dependency-check / dependency-check/DependencyCheck
Report Fixed State of Vulnerabilities
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
I'd like to be able to filter out vulnerabilities for which no fix is available by upgrading the dependency, so I can present them differently compared to vulnerabilities which can be fixed by upgrading the version of the dependency.
**Describe the solution you'd like**
Include the fixed status for each vulnerability in the Dependency Check json output.
**Describe alternatives you've considered**
The `grype` output (also available in json format) includes the version in which the CVE is fixed:
```
NAME INSTALLED FIXED-IN VULNERABILITY SEVERITY
apk-tools 2.10.6-r0 2.10.7-r0 CVE-2021-36159 Critical
libcrypto1.1 1.1.1k-r0 CVE-2021-3711 Critical
libcrypto1.1 1.1.1k-r0 CVE-2021-3712 High
libssl1.1 1.1.1k-r0 CVE-2021-3712 High
libssl1.1 1.1.1k-r0 CVE-2021-3711 Critical
```
The output from `trivy` (also in json format) includes information about the fixed status as well.
Additionally `trivy` has an `--ignore-unfixed` flag and `grype` has an `--only-fixed` flag.
My request is for the Dependency Check json output to also include the fixed status of a CVE.
**Additional context**
I'm not sure if this data (fixed version) is available in the data sources used by Dependency Check.
Contributor guide
Assessment
This issue has not been assessed yet.