PHP pecl redis mixes with redis project itself and creates false positive cve

[shyim]

What happened:

Scanning a PHP docker image with Redis PHP extension shows s a lot of vulnerabilities.

redis                         6.0.2                 php-pecl   CVE-2022-24834       High
redis                         6.0.2                 php-pecl   CVE-2022-24735       High
redis                         6.0.2                 php-pecl   CVE-2021-41099       High
redis                         6.0.2                 php-pecl   CVE-2021-32762       High
redis                         6.0.2                 php-pecl   CVE-2021-32687       High
redis                         6.0.2                 php-pecl   CVE-2021-32675       High
redis                         6.0.2                 php-pecl   CVE-2021-32628       High
redis                         6.0.2                 php-pecl   CVE-2021-32627       High
redis                         6.0.2                 php-pecl   CVE-2021-32626       High
redis                         6.0.2                 php-pecl   CVE-2023-28856       Medium
redis                         6.0.2                 php-pecl   CVE-2023-25155       Medium
redis                         6.0.2                 php-pecl   CVE-2022-36021       Medium
redis                         6.0.2                 php-pecl   CVE-2022-35977       Medium
redis                         6.0.2                 php-pecl   CVE-2022-24736       Medium
redis                         6.0.2                 php-pecl   CVE-2021-32672       Medium
redis                         6.0.2                 php-pecl   CVE-2021-31294       Medium
redis                         6.0.2                 php-pecl   CVE-2023-45145       Low
redis                         6.0.2                 php-pecl   CVE-2022-3647        Low

these CVE are associated with the redis-server, not the PHP extension.

I have no idea if this is a problem of Grype, the vulnerability database 🤔

What you expected to happen:

Don't show these records

How to reproduce it (as minimally and precisely as possible):

grype shopware/docker-base:8.3

Anything else we need to know?:

Environment:

• Output of grype version:

Application:         grype
Version:             0.75.0
BuildDate:           2024-04-04T16:02:59Z
GitCommit:           57af1c34cb7db17824eac983cc6ae6945db47c88
GitDescription:      v0.75.0
Platform:            linux/amd64
GoVersion:           go1.21.8
Compiler:            gc
Syft Version:        v1.1.1
Supported DB Schema: 5

• OS (e.g: cat /etc/os-release or similar):