search

DependencyTrack / dependency-track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
https://dependencytrack.org/
Apache License 2.0
2.46k stars 536 forks source link

Add PURL support to VulnDB analyzer #885

Open stevespringett opened 3 years ago

stevespringett commented 3 years ago

VulnDB now supports PURL and has a dedicated endpoint for making queries.

See: https://vulndb.cyberriskanalytics.com/doc/classes/Api/V1/VulnerabilitiesController.html#method-i-find_by_purl

Additionally, VulnDB mirroring should include PURLs so that the Internal Analyzer can make use of them.

Note: It appears that VulnDB PURLs conform to the spec, but there are some issues. Support ticket opened.

melba-lopez commented 11 months ago

@msymons this is a pretty old issue. There's a switch in DT to enable PURL searches. Does that address this issue?