Skip to content

False positive on certifi 2022.12.07 #1034

@mrginglymus

Description

@mrginglymus

What happened:

TYPE    NAME                    INSTALLED               VULN                  SEVERITY      FIXED?     FIXED IN              UPSTREAM PACKAGE           DATASOURCE
python  certifi                 2022.12.7               GHSA-43fp-rhv2-5gv8   Medium        fixed      2022.12.07                                       https://github.com/advisories/GHSA-43fp-rhv2-5gv8

What you expected to happen:
No security advisory

How to reproduce it (as minimally and precisely as possible):
Python docker image with certifi==2022.12.7 installed

Anything else we need to know?:

certifi publish their python packages with a 'human formatted' zero-padded date format. However, PEP440 canonical versions have their leading zeros removed. Thus, 2022.12.7 is equivalent to 2022.12.07.

What makes this odd is that even on a string comparison, 2022.12.7 is greater than 2022.12.07.

Environment:

Application:          grype
Version:              0.50.2
Syft Version:         v0.57.0
BuildDate:            2022-09-20T19:54:28Z
GitCommit:            f094b860b9b9ebcdf06d9b9c6f7d5c000fad395b
GitDescription:       v0.50.2
Platform:             windows/amd64
GoVersion:            go1.18.6
Compiler:             gc
Supported DB Schema:  4

Metadata

Metadata

Labels

Type

No type

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions