Go mod pseudo-versions may cause false positive results

Author: FrimIdanCreated Oct 31, 2022Updated Sep 8, 2026

Labelsbugfalse-positiveneeds-investigation

What happened: Go program with pseudo versions in go.mod/sum cause false positive results

How to reproduce it (as minimally and precisely as possible): Create a go program that points to

istio.io/istio v0.0.0-20220308185742-91533d04e894

(go get istio.io/[email protected])

Scan it with grype.

You will get the following results

istio.io/istio                        v0.0.0-20220308185742-91533d04e894                          1.11.7    go-module  GHSA-856q-xv3c-7f2f  High
istio.io/istio                        v0.0.0-20220308185742-91533d04e894                          1.12.18   go-module  GHSA-xwx5-5c9g-x68x  Medium
istio.io/istio                        v0.0.0-20220308185742-91533d04e894                          1.9.8     go-module  GHSA-7774-7vr3-cc8j  High
istio.io/istio                        v0.0.0-20220308185742-91533d04e894                          1.9.8     go-module  GHSA-hqxw-mm44-gc4r  High

which are false positive since v0.0.0-20220308185742-91533d04e894 is istio version 1.13.2

Environment:

Output of grype version:

$ grype version
Application:          grype
Version:              0.50.1
Syft Version:         v0.56.0
BuildDate:            2022-09-13T18:32:52Z
GitCommit:            403a535321c20565676dc633344e2bf8881cee29
GitDescription:       v0.50.1
Platform:             darwin/amd64
GoVersion:            go1.18.5
Compiler:             gc
Supported DB Schema:  4

Source: anchore/grype

View original on GitHub View discussion on GitHub