OWASP Dependency Track unable to analyze vulnerability with PuRL

[swetan27]

The defect may already be reported! Please search for the defect before creating one.

Current Behavior:

As per my analysis, it is unable to perform vulnerability analysis with PuRL, for me.
It will be able to find vulnerability only when CPE URL is added in the component

Steps to Reproduce:

Step 1: Upload bom.xml into OWASP Dependency Track
Step 2: After analysis, OWASP Dependency Track produced 0 Risk Score and 0 Vulnerability for all components

As per my analysis, it is unable to perform vulnerability analysis with PuRL, for me.
It will be able to find vulnerability only when CPE URL is added in the component

Expected Behavior:

SHould be able to find vulnerability with PuRL

Environment:

• Dependency-Track Version: 3.8
• Distribution: [ Docker | Executable WAR | Traditional WAR ] - Docker
• BOM Format & Version: CycloneDX v1.1
• Database Server: PostgreSQL
• Browser: Mozilla Firefox v 79.0

Kindly let me know if you need any additional details

[stevespringett]

Refer to https://docs.dependencytrack.org/FAQ/

[swetan27]

Hi, I have enabled OSS Index Analyzer in OWASP Dependency Tracker with valid API Token.

[stevespringett]

What does the DT log say because OSS Index does find vulnerabilities in Axis 1.4.
https://ossindex.sonatype.org/component/pkg:maven/axis/axis@1.4

[swetan27]

Yes it shows 1 critical and 3 severe, and similarly, but OWASP Dependency Track only identities when i manually update the CPE URL. The expected behavior of the tool is to identify the vulnerability basis the bom.xml and bom.xml does not have CPE URL by default. It does not identify vulnerability basis PuRL alone. As mentioned above i have enabled OSS Index Analyzer and disabled internal analyzer.

[himanshubhardwajprovar]

I am facing same issue, how did you resolve it?

[stevespringett]

Again, what does the DT log say?

[swetan27]

DT Log screenshot:

[swetan27]

Also adding very recent logs:

Still the vulnerability count shows as 0.

[swetan27]

Request you to please let me know next steps please

[stevespringett]

Try enabling debug logging to see if there's any issues not being displayed. Refer to the bottom of https://docs.dependencytrack.org/getting-started/configuration/ for info on how to enable debug logging.

[satyendra22]

@stevespringett I'm also facing the same issue OWASP Dependency Track is unable to analyze vulnerability. I have enabled OSS Index Analyzer but no luck for me.

[stevespringett]

Can you provide an SBOM that is unable to be analyzed?

[satyendra22]

@stevespringett i have attached the bom
container-bom.zip
.

[stevespringett]

You might want to upgrade your version of grype. The SBOM produced by that version lacks CPE or PURL for all of the components. CPE or PURL is absolutely required by DT in order to identify vulnerabilities. OSS Index requires PURL.

[stevespringett]

See also https://cyclonedx.org/use-cases/#known-vulnerabilities

[satyendra22]

hi @stevespringett thanks for quick response. even the latest grype (0.23.0) version is not generating cpe or purl in XML file. not sure how it's supported by dependency track?

[stevespringett]

Grype is built on Syft and Syft has an open issue that is relevant to this issue. See anchore/syft#216

[satyendra22]

thanks @stevespringett for your support and quick response.

[zaichegk]

@stevespringett I'm also facing the same issue OWASP Dependency Track is unable to analyze vulnerability. If I will use version 4.3.6 and 4.3.1 (API and front) which can't to find out version of CycloneDX 1.4 (CycloneDX null) then Dependency Track can to sees vulnerabilities. As result, if Dependency Track determinate version of CycloneDX so it can't to find vulnerabilities.

[kashishtopi]

@stevespringett @swetan27 For me, I was facing the same issues, and Here are the few things that I did to which now the dep track is able to analyze Vulns.

Purl format: Make sure you mention mandatory fields in the format: pkg: package manager/name of the package @ version and adding a few more like 8-10 package manager references into the repository could have helped Repositories.