Skip to content

fix: CPE detection for APK libavif to use aomedia vendor#4597

Merged
westonsteimel merged 1 commit intoanchore:mainfrom
naag:fix-libavif-cpe-vendor
Feb 5, 2026
Merged

fix: CPE detection for APK libavif to use aomedia vendor#4597
westonsteimel merged 1 commit intoanchore:mainfrom
naag:fix-libavif-cpe-vendor

Conversation

@naag
Copy link
Contributor

@naag naag commented Feb 4, 2026 •
edited
Loading

Description

TLDR: This change adds libavif to the APK package CPE candidate additions with aomedia as an additional vendor, enabling Syft/Grype to match CVEs like CVE-2025-48174 and CVE-2025-48175 using CPEs.

NVD uses aomedia as the vendor for libavif CVEs, see for example https://nvd.nist.gov/vuln/detail/CVE-2025-48174:

cpe:2.3:a:aomedia:libavif:*:*:*:*:*:*:*:*

The CPE currently computed by Syft/Grype uses the vendor libavif, which causes a CPE mismatch:

[0003] TRACE searching for vulnerability matches package=pkg:apk/alpine/libavif@1.0.4-r0?arch=x86_64&distro=alpine-3.21.5
[0003] TRACE fetched package record distro=alpine@3.21.5 duration=176.125µs pkg=package(name=libavif) records=0 vulns=any
[0003] TRACE fetched package record distro=none duration=87.875µs pkg=package(cpe=cpe:2.3:a:libavif:libavif:1.0.4:*:*:*:*:*:*:*) records=0 vulns=any
[0003] TRACE fetched CPE record cpe=cpe:2.3:a:libavif:libavif:1.0.4:*:*:*:*:*:*:* duration=45.417µs records=0
[0003] TRACE fetched package record distro=alpine@3.21.5 duration=263.042µs pkg=package(name=libavif) records=0 vulns=any
[0003] TRACE fetched package record distro=alpine@3.21.5 duration=244µs pkg=package(name=libavif) records=0 vulns=any
[0003] TRACE fetched package record distro=alpine@3.21.5 duration=178.292µs pkg=package(name=libavif) records=0 vulns=any
[0003] TRACE fetched package record distro=none duration=106.25µs pkg=package(cpe=cpe:2.3:a:libavif:libavif:1.0.4:*:*:*:*:*:*:*) records=0 vulns=any
[0003] TRACE fetched CPE record cpe=cpe:2.3:a:libavif:libavif:1.0.4:*:*:*:*:*:*:* duration=51.458µs records=0
[0003] TRACE fetched package record distro=alpine@3.21.5 duration=174.167µs pkg=package(name=libavif) records=0 vulns=any
[0003] TRACE fetched package record distro=alpine@3.21.5 duration=133.375µs pkg=package(name=libavif) records=0 vulns=any
[0003] TRACE fetched package record distro=alpine@3.21.5 duration=133.166µs pkg=package(name=libavif) records=0 vulns=any

With this PR merged, the generated CPE for libavif will match what NVD is using, which fixes false negatives in Grype.

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (please discuss with the team first; Syft is 1.0 software and we won't accept breaking changes without going to 2.0)
  • Documentation (updates the documentation)
  • Chore (improve the developer experience, fix a test flake, etc, without changing the visible behavior of Syft)
  • Performance (make Syft run faster or use less memory, without changing visible behavior much)

Checklist

  • I have added unit tests that cover changed behavior
  • I have tested my code in common scenarios and confirmed there are no regressions
  • I have added comments to my code, particularly in hard-to-understand sections

Issue references

@naag
fix: CPE detection for APK libavif to use aomedia vendor
160f9f5 
NVD uses "aomedia" as the vendor for libavif CVEs. This change adds
libavif to the APK package CPE candidate additions with "aomedia" as
an additional vendor, enabling Syft/Grype to match CVEs like
CVE-2025-48174 and CVE-2025-48175.

Signed-off-by: Peter Bücker <peter.buecker@gmail.com>
@naag naag mentioned this pull request Feb 4, 2026
Open
@westonsteimel
Copy link
Contributor

westonsteimel commented Feb 5, 2026

@naag , thanks very much for helping make the CPEs more accurate. As noted in anchore/grype#210 (comment) we are working towards an eventual solution where we will know about all of the CPE to distro package mappings that exist in release-monitoring.org (as well as some other datasets), and it appears that they do have this mapping https://release-monitoring.org/project/178015/. Thanks again for the improvement!

@peterbuecker-form3
Copy link

peterbuecker-form3 commented Feb 5, 2026

Thanks a lot @westonsteimel for your swift response and the additional explanations, very much appreciate the outlook :)

@westonsteimel westonsteimel merged commit 6755377 into anchore:main Feb 5, 2026
10 checks passed
@BrewTestBot BrewTestBot mentioned this pull request Feb 10, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@westonsteimel westonsteimel westonsteimel approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@naag @westonsteimel @peterbuecker-form3