DependencyTrack / DependencyTrack/dependency-track

VEX file with analysis state set to resolved does not mark the CVE as resolved in DT after applying VEX

Closed
#5,260 17 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Hi there and thanks for a great free tool!

I'm trying to apply a rather large VEX file of 24k CVE:s to a project of mine (large in my world 😉) but even though I have CVE:s which are marked as resolved in the VEX file they are not marked as resolved, even after waiting several days. Some CVE:s which are marked resolved in exactly the same way in the VEX however get's marked as resolved in the project.

I've tried everything I can think off, more resources for the backend, my own API key for NVD.nist.gov, Sonatype own API key. But I cannot seem to do anything to actually just get DT to apply the whole VEX with the analysis state to my whole project 🤔

### Steps to Reproduce

1. Create a new project
2. Upload [bom.json](https://github.com/user-attachments/files/22005929/bom.json) and wait for components and vulnerabilities to be synced.
3. Apply [vex.json](https://github.com/user-attachments/files/22005937/vex.json)

### Current Behavior:

Not all DT CVE:s which has been resolved in the VEX file are resolved in the DT project, not even after several days off waiting.

For example this CVE is marked as resolved in the VEX file

Image

But even after applying VEX it's still not resolved in DT

Image

### Expected Behavior

All CVE:s found in the project which have analysis.state set in the VEX file should get matching analysis state set in DT.

### Dependency-Track Version

4.13.2

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

16.9

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.