DependencyTrack / DependencyTrack/dependency-track
Take CycloneDX 1.2 patches into account when analysing CVE exposure
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
CycloneDX 1.2 have added support for [Pedigrees](https://cyclonedx.org/use-cases/#pedigree) such commits and patches. It is possible to specify that a patch/commit resolves vulnerabilities. This can make sense in some scenarios where patching components in a build system is preferred as a better option than upgrading the component (short term)
It would be great if this information could be taken into account when analysing CVEs for the components in DT, and that those CVE ids listed as resolved in an imported BOM is regarded as resolved by DT as well. The exact resolvent category to use in this case I am not sure of. I see that when auditing a CVE these possible values could be specified when suppressing the CVE
- Not Set
- False Positive
- Not affected
Not sure if any one of them fits. I guess from a monitoring point of view, it would be nice to get to know what CVE has been patched.
### Current Behavior:
### Proposed Behavior:
Contributor guide
Assessment
This issue has not been assessed yet.