OWASP dependency track is not listing vulnerabilities (cyclone dx format) from grype , syft is working however

anchore / grype

A vulnerability scanner for container images and filesystems

Apache License 2.0

8.76k stars 571 forks source link

OWASP dependency track is not listing vulnerabilities (cyclone dx format) from grype , syft is working however #796

Closed usmankhanisb closed 1 year ago

usmankhanisb commented 2 years ago

What happened: OWASP dependency track is not listing vulnerabilities (cyclone dx format) from grype , syft is working however . Grype cyclonedx sbom only listing components.

What you expected to happen: List vulnerabilties correctly so that various dashboard tools like depenendcy track can enlist vulnerabilties. just syft generated SBOM (cyclonedx format. ) How to reproduce it (as minimally and precisely as possible): genrate SBOM cyclonedx from both of the tools (syft and grype) and play them in depenedncy track and you will see the issue use it for OWASP DVWA project. generate sbom for entire all layers of docker image. Anything else we need to know?: syft and grype xml generation is not consistent.

Environment: MAC, docker compose, OWASP DVWA

Output of grype version: xml
OS (e.g: cat /etc/os-release or similar): MAC OS

spiffcs commented 2 years ago

Thanks for the comment @usmankhanisb - looks like we need to get grype generating the latest version of cyclonedx as well as update it so it has parity with the syft format. Apologies for the lag between the tools.

How to reproduce easily:

grype alpine:latest -o cyclonedx > bom.xml
syft alpine:latest -o cyclonedx-xml > syft.bom

Not the version differences in the schema. Larger images would also show other delta points since the schema has changed. We probably also want to discuss keeping the formatting options up to date between the tools to reduce confusion and keep the API closer together.

cpendery commented 2 years ago

Happy to pick up this issue if @spiffcs you want to assign me to it. I believe that the json output is currently 1.4, but I can update the presenters to be 1.4 for the xml

spiffcs commented 2 years ago

Thanks @cpendery! I'm working on this today, but I really appreciate the offer.

spiffcs commented 1 year ago

@usmankhanisb @cpendery feel free to check out the tip of main on grype after #1038 has merged - grype is now using syft's formatting library which consumes the official upstream cyclonedx tooling.

If you see other compatibility errors let us know! There is also a test now that checks against the official tooling to make sure syft/grype are producing valid outputs for the respective formats