False positive CVE-2017-18589 rust package matching cookie npm package

[fouadh]

What happened:
We have cookie in our dependencies. When scanning our repository we get a false positive on cookie Rust package

NAME    INSTALLED  FIXED-IN  TYPE  VULNERABILITY   SEVERITY 
cookie  0.5.0                npm   CVE-2017-18589  High   

What you expected to happen:
I expect npm cookie package not to match CVEs against "cookie" Rust package.

How to reproduce it (as minimally and precisely as possible):

mkdir sandbox
cd sandbox
npm init
npm install cookie
grype dir:.

Anything else we need to know?:

Environment:

• Output of grype version:

Application:          grype
Version:              0.50.1
Syft Version:         v0.56.0
BuildDate:            2022-09-13T18:32:52Z
GitCommit:            403a535321c20565676dc633344e2bf8881cee29
GitDescription:       v0.50.1
Platform:             darwin/amd64
GoVersion:            go1.18.5
Compiler:             gc
Supported DB Schema:  4

• OS (e.g: cat /etc/os-release or similar):

System Software Overview:
      System Version: macOS 12.4 (21F79)
      Kernel Version: Darwin 21.5.0
      Boot Volume: Macintosh HD

[tgerla]

I can confirm that this particular false positive is fixed now that we have adjusted our vulnerability matching method as described here: https://anchore.com/blog/say-goodbye-to-false-positives/ -- I'll go ahead and close this issue but please feel free to re-open if you find more false positives, or if this one is still affecting your images. Thanks!