CVE-2025-15558: affected range for github.com/docker/cli is unbounded

[rtribotte]

Hi,

Executing docker scout cves traefik:v3.7.1 --only-vuln-packages reports github.com/docker/cli@29.4.0+incompatible as affected by CVE-2025-15558 (GHSA-p436-gjf2-799p) with an unbounded affected range and no fixed version.

The upstream GitHub advisory gates this CVE to < v29.2.0 and marks it fixed in v29.2.0, so v29.4.0 is past the fix and should not match.

The scout CVE-2025-1558 details page is reporting the same information.

I'm not sure if this is the right place to report this issue, but what would be the best way to fix it?

[thaJeztah]

I see this as well;

version: v1.23.1 (go1.26.3 - darwin/arm64)
git commit: 1f5f7a51d7dbbd427feccfa2e133aa51ec702c22

I'm wondering if the databases got confused because the "affected" contains multiple versions; >= 19.03.0, < 29.2.0

Original advisory; GHSA-p436-gjf2-799p

GitHub advisory database; GHSA-p436-gjf2-799p

FWIW; the advisory only impacts consumers of the https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager package, so likely a false positive either way for traefik

[thaJeztah]

Oh; forgot to post; so after chatting with some folks from the Scout team on our Slack, the likely cause is Golang's vulndb not having a "fixed" version for the custom ranges.

I opened a pull request to correct that data, but it's currently still pending;

• data/reports: add fixed non-Go version for GO-2026-4610 golang/vulndb#5931 (imported in gerrit as https://golang.org/cl/797540)

[rtribotte]

I have to report the same type of failure for a different record: Scout reports golang.org/x/crypto@0.54.0 as affected by GO-2026-5932, range >=0, no fixed version.

This one can't be fixed upstream.
GO-2026-5932 says golang.org/x/crypto/openpgp is unmaintained, so there is no fixed version and never will be.
The Go database scopes it to the openpgp import paths via ecosystem_specific.imports, which govulncheck honours.
Matching at module level instead means anything depending on x/crypto for ocsp, ssh or bcrypt is reported vulnerable forever.
The Go team says this is for the scanners to handle (golang/vulndb#5932, and golang/go#80347 closed as not planned).

Could Scout use ecosystem_specific.imports for Go advisories?

Happy to move this to its own issue if you prefer.

[thaJeztah]

Ah, interesting; @rtribotte yes, may be good to put it as a separate issue (I'm not on the team working on Scout, but can x-post in our internal slack once opened).