bug: zlib with known vulnerabilities is showing in "products with no identified vulnerabilities " section

[firefive4u]

When I used this tool to test curl-i386 from https://github.com/moparisthebest/static-curl/releases/tag/v8.1.2, in the console report, I could see that there were some CVEs in Zlib with version 1.2.12.
But when looked into "Products with No Identified Vulnerabilities", Zlib with version 1.2.12 was there. So I am confused, what's the purpose of "Products with No Identified Vulnerabilities" part? Why Zlib with CVEs was listed there?

[terriko]

So first, this sounds like a bug. Something that has vulnerabilities shouldn't appear in that section. I'm guessing we might have introduced something when we updated what's supposed to go in the blank reports? But anyhow, I'm going to tag this as a bug that needs investigation and fixing.

More generally: the "Products with no identified vulnerabilities" section is intended to give people a more complete picture of what was scanned. Otherwise when you get a scan that says no vulnerabilities were found it would be hard to distinguish between a few possibilities:

1. Everything scanned correctly and no vulnerabilities were found.
2. The tool couldn't parse some/all of the files supplied and thus never scanned some components.
3. The tool didn't have checkers that could detect some/all of the components in this package and thus some components were not found or scanned.
4. The tool had some checkers that didn't detect correctly so the incorrect component was found/scanned.
5. The user accidentally scanned the wrong directory.

So the idea is to tell people exactly what components were found (even if they had no CVEs!) so you can make sure that it's case 1, and if it's one of the other cases it will hopefully give you enough information to fix the scan or file a bug.

I'm not sure if the right fix for your zlib issue is "make sure things with CVEs don't appear in that section" or "change the name of the section to indicate that it's showing a complete list of what's scanned" (a full list works just as well for those cases above as a list with the vulnerable components removed) but we should figure that out.

[ffontaine]

The issue is raised because zlib has two CPE IDs in NVD NIST database:

• gnu:zlib is used by NVD NIST to tag CVE-2016-9842
• zlib:zlib is used for all other CVEs

Currently, cve-bin-tool will return gnu:zlib in "Products with No Identified Vulnerabilities" if zlib is found but not affected by CVE-2016-9842 (i.e. zlib >= 1.2.9).

Perhaps the name of the section could be changed or a note could be added to better explain those corner cases. An other option would be to better handle products with multiple CPE IDs (e.g. zlib but also acpid, apcupsd, asterisk, etc.) inside cve-bin-tool but this is not easy.