DependencyTrack / DependencyTrack/dependency-track
Search index for 'Vulnerable software' is not built on fresh instance leading to fuzzy matching feature not working
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
After creating a fresh instance of DT (docker compose), fuzzy matching does not work. Only exact CPE matches are working.
### Resolution
1. Manual rebuild of "Vulnerable software" search index. See Configuration -> Search in the config panel.
2. Go to the project and click the "Reanalyze" button in the "Audit Vulnerabilities" tab.
### Files
- SBOM: [bom.json.zip](https://github.com/DependencyTrack/dependency-track/files/12441130/bom.json.zip)
- Server log: [apiserver_search_index_issue.log](https://github.com/DependencyTrack/dependency-track/files/12441147/apiserver_search_index_issue.log)
_Reference discussion: https://github.com/DependencyTrack/dependency-track/discussions/2983#discussioncomment-6816981_
### Steps to Reproduce
1. Set up DT via docker compose as described [here](https://docs.dependencytrack.org/getting-started/deploy-docker/#quickstart-docker-compose).
2. Wait until DT has downloaded and processed all NVD Vulnerabilities
3. Log into DT as admin (change your password, if necessary)
4. Enable all three fuzzy matching options in the config panel (Analyzers -> Internal)
5. Create a new Project
6. Upload SBOM (see attached file) to that newly created project
### Expected Behavior
At least 3 of the 4 contained components should be matched against OpenSSL v1.0.2 and its according vulnerabilities.
### Dependency-Track Version
4.8.2
### Dependency-Track Distribution
Container Image
### Database Server
H2
### Database Server Version
_No response_
### Browser
Mozilla Firefox
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.