rust-crate false-positive: CVE-2019-3826

[lclc]

What happened:

False-positive for the following rust-crate:
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
prometheus 0.13.1 2.7.1 rust-crate CVE-2019-3826 Medium

What you expected to happen:

0.13.1 is the latest version of that crate. See https://crates.io/crates/prometheus

grype seems to mix up the version of Prometheus with the version of the crate.

Environment:

Output of grype version:
Application: grype
Version: 0.48.0
Syft Version: v0.54.0
BuildDate: 2022-08-24T15:42:08Z
GitCommit: https://github.com/anchore/grype/commit/e9df59b4b1bd56c370500b5072eeace3ab51f8b3
GitDescription: v0.48.0

[spiffcs]

This looks like it's another overlap caused by the naming convention.

https://crates.io/crates/prometheus <-- Since the crate's name is prometheus it matches against upstream prometheus
https://github.com/prometheus/prometheus

These are hard to tune against these, but we're working on finding ways to invalidate these overlaps from being reported based on a couple of factors.

It's not something we want to maintain at the app layer though which is why you'll probably see some future schema updates in the grype db to protect against this. That way we don't have to cut a new grype release for every overlap/fp we mitigate.

[willmurphyscode]

Hi @lclc!

This was fixed by the same change I mentioned at #901 (comment)

Please let us know if we missed something. Thanks!