False positive: CVE-2014-9939 unexpected scan result

[JwishPark]

Description

I scanned my centos-based image with Trivy. And found there is a vulnerability CVE-2014-9939 in binutils. However according to the description, problem has before version 2.26 and installed version is 2.27 in my image So I want to know why it was found as a vulnerability.

What did you expect to happen?

[email protected]_9.1.x86_64 is not vulnerable to CVE-2014-9939

What happened instead?

CVE-2014-9939 reported on [email protected]_9.1.x86_64

Output of run

Output of trivy -v

[DmitriyLewen]

Hello @JwishPark Thanks for your report!

Trivy uses RedHat database for RHEL/CentOS.(More information about Data Sources here.

For RHEL7 CVE-2014-9939 has status affected(https://access.redhat.com/security/cve/cve-2014-9939) That is why Trivy found this CVE.

Best Regards, Dmitriy

[github-actions[bot]]

This issue is stale because it has been labeled with inactivity.