CVSS3 and Severity mismatch when using Trivy

[someoilguy]

Hello,
I have just installed created a fresh instance of Harbor 2.10.2.
When scanning containers, I have noticed that severity and the CVSS 3 value shown don't always match, such as this:

Following the link to aqua vulnerability database I see the following:

An even more extreme version is CVE-2014-9939 showing as Low but with a CVSS 3 of 9.8

It was installed with the "--with-trivy" flag and is using version v0.50.1

Some more examples for reference:

[MinerYang]

#18946

[zyyw]

Hi @someoilguy could you please push the image, which has CVE score not matching severity, to dockerhub (a public accessible registry) so that we can use it to reproduce it and do further investigation?

[someoilguy]

python:3.10.14 does it with cve-2023-34152 (imagemagick) cvss of 9.8 but severity low. I'll see what I can do about getting some other samples for you guys.

[zyyw]

@knqyf263 please help to provide some insight on this, thanks

[zyyw]

@someoilguy essentially, if we run trivy image -f json python:3.10.14 -o cves.json and then search by the cve id CVE-2023-34152, the SeveritySource is debian:

And it redirects us to: https://security-tracker.debian.org/tracker/CVE-2023-34152. In this page, it shows unimportant for Urgency, which is converted to Low severity in trivy-db source code.

@knqyf263, please correct me if there is anything wrong about it.

[knqyf263]

@zyyw You're right. Also, it's documented here.
https://aquasecurity.github.io/trivy/v0.51/docs/scanner/vulnerability/#severity-selection