CVE-2024-3924 False Positive (text-generation)

[muhammad-asn]

IDs

CVE-2024-3924

Description

We got text-generation CVE-2024-3924 although the library not installed.
Also from the pypi the latest package in 0.7
https://pypi.org/project/text-generation/#history

Reproduction Steps

1. Install package
2. Copy in the docker image
3. Run trivy scanning

Target

Container Image

Scanner

Vulnerability

Target OS

Debug Output

$ trivy image \
      --cache-dir /root/.cache/trivy \
      --severity MEDIUM,HIGH,CRITICAL \
      --exit-code 1 \
      --no-progress \
      --ignore-unfixed \
      --scanners vuln \
      backend-image:latest

Version

$ trivy --version
Version: 0.51.4

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[DmitriyLewen]

Hello @muhammad-asn
Thanks for your report!

Perhaps pypi doesn't have all version.
repository has more tags (including 2.0.0).

the library not installed.

Can you scan your image with -f json --list-all-pkgs and check filepath to text-generation package?

Regards, Dmitriy