Interpretation of Fixed_Version

[DontWanna1]

Hi I am exploring the scan reports and try to understand if I should be alarmed.

Base-image: python3.9-slim
Offending CVE:

Package	Vulnerability ID	Severity	Installed Version	Fixed Version
binutils	CVE-2021-37322	CRITICAL	2.35.2-2

The Link (https://avd.aquasec.com/nvd/cve-2021-37322/) directs to the Affected Software, where it states:

Name	Vendor	Start Version	End Version
Binutils	Gnu	2.26	2.26

Now, do I have a critical CVE on hand or can I ignore it safely, since it is fixed since version 2.26?
Should "Fixed Version" state 2.26?

Best Regards

[afdesk]

Hi @DontWanna1!
thanks for your report!
I'll try to reproduce and resolve this issue.

[afdesk]

@DontWanna1 which version of trivy do you use?

$ trivy --version

I tried to scan this image (python:3.9-slim), and don't see CVE-2021-37322. The result is here.
my steps were:

$ docker pull python:3.9-slim
$ trivy image python:3.9-slim

python:3.9-slim (debian 11.1)
=============================
Total: 66 (UNKNOWN: 0, LOW: 61, MEDIUM: 1, HIGH: 2, CRITICAL: 2)
....

I use trivy version 0.21.2.

[DontWanna1]

Version: 0.19.1
That would be most welcome.
I will explore this.
Thank you.

[afdesk]

Hi @DontWanna1 did update trivy help you?

[DontWanna1]

Hi,

yes it did.
The fundamental problem (ignorance) remains:
How to interpret "Fixed_Version" and "End Version".

Another issue: https://avd.aquasec.com/nvd/cve-2021-33026/

Does "End version" indicate the last version with the CVE?
Any later version should be fine then?

Another example: https://avd.aquasec.com/nvd/cve-2021-33574/
"End Version" is 2.33.
Is 2.34 safe? Or not yet tested?

Thank you for your support
Best regards.

[afdesk]

yes it did.
The fundamental problem (ignorance) remains:

Did you clean cache before scanning?

$ trivy image --clear-cache

How to interpret "Fixed_Version" and "End Version".
Another issue: https://avd.aquasec.com/nvd/cve-2021-33026/
Does "End version" indicate the last version with the CVE?

Yes, you're right. If we take a look at nvd.nist.gov/vuln/detail/CVE-2021-33026, we can see:

Up to (including)
1.10.1

[DontWanna1]

yes it did.
The fundamental problem (ignorance) remains:

Did you clean cache before scanning?

Yes, by default (Git-Job).

Thank you.

[afdesk]

@DontWanna1 You're scanning python:3.9-slim image, right?

[DontWanna1]

@DontWanna1 You're scanning python:3.9-slim image, right?

I did, yes. I have switched to python:3.10-slim, by now. Both are debian11, I think

[afdesk]

@DontWanna1 I've run trivy -d image python:3.10-slim and my output is here.
Do you have the same results?