Why the Severity is set to HIGH for ruby rexml CVE-2024-49761 with CVSS score = 6.6

[jwenjian]

Question

Hi,

I'd like to know how the severity of trivy works, I thought it just use the CVE severity?

But the ruby rexml gem CVE, https://www.cve.org/CVERecord?id=CVE-2024-49761, I got HIGH by trivy output, but I saw Medium in cve.org.

somewhere wrong?

Thanks

Target

Container Image

Scanner

Vulnerability

Output Format

Table

Mode

Standalone

Operating System

Rocky Linux 9.0

Version

# trivy --version
Version: 0.58.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-12-17 06:16:04.798697378 +0000 UTC
  NextUpdate: 2024-12-18 06:16:04.798697017 +0000 UTC
  DownloadedAt: 2024-12-17 07:25:33.40114213 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-12-17 02:46:02.884793825 +0000 UTC
  NextUpdate: 2024-12-20 02:46:02.884793715 +0000 UTC
  DownloadedAt: 2024-12-17 07:38:13.416442913 +0000 UTC

[jwenjian]

trivy output when I scan container images:

ghcr.io/voxpupuli/puppetserver:8.7.0-latest (ubuntu 22.04)

Total: 0 (HIGH: 0, CRITICAL: 0)

2024-12-17T15:38:13+08:00       INFO    Table result includes only package filenames. Use '--format json' option to get the full path to the package file.

Ruby (gemspec)

Total: 1 (HIGH: 1, CRITICAL: 0)

┌─────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────┐
│           Library           │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                         Title                          │
├─────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────┤
│ rexml (rexml-3.2.5.gemspec) │ CVE-2024-49761 │ HIGH     │ fixed  │ 3.2.5             │ >= 3.3.9      │ REXML is an XML toolkit for Ruby. The REXML gem before │
│                             │                │          │        │                   │               │ 3.3.9...                                               │
│                             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-49761             │
└─────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────┘

[knqyf263]

It's described here: https://trivy.dev/latest/docs/scanner/vulnerability/#severity-selection

[jwenjian]

Thanks