search

Festo-se / cyclonedx-editor-validator

Tool for creating, modifying and validating CycloneDX SBOMs.
https://festo-se.github.io/cyclonedx-editor-validator/
GNU General Public License v3.0
18 stars 4 forks source link

`merge-vex` reference check doesn't take nested components into account #155

Open mmarseu opened 5 months ago

mmarseu commented 5 months ago

The following piece of code doesn't take nested components into account:

https://github.com/Festo-se/cyclonedx-editor-validator/blob/8bdf8fd2195b68c18a9f76d74146a8f8d14550a3/cdxev/merge_vex.py#L32-L49

That means, if your vulnerabilities reference a nested component, the merge will fail.