DependencyTrack / DependencyTrack/dependency-track
Investigate possibility of integrating with nexB VulnerableCode
Open
enhancement
p2
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
VulnerableCode may be able to be as an additional source of vulnerability intelligence.
If an org uses VulnerableCode and has the webserver running, the API could be used by Dependency-Track during analysis.
SPIKE: Need to determine if PURL or CPE is supported in API, and if not, what other pieces of data it needs. Also need to investigate response to ensure the necessary fields are there to support it as a source.
https://github.com/nexB/vulnerablecode
Contributor guide
Assessment
This issue has not been assessed yet.