DependencyTrack / DependencyTrack/dependency-track
Some vulnerabilities are not detected
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior:
In my project, I'm using gem sidekiq version 5.1.1.
This version has the following two vulnerabilities, which have not been detected.
- https://github.com/advisories/GHSA-jrfj-98qg-qjgv
- https://github.com/advisories/GHSA-grh7-935j-hg6w
### Steps to Reproduce:
Upload a SBOM containing sidekiq version 5.1.1 for analysis.
### Expected Behavior:
Both of the above vulnerabilities are detected.
### Environment:
- Dependency-Track Version: 4.1.1
- Distribution: Docker
- BOM Format & Version: CycloneDX 1.1
- Database Server: H2
- Browser: Google Chrome 98.0.4758.109(Official Build) (x86_64)
### Additional Details:
Both NVD and Github Advisory Database are enabled as data sources.
Contributor guide
Assessment
This issue has not been assessed yet.