DependencyTrack / DependencyTrack/dependency-track

DepTrack not able to inspect CVE-2020-28483 in GO gin-gonic/gin 1.6.3

Open
#1,489 10 comments 0 reactions 0 assignees View on GitHub
in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

The defect may already be reported! Please search for the defect before creating one.

### Current Behavior:
vulnerable go module github.com/gin-gonic/gin v1.6.3 isnt't vulnerable via DepTrack.

### Steps to Reproduce:
i want to check GO project. i manully found vulnerable go module - github.com/gin-gonic/gin v1.6.3 in go.mod, then run cyclonedx-gomod and finally upload bom.xml to DepTrack.
then i go to my project via WebUI, then found component github.com/gin-gonic/gin v1.6.3 and there is no any vulnerability in it

### Expected Behavior:
DepTrack should alert this CVE - https://nvd.nist.gov/vuln/detail/CVE-2020-28483 on github.com/gin-gonic/gin v1.6.3

### Environment:

- Dependency-Track Version: 4.4.2
- Distribution: [ Docker | Executable WAR | Traditional WAR ] Docker
- BOM Format & Version: CycloneDX 1.4
- Database Server: [ H2 | MSSQL | MySQL | PostgreSQL ] Internal in Docker Container
- Browser: Chrome

### Additional Details:
oss sonotype index - https://ossindex.sonatype.org/component/pkg:golang/github.com/gin-gonic/gin@v1.6.3
nvd - https://nvd.nist.gov/vuln/detail/CVE-2020-28483
snyk - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736
(e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. stackoverflow, gitter, etc)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.