fleetdm
False positive for CVE-2024-47606
Fleet version: 4.65
💥 Actual behavior
Fleet has misidentified a vulnerability in libgstreamer1.0-0, 1.16.3-0ubuntu1.2 CVE-2024-47606
🧑💻 Steps to reproduce
- Upload libgstreamer1.0-0, 1.16.3-0ubuntu1.2 to Fleet.
- Wait for CVE-2024-47606 to be assigned to it.
🕯️ More info (optional)
N/A
Fix the false positive.
Scope of this is likely either "add false positive handling to OVAL" or "fix parsing of OVALs", to give an idea on estimation.
This appears to have been resolved with an update from Canonical's side of the OVAL.
Confirmed true-negative and true-positive scenarios here:
The top (vulnerable, true positive) entry was repro'd by running apt install libgstreamer1.0-0=1.16.2-2 on the ubuntu:focal-20191030 Docker image.
The bottom (not vulnerable, true negative) entry was repro'd by running apt install libgstreamer1.0-0 on the ubuntu:focal Docker image.
We'll likely need to revisit OVAL false-positive handling at a later date, but since this ticket is scoped to this specific CVE we'll handle the OVAL false-positive issue the next time we see an instance of that in the wild.
False alert now tamed, Fleet's vigilance unblamed, Security's name reclaimed.
