The package was delivered vis Redhat extended update support EUS.

Hi @pkeecom thanks for the issue! I'll do some digging and get back to you.

The fixed version showing in grype output is from https://access.redhat.com/errata/RHSA-2025:1262, which is listed as the RHEL 9 fix for the CVE at https://access.redhat.com/security/cve/cve-2024-53104, so I think the issue is that Grype is treating the image as regular RHEL 9, not as RHEL 9.4 EUS.

Hi @pkeecom can you give us one bit of additional information about the image you are scanning? What are the contents of /etc/os-release and /etc/redhat-release?

@willmurphyscode

`cat /etc/os-release
NAME="Red Hat Enterprise Linux"
VERSION="9.4 (Plow)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="9.4"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Red Hat Enterprise Linux 9.4 (Plow)"
ANSI_COLOR="0;31"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:redhat:enterprise_linux:9::baseos"
HOME_URL="https://www.redhat.com/"
DOCUMENTATION_URL="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9"
BUG_REPORT_URL="https://issues.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 9"
REDHAT_BUGZILLA_PRODUCT_VERSION=9.4
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.4"

[root@myhost~] $ cat /etc/redhat-release
Red Hat Enterprise Linux release 9.4 (Plow)`

Yeah @willmurphyscode I'm fairly certain this is going to require querying and surfacing the enabled rpm repos in syft, it isn't going to be in the distro files. https://www.redhat.com/en/blog/how-update-red-hat-enterprise-linux-tvia-minor-releases-and-extended-update-support might help some

I thought we had a syft issue about this. I know @wagoodman and I have discussed it many times. It might be captured some in anchore/syft#2549, but I thought there was a more specific one somewhere

@willmurphyscode @westonsteimel I don't think there's a reliable way of determining if it is under EUS or not. We mirror repos - so it may not have the word "eus" in the repo name either.

May be a setting in grype yaml or a command line option for a user to set if it is EUS or not?

Any movement on this @willmurphyscode ? It's a bit tedious trying to add CVEs to ignore list as more and more CVEs are being flagged with every run. Is there a workaround?

Hi @pkeecom,

I'm planning to pick this up next. I like the idea of providing a config option that lets users specify that they're scanning a -eus image. We'll also need to do some data work on the backend to get EUS fix versions into grype's database.

At present, I don't believe there's a great workaround.

Thanks @willmurphyscode . Looking forward to the fix.