DependencyTrack / DependencyTrack/dependency-track
cpe:2.3:a:perl:perl is incorrectly mapped to debian package perl instead of perl-base
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
In Debian, the perl executable is contained in the package `perl-base`, and not `perl` - cf https://packages.debian.org/bookworm/amd64/perl-base/filelist
Since most of the time, either both or neither package is installed, the difference is marginal.
However, in order to minimize the target surface, we added `apt-get -y remove --purge perl` to our Dockerfile, thinking that this would remove the perl binary. Two things we learned by doing that:
1) the perl executable was still there
2) but DependencyTrack no longer reported the perl vulnerabilities
So my understanding is that cpe:2.3:a:perl:perl is incorrectly mapped to debian package perl instead of perl-base.
### Steps to Reproduce
1. create a Dockerfile:
```
FROM python:3.12
RUN apt-get update && \
apt-get -y remove --purge perl && \
apt-get -y autoremove --purge && \
rm -rf /var/lib/apt/lists/*
```
2. create a BOM file for this image, e.g. with syft:
```sh
syft your-image -o cyclonedx-json > sbom.json
```
3. upload the sbom to DependencyTrack
4. check the vulnerabilities
### Expected Behavior
Vulnerabilities like CVE-2023-47100 are reported, because the perl executable is installed in this image.
### Dependency-Track Version
4.10.0
### Dependency-Track Distribution
Container Image
### Database Server
N/A
### Database Server Version
_No response_
### Browser
Google Chrome
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.