DependencyTrack / DependencyTrack/dependency-track

Threat Suppression for Component: Threat Invisible at Project Level

Open
#649 3 comments 0 reactions 0 assignees View on GitHub
in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:
In DT 3.8.0, performing vulnerability triage within a project seems to work fine. After the audit is peformed, the audit trail displays correct comment, analysis, and suppression state.

However, there are problems with performing triage from `/components` page.

1. When the component vulnerability tab is refreshed the "Analysis" column does not display analysis result. eg "Exploitable".
2. If the vulnerability is suppressed then it disappears from component vulnerability tab. The consequence is that it cannot then be unsuppressed (or have any other kind of auditing performed).
3. The suppression also impacts projects that use the component.... the vulnerability is entirely missing from the project audit tab, although the counter on the tab (new feature in 3.8.0) is correct. Thus, for one project and 3 tests, the audit tab counter says 15 but the page itself says "Showing 1 to 10 of 12 rows".

### Steps to Reproduce:

1. Pick a component/version that has several vulnerabilities and which is used in at least one project
Check that the vulnerabilities are displaying in the project, and reported against the component/version. Chose one of the vulnerabilities (x) and make a note of the id.
2. On components page, locate the component/version. Make sure you do not accidentally select a different version!
3 On Vulnerabilities tab, enter audit mode. Locate vulnerability x and set Analysis to "Exploitable". After refreshing the screen, note that the Analysis column is not displaying "Exploitable" as it should.
4. Update analysis and suppress the vulnerability. On page refresh, note that the vulnerability has disappeared fom the screen.
5. Navigate back to project that uses the component. The vulnerability is now missing.

### Expected Behavior:
Vulnerability suppression does not remove vulnerabilities from display. It must be possible to re-do triage and reverse suppression.

What I am actually expecting is to have a way whereby triage performed on an individual vulnerability in a project can be updated by re-performing for the component as a whole. With the defect reported above I do not know if this is possible. If not, I can log a separate enhancement ...and also request a way to globally triage a vulnerability such that all vulnerable versions of a component are audited in one go (jackson-databind has a LOT of versions and a LOT of vulnerabilities).

### Environment:

- Dependency-Track Version: 3.8.0
- Distribution: [ Executable WAR ]
- BOM Format & Version: Cyclone DX 1.1
- Database Server: [ H2 ] (this was on my test server)
- Browser: Firefox 74.0

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.