False positive: CVE-2023-47100 (duplicate of CVE-2023-47038) in perl-5.36.2

[nielsaka]

What happened:
Grype reports alpine perl-5.36.2-r0 being affected by critical CVE-2023-47100.

What you expected to happen:
No CVE. According to Ubuntu and Redhat, CVE-2023-47100 is a duplicate of CVE-2023-47038. The latter has been fixed in perl-5.36.2 see release notes of perl and secdb for alpine 3.17.

How to reproduce it (as minimally and precisely as possible):

docker pull ckan/ckan-base:2.10.5
docker run --rm --volume /var/run/docker.sock:/var/run/docker.sock --name Grype anchore/grype:latest db update
docker run --rm --volume /var/run/docker.sock:/var/run/docker.sock --name Grype anchore/grype:latest ckan/ckan-base:2.10.5 | grep 47100

Anything else we need to know?:
I presume the same behaviour holds for the other perl versions perl-5.38.1 and perl-5.34.2 that were updated on 2023-11-25 see here.

perl-5.38.1a (2023-11-25T15:59:13)
perl-5.36.2a (2023-11-25T15:59:01)
perl-5.34.2a (2023-11-25T15:58:49)
perl-5.38.1 (2023-11-25T15:21:49)
perl-5.36.2 (2023-11-25T15:20:11)
perl-5.34.2 (2023-11-25T15:19:49)

Environment:

• Output of grype version:
  Application: grype
  Version: 0.80.1
  BuildDate: 2024-09-11T17:30:28Z
  GitCommit: 9fb2194
  GitDescription: v0.80.1
  Platform: linux/amd64
  GoVersion: go1.23.1
  Compiler: gc
  Syft Version: v1.12.2
  Supported DB Schema: 5

• OS (e.g: cat /etc/os-release or similar):
  PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
  NAME="Debian GNU/Linux"
  VERSION_ID="12"
  VERSION="12 (bookworm)"
  VERSION_CODENAME=bookworm
  ID=debian
  HOME_URL="https://www.debian.org/"
  SUPPORT_URL="https://www.debian.org/support"
  BUG_REPORT_URL="https://bugs.debian.org/"

[westonsteimel]

Thanks, this should be addressed with the latest published grype database

[spiffcs]

👍 Confirmed this morning that this is no longer showing up when scanning ckan/ckan-base:2.10.5

Here is the full list of pearl-* report findings (does not include CVE-2023-47100):

perl                 5.36.2-r0               apk     CVE-2023-31486       High
perl                 5.36.2-r0               apk     CVE-2023-31484       High
perl-git             2.38.5-r0   2.39.5-r0   apk     CVE-2024-32002       Critical
perl-git             2.38.5-r0   2.39.5-r0   apk     CVE-2024-32465       High
perl-git             2.38.5-r0   2.39.5-r0   apk     CVE-2024-32004       High
perl-git             2.38.5-r0   2.39.5-r0   apk     CVE-2024-32021       Low
perl-git             2.38.5-r0   2.39.5-r0   apk     CVE-2024-32020       Low