Trivy: How the fixed_version attribute works? CVE-2019-20367

[angelbarrera92]

Hi team!

I am trying to understand how the fixed_version works.

In my use case, I want to patch a CVE (CVE-2019-20367) in the upstream python:3.8.6-buster image.

If you run:

$ docker pull python:3.8.6-buster
$ docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v $HOME/Library/Caches:/root/.cache/ aquasec/trivy i --timeout=5m --severity="CRITICAL" --format json python:3.8.6-buster
[
  {
    "Target": "python:3.8.6-buster (debian 10.6)",
    "Type": "debian",
    "Vulnerabilities": [
      {
        "VulnerabilityID": "CVE-2019-20367",
        "PkgName": "libbsd0",
        "InstalledVersion": "0.9.1-2",
        "Layer": {
          "DiffID": "sha256:f49d20b92dc8af0dd805860e55a56dc74ef524cc069f286ceeb00d51fd9d07e3"
        },
        "SeveritySource": "nvd",
        "Description": "nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "V2Score": 6.4,
            "V3Score": 9.1
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00043.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20367",
          "https://gitlab.freedesktop.org/libbsd/libbsd/commit/9d917aad37778a9f4a96ba358415f077f3f36f3b",
          "https://lists.freedesktop.org/archives/libbsd/2019-August/000229.html",
          "https://usn.ubuntu.com/4243-1/",
          "https://usn.ubuntu.com/usn/usn-4243-1"
        ],
        "PublishedDate": "2020-01-08T17:15:00Z",
        "LastModifiedDate": "2020-05-23T00:15:00Z"
      }
    ]
  }
]

Ok, based on the information available here: https://security-tracker.debian.org/tracker/CVE-2019-20367 and in the json api: https://security-tracker.debian.org/tracker/data/json

It is resolved in the sid release version using the: libbsd0=0.10.0-1 package version.

So... what if I add the sid repository to the buster container image? Then build an scan the following Dockerfile (after building it):

FROM docker.io/library/python:3.8.6-buster

RUN echo "deb http://deb.debian.org/debian testing non-free contrib main" >> /etc/apt/sources.list \
    && echo "deb http://deb.debian.org/debian unstable non-free contrib main" >> /etc/apt/sources.list \
    && apt-get update \
    && apt-get install --yes --no-install-recommends \
    libbsd0=0.10.0-1

$ docker build -f Dockerfile -t python:3.8.6-buster-local .
$ docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v $HOME/Library/Caches:/root/.cache/ aquasec/trivy i --timeout=5m --severity="CRITICAL" --format json python:3.8.6-buster-local
[
  {
    "Target": "python:3.8.6-buster-local (debian 10.6)",
    "Type": "debian",
    "Vulnerabilities": [
      {
        "VulnerabilityID": "CVE-2019-20367",
        "PkgName": "libbsd0",
        "InstalledVersion": "0.10.0-1",
        "Layer": {
          "DiffID": "sha256:985f7521efb9feb8a5f055aaa9bfb309d828bb55b8e994dbea00318a42852e55"
        },
        "SeveritySource": "nvd",
        "Description": "nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "V2Score": 6.4,
            "V3Score": 9.1
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00043.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20367",
          "https://gitlab.freedesktop.org/libbsd/libbsd/commit/9d917aad37778a9f4a96ba358415f077f3f36f3b",
          "https://lists.freedesktop.org/archives/libbsd/2019-August/000229.html",
          "https://usn.ubuntu.com/4243-1/",
          "https://usn.ubuntu.com/usn/usn-4243-1"
        ],
        "PublishedDate": "2020-01-08T17:15:00Z",
        "LastModifiedDate": "2020-05-23T00:15:00Z"
      }
    ]
  }
]

Trivy detects the new package version: InstalledVersion but the CVE shouldn't appear. Isn't it?

What am I assuming wrong?

[simar7]

hi @angelbarrera92 - thanks for the detailed feedback. I'm able to reproduce this as well. We're looking into it and will get back to you.

[knqyf263]

Almost the same issue as https://github.com/aquasecurity/trivy/issues/649

The root cause is that Trivy doesn't check from where a package was downloaded. Trivy implicitly assumes it was downloaded from an official repository corresponding to the OS version. For example, if an image is based on debian:stretch, it is assumed that all packages are downloaded from the stretch repository. But they can be downloaded from other repositories like remi repository. It provides php packages and the problem is the package name is the same as the official one.

Let's say php and Debian buster,

• The official repository of Debian buster provides php package with v7.1.0
  
  
  
  • A vulnerability CVE-2020-XXXX was found for v7.1.0 and buster repository provided the patch at v7.1.1.
  
  
  • So, it looks like version < v7.1.1 is vulnerable to this vulnerability.
  
  
• The foo repository provides php​​​​​​​ with v5.1.0
  
  
  
  • CVE-2020-XXXX affects v5.1.0 as well.
  
  
  • So, the foo maintainer provided the patch at v5.1.1
  
  
  • It means v5.1.1 is not vulnerable to CVE-2020-XXXX
  
  
• The problem is Trivy assumes php​​​​​​​ was downloaded from the buster repository.
  
  
  
  • The official advisory mentions the version less than v7.1.1 is vulnerable
  
  
  • Trivy compares v5.1.1 and v7.1.1, then it'd think v5.1.1 is vulnerable, even though v5.1.1 is the patched version.
  
  
• sid​​​​​​​ is the same situation
  
  
  
  • If the package was downloaded from sid repository, we must not use the security advisories of buster. We have to use advisories for sid.
  
  
  • As for CVE-2019-20367, buster has not provided the patch yet, so any version is vulnerable.
    
    
    
    
    
    • https://security-tracker.debian.org/tracker/CVE-2019-20367
    
    
    
  
  
  • So, Trivy thinks it is still vulnerable, even if libbsd was downloaded from sid​​​​​​​ repository.
  
  

Now, we're planning to retrieve the repository from which the package was installed.

[angelbarrera92]

@knqyf263 Thanks for the awesome description of the behaviour of trivy.

Looking forward to seeing how you manage to gather the origin of a Debian package :). Then modify it to use the right security advisor (sid, buster...).

Sounds interesting!