Just to add some more context here: Syft is currently a static analysis tool and does not currently look up anything from the internet, so scanning a pom.xml with a parent pom won't have the fidelity it could. We are investigating a number of solutions for this, all of which take Syft outside the realm of strictly a static analysis tool: invoking mvn, looking things up directly against a maven repo. This is definitely an important thing for us to solve 👍

Any news on that? Grype not beeing able to detect inherited versions from a parent seems to be a bigger issue.

Hi @Restage - no particular update here, but anchore/syft#1562 is a discussion of how to enable Syft to capture more information about this type of dependency relationship so that it can be exposed to Grype.

i'm using lastest spring-boot-starter-parent 3.2.0 with graalvm21 when scanning the image i have the following;
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
spring-boot-starter-web 2.5.12 java-archive GHSA-36p3-wjmg-h94x Critical

i have no forced reference to a version of spring-boot-starter-web.
When doing a simple build i only have spring 6.1.1 and springboot 3.2.0 references....
Is it a problem with grype/sbom ?
Or i'm missing something ?

Thanks in advance

Thanks @cezapata for the excellent repro steps and example repository.

I want to try to state the issue as simply as possible so we can try to start working on it.

To reproduce:

git clone git@github.com:cezapata/appconfiguration-sample.git
grype -q appconfiguration-sample | grep GHSA-36p3-wjmg-h94x

Grype still finds the vulnerability.

Looking at the syft output:

syft -q appconfiguration-sample
NAME                                        VERSION  TYPE
azure-spring-cloud-appconfiguration-config  2.9.0    java-archive
maven-wrapper                               3.1.0    java-archive
spring-boot-starter-test                             java-archive
spring-boot-starter-web                              java-archive

Syft doesn't know the version of spring-boot-starter-web because it's not explicitly in the pom.xml.

However, the <relativePath/> directive in the parent node of the pom.xml is enough that syft should know to go ask Maven Central what version of spring-boot-starter-web should be installed for version 2.7.5 of spring-boot-starter-parent. Do I have that right?

Note to developers: this would need to be implemented in Syft, a couple related issues are:

• Empty version field on some dependencies when reading pom.xml syft#1129
• Support Maven multi-level configuration file / parent POM syft#2017

Hi, Syft has implemented a fairly large enhancement to the Maven resolution, which allows it to use the network to resolve Maven artifacts much more completely. There currently is no way to enable this in Grype, unfortunately, but you are able to use Syft, and send the output to grype to get more accurate results:

$ git clone git@github.com:cezapata/appconfiguration-sample.git

$ SYFT_JAVA_USE_NETWORK=true syft appconfiguration-sample -o json | grype -o table
No vulnerabilities found