What happened:
TYPE NAME INSTALLED VULN SEVERITY FIXED? FIXED IN UPSTREAM PACKAGE DATASOURCE
python certifi 2022.12.7 GHSA-43fp-rhv2-5gv8 Medium fixed 2022.12.07 https://github.com/advisories/GHSA-43fp-rhv2-5gv8
What you expected to happen:
No security advisory
How to reproduce it (as minimally and precisely as possible):
Python docker image with certifi==2022.12.7 installed
Anything else we need to know?:
certifi publish their python packages with a 'human formatted' zero-padded date format. However, PEP440 canonical versions have their leading zeros removed. Thus, 2022.12.7 is equivalent to 2022.12.07.
What makes this odd is that even on a string comparison, 2022.12.7 is greater than 2022.12.07.
Environment:
Application: grype
Version: 0.50.2
Syft Version: v0.57.0
BuildDate: 2022-09-20T19:54:28Z
GitCommit: f094b860b9b9ebcdf06d9b9c6f7d5c000fad395b
GitDescription: v0.50.2
Platform: windows/amd64
GoVersion: go1.18.6
Compiler: gc
Supported DB Schema: 4
What happened:
What you expected to happen:
No security advisory
How to reproduce it (as minimally and precisely as possible):
Python docker image with certifi==2022.12.7 installed
Anything else we need to know?:
certifipublish their python packages with a 'human formatted' zero-padded date format. However, PEP440 canonical versions have their leading zeros removed. Thus,2022.12.7is equivalent to2022.12.07.What makes this odd is that even on a string comparison,
2022.12.7is greater than2022.12.07.Environment: