l3montree-dev / l3montree-dev/devguard
Make CVE (`vulnerabilities`) in scanned SBOMs available inside DevGuard
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 161
- Forks
- 43
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 37
Description
Is your feature request related to a problem? Please describe.
SBOM created by external software or customer can contain the property vulnerabilities. This information is lost when importing the SBOM into Devguard.
Describe the solution you'd like
vulnerabilities is scanned and included in the vulnerabilies inside Devguard.
Context:
- CycloneDX Spec: https://cyclonedx.org/docs/1.7/json/#vulnerabilities
- Devguard might not "find" all vulnerabilities if the "CVE data is wrong" - some external tools can find "more" https://github.com/l3montree-dev/devguard/issues/2597
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the SBOM import path and read the CycloneDX 1.7 JSON vulnerabilities specification linked in the issue. Check how imported vulnerability data is currently represented in DevGuard; done means vulnerabilities supplied in scanned SBOMs are retained and available inside DevGuard, including cases where external tools find vulnerabilities DevGuard does not.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100