False positives for security fixes part of .NET 8.0.10

[raoganeshr]

IDs

CVE-2024-43485, CVE-2024-43483

Description

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485 & https://avd.aquasec.com/nvd/2024/cve-2024-43483 are fixed in .net 8.0.10. However the nuget packages for the associated fixes are not numbered as 8.0.10. Hence even after upgrading to the patched versions, we are unable to fix the trivy findings. Trivy database needs to be updated to correct the fixed package versions for these two nuget packages.

1. System.Text.Json (CVE-2024-43485)
   GHSA-8g4q-xg66-9fp4 - Has correct version
   
   https://www.nuget.org/packages/system.text.json/
   

2. System.Runtime.Caching (CVE-2024-43483)

3. GHSA-qj66-m88j-hmgj - Has correct version
   
   https://www.nuget.org/packages/System.Runtime.Caching/9.0.0-rc.2.24473.5
   

Reproduction Steps

1.
2.
3.
...

Target

Filesystem

Scanner

Vulnerability

Target OS

No response

Debug Output

N.A.

Version

Version: 0.56.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-10-09 00:24:02.775946363 +0000 UTC
  NextUpdate: 2024-10-10 00:24:02.775946233 +0000 UTC
  DownloadedAt: 2024-10-09 00:31:07.910605636 +0000 UTC

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[DmitriyLewen]

Hello @raoganeshr
Thanks for your report!

System.Text.Json (GHSA-8g4q-xg66-9fp4)
GHSA-8g4q-xg66-9fp4 - Has correct version

Can you update trivy-db?
Fixed versions are correct now:

System.Runtime.Caching (GHSA-qj66-m88j-hmgj)
GHSA-qj66-m88j-hmgj - Has correct version

same.

However the nuget packages for the associated fixes are not numbered as 8.0.10

Do you mean System.Text.Json (as an example) has version 8.0.4 before and after .net upgrade to 8.0.10?

[raoganeshr]

No. I meant even though the CVE advisory mentioned that its fixed in .NET 8.0.10, the nuget packages dont follow that versioning. I believe the updated GitHub Advisory has the correct versions for the fixed components. I will proceed with updating the trivy database. Thanks for your help.