DependencyTrack / DependencyTrack/dependency-track
Components which are not having any vulnerabilities is showing as vulnerable component with CVE's in Dependency Track 4.12.1
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Components which are not having any vulnerabilities is showing as vulnerable component with CVE's in Dependency Track 4.12.1.
Example:
Name: @react-leaflet/core
Version : 2.1.0
Purl: pkg:npm/%40react-leaflet/core@2.1.0

Attached is the list of CVE shown by DT for the above Example component
### Steps to Reproduce
1.Create the component and provide the purl as given above
2.Check for vulnerabilities it shows 10 vulnerabilities
3.checked the component and version in other vulnerability sources but they show no vulnerability ( Synk)
### Expected Behavior
1.Only the current vulnerability showed be shown.
2.Historical vulnerabilities should not be shown.
### Dependency-Track Version
4.12.1
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
12
### Browser
Google Chrome
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.