syalioune
syalioune
Looking at the different logs and sbom provided, the common pattern that emerge is a nested duplicate component like in the SBOM below ```json { "bomFormat": "CycloneDX", "specVersion": "1.4", "version":...
Hello @salfie Thanks for your thorough investigation. It match with my observations and based on that, I can provide the attached real life reproductible example [cyclonedx-gomod-issue-1905.zip](https://github.com/DependencyTrack/dependency-track/files/11602835/cyclonedx-gomod-issue-1905.zip). Given the example application...
> Apologies for the delayed response, I only now got some time to look at BOM processing more closely. No pb. Same time issues here. I guess the fix you...
They are two distinct components serving their own resources so you can't run them on the same port. You can however use the same domain so long as they can...
Following discussion https://github.com/DependencyTrack/dependency-track/discussions/2188, I think that an agreement should be reached @nscuro @stevespringett. In any case, there is indeed another bug as comparing `cpe:2.3:a:xiph:speex:1.2:-:*:*:*:*:*:*` to `cpe:2.3:a:xiph:speex:1.2:-:*:*:*:*:*:*` lead to a no...
My understanding as per https://nvlpubs.nist.gov/nistpubs/Legacy/IR/nistir7696.pdf is that `cpe:2.3:a:apache:http_server:-:*:*:*:*:*:*:*` should not match `cpe:2.3:a:apache:http_server:2.4.53:*:*:*:*:*:*:*`
Hello @melba-lopez Sorry for the late answer. I think the _blocking_ point on this PR is not a technical one but a functional one. With : - Source (NVD) :...
> I'm going to close this now as nothing seems likely to move on the original complaint. Sorry for the silent treatment, I'll submit a PR to make the documentation...
Hello @cmenzi The difference lies with OSSIndex which report v4.8.5 as still vulnerable.  https://ossindex.sonatype.org/vulnerability/CVE-2022-41064  You can create an issue in OSSIndex repo if need be : https://github.com/OSSIndex/vulns
That deviation notice is not machine readable & processable by DT which only reports what OSSIndex tell. Only possibility for you, if you don't use netstandard 1.3, is to audit...