DependencyTrack / DependencyTrack/dependency-track
DepTrack not able to inspect CVE-2020-28483 in GO gin-gonic/gin 1.6.3
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
The defect may already be reported! Please search for the defect before creating one.
### Current Behavior:
vulnerable go module github.com/gin-gonic/gin v1.6.3 isnt't vulnerable via DepTrack.
### Steps to Reproduce:
i want to check GO project. i manully found vulnerable go module - github.com/gin-gonic/gin v1.6.3 in go.mod, then run cyclonedx-gomod and finally upload bom.xml to DepTrack.
then i go to my project via WebUI, then found component github.com/gin-gonic/gin v1.6.3 and there is no any vulnerability in it
### Expected Behavior:
DepTrack should alert this CVE - https://nvd.nist.gov/vuln/detail/CVE-2020-28483 on github.com/gin-gonic/gin v1.6.3
### Environment:
- Dependency-Track Version: 4.4.2
- Distribution: [ Docker | Executable WAR | Traditional WAR ] Docker
- BOM Format & Version: CycloneDX 1.4
- Database Server: [ H2 | MSSQL | MySQL | PostgreSQL ] Internal in Docker Container
- Browser: Chrome
### Additional Details:
oss sonotype index - https://ossindex.sonatype.org/component/pkg:golang/github.com/gin-gonic/gin@v1.6.3
nvd - https://nvd.nist.gov/vuln/detail/CVE-2020-28483
snyk - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736
(e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. stackoverflow, gitter, etc)
Contributor guide
Assessment
This issue has not been assessed yet.