DependencyTrack / DependencyTrack/dependency-track

Vulnerabilities and versions for Magento 2 and Typo 3

Open
#5,439 6 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Currently, I can't see any info about Magento 2 and Typo 3 vulnerabilities and versions

For example: 2.4.7-p7

`pkg:composer/magento/product-community-edition@2.4.5-p7`

There is a [new security patch](https://experienceleague.adobe.com/en/docs/commerce-operations/release/notes/security-patches/2-4-5-patches), and there are some vulnerabilities, for example [CVE-2024-34102](https://nvd.nist.gov/vuln/detail/cve-2024-34102). But I don't see them.

Image

Image

[NVD Vulnerability Search](https://nvd.nist.gov/vuln/search#/nvd/home?cpeFilterMode=cpe&cpeName=cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*&resultType=records)

The Magento repository `https://repo.magento.com/` is configured

Image

### Steps to Reproduce

1. Configure Magento repository: `https://repo.magento.com/`
2. Import SBOM containing `magento/product-community-edition` (composer dependency)
3. Navigate to component: `pkg:composer/magento/product-community-edition@2.4.5-p7`
4. Check vulnerability analysis results

### Expected Behavior

- Vulnerabilities from NVD should be displayed for Magento 2 versions
- Security patches (e.g., 2.4.7-p7) should trigger vulnerability alerts
- TYPO3 vulnerabilities should also be visible

### Dependency-Track Version

4.13.5

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

16.4

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.