for Minio java client latest packages (8.5.2)?

[prabutdr]

Tool reported two additional high vulnerabilities on minio:8..5.2 -

CVE-2023-28433
CVE-2023-28434

As per the fix provided for each vulnerability, it seems, the above all vulnerabilities are also fall into this category.

Please confirm, whether these also False Positives for Minio java client latest packages (8.5.2)?

Any possible fix from tool to handle these cases?

[spiffcs]

Hey @prabutdr! We're taking a look at false positives as a problem and trying to determine the best way forward for reducing them as much as possible. I think the above problem comes into play when the cpe matching is a little too broad. We've found that narrowing that down in specific ecosystems leads to more false negatives being reported which is the trade off we've accepted for the time being.

I'm sorry these are showing up and causing noise in the scan at the moment.

Grype does allow you to specify an ignore list in the config. Usually this is commented with the reasons for the FP:
https://github.com/anchore/grype#specifying-matches-to-ignore

We'll keep this issue open and add it as part of our false positive effort!

[prabutdr]

Thanks much @spiffcs

[willmurphyscode]

Thanks @prabutdr for reporting this!

Here's a short repro script for anyone testing it in the future:

wget https://repo1.maven.org/maven2/io/minio/minio/8.5.2/minio-8.5.2.jar
grype minio-8.5.2.jar

It looks like we're generating a CPE for the minio jar that's too broad:

CVE-2018-1000538 from https://nvd.nist.gov/vuln/detail/CVE-2018-1000538
matched artifact is:
minio - pkg:maven/minio/[email protected]
match type is cpe-match
CPEs

• cpe:2.3:a:minio:minio:8.5.2:*:*:*:*:*:*:*

URLs:

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000538
• minio/minio@9c8b730#diff-e8c3bc9bc83b5516d0cc806cd461d08bL220
• security: fix write-to-RAM DoS vulnerability minio/minio#5957

But @prabutdr is right, cpe:2.3:a:minio:minio:8.5.2:*:*:*:*:*:*:* should be matched against Minio server, not the Java client. So the CPE generated here is too broad. I'm adding a label that this is a false positive caused by a too-broad CPE, so that we can try to investigate and fix this type of error.

[willmurphyscode]

Hi @prabutdr,

I'm closing this issue because it was fixed by intervening development. Specifically, Grype no longer uses CPEs to match against JARs by default. You can read more about this change at https://anchore.com/blog/say-goodbye-to-false-positives/.

wget -q https://repo1.maven.org/maven2/io/minio/minio/8.5.2/minio-8.5.2.jar
grype -q minio-8.5.2.jar
No vulnerabilities found

Please let us know if we've missed something. Thanks!