Trivy: not detecting CVE-2019-15903

[nycalex]

Not detecting CVE-2019-15903

when scanning an older version of postgres:9.6 (based on debian 9.9) with the latest db & trivy version 0.12 is not detecting that CVE.
I manually connected into the container bash via docker, and validated that the vulnerable version of the package is there.
Other vulnerabilities are detected accurately in this image

Output of run with -debug:

sudo trivy -debug postgres:9.6
2020-10-14T13:10:02.089-0400    DEBUG   Severities: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
2020-10-14T13:10:02.093-0400    DEBUG   cache dir:  /root/.cache/trivy
2020-10-14T13:10:02.093-0400    INFO    Need to update DB
2020-10-14T13:10:02.093-0400    INFO    Downloading DB...
2020-10-14T13:10:02.183-0400    DEBUG   release name: v1-2020101412
2020-10-14T13:10:02.183-0400    DEBUG   asset name: trivy-light-offline.db.tgz
2020-10-14T13:10:02.183-0400    DEBUG   file name doesn't match
2020-10-14T13:10:02.183-0400    DEBUG   asset name: trivy-light.db.gz
2020-10-14T13:10:02.183-0400    DEBUG   file name doesn't match
2020-10-14T13:10:02.183-0400    DEBUG   asset name: trivy-offline.db.tgz
2020-10-14T13:10:02.183-0400    DEBUG   file name doesn't match
2020-10-14T13:10:02.183-0400    DEBUG   asset name: trivy.db.gz
18.51 MiB / 18.51 MiB [-------------------------------] 100.00% 23.71 MiB p/s 1s
2020-10-14T13:10:03.247-0400    DEBUG   Updating database metadata...
2020-10-14T13:10:03.248-0400    DEBUG   DB Schema: 1, Type: 1, UpdatedAt: 2020-10-14 12:19:11.480760421 +0000 UTC, NextUpdate: 2020-10-15 00:19:11.480760021 +0000 UTC
2020-10-14T13:10:03.299-0400    DEBUG   Vulnerability type:  [os library]
2020-10-14T13:10:03.302-0400    DEBUG   Artifact ID: sha256:edb112fd27660755021fa7d373f968e4f6346ccac1ecfce18a1c79f4c2cd0560
2020-10-14T13:10:03.302-0400    DEBUG   Blob IDs: [sha256:cf5b3c6798f77b1f78bf4e297b27cfa5b6caa982f04caeb5de7d13c255fd7a1e sha256:46eac194dee6fca6ab3b0d759b71bc2bb152c83b01f4754ab2ff6cef5e72560f sha256:b2017cfdc637ceaee1079461fd529cf8051d86d131e2996760310873dc344270 sha256:9304f50cc2bcf539e2faa8241fc51d1b375d3206ee94cdd3513f90878bc8d5e1 sha256:0900a17ef9ffac1c08b5cf40418e347d88aabfb8c51de3982e9d38b17d025630 sha256:dda1d057bd73c077fee44d5d56169426438a7daf6bada046470ee02160ec46f7 sha256:77c437363b480b0d37c46b2aa25401b3f519066b3ce12cbb0325ff7d36bb1ee2 sha256:0f3647e648d8dde54eeb157f8a5b813b772d58ecbaf9a10daeabef56ae8831c2 sha256:f1033145b2880f2c8ab0ee1be90387ae8e46c6076209a90e308f6ea203bacc43 sha256:4161986cd718bd87c0522b0653388a0b738b4c652de38325c0cdf74aaf8f8a5b sha256:ff48b036201e1f3e22926be3cd7f8d38d9cbd19f1a7a0c8ada4a7f448ea01eea sha256:91290c4c43b7e9a5c9fc9422deda0420a33def5058dd8b73202cb6d7dfb47f5d sha256:59b9ec4e0b29315ff64b3f6c30a302cffea9a3a83e7ff67e61205b4f3279199e sha256:7587d7ddeb542cbb4ec8dc7224ab0a68646325c3fbf189885f5ebd202f6fe3c6]
2020-10-14T13:10:03.307-0400    INFO    Detecting Debian vulnerabilities...
2020-10-14T13:10:03.307-0400    DEBUG   debian: os version: 9
2020-10-14T13:10:03.307-0400    DEBUG   debian: the number of packages: 177

postgres:9.6 (debian 9.9)
=========================
Total: 457 (UNKNOWN: 1, LOW: 255, MEDIUM: 153, HIGH: 48, CRITICAL: 0)

Output of trivy -v:

sudo trivy -v
Version: 0.12.0
Vulnerability DB:
  Type: Light
  Version: 1
  UpdatedAt: 2020-10-13 12:19:08.372138112 +0000 UTC
  NextUpdate: 2020-10-14 00:19:08.372137912 +0000 UTC

Additional details (base image name, container registry info...):
postgres:9.6 / based on debian 9.9

[knqyf263]

@rahul2393 Could you look into it?

1. Check the fixed version of CVE-2019-15903 in vuln-list
2. Check the fixed version in JSON API
3. Make sure that they are the same
4. Check the installed version in postgres:9.6
5. Compare those versions

[rahul2393]

Ack

[nycalex]

if it helps in any way:

running apt list --installed | grep libexpat1 from inside the container shows version 2.2.0-2+deb9u2
libexpat1/now 2.2.0-2+deb9u2 amd64 [installed,local]

This container is based on debian release named Stretch.

Per https://security-tracker.debian.org/tracker/CVE-2019-15903, in Stretch, the fixed version is 2.2.0-2+deb9u3

Thanks for looking into this!!!

[rahul2393]

I think this is because of the version check issue, I ran a unit test to compare 2.2.0-2+deb9u2 with 2.2.0-2+deb9u3 and it was failing, let me push a unit test in a PR covering this case
https://github.com/aquasecurity/trivy/issues/643
@knqyf263

[knqyf263]

I don't think it is a problem of version comparison.

Per https://security-tracker.debian.org/tracker/CVE-2019-15903, in Stretch, the fixed version is 2.2.0-2+deb9u3

It's pretty confusing, but 2.2.0-2+deb9u3 is not a fixed version, just the latest version. The problem seems that OVAL doesn't have expat here.
https://github.com/aquasecurity/vuln-list/blob/master/oval/debian/stretch/2019/CVE-2019-15903.json

@rahul2393 Could you look into it?

[knqyf263]

Ah, but in this case, the latest version and the fixed version might be the same.
https://security-tracker.debian.org/tracker/DSA-4530-1

But anyway, it is possible OVAL doesn't include the vulnerability.