fix(rootio): fix severity selection

[DmitriyLewen]

Description

There are 2 points:

• Root.io feed based on BaseOS (Debian/Ubuntu/Alpine).
• We use advisories for BaseOS, if Root.io feed doesn't have this advisory.

So we need to use severity from BaseOS (if exists) for Root.io vulnerabilities.

Base changes:

• Get function merge severity from baseOS (see fix(rootio): add severities from base OS advisories trivy-db#554)
• Use severity from Advisory for Vulnerability (as for Debian)
• Change severity source for Root.io images to baseOS source

Fix example:

before (rootio doesn't have severities, so we use nvd (see auto logic)):

➜ trivy -q image rootioinc/common-elasticsearch:9.0.1-bookworm-slim_rootio -f json | jq '.Results[].Vulnerabilities[] | select(.VulnerabilityID == "CVE-2018-6829") | {VulnerabilityID, Severity, SeveritySource}'
{
  "VulnerabilityID": "CVE-2018-6829",
  "Severity": "HIGH",
  "SeveritySource": "nvd"
}

after:

➜  ./trivy -q image rootioinc/common-elasticsearch:9.0.1-bookworm-slim_rootio -f json | jq '.Results[].Vulnerabilities[] | select(.VulnerabilityID == "CVE-2018-6829") | {VulnerabilityID, Severity, SeveritySource}'
{
  "VulnerabilityID": "CVE-2018-6829",
  "Severity": "LOW",
  "SeveritySource": "debian"
}

Related issues

• Close bug(rootio): Trivy doesn't use severity from BaseOS for vulnerabilities #9178

Related PRs

• fix(rootio): add severities from base OS advisories trivy-db#554

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

@DmitriyLewen Do you have a "rooted" Alpine-based image for testing?

[DmitriyLewen]

No, I only wrote a test for Alpine.
@benjifin, can you share an Alpine image for our testing?

[knqyf263]

LGTM 🚀