DependencyTrack / DependencyTrack/dependency-track

Some vulnerabilities are not detected

Open
#1,420 1 comment 5 reactions 0 assignees View on GitHub
in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:

In my project, I'm using gem sidekiq version 5.1.1.
This version has the following two vulnerabilities, which have not been detected.

- https://github.com/advisories/GHSA-jrfj-98qg-qjgv
- https://github.com/advisories/GHSA-grh7-935j-hg6w

### Steps to Reproduce:

Upload a SBOM containing sidekiq version 5.1.1 for analysis.

### Expected Behavior:

Both of the above vulnerabilities are detected.

### Environment:

- Dependency-Track Version: 4.1.1
- Distribution: Docker
- BOM Format & Version: CycloneDX 1.1
- Database Server: H2
- Browser: Google Chrome 98.0.4758.109(Official Build) (x86_64)

### Additional Details:

Both NVD and Github Advisory Database are enabled as data sources.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.