search

DependencyTrack / dependency-track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
https://dependencytrack.org/
Apache License 2.0
2.45k stars 532 forks source link

Return once identical CVEs within SBOM:vulnerabilities section #3907

Open andreeaButerchi opened 6 days ago

andreeaButerchi commented 6 days ago

Current Behavior

For a project having a dependency with several versions within its dependencies SBOM section, when ODT scan is performed we find several times the same CVE present within the vulnerabilities section. The only variable part is the affects bom-ref -> each CVE entry references a different dependency/component.

Proposed Behavior

As we already have a list for affected components at the level of each vulnerability -> we could avoid data duplication and have each unique CVE only once and refference each vulnerable component within the affects list. Ticket created following the discussion: https://github.com/DependencyTrack/dependency-track/discussions/3904#discussioncomment-9924921

Checklist