Grype doesn't detect CVE-2021-43798

[awoodobvio]

What happened:
Attempted to scan both the Grafana 8.2.2 Enterprise and Grafana 8.2.2 OSS releases and neither flagged this CVE. Verified that the CVE was present by using the blog post about it.

What you expected to happen:
Grype was able to detect and report on this CVE from the docker image.

How to reproduce it (as minimally and precisely as possible):
mkdir ${PWD}/work
docker pull grafana/grafana-enterprise:8.2.2
docker save -o ${PWD}/work/grafana.tar grafana/grafana-enterprise:8.2.2
docker run --rm -v ${PWD}/work:/work anchore/grype /work/grafana.tar

Anything else we need to know?:
https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/
https://j0vsec.com/post/cve-2021-43798/

Environment:

• Output of grype version:
  Application: grype
  Version: 0.27.0
  Syft Version: v0.32.0
  BuildDate: 2021-12-08T22:17:50Z
  GitCommit: e621867
  GitTreeState: clean
  Platform: linux/amd64
  GoVersion: go1.16.10
  Compiler: gc
  Supported DB Schema: 3

• OS Windows 10 WSL 2 Environment on Ubuntu:
  lsb_release -a:

Distributor ID: Ubuntu
Description: Ubuntu 20.04.3 LTS
Release: 20.04
Codename: focal

[spiffcs]

Hey @awoodsprim I was able to recreate this locally with the information you provided.

I validated that CVE-2021-43798 is in the grype database so I'll start digging into why this is not surfacing a match.

Thanks for the report!

[spiffcs]

So digging into this a bit more I think I'm starting to understand the mismatch.

Here are the current CPE that match for the vulnerability in the vulnerability database:

Can fetch the DB from here:

https://toolbox-data.anchore.io/grype/databases/vulnerability-db_v3_2021-12-13T08:14:38Z.tar.gz

[
  "cpe:2.3:a:grafana:grafana:8.0.0:beta1:*:*:*:*:*:*",
  "cpe:2.3:a:grafana:grafana:8.0.0:beta2:*:*:*:*:*:*",
  "cpe:2.3:a:grafana:grafana:8.0.0:beta3:*:*:*:*:*:*",
  "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
  "cpe:2.3:a:grafana:grafana:8.3.0:*:*:*:*:*:*:*"
]

If you examine the sbom generated when scanning grafana/grafana-enterprise:8.2.2 you can see that there are 13 matches for the string cpe:2.3:a:grafana.

alertmanager
go-mssqldb
grafana-aws-sdk
grafana-plugin-sdk-go
loki

I'm trying to see if there is a misalignment between the cpe to match being under grafana:grafana vs things like grafana:grafana-server where they would be picked up.

[kzantow]

I think we just need a "binary" Grafana detector for this. Thanks for the report.