DependencyTrack / DependencyTrack/dependency-track

Problems with analyzing dotnet projects

Open
#3,040 1 comment 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Dependency track seems to have a problem with analyzing dotnet projects. Here I have made 2 example projects by uploading their CycloneDX SBOMs.
image

The 1st one probably contains a component with an empty name entry in it's SBOM (which is a known and reported issue - https://github.com/DependencyTrack/dependency-track/issues/2821)
image

The 2nd one has the components and their versions enumerated, but shows no vulnerabilities in any of them (a bit too suspicious?)
image

Also when viewing the suggested updated version icon, the version is not making sense in relation to the listed one from the SBOM (i.e. 4.3.2 is higher version than 7.0.1023.36312)
image

### Steps to Reproduce

1. Upload an SBOM from a dotnet project that has named components, but no vulnerabilities (example attached)
[example.cdx.json.txt](https://github.com/DependencyTrack/dependency-track/files/12649969/example.cdx.json.txt)

### Expected Behavior

Would expect DT to list versions/suggested versions correctly and also to match them to known vulnerabilities

### Dependency-Track Version

4.8.2

### Dependency-Track Distribution

Container Image

### Database Server

N/A

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.