False positive: CVE-2022-36087 not affected in SLES 15 SP4, SP5

[sekveaja]

IDs

CVE-2022-36087

Description

1. Scan container image with SLES 15 SP4 as based OS and reported this CVE-2022-36087 vulnerability:

│ oauthlib (METADATA) │ CVE-2022-36087 │ MEDIUM │ 3.2.1 │ 3.2.2 │ DoS when attacker provides malicious IPV6 URI

2. Other useful info:

   "Target": "Python",
   "Class": "lang-pkgs",
   "Type": "python-pkg",
   "Vulnerabilities": [
   {
   "VulnerabilityID": "CVE-2022-36087",
   "PkgName": "oauthlib",
   "PkgPath": "usr/lib/python3.6/site-packages/oauthlib-3.2.1.dist-info/METADATA",
   "InstalledVersion": "3.2.1",
   "FixedVersion": "3.2.2",
   "Layer": {
   "DiffID": "sha256:4403074b6398a230c663b1080b82845ce3cc862b73881ed2dec1d1097e9099dd"
   },
   "SeveritySource": "ghsa",
   "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-36087",
   "DataSource": {
   "ID": "ghsa",
   "Name": "GitHub Security Advisory pip",
   "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
   },

3. On SUSE page https://www.suse.com/security/cve/CVE-2022-36087.html
   It is confirmed, that is not affected:

SUSE Linux Enterprise Server 15 SP4 | python-oauthlib | Not affected

SUSE Linux Enterprise Server 15 SP5 | python-oauthlib | Not affected

Reproduction Steps

1.  Have python-oauthlib 3.2.1 installed in the SUSE OS eco-system.
...

Target

Container Image

Scanner

Vulnerability

Target OS

SLES 15.4

Debug Output

:
2023-11-24T21:04:07.309+0100    INFO    Detected OS: suse linux enterprise server
2023-11-24T21:04:07.309+0100    INFO    Detecting SUSE vulnerabilities...
2023-11-24T21:04:07.309+0100    DEBUG   SUSE: os version: 15.4
2023-11-24T21:04:07.309+0100    DEBUG   SUSE: the number of packages: 153
2023-11-24T21:04:07.311+0100    INFO    Number of language-specific files: 3
2023-11-24T21:04:07.311+0100    INFO    Detecting gobinary vulnerabilities...
2023-11-24T21:04:07.311+0100    DEBUG   Detecting library vulnerabilities, type: gobinary, path: bin/_mc
2023-11-24T21:04:07.313+0100    DEBUG   Detecting library vulnerabilities, type: gobinary, path: bin/eosc
2023-11-24T21:04:07.313+0100    INFO    Detecting python-pkg vulnerabilities...
2023-11-24T21:04:07.313+0100    DEBUG   Detecting library vulnerabilities, type: python-pkg, path:

<---Custom Image>  (suse linux enterprise server 15.4)
:
┌────────────────────┬─────────────────────┬──────────┬────────┬──────────────────────────────┬─────────────────────────────┬────────────────────────────────────────┐

│       Library       │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version  │                           Title                            │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼────────────────────────────────────────────────────────────┤
│ oauthlib (METADATA) │ CVE-2022-36087 │ MEDIUM   │ fixed  │ 3.2.1             │ 3.2.2          │ DoS when attacker provides malicious IPV6 URI              │
│                     │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2022-36087                 │
├─────────────────────┼────────────────┤          │

Version

]$ trivy --version
Version: 0.47.0

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[DmitriyLewen]

Hello @sekveaja
Thanks for your report!

Perhaps you have the same case #4067 (comment)?

Take a look, please.