tykio/tyk-gateway:v5.7 contains vulnerable Vault dependency

[jakub-bochenski]

It contains github.com/hashicorp/vault/api v1.15.0 that has multiple high level vulnerabilities:

[buger]

Hello!

As part of our LTS support, 5.7 is not supported anymore. Currently supported versions are 5.3, 5.8, and upcoming 5.9 (to be released soon). https://tyk.io/docs/developer-support/release-types/long-term-support/

All currently supported releases regularly go though the CVE scanning.

Hope it makes sense!

[jakub-bochenski]

I see 5.8 still has v.1.16.0 that contains CVE-2024-9180

[buger]

@jakub-bochenski which scanner do you use? This CVE is for the vault package, however we do use vault/api one, which is separate module. I'm not sure it related (plus this CVE only for the vault server side).

[jakub-bochenski]

@buger I'm using syft: syft scan tykio/tyk-gateway:v5.8 -o cyclonedx-json

It seems the package is correctly identified, I'd guess the CVE is reported for that package too

$ syft scan tykio/tyk-gateway:v5.8  -o cyclonedx-json | jq '.components[] | select( .name == "github.com/hashicorp/vault/api")'

{
  "bom-ref": "pkg:golang/github.com/hashicorp/vault@v1.16.0?package-id=5764d6436e0e5d90#api",
  "type": "library",
  "name": "github.com/hashicorp/vault/api",
  "version": "v1.16.0",
  "cpe": "cpe:2.3:a:hashicorp:vault\\/api:v1.16.0:*:*:*:*:*:*:*",
  "purl": "pkg:golang/github.com/hashicorp/vault@v1.16.0#api",
  "properties": [
    {
      "name": "syft:package:foundBy",
      "value": "go-module-binary-cataloger"
    },
    {
      "name": "syft:package:language",
      "value": "go"
    },
    {
      "name": "syft:package:type",
      "value": "go-module"
    },
    {
      "name": "syft:package:metadataType",
      "value": "go-module-buildinfo-entry"
    },
    {
      "name": "syft:location:0:layerID",
      "value": "sha256:9fb70a057f44482dd229de570660f40c1b5feae3caf1bf123934ceeb165a8043"
    },
    {
      "name": "syft:location:0:path",
      "value": "/opt/tyk-gateway/tyk"
    },
    {
      "name": "syft:metadata:architecture",
      "value": "amd64"
    },
    {
      "name": "syft:metadata:goCompiledVersion",
      "value": "go1.23.8"
    },
    {
      "name": "syft:metadata:goCryptoSettings:0",
      "value": "standard-crypto"
    },
    {
      "name": "syft:metadata:h1Digest",
      "value": "h1:nbEYGJiAPGzT9U4oWgaaB0g+Rj8E59QuHKyA5LhwQN4="
    },
    {
      "name": "syft:metadata:mainModule",
      "value": "github.com/TykTechnologies/tyk"
    }
  ]
}

[jakub-bochenski]

The vulnerability information comes from https://ossindex.sonatype.org/vulnerability/CVE-2024-9180?component-type=golang&component-name=github.com%2Fhashicorp%2Fvault but I can't tell from that page exactly what packages are affected

[jakub-bochenski]

I'm no expert but my guess is that #api being a subpath then by the matching logic the #api subpath is affected by CVE reported for the main pkg:golang/github.com/hashicorp/vault

[jakub-bochenski]

It turns out that OSS Index can't handle subpaths, it errors out with ISE 500 (as you can see by entering pkg:golang/github.com/hashicorp/vault@v1.16.0#api in the Web UI) :(

Apparently anyone using the OSS Index is limited to querying for the whole project only.

So it's a False Positive, but given that there is an updated version with a fix, maybe you would consider upgrading anyway?