DependencyTrack / DependencyTrack/dependency-track

Analyze vulnerabilities for rpm packages in RedHat or CentOS operating systems

Open
#3,991 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

I collected the sbom of all rpm packages in the CentOS system through the syft(https://github.com/anchore/syft) tool, the format of the sbom file is cyclonedx-json, then I upload the sbom file to the Dependency-Track.
I found that Dependency Track could only analyze very few vulnerabilities on individual rpm packages.
![Snipaste_2024-07-22_11-42-32](https://github.com/user-attachments/assets/81e6b887-c900-4bcc-b9f3-1ad3f272106a)

However, I used the grype(https://github.com/anchore/grype) tool to perform vulnerability scanning locally and was able to scan over 10,000 vulnerabilities.
`# grype sbom:./only-rpm-sbom-by-syft.json -o cyclonedx-json --file rpm-vulnerabilities.json
✔ Vulnerability DB [updated]
✔ Scanned for vulnerabilities [15862 vulnerability matches]
├── by severity: 11 critical, 724 high, 9902 medium, 6470 low, 0 negligible (49 unknown)
└── by status: 5934 fixed, 11222 not-fixed, 1294 ignored`

I found the following vulnerability databases supported by grype:
![image](https://github.com/user-attachments/assets/67950deb-99d8-461f-92d6-e9f9d74c0220)
https://github.com/anchore/grype?tab=readme-ov-file#grypes-database

Dependency-Track whether it supports distributions such as RedHat, or planned to be supported?

### Proposed Behavior

I hope that Dependency Track can analyze more vulnerabilities for rpm packages like grype did.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.