DependencyTrack / DependencyTrack/dependency-track

Toggle Duplicate CVE Notifications

Open
#1,635 3 comments 4 reactions 0 assignees View on GitHub
enhancement vuln-aliases
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

The enhancement may already be reported! Please search for the enhancement before creating one.

### Current Behavior:
When Dependency Track uses the GitHub external repository source to find additional vulnerabilities, Dependency Track will send a notification that a new vulnerability has been found even though the same CVE has already been reported for that component from another source. This results in duplicate CVE's reported, but from two different sources.

### Proposed Behavior:
The number of duplicate vulnerabilities can be reduced by checking the CVE reported from GitHub and crosscheck for a CVE reported for the same component and not report the GitHub notification if the CVE exists. Some users may want to continue to receive notifications from both sources even if they are duplicates in the event one gives more information than the other, so it would be ideal to let the user enable this feature as wanted.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.