After Component update, only CVEs related to updated CPE should be available

[JN-CSIRT]

Current Behavior

If we update the version and CPE of an existing component, all old CVEs not related to the new CPE and their audit histories are still available in Vulnerability Audit.

Steps to Reproduce

1. Edit any exist component with outdated version and CPE > Note available CVEs
2. Change version number and CPE to new one
3. After some time check for new CVEs > Old and new CVEs are observed

Expected Behavior

After updating the version and CPE of an existing component, only new CVEs and previously found CVEs related to the new CPE and their audit histories should be available in Vulnerability Audit.

Dependency-Track Version

4.6.2

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

No response

Browser

Mozilla Firefox

Checklist

• [X] I have read and understand the contributing guidelines
• [X] I have checked the existing issues for whether this defect was already reported