False Positive: CVE-2017-12621 commons-jelly 1.0.1

[sekveaja]

IDs

CVE-2017-12621

Description

Installed common-jelly is version 1.0.1.
Every accessible reference show issue is related to common-jelly < 1.0.1
https://avd.aquasec.com/nvd/cve-2017-12621
GHSA-6g33-82gc-3pw5
https://nvd.nist.gov/vuln/detail/CVE-2017-12621

See Trivy stripped logfile.

    {
      "VulnerabilityID": "CVE-2017-12621",
      "PkgName": "commons-jelly:commons-jelly",
      "PkgPath": "<----stripped_path---->/lib/commons-jelly-1.0.1.jar",
      "InstalledVersion": "1.0.1",
      "FixedVersion": "1.0.2",
      "Layer": {
        "DiffID": "sha256:be3d312ee18c9f22d59eb1ca84472e2cc89c69df89a34186a3936684475fd129"
      },
      "SeveritySource": "nvd",
      "PrimaryURL": https://avd.aquasec.com/nvd/cve-2017-12621,

The installed version: common-jelly-1.0.1 is not affected according to NVD.
However Trivy is reported as critical, and we believe it is a false positive.

Reproduction Steps

We can't share unfortunately the internal image.

Is there is a way to scan on the jar file reported by the tool?
In example:
https://repo1.maven.org/maven2/commons-jelly/commons-jelly/1.0.1/commons-jelly-1.0.1.jar

Target

Container Image

Scanner

Vulnerability

Target OS

SUSE Linux enterprise server 15.4

Debug Output

{
          "VulnerabilityID": "CVE-2017-12621",
          "PkgName": "commons-jelly:commons-jelly",
          "PkgPath": "<----- stripped_path ------>/lib/commons-jelly-1.0.1.jar",
          "InstalledVersion": "1.0.1",
          "FixedVersion": "1.0.2",
          "Layer": {
            "DiffID": "sha256:be3d312ee18c9f22d59eb1ca84472e2cc89c69df89a34186a3936684475fd129"
          },
          "SeveritySource": "nvd",
          "PrimaryURL": https://avd.aquasec.com/nvd/cve-2017-12621,
          "DataSource": {
            "ID": "glad",
            "Name": "GitLab Advisory Database Community",
            "URL": https://gitlab.com/gitlab-org/advisories-community
          },
          "Title": "commons-jelly: Apache Commons Jelly connects to URL with custom doctype definitions",
          "Description": "During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a \"SYSTEM\" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-611"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            }
          },
          "References": [
            http://www.securityfocus.com/bid/101052,
            http://www.securitytracker.com/id/1039444,
            https://access.redhat.com/security/cve/CVE-2017-12621,
            https://github.com/advisories/GHSA-6g33-82gc-3pw5,
            https://issues.apache.org/jira/browse/JELLY-293,
            https://lists.apache.org/thread.html/f1fc3f2c45264af44ce782d54b5908ac95f02bf7ad88bb57bfb04b73@%3Cdev.commons.apache.org%3E,
            https://nvd.nist.gov/vuln/detail/CVE-2017-12621,
            https://web.archive.org/web/20200227144849/http://www.securityfocus.com/bid/101052,
            https://web.archive.org/web/20210303081618/http://www.securitytracker.com/id/1039444,
            https://www.cve.org/CVERecord?id=CVE-2017-12621,
            https://www.securitytracker.com/id/1039444
          ],
          "PublishedDate": "2017-09-28T01:29:00Z",
          "LastModifiedDate": "2023-02-09T16:14:00Z"
        },

Version

]$ trivy --version
Version: 0.43.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-07-04 18:11:46.627495176 +0000 UTC
  NextUpdate: 2023-07-05 00:11:46.627494876 +0000 UTC
  DownloadedAt: 2023-07-04 19:03:23.920043982 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2023-07-04 01:08:01.820433584 +0000 UTC
  NextUpdate: 2023-07-07 01:08:01.820433284 +0000 UTC
  DownloadedAt: 2023-07-04 15:52:21.893064384 +0000 UTC

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[DmitriyLewen]

Hello @sekveaja !

Thanks for your report!
GitLab database has wrong fixed version.

I created #233.

Regards, Dmitriy

[knqyf263]

The fix was merged.
https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/merge_requests/24820