False Positive: CVE-2021-22696 Apache Cxf-Xjc-Runtime vs Apache Cxf

[sekveaja]

What happened:
Using Apache cxf-xfc-runtime version 3.3.1
"package_cpe23": "cpe:2.3:a:apache:cxf-xjc-runtime:3.3.1:::::::*",
"package_path": "/opt/jboss/keycloak/modules/system/layers/base/org/apache/cxf/impl/main/cxf-xjc-runtime-3.3.1.jar",

Reported: CVE-2021-22696 on NVD
"criteria": "cpe:2.3:a:apache:cxf::::::::"

Grype reports vulnerability CVE-2021-22696 related to Apache CXF.
Apache CXF and Apache CXF XFC Runtime are different application.
Therefore, it is a false positive.

What you expected to happen:

Should not reported apache:cxf-xjc-runtime to apache:cxf.

Environment:

• Output of grype version: 0.61.1
• OS (e.g: cat /etc/os-release or similar): SLES 15 SP4

[willmurphyscode]

Hi @sekveaja,

This was fixed by the switch from using CPE matching by default to using GHSA package ecosystem matching by default. It no longer reproduces:

echo "FROM alpine:latest

RUN wget 'https://repo1.maven.org/maven2/org/apache/cxf/xjc-utils/cxf-xjc-runtime/3.3.1/cxf-xjc-runtime-3.3.1.jar'
" > Dockerfile

docker build -t testimage .
grype -q testimage | grep java # prints nothing

However, if we turn CPE matching back on, we can see:

$ GRYPE_MATCH_JAVA_USING_CPES=true grype -q testimage | grep java
cxf-xjc-runtime  3.3.1                 java-archive  CVE-2022-46364  Critical
cxf-xjc-runtime  3.3.1                 java-archive  CVE-2019-12419  Critical
cxf-xjc-runtime  3.3.1                 java-archive  CVE-2022-46363  High
cxf-xjc-runtime  3.3.1                 java-archive  CVE-2021-30468  High
cxf-xjc-runtime  3.3.1                 java-archive  CVE-2021-22696  High
cxf-xjc-runtime  3.3.1                 java-archive  CVE-2019-12423  High
cxf-xjc-runtime  3.3.1                 java-archive  CVE-2020-1954   Medium
cxf-xjc-runtime  3.3.1                 java-archive  CVE-2020-13954  Medium
cxf-xjc-runtime  3.3.1                 java-archive  CVE-2019-17573  Medium
cxf-xjc-runtime  3.3.1                 java-archive  CVE-2019-12406  Medium
cxf-xjc-runtime  3.3.1                 java-archive  CVE-2024-28752  Unknown

I'm closing this as completed, since the false positive no longer occurs on default configuration grype. Please let me know if I've missed anything.

[sekveaja]

Thank you @willmurphyscode for the input.
From which version that Grype is using GHSA package ecosystem matching by default?

[spiffcs]

@sekveaja looks like it was this release:
https://github.com/anchore/grype/releases/tag/v0.71.0

This PR
#1412