DependencyTrack / DependencyTrack/dependency-track

Vulnerabilities not shown since uograde

Open
#6,152 7 comments 1 reaction 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

We upgraded Dependency Track to the latest image + helm versions a few weeks ago. We have also tried again and now we are at 4.14.2. Ever since then we don't see any new vulnerabilities after uploading docker image sboms with the exact same workflow as before. I have tried to trigger a reindex and then reanalyze, that didn't help. The logs don't show any significant issue - just that 0 issues have been found. Old vulnerabilities are shown as well as components, licenses and all other info. I can see new CVEs are also updated as usual everyday.

### Steps to Reproduce

1. generate sbom with trivy image command (or jf scan command, that didnt work either): echo **** | trivy image --password-stdin --username devops --scanners vuln --exit-code 0 --format cyclonedx --output sbom.json --db-repository aquasec/trivy-db:latest --java-db-repository aquasecurity/trivy-java-db:1 /,client-image> --platform linux/amd64
2. upload to dependency track: curl -s -X POST https://:443/api/v1/bom -H 'Content-Type: multipart/form-data' -H 'X-Api-Key: ****' -k -F autoCreate=true -F projectName= -F projectVersion=-amd64 -F classifier=CONTAINER -F parentUUID= -F bom=@sbom.json

### Expected Behavior

Vulnerabilities listed as usual - no 0 in audit page/overview

### Dependency-Track Version

4.14.2

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.