Component description misleadingly inherited

Component descriptions (bom/components/component/description) seem to be inherited. This leads to completely wrong descriptions when a particular Maven module has none. Example:

parent POM#description : I'm the parent of all
  ^
  |
  -- project parent POM#description: <none>
          ^
          |
          -- project module POM#description : <none>

In the CDX the "project module" component will have a <description> of "I'm the parent of all" which is confusing at best.

I am expecting for "project module" to have no description at all as it is also missing in its POM.

Public example

• https://search.maven.org/artifact/io.swagger/swagger-annotations/1.6.8/bundle --> no description
• depends on https://search.maven.org/artifact/io.swagger/swagger-project/1.6.8/bundle --> no description
• depends on https://search.maven.org/artifact/org.sonatype.oss/oss-parent/5/bundle --> described as "Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/"

<component type="library" bom-ref="pkg:maven/io.swagger/swagger-annotations@1.6.8?type=jar">
  <group>io.swagger</group>
  <name>swagger-annotations</name>
  <version>1.6.8</version>
  <description>Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/</description>
  <scope>required</scope>

Reproduce the public Maven example and inspect the generated CycloneDX XML for the module component. Trace how descriptions are resolved through the parent POM hierarchy; done means a module with no description has no component description even when an ancestor POM is described.