DependencyTrack / DependencyTrack/dependency-track

cpe:2.3:a:perl:perl is incorrectly mapped to debian package perl instead of perl-base

Open
#4,015 5 comments 0 reactions 0 assignees View on GitHub
defect pending more information
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

In Debian, the perl executable is contained in the package `perl-base`, and not `perl` - cf https://packages.debian.org/bookworm/amd64/perl-base/filelist
Since most of the time, either both or neither package is installed, the difference is marginal.
However, in order to minimize the target surface, we added `apt-get -y remove --purge perl` to our Dockerfile, thinking that this would remove the perl binary. Two things we learned by doing that:
1) the perl executable was still there
2) but DependencyTrack no longer reported the perl vulnerabilities

So my understanding is that cpe:2.3:a:perl:perl is incorrectly mapped to debian package perl instead of perl-base.

### Steps to Reproduce

1. create a Dockerfile:
```
FROM python:3.12
RUN apt-get update && \
apt-get -y remove --purge perl && \
apt-get -y autoremove --purge && \
rm -rf /var/lib/apt/lists/*
```

2. create a BOM file for this image, e.g. with syft:
```sh
syft your-image -o cyclonedx-json > sbom.json
```

3. upload the sbom to DependencyTrack
4. check the vulnerabilities

### Expected Behavior

Vulnerabilities like CVE-2023-47100 are reported, because the perl executable is installed in this image.

### Dependency-Track Version

4.10.0

### Dependency-Track Distribution

Container Image

### Database Server

N/A

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.