search

DependencyTrack / dependency-track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
https://dependencytrack.org/
Apache License 2.0
2.61k stars 552 forks source link

CVE-2020-4682 not returned for project having IBM MQ vulnerable dependency #3823

Open andreeaButerchi opened 3 months ago

andreeaButerchi commented 3 months ago

Current Behavior

Hello,

We're currently migrating from OWASP Dependency Check to Dependency Track and during our tests we noticed that the CVE-2020-4682 (https://nvd.nist.gov/vuln/detail/CVE-2020-4682) is returned for a project having a dependency on IBM MQ 8.0, but the CVE is not present in the DT report. DC: image DT does see the dependency...but no trace of the CVE: image

Other CVEs are being returned for the project so I don't think there's an issue with the scan itself The CPE for CVE-2020-4682 seems pretty clear and covers our project's dependency version So I must admit that I have no other ideas on why DT is not returning it :(

Thank you very much for your help! Best regards, Andreea

Steps to Reproduce

  1. Upload an SBOM having a dependency on "group": "com.ibm.mq", "name": "com.ibm.mq", "version": "8.0.0.6",
  2. once the processing is done: check the Dependency Graph to make sure the dependency was properly identified
  3. check the vulnerability section -> no CVEs are linked to the IBM MQ dependency

Expected Behavior

I would expect to see the CVE-2020-4682 linked to IBM MQ 8.0.0.6 (this is just an example...for this version the patched was applied starting with version 8.0.0.15)

Dependency-Track Version

4.11.3

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

15

Browser

Google Chrome

Checklist

valentijnscholten commented 3 months ago

Looks like you're project is using PURLs and not CPEs? https://docs.dependencytrack.org/analysis-types/known-vulnerabilities/

andreeaButerchi commented 3 months ago

Hello,

Thank you very much for your quick answer :) We checked our configuration...we have both OSS Index & the internal one activated within DT. We also found that it's the OSS Index responsibility to match/convert between PURL & CPE. We also checked and noticed that we have other projects having the PURL within the SBOM -> and on which the CVE is being found: image

image

So we can see that's the being com.ibm.mq ▸ com.ibm.mq.allclient flagged, while the CPE is larger than the allclient lib.

Thank you very much for your help.