certifi dependency false positive.

[xanderstevenson]

What happened:

In Cisco Code Exchange, the following vulnerability was found.

certifi | 2023.7.22 | 2023.07.22 | requirements.txt | GHSA-xqr8-7jwr-rhp7 |

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.
-- | -- | -- | -- | -- | --

What you expected to happen:

User updated certifi to 2023.07.22. Repo was rescanned and vulnerability alert still exisits.

How to reproduce it (as minimally and precisely as possible):

Scan GitHUb repo for Code Exchange and set certifi version to 2023.7.22 or 2023.07.22

Are there any error messages in KubeClarity logs?

(e.g. kubectl logs -n kubeclarity --selector=app=kubeclarity)

Unknown

Anything else we need to know?:

Environment:

• Kubernetes version (use kubectl version --short):
• Helm version (use helm version):
• KubeClarity version (use kubectl -n kubeclarity exec deploy/kubeclarity -- ./backend version)
• KubeClarity Helm Chart version (use helm -n kubeclarity list)
• Cloud provider or hardware configuration:
• Others:

[FrimIdan]

Hi @xanderstevenson thanks for the report, I'm afraid the false positive is an issue with grype scanner. anchore/grype#1430, anchore/grype#1417 and anchore/grype#1172 are still open issues in grype.

[github-actions]

Thank you for your contribution! This issue has been automatically marked as stale because it has no recent activity in the last 60 days. It will be closed in 14 days, if no further activity occurs. If this issue is still relevant, please leave a comment to let us know, and the stale label will be automatically removed.

[akpsgit]

@xanderstevenson @FrimIdan, looks like it was solved in anchore/grype#1510 and present in v0.69.1.
We'll bump grype to solve this.
Thanks!