DependencyTrack / DependencyTrack/dependency-track

Search index for 'Vulnerable software' is not built on fresh instance leading to fuzzy matching feature not working

Open
#2,986 1 comment 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

After creating a fresh instance of DT (docker compose), fuzzy matching does not work. Only exact CPE matches are working.

### Resolution
1. Manual rebuild of "Vulnerable software" search index. See Configuration -> Search in the config panel.
2. Go to the project and click the "Reanalyze" button in the "Audit Vulnerabilities" tab.

### Files
- SBOM: [bom.json.zip](https://github.com/DependencyTrack/dependency-track/files/12441130/bom.json.zip)
- Server log: [apiserver_search_index_issue.log](https://github.com/DependencyTrack/dependency-track/files/12441147/apiserver_search_index_issue.log)

_Reference discussion: https://github.com/DependencyTrack/dependency-track/discussions/2983#discussioncomment-6816981_

### Steps to Reproduce

1. Set up DT via docker compose as described [here](https://docs.dependencytrack.org/getting-started/deploy-docker/#quickstart-docker-compose).
2. Wait until DT has downloaded and processed all NVD Vulnerabilities
3. Log into DT as admin (change your password, if necessary)
4. Enable all three fuzzy matching options in the config panel (Analyzers -> Internal)
5. Create a new Project
6. Upload SBOM (see attached file) to that newly created project

### Expected Behavior

At least 3 of the 4 contained components should be matched against OpenSSL v1.0.2 and its according vulnerabilities.

### Dependency-Track Version

4.8.2

### Dependency-Track Distribution

Container Image

### Database Server

H2

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.