Leading zeros seen as difference in version numbers

[FlorianPfaff]

Thanks for the nice tool. I am encountering an issue and am not 100 % sure if this is intended behavior or not. If this is intended behavior, it should be handled differently elsewhere.

What happened:
I got the report
❌ Linted [REPOSITORY] files with [grype]: Found 1 error(s) - (11.02s) (expand for details)

• Using [grype v0.63.1] https://megalinter.io/7.3.0/descriptors/repository_grype
• MegaLinter key: [REPOSITORY_GRYPE]
• Rules config: [.grype.yaml]
  --Error detail:
  NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
  certifi 2023.7.22 2023.07.22 python GHSA-xqr8-7jwr-rhp7 High
  1 error occurred:
  • discovered vulnerabilities at or above the severity threshold

What you expected to happen:
No error because it is the version in which it is already fixed.

How to reproduce it (as minimally and precisely as possible):
Have
certifi==2023.7.22 ; python_version >= "3.10" and python_version < "3.13"
in the requirements.txt, install it and run grype.

Anything else we need to know?:
This may be intended behavior - I am not sure. In this case, whatever is used to check the version should properly output it in the format required for grype.

Environment:

• Output of grype version:
  v0.63.1
• OS (e.g: cat /etc/os-release or similar):
  MegaLinter image based on alpine linux.
• Image Creation Date: 2023-08-09T22:49:15Z
• Image Revision: fda6ac3a38be0e969820709ac16e442464e5a035
• Image Version: v7.3.0

[kzantow]

Looking at GHSA-xqr8-7jwr-rhp7, you'll see that it does, in fact have the 07 in the fixed-in version: 2023.07.22. I'm not entirely sure what the correct format is, but I think this is something Grype should be able to handle when doing version comparisons, at least for Python packages.

[crimsonknave]

I've submitted and update to the advisory db which has been merged and the advisory how has 2023.7.22 as the patched version.

But, as noted in the PR, tooling should handle this case correctly as it's stated as a valid format in PEP440: https://peps.python.org/pep-0440/#integer-normalization. I'm sure it won't be the last time the version has a leading 0 in it.