feat: filter out packages owned by OS packages #1387

willmurphyscode · 2023-07-13T21:33:06Z

For example, if the rpm "python3-rpm" is installed, it brings a python package called "rpm" with it, which is just python bindings to RPM. But this python package is part of "python3-rpm", and should not be matched against directly.

Fixes #1373
#1362 won't be fixed anymore because of the comprehensive distro check.

grype/pkg/package.go

willmurphyscode · 2023-07-22T10:46:51Z

The quality gate is failing in an interesting way. Let's take this example:

Quality gate failure snippet:

Testing image: docker.io/sonatype/nexus3@sha256:e8fea6b4279f2b5b24b36170459cb7aa3d6afe999f9d3e3713541be28bae8ec4
with syft@v0.74.1
with grype@65d27af2d161adce9e8c9cb972fc0e50aff6040f
with grype@latest

Running relative comparison...
Results used:
├── a10b0d0a-8944-4747-84c5-f83641583d65 : grype@v0.64.2-7-g65d27af against docker.io/sonatype/nexus3@sha256:e8fea6b4279f2b5b24b36170459cb7aa3d6afe999f9d3e3713541be28bae8ec4
└── 4142c1de-9334-476a-b077-804344861558 : grype@v0.64.2 against docker.io/sonatype/nexus3@sha256:e8fea6b4279f2b5b24b36170459cb7aa3d6afe999f9d3e3713541be28bae8ec4

Running comparison against labels...
Results used:
├── a10b0d0a-8944-4747-84c5-f83641583d65 : grype@v0.64.2-7-g65d27af against docker.io/sonatype/nexus3@sha256:e8fea6b4279f2b5b24b36170459cb7aa3d6afe999f9d3e3713541be28bae8ec4
└── 4142c1de-9334-476a-b077-804344861558 : grype@v0.64.2 against docker.io/sonatype/nexus3@sha256:e8fea6b4279f2b5b24b36170459cb7aa3d6afe999f9d3e3713541be28bae8ec4

Match differences between tooling (with labels):

   TOOL PARTITION      PACKAGE         VULNERABILITY        LABEL         COMMENTARY
   grype@v0.64.2 ONLY  rpm@4.14.3      CVE-2021-20266       TruePositive  (this is a new FN 😱)
   grype@v0.64.2 ONLY  rpm@4.14.3      CVE-2021-3421        TruePositive  (this is a new FN 😱)
   grype@v0.64.2 ONLY  rpm@4.14.3      CVE-2021-3521        TruePositive  (this is a new FN 😱)
   grype@v0.64.2 ONLY  rpm@4.14.3      CVE-2021-35937       TruePositive  (this is a new FN 😱)
   grype@v0.64.2 ONLY  rpm@4.14.3      CVE-2021-35938       TruePositive  (this is a new FN 😱)
   grype@v0.64.2 ONLY  rpm@4.14.3      CVE-2021-35939       TruePositive  (this is a new FN 😱)
   grype@v0.64.2 ONLY  urllib3@1.24.2  CVE-2019-11236       TruePositive  (this is a new FN 😱)
   grype@v0.64.2 ONLY  urllib3@1.24.2  CVE-2020-26137       TruePositive  (this is a new FN 😱)
   grype@v0.64.2 ONLY  urllib3@1.24.2  CVE-2021-33503       TruePositive  (this is a new FN 😱)
   grype@v0.64.2 ONLY  urllib3@1.24.2  GHSA-r64q-w8jr-g9qp  TruePositive  (this is a new FN 😱)
   grype@v0.64.2 ONLY  urllib3@1.24.2  GHSA-wqvq-5m8c-6g24  TruePositive  (this is a new FN 😱)

But the code still finds these vulnerabilites. Let's take 2 examples:

❯ grype -q willtmp/sonatype-nexus.tar| rg CVE-2021-3421
python3-rpm                             4.14.3-4.el8             0:4.14.3-14.el8_4        rpm           CVE-2021-3421        Medium    
rpm                                     4.14.3                                            python        CVE-2021-3421        Medium    
rpm                                     4.14.3-4.el8             0:4.14.3-14.el8_4        rpm           CVE-2021-3421        Medium    
rpm-build-libs                          4.14.3-4.el8             0:4.14.3-14.el8_4        rpm           CVE-2021-3421        Medium    
rpm-libs                                4.14.3-4.el8             0:4.14.3-14.el8_4        rpm           CVE-2021-3421        Medium    

❯ go run cmd/grype/main.go -q willtmp/sonatype-nexus.tar| rg CVE-2021-3421
python3-rpm                             4.14.3-4.el8             0:4.14.3-14.el8_4        rpm           CVE-2021-3421        Medium    
rpm                                     4.14.3-4.el8             0:4.14.3-14.el8_4        rpm           CVE-2021-3421        Medium    
rpm-build-libs                          4.14.3-4.el8             0:4.14.3-14.el8_4        rpm           CVE-2021-3421        Medium    
rpm-libs                                4.14.3-4.el8             0:4.14.3-14.el8_4        rpm           CVE-2021-3421        Medium    

❯ grype -q willtmp/sonatype-nexus.tar| rg CVE-2021-3521                   
python3-rpm                             4.14.3-4.el8             0:4.14.3-19.el8_5.2      rpm           CVE-2021-3521        Medium    
rpm                                     4.14.3                                            python        CVE-2021-3521        Medium    
rpm                                     4.14.3-4.el8             0:4.14.3-19.el8_5.2      rpm           CVE-2021-3521        Medium    
rpm-build-libs                          4.14.3-4.el8             0:4.14.3-19.el8_5.2      rpm           CVE-2021-3521        Medium    
rpm-libs                                4.14.3-4.el8             0:4.14.3-19.el8_5.2      rpm           CVE-2021-3521        Medium    

❯ go run cmd/grype/main.go -q willtmp/sonatype-nexus.tar| rg CVE-2021-3521
python3-rpm                             4.14.3-4.el8             0:4.14.3-19.el8_5.2      rpm           CVE-2021-3521        Medium    
rpm                                     4.14.3-4.el8             0:4.14.3-19.el8_5.2      rpm           CVE-2021-3521        Medium    
rpm-build-libs                          4.14.3-4.el8             0:4.14.3-19.el8_5.2      rpm           CVE-2021-3521        Medium    
rpm-libs                                4.14.3-4.el8             0:4.14.3-19.el8_5.2      rpm           CVE-2021-3521        Medium

The image is vulnerability, and both the latest release of grype and this feature branch report the image as vulnerable. But this feature branch (correctly, I think) reports 1 fewer affected packages, because the python package rpm is merged into the RPM python3-rpm before matching. So the matches need to be updated, not because the feature branch no longer reports the vulnerability, but because it now reports the vulnerability for 1 fewer package, at least for the nvd:cpe ones.

willmurphyscode · 2023-07-22T11:07:07Z

Let's look at the GHSAs, since this branch no longer finds them. First up is GHSA-r64q-w8jr-g9qp:

❯ go run cmd/grype/main.go -q willtmp/sonatype-nexus.tar| rg GHSA-r64q-w8jr-g9qp # prints nothing
❯ grype -q willtmp/sonatype-nexus.tar| rg GHSA-r64q-w8jr-g9qp                   
urllib3                                 1.24.2                   1.24.3                   python        GHSA-r64q-w8jr-g9qp  Medium

sqlite> select id, package_name, namespace, package_qualifiers, version_constraint 
from vulnerability where 
(id like 'CVE-2019-11236' and (namespace like 'nvd:cpe' or namespace like 'redhat:distro:redhat:8'))
or id like 'GHSA-r64q-w8jr-g9qp';
id                   package_name    namespace               package_qualifiers  version_constraint
-----------------    --------------  ----------------------  ------------------  ------------------
CVE-2019-11236       urllib3         nvd:cpe                                     <= 1.24.2         
GHSA-r64q-w8jr-g9qp  urllib3         github:language:python                      <=1.24.2          
CVE-2019-11236       python-urllib3  redhat:distro:redhat:8                      < 0:1.24.2-2.el8  
CVE-2019-11236       python-pip      redhat:distro:redhat:8                      < 0:9.0.3-16.el8

So let's take a look at the syft packages that are here:

❯ syft packages -q ../grype1373/willtmp/sonatype-nexus.tar| rg urllib3
python3-urllib3                                    1.24.2-4.el8                      rpm
urllib3                                            1.24.2                            python

So here the rpm python-urllib3@1.24.2-4.el8 is fixed, so this was a false positive introduced by the duplication
of treating the rpm python-urllib3 as if it were also urllib3 from PyPI. In other words, RedHat patched their
RPM, and our database knew it, but was reporting a false positive because this package was treated as if it was from
the RedHat RPM and from PyPI.

willmurphyscode · 2023-07-22T11:13:22Z

Looking at the other GHSA, GHSA-wqvq-5m8c-6g24:

sqlite> select id, package_name, namespace, package_qualifiers, version_constraint 
from vulnerability where 
(id like 'CVE-2020-26137' and (namespace like 'nvd:cpe' or namespace like 'redhat:distro:redhat:8'))
or id like 'GHSA-wqvq-5m8c-6g24';
id                   package_name                                                  namespace               package_qualifiers  version_constraint
-------------------  ------------------------------------------------------------  ----------------------  ------------------  ------------------
CVE-2020-26137       communications_cloud_native_core_network_function_cloud_nati  nvd:cpe                                     = 22.2.0          
                  ve_environment                                                                                                              

CVE-2020-26137       zfs_storage_appliance_kit                                     nvd:cpe                                     = 8.8             

CVE-2020-26137       urllib3                                                       nvd:cpe                                     < 1.25.9          

GHSA-wqvq-5m8c-6g24  urllib3                                                       github:language:python                      <1.25.9           

CVE-2020-26137       python-urllib3                                                redhat:distro:redhat:8                      < 0:1.24.2-5.el8

Again, the RPM has an earlier fix version than the PyPI record, so this finding was always a false positive for the same reason as described in the previous comment.

test/quality/update-scripts/grype1373.py

spiffcs

This is great work @willmurphyscode - the persistence in getting the vulnerability labels updated and following through on different examples made for an easy review. I made some nit comments for discussion.

cc @wagoodman for a second 👀

grype/pkg/package.go

spiffcs · 2023-08-16T21:25:45Z

grype/pkg/syft_provider.go


-	catalog = removePackagesByOverlap(catalog, relationships)
+	catalog = removePackagesByOverlap(s)


nit: what do you think of the return type here? we are passing in an sbom s only for sbom to be remade with the modified catalog on line 47 down below - what do you think about removePackagesByOerlap as a method on s?

Thanks for catching this. I didn't notice that we were re-assembling another SBOM struct below. I'll see if this can be easily rearranged.

kzantow

LGTM -- minor comment, which is mostly a preferential thing

kzantow · 2023-08-16T21:25:29Z

grype/pkg/package.go

 		if r.Type == artifact.OwnershipByFileOverlapRelationship {
 			byOverlap[r.To.ID()] = r
 		}
 	}

 	out := pkg.NewCollection()
-
+	comprehensiveDistroFeed := distroFeedIsComprehensive(sbm.Artifacts.LinuxDistribution)


It seems a little odd to add this call here rather than, say, passing the sbom to excludePackages on line 121

the nice thing about calling it here though is that excludePackage is minimizing what it needs as inputs.

Alex should probably give the final review of this one

grype/pkg/package_test.go

For example, if the rpm "python3-rpm" is installed, it brings a python package called "rpm" with it, which is just python bindings to RPM. But this python package is part of "python3-rpm", and should not be matched against directly. Signed-off-by: Will Murphy <will.murphy@anchore.com>

Signed-off-by: Will Murphy <will.murphy@anchore.com>

These matches are excluded by the new behavior, but the SBOM format used in these tests doesn't preserve enough information about the match. Signed-off-by: Will Murphy <will.murphy@anchore.com>

Signed-off-by: Will Murphy <will.murphy@anchore.com>

From the list of packages that are considered OS packages. The reason is that the APK data feed includes fix info, but not underlying metadata info, so we shouldn't prefer APK packages to ecosystem specific packages the way we do for RPMs, for example. Signed-off-by: Will Murphy <will.murphy@anchore.com>

Signed-off-by: Will Murphy <will.murphy@anchore.com>

Make it easier to investigate quality gate failures by printing yardstick scan result IDs with each failure reason. Signed-off-by: Will Murphy <will.murphy@anchore.com>

Signed-off-by: Will Murphy <will.murphy@anchore.com>

wagoodman

nice work 🙌

willmurphyscode commented Jul 13, 2023

View reviewed changes

grype/pkg/package.go Outdated Show resolved Hide resolved

willmurphyscode self-assigned this Jul 13, 2023

willmurphyscode changed the title ~~Filter out packages owned by OS packages~~ feat: filter out packages owned by OS packages Jul 20, 2023

willmurphyscode force-pushed the feat-grype1373 branch from 32a96ce to 673670e Compare July 20, 2023 14:49

willmurphyscode mentioned this pull request Jul 22, 2023

Filter out packages that are owned by OS packages (ownership overlap) #1373

Closed

willmurphyscode force-pushed the feat-grype1373 branch 3 times, most recently from 04df898 to 84deda4 Compare August 4, 2023 20:51

willmurphyscode commented Aug 15, 2023

View reviewed changes

test/quality/update-scripts/grype1373.py Outdated Show resolved Hide resolved

willmurphyscode force-pushed the feat-grype1373 branch 2 times, most recently from 3cfc36b to e558222 Compare August 16, 2023 20:33

spiffcs reviewed Aug 16, 2023

View reviewed changes

kzantow previously approved these changes Aug 16, 2023

View reviewed changes

wagoodman reviewed Aug 17, 2023

View reviewed changes

grype/pkg/package_test.go Show resolved Hide resolved

willmurphyscode added 12 commits August 18, 2023 13:50

Fetch relationships during sbom tests

42a5f06

Signed-off-by: Will Murphy <will.murphy@anchore.com>

Make exceptions for some matches

e5ad2ed

These matches are excluded by the new behavior, but the SBOM format used in these tests doesn't preserve enough information about the match. Signed-off-by: Will Murphy <will.murphy@anchore.com>

Explain exceptions to integ test

78a67cf

Signed-off-by: Will Murphy <will.murphy@anchore.com>

Explain APK omission

3aac125

Signed-off-by: Will Murphy <will.murphy@anchore.com>

Move special case

77d963a

Signed-off-by: Will Murphy <will.murphy@anchore.com>

fix stray comments

aaa0cd4

Signed-off-by: Will Murphy <will.murphy@anchore.com>

WIP - start script to update yardstick labels

735e0ce

Signed-off-by: Will Murphy <will.murphy@anchore.com>

WIP - close to update script

d200732

Signed-off-by: Will Murphy <will.murphy@anchore.com>

Quality gate prints IDs for compare

bb0fe4d

Make it easier to investigate quality gate failures by printing yardstick scan result IDs with each failure reason. Signed-off-by: Will Murphy <will.murphy@anchore.com>

WIP

b109444

Signed-off-by: Will Murphy <will.murphy@anchore.com>

willmurphyscode added 12 commits August 18, 2023 13:51

refactor to take whole SBOM

359ae86

Signed-off-by: Will Murphy <will.murphy@anchore.com>

check distro before removing by overlap

3657929

Signed-off-by: Will Murphy <will.murphy@anchore.com>

Stop treating alinux as rhel clone

75bd4b8

Signed-off-by: Will Murphy <will.murphy@anchore.com>

remove unused update script

3fdbc13

Signed-off-by: Will Murphy <will.murphy@anchore.com>

linter rename

19094b7

Signed-off-by: Will Murphy <will.murphy@anchore.com>

remove gate changes

72f5ac5

Signed-off-by: Will Murphy <will.murphy@anchore.com>

fix comment

56df7c8

Signed-off-by: Will Murphy <will.murphy@anchore.com>

fix gate file

8e240f5

Signed-off-by: Will Murphy <will.murphy@anchore.com>

fix comment again

3ca436a

Signed-off-by: Will Murphy <will.murphy@anchore.com>

additional test cases

74e6851

Signed-off-by: Will Murphy <will.murphy@anchore.com>

WIP - confusing test cases

caa6941

Signed-off-by: Will Murphy <will.murphy@anchore.com>

touch up comments after rebase

4ce2f82

Signed-off-by: Will Murphy <will.murphy@anchore.com>

willmurphyscode force-pushed the feat-grype1373 branch from 23a982f to 4ce2f82 Compare August 18, 2023 17:55

wagoodman approved these changes Aug 18, 2023

View reviewed changes

willmurphyscode merged commit 7ff37a0 into main Aug 18, 2023

willmurphyscode deleted the feat-grype1373 branch August 18, 2023 19:43

p-linnane mentioned this pull request Aug 31, 2023

grype 0.66.0 Homebrew/homebrew-core#141029

Merged

dependabot bot mentioned this pull request Sep 1, 2023

Bump github.com/anchore/grype from 0.65.2 to 0.66.0 anchore/grype-db#153

Merged

willmurphyscode mentioned this pull request Sep 11, 2023

Vulnerabilities marked as fixed in distro packages should be reported as fixed for all contained packages too #1236

Closed

luhring mentioned this pull request Nov 15, 2023

fix: distro FP data not applied correctly #1603

Merged

tgerla mentioned this pull request Dec 8, 2023

Grype doesn't take account OS distributor patch release #1541

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: filter out packages owned by OS packages #1387

feat: filter out packages owned by OS packages #1387

willmurphyscode commented Jul 13, 2023 •

edited

Loading

willmurphyscode commented Jul 22, 2023

willmurphyscode commented Jul 22, 2023

willmurphyscode commented Jul 22, 2023

spiffcs left a comment

spiffcs Aug 16, 2023 •

edited

Loading

willmurphyscode Aug 17, 2023

kzantow left a comment

kzantow Aug 16, 2023

wagoodman Aug 17, 2023

wagoodman left a comment


		catalog = removePackagesByOverlap(catalog, relationships)
		catalog = removePackagesByOverlap(s)

feat: filter out packages owned by OS packages #1387

feat: filter out packages owned by OS packages #1387

Conversation

willmurphyscode commented Jul 13, 2023 • edited Loading

willmurphyscode commented Jul 22, 2023

Quality gate failure snippet:

willmurphyscode commented Jul 22, 2023

willmurphyscode commented Jul 22, 2023

spiffcs left a comment

Choose a reason for hiding this comment

spiffcs Aug 16, 2023 • edited Loading

Choose a reason for hiding this comment

willmurphyscode Aug 17, 2023

Choose a reason for hiding this comment

kzantow left a comment

Choose a reason for hiding this comment

kzantow Aug 16, 2023

Choose a reason for hiding this comment

wagoodman Aug 17, 2023

Choose a reason for hiding this comment

wagoodman left a comment

Choose a reason for hiding this comment

willmurphyscode commented Jul 13, 2023 •

edited

Loading

spiffcs Aug 16, 2023 •

edited

Loading