CVE-2022-22965 detected in Spring Boot 3.2.0

[DarkAtra]

IDs

CVE-2022-22965

Description

Trivy detected the following CVE in Spring Boot 3.2.0:

Package: org.springframework.boot:spring-boot-starter-web
Installed Version:
Vulnerability [CVE-2022-22965](https://avd.aquasec.com/nvd/cve-2022-22965)
Severity: CRITICAL
Fixed Version: 2.5.12, 2.6.6
Link: CVE-2022-22965

This seems to be a false positive as the issue was fixed back in Spring Framework 5.3.18+. Spring Boot 3.2.0 is based on Spring Framework 6.1.1 which was never affected.

Reproduction Steps

Scan the following image with trivy: `ghcr.io/idealo/spring-endpoint-exporter:1.0.10`


docker run -v /var/run/docker.sock:/var/run/docker.sock -v $HOME/Library/Caches:/root/.cache/ aquasec/trivy:0.47.0 image ghcr.io/idealo/spring-endpoint-exporter:1.0.10

### Target

Container Image

### Scanner

Vulnerability

### Target OS

Ubuntu 22.04

### Debug Output

```bash
Java (jar)
==========
Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 2, CRITICAL: 1)

┌──────────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│                     Library                      │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├──────────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ org.springframework.boot:spring-boot-starter-web │ CVE-2022-22965 │ CRITICAL │ fixed  │                   │ 2.5.12, 2.6.6 │ RCE via Data Binding on JDK 9+                               │
│                                                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2022-22965                   │
├──────────────────────────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ org.yaml:snakeyaml                               │ CVE-2022-1471  │ HIGH     │        │ 1.33              │ 2.0           │ SnakeYaml: Constructor Deserialization Remote Code Execution │
│                                                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2022-1471                    │
├──────────────────────────────────────────────────┤                │          │        │                   │               │                                                              │
│ org.yaml:snakeyaml (snakeyaml-1.33.jar)          │                │          │        │                   │               │                                                              │
│                                                  │                │          │        │                   │               │                                                              │
└──────────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Version

Running `aquasecurity/[email protected]` which uses `ghcr.io/aquasecurity/trivy:0.47.0`

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[DmitriyLewen]

Hello @DarkAtra
Thanks for your report!

Your image contains layers/sbom/launch/paketo-buildpacks_executable-jar/sbom.cdx.json.
This CycloneDX has org.springframework.boot:spring-boot-starter-web without version:

  {
      "bom-ref": "pkg:maven/org.springframework.boot/spring-boot-starter-web?package-id=4bb281bc258e5bed",
      "cpe": "cpe:2.3:a:spring-boot-starter-web:spring-boot-starter-web:*:*:*:*:*:*:*:*",
      "group": "org.springframework.boot",
      "name": "spring-boot-starter-web",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "java-pom-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "java"
        },
        {
          "name": "syft:package:metadataType",
          "value": "JavaMetadata"
        },
        {
          "name": "syft:package:type",
          "value": "java-archive"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:spring-boot-starter-web:spring_boot_starter_web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:spring_boot_starter_web:spring-boot-starter-web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:spring_boot_starter_web:spring_boot_starter_web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:spring-boot-starter:spring-boot-starter-web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:spring-boot-starter:spring_boot_starter_web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:spring_boot_starter:spring-boot-starter-web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:spring_boot_starter:spring_boot_starter_web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:springframework:spring-boot-starter-web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:springframework:spring_boot_starter_web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:spring-boot:spring-boot-starter-web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:spring-boot:spring_boot_starter_web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:spring_boot:spring-boot-starter-web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:spring_boot:spring_boot_starter_web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:spring:spring-boot-starter-web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:spring:spring_boot_starter_web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:boot:spring-boot-starter-web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:boot:spring_boot_starter_web:*:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "/META-INF/maven/de.idealo.security/spring-endpoint-exporter/pom.xml"
        },
        {
          "name": "syft:metadata:-:artifactID",
          "value": "spring-boot-starter-web"
        },
        {
          "name": "syft:metadata:-:groupID",
          "value": "org.springframework.boot"
        }
      ],
      "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-web",
      "type": "library"
    },

Thanks is why Trivy reports this CVE.

If you don't need this file - you can skip this file.

Regards, Dmitriy

[DarkAtra]

Thanks for your reply! It seems like the version is somehow lost in the build process. I'll report this to the paketo team.
See: paketo-buildpacks/spring-boot#421