#5214·syft

exclude-binary-overlap-by-ownership suppresses vendored libraries owned by unrelated RPMs

Author: sekveajaCreated Aug 21, 2026Updated Sep 10, 2026

Labelsbug

Description

Syft's exclude-binary-overlap-by-ownership: true (default) silently removes binary-detected packages when the file is owned by any RPM — even if that RPM has no relation to the detected software. This causes vulnerabilities in vendored/bundled libraries to go completely undetected.

Steps to Reproduce

1. Save the Dockerfile below and build:

bash

docker build -f Dockerfile.grype-issue -t grype-binary-cataloger-issue .

2. Dockerfile:

dockerfile

# Reproducer: exclude-binary-overlap-by-ownership suppresses vendored OpenSSL
#
# Build:  docker build -f Dockerfile.grype-issue -t grype-binary-cataloger-issue .
#
# Test 1 (default - MISSES 3.5.0):
#   syft grype-binary-cataloger-issue | grep openssl
#
# Test 2 (overlap disabled - FINDS 3.5.0):
#   syft grype-binary-cataloger-issue -c <(echo 'package:
#     exclude-binary-overlap-by-ownership: false') | grep openssl

FROM registry.suse.com/bci/bci-base:15.7

# Install system OpenSSL 3.2.3 via RPM
RUN zypper --non-interactive refresh && \
    zypper --non-interactive install --no-confirm openssl-3 libopenssl3 rpm-build && \
    zypper clean --all

# Build OpenSSL 3.5.0 into /opt/VendorProduct
RUN zypper --non-interactive install --no-confirm gcc gcc-c++ make perl wget tar gzip && \
    zypper clean --all

ARG OPENSSL_VERSION=3.5.0
RUN wget -q https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz \
        -O /tmp/openssl-${OPENSSL_VERSION}.tar.gz && \
    tar -xzf /tmp/openssl-${OPENSSL_VERSION}.tar.gz -C /tmp && \
    cd /tmp/openssl-${OPENSSL_VERSION} && \
    ./Configure --prefix=/opt/VendorProduct --openssldir=/opt/VendorProduct/ssl shared linux-x86_64 && \
    make -j$(nproc) && make install_sw && \
    rm -rf /tmp/openssl-${OPENSSL_VERSION}* /opt/VendorProduct/include /opt/VendorProduct/lib64/pkgconfig

# Package vendored OpenSSL into an unrelated RPM (triggers overlap exclusion)
RUN cat > /tmp/vendor-product.spec << 'EOF'
Name:           vendor-product
Version:        1.0.0
Release:        1
Summary:        Vendor product bundling OpenSSL
License:        Commercial
BuildArch:      x86_64
AutoReqProv:    no
%description
Simulates a vendor RPM that bundles OpenSSL with no OpenSSL metadata.
%install
mkdir -p %{buildroot}/opt/VendorProduct
cp -a /opt/VendorProduct/* %{buildroot}/opt/VendorProduct/
%files
/opt/VendorProduct
EOF
RUN rpmbuild -bb /tmp/vendor-product.spec && \
    find /usr/src/packages/RPMS -name "*.rpm" -exec rpm -ivh {} \; && \
    rm -rf /usr/src/packages /tmp/vendor-product.spec

# Cleanup build tools
RUN zypper --non-interactive remove --no-confirm gcc gcc-c++ make perl wget tar rpm-build || true && \
    zypper clean --all

# Verify both versions exist
RUN openssl version && \
    LD_LIBRARY_PATH=/opt/VendorProduct/lib64 /opt/VendorProduct/bin/openssl version && \
    rpm -qf /opt/VendorProduct/bin/openssl

CMD ["/bin/bash"]

Test Results

3. Default scan — MISSES OpenSSL 3.5.0:

$ syft grype-binary-cataloger-issue | grep openssl
libopenssl-3-fips-provider              3.2.3-150700.5.40.1    rpm
libopenssl3                             3.2.3-150700.5.40.1    rpm
openssl                                 3.2.3-150700.1.1       rpm
openssl-3                               3.2.3-150700.5.40.1    rpm

4. With exclude-binary-overlap-by-ownership: false — FINDS OpenSSL 3.5.0:

$ syft grype-binary-cataloger-issue -c <(echo 'package:
    exclude-binary-overlap-by-ownership: false') | grep openssl
libopenssl-3-fips-provider              3.2.3-150700.5.40.1    rpm
libopenssl3                             3.2.3-150700.5.40.1    rpm
openssl                                 3.2.3                  binary
openssl                                 3.2.3-150700.1.1       rpm
openssl                                 3.5.0                  binary
openssl-3                               3.2.3-150700.5.40.1    rpm

5. Verbose confirms binary cataloger DID detect it:

$ syft grype-binary-cataloger-issue -vv 2>&1 | grep -i "binary-classifier\|overlap\|ownership"
      exclude-binary-overlap-by-ownership: true
[0007] DEBUG discovered 8 packages cataloger=binary-classifier-cataloger

Expected Behavior

The overlap exclusion should not suppress a binary detection when the owning RPM's name does not match the detected package. In this case:

Detected: openssl 3.5.0 (binary)
Owning RPM: vendor-product 1.0.0

These are different software packages. The binary finding should be preserved.

Actual Behavior

The binary detection is silently dropped because the file has RPM ownership, regardless of whether the RPM represents the same software. No warning is emitted.

Impact

CVE-2025-15467 (Critical) and other OpenSSL CVEs go undetected by Grype
Affects any enterprise software that bundles third-party libraries inside vendor RPMs (e.g., Micro Focus VisiBroker, Oracle products, SAP, etc.)

Workaround

yaml

# ~/.syft.yaml
package:
  exclude-binary-overlap-by-ownership: false

Environment

Grype: 0.117.0
Syft: embedded in Grype
OS: SUSE Linux Enterprise 15 SP7

Source: anchore/syft

View original on GitHub View discussion on GitHub