dependency-check / dependency-check/DependencyCheck

Report Fixed State of Vulnerabilities

Open
#5,613 7 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Is your feature request related to a problem? Please describe.**

I'd like to be able to filter out vulnerabilities for which no fix is available by upgrading the dependency, so I can present them differently compared to vulnerabilities which can be fixed by upgrading the version of the dependency.

**Describe the solution you'd like**

Include the fixed status for each vulnerability in the Dependency Check json output.

**Describe alternatives you've considered**

The `grype` output (also available in json format) includes the version in which the CVE is fixed:

```
NAME INSTALLED FIXED-IN VULNERABILITY SEVERITY
apk-tools 2.10.6-r0 2.10.7-r0 CVE-2021-36159 Critical
libcrypto1.1 1.1.1k-r0 CVE-2021-3711 Critical
libcrypto1.1 1.1.1k-r0 CVE-2021-3712 High
libssl1.1 1.1.1k-r0 CVE-2021-3712 High
libssl1.1 1.1.1k-r0 CVE-2021-3711 Critical
```

The output from `trivy` (also in json format) includes information about the fixed status as well.

Additionally `trivy` has an `--ignore-unfixed` flag and `grype` has an `--only-fixed` flag.

My request is for the Dependency Check json output to also include the fixed status of a CVE.

**Additional context**

I'm not sure if this data (fixed version) is available in the data sources used by Dependency Check.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.