chore(vex): add CVE-2024-34155, CVE-2024-34156 and CVE-2024-34158 in trivy.openvex.json

[DmitriyLewen]

Description

Trivy doesn't use vulnerable packages for CVE-2024-34155, CVE-2024-34156 and CVE-2024-34158:

➜  govulncheck -format openvex ./... | jq '.statements[]'                                               
{
  "vulnerability": {
    "@id": "https://pkg.go.dev/vuln/GO-2024-3105",
    "name": "GO-2024-3105",
    "description": "Stack exhaustion in all Parse functions in go/parser",
    "aliases": [
      "CVE-2024-34155"
    ]
  },
  "products": [
    {
      "@id": "Unknown Product"
    }
  ],
  "status": "not_affected",
  "justification": "vulnerable_code_not_in_execute_path",
  "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
}
{
  "vulnerability": {
    "@id": "https://pkg.go.dev/vuln/GO-2024-3106",
    "name": "GO-2024-3106",
    "description": "Stack exhaustion in Decoder.Decode in encoding/gob",
    "aliases": [
      "CVE-2024-34156"
    ]
  },
  "products": [
    {
      "@id": "Unknown Product"
    }
  ],
  "status": "affected"
}
{
  "vulnerability": {
    "@id": "https://pkg.go.dev/vuln/GO-2024-3107",
    "name": "GO-2024-3107",
    "description": "Stack exhaustion in Parse in go/build/constraint",
    "aliases": [
      "CVE-2024-34158"
    ]
  },
  "products": [
    {
      "@id": "Unknown Product"
    }
  ],
  "status": "not_affected",
  "justification": "vulnerable_code_not_in_execute_path",
  "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
}

govulncheck marks CVE-2024-34156 as affected, but this is mistake.
See #7478 for more details.

example:

➜  trivy -q fs go.mod --detection-priority comprehensive --show-suppressed --vex .vex/trivy.openvex.json
...
Suppressed Vulnerabilities (Total: 3)

┌─────────┬────────────────┬──────────┬──────────────┬─────────────────────────────────────┬─────────────────────────┐
│ Library │ Vulnerability  │ Severity │    Status    │              Statement              │         Source          │
├─────────┼────────────────┼──────────┼──────────────┼─────────────────────────────────────┼─────────────────────────┤
│ stdlib  │ CVE-2024-34156 │ HIGH     │ not_affected │ vulnerable_code_not_in_execute_path │ .vex/trivy.openvex.json │
│         ├────────────────┼──────────┤              │                                     │                         │
│         │ CVE-2024-34155 │ MEDIUM   │              │                                     │                         │
│         ├────────────────┤          │              │                                     │                         │
│         │ CVE-2024-34158 │          │              │                                     │                         │
└─────────┴────────────────┴──────────┴──────────────┴─────────────────────────────────────┴─────────────────────────┘

➜  trivy -q rootfs ./trivy --show-suppressed --vex .vex/trivy.openvex.json                              
...
Suppressed Vulnerabilities (Total: 3)

┌─────────┬────────────────┬──────────┬──────────────┬─────────────────────────────────────┬─────────────────────────┐
│ Library │ Vulnerability  │ Severity │    Status    │              Statement              │         Source          │
├─────────┼────────────────┼──────────┼──────────────┼─────────────────────────────────────┼─────────────────────────┤
│ stdlib  │ CVE-2024-34156 │ HIGH     │ not_affected │ vulnerable_code_not_in_execute_path │ .vex/trivy.openvex.json │
│         ├────────────────┼──────────┤              │                                     │                         │
│         │ CVE-2024-34155 │ MEDIUM   │              │                                     │                         │
│         ├────────────────┤          │              │                                     │                         │
│         │ CVE-2024-34158 │          │              │                                     │                         │
└─────────┴────────────────┴──────────┴──────────────┴─────────────────────────────────────┴─────────────────────────┘

Related issues

• Close Add CVE-2024-34156 to VEX #7478

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).