Skip to content

Incorrect DependencyVersion parsing for libjpeg library #4139

Description

@dr0ndv

Describe the bug
libjpeg library uses specific version scheme with one digit and one letter (e.g., 8a, 9d).
parseVersion function from DependencyVersionUtil uses two regex patterns: RX_VERSION and RX_SINGLE_VERSION. Unfortunately, none of them is able to fully parse such version scheme. For example for version "9d", DependencyVersionUtil::parseVersion extracts '9' as a version without a suffix with RX_SINGLE_VERSION pattern. Such incorrect parsing leads to FPs, because CPEAnalyzer uses all CPEs that are related to version 9 and have vulnerabilities ("cpe:2.3:a:ijg:libjpeg:9a:::::::, cpe:2.3:a:ijg:libjpeg:9c:::::::" in "CPE" column in the report).

Valid versions for libjpeg can be found here: https://jpegclub.org/reference/reference-sources/ or https://www.ijg.org/files/

Libjpeg source code archive contains another version scheme in configure.ac file: AC_INIT([libjpeg], [9.5.0]). I use following hints.xml file to provide version string which is compatible with CPEs from NVD database:

<?xml version="1.0" encoding="UTF-8"?>
<hints xmlns="https://jeremylong.github.io/DependencyCheck/dependency-hint.1.3.xsd">
  <hint>
    <given>
      <evidence type="product" source="configure.ac" name="package" value="libjpeg" confidence="HIGHEST"/>
    </given>
    <add>
      <evidence type="product" source="hint analyzer" name="product" value="libjpeg" confidence="HIGHEST"/>
      <evidence type="version" source="hint analyzer" name="version" value="9e" confidence="HIGHEST"/>
      <evidence type="vendor" source="hint analyzer" name="vendor" value="ijg" confidence="HIGHEST"/>
    </add>
  </hint>
</hints>

Version of dependency-check used
The problem occurs using version 7.0.0 of the cli.
I assume previous versions have the same behavior.

To Reproduce
Steps to reproduce the behavior:

  1. cd ~/Downloads
  2. wget https://www.ijg.org/files/jpegsr9e.zip
  3. unzip jpegsr9e.zip
  4. wget https://github.com/jeremylong/DependencyCheck/releases/download/v7.0.0/dependency-check-7.0.0-release.zip
  5. unzip dependency-check-7.0.0-release.zip
  6. create hints.xml with content provided in description section
  7. ./dependency-check/bin/dependency-check.sh --enableExperimental --hints hints.xml --format CSV -s jpeg-9e
  8. dependency-check-report.csv contains at least 6 rows. CPE column contains "cpe:2.3:a:ijg:libjpeg:9.5.0:::::::, cpe:2.3:a:ijg:libjpeg:9a:::::::, cpe:2.3:a:ijg:libjpeg:9c:::::::*"

Expected behavior
DependencyVersionUtil::parseVersion should be able to parse versions like 8a, 9b, etc.
CPE section in dependency-report should contain: "cpe:2.3:a:ijg:libjpeg:9.5.0:::::::, cpe:2.3:a:ijg:libjpeg:9e:::::::"

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions