Different results scanning PHP SBOMs generated by cdxgen and Syft #2037
Labels
bug
Something isn't working
Comments
|
Look related: anchore/syft#1202, anchore/syft#2981. |
I see the similar problem with SBOMs generated from SBOM by cdxgen: "group": "@colors",
"name": "colors",
"version": "1.5.0",SBOM by Syft: "name": "@colors/colors",
"version": "1.5.0",This leads to a false positive GHSA-gh88-3pxp-6fm8 on scanning cdxgen's SBOM: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
What happened:
I'm working on detecting vulns in a PHP project and I get quite different results when scanning and I'm not sure if it's expected or there could be something to improve in Grype, Syft or cdxgen. I've created a minimal example to demonstrate the problem.
cdxgen + Grype:
Syft + Grype:
As we can see, completely different vulns are detected.
What you expected to happen:
Same results in two scenarios.
How to reproduce it (as minimally and precisely as possible):
PHP
composer.json:{ "name": "example/php_sbom_issue", "require": { "yiisoft/yii2": "2.0.49.2" }, "repositories": [ { "type": "composer", "url": "https://asset-packagist.org" } ], "config": { "allow-plugins": { "yiisoft/yii2-composer": true } } }composer.lockgenerated viacomposer update --no-install:Click me
Commands to generate SBOMs:
Generarted
cdxgen.jsonSBOM:Click me
{ "bomFormat": "CycloneDX", "specVersion": "1.5", "serialNumber": "urn:uuid:f108f84c-51a3-4f75-84ae-27eaf31d1390", "version": 1, "metadata": { "timestamp": "2024-08-06T22:07:01Z", "tools": { "components": [ { "group": "@cyclonedx", "name": "cdxgen", "version": "10.8.1", "purl": "pkg:npm/%40cyclonedx/cdxgen@10.8.1", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@10.8.1", "author": "OWASP Foundation", "publisher": "OWASP Foundation" } ] }, "authors": [ { "name": "OWASP Foundation" } ], "lifecycles": [ { "phase": "build" } ], "component": { "group": "example", "name": "php_sbom_issue", "type": "application", "version": "latest", "bom-ref": "pkg:composer/example/php_sbom_issue@latest", "purl": "pkg:composer/example/php_sbom_issue%40latest", "components": [ { "group": "", "name": "composer_issue", "version": "latest", "type": "application", "bom-ref": "pkg:gem/composer_issue@latest", "purl": "pkg:gem/composer_issue@latest" } ] }, "properties": [ { "name": "cdx:bom:componentTypes", "value": "composer" }, { "name": "cdx:bom:componentNamespaces", "value": "bower-asset\\ncebe\\nezyang\\nparagonie\\nyiisoft" } ] }, "components": [ { "group": "bower-asset", "name": "inputmask", "version": "5.0.9", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "http://opensource.org/licenses/mit-license.php" } } ], "purl": "pkg:composer/bower-asset/inputmask@5.0.9", "externalReferences": [ { "type": "vcs", "url": "https://github.com/RobinHerbots/Inputmask.git" } ], "type": "library", "bom-ref": "pkg:composer/bower-asset/inputmask@5.0.9", "evidence": { "identity": { "field": "purl", "confidence": 1, "methods": [ { "technique": "manifest-analysis", "confidence": 1, "value": "/Users/yuri/dev/composer_issue/composer.lock" } ] } }, "properties": [ { "name": "SrcFile", "value": "/Users/yuri/dev/composer_issue/composer.lock" } ] }, { "group": "bower-asset", "name": "jquery", "version": "3.7.1", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:composer/bower-asset/jquery@3.7.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/jquery/jquery-dist.git" } ], "type": "framework", "bom-ref": "pkg:composer/bower-asset/jquery@3.7.1", "evidence": { "identity": { "field": "purl", "confidence": 1, "methods": [ { "technique": "manifest-analysis", "confidence": 1, "value": "/Users/yuri/dev/composer_issue/composer.lock" } ] } }, "properties": [ { "name": "SrcFile", "value": "/Users/yuri/dev/composer_issue/composer.lock" } ] }, { "group": "bower-asset", "name": "punycode", "version": "v2.2.3", "scope": "required", "purl": "pkg:composer/bower-asset/punycode@v2.2.3", "externalReferences": [ { "type": "vcs", "url": "https://github.com/mathiasbynens/punycode.js.git" } ], "type": "library", "bom-ref": "pkg:composer/bower-asset/punycode@v2.2.3", "evidence": { "identity": { "field": "purl", "confidence": 1, "methods": [ { "technique": "manifest-analysis", "confidence": 1, "value": "/Users/yuri/dev/composer_issue/composer.lock" } ] } }, "properties": [ { "name": "SrcFile", "value": "/Users/yuri/dev/composer_issue/composer.lock" } ] }, { "group": "bower-asset", "name": "yii2-pjax", "version": "2.0.8", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:composer/bower-asset/yii2-pjax@2.0.8", "type": "library", "bom-ref": "pkg:composer/bower-asset/yii2-pjax@2.0.8", "evidence": { "identity": { "field": "purl", "confidence": 1, "methods": [ { "technique": "manifest-analysis", "confidence": 1, "value": "/Users/yuri/dev/composer_issue/composer.lock" } ] } }, "properties": [ { "name": "SrcFile", "value": "/Users/yuri/dev/composer_issue/composer.lock" } ] }, { "group": "cebe", "name": "markdown", "version": "1.2.1", "description": "A super fast, highly extensible markdown parser for PHP", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:composer/cebe/markdown@1.2.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/cebe/markdown.git" } ], "type": "library", "bom-ref": "pkg:composer/cebe/markdown@1.2.1", "evidence": { "identity": { "field": "purl", "confidence": 1, "methods": [ { "technique": "manifest-analysis", "confidence": 1, "value": "/Users/yuri/dev/composer_issue/composer.lock" } ] } }, "properties": [ { "name": "SrcFile", "value": "/Users/yuri/dev/composer_issue/composer.lock" }, { "name": "Namespaces", "value": "cebe\\markdown\\" } ] }, { "group": "ezyang", "name": "htmlpurifier", "version": "v4.17.0", "description": "Standards compliant HTML filter written in PHP", "scope": "required", "licenses": [ { "license": { "id": "LGPL-2.1-or-later", "url": "https://opensource.org/licenses/LGPL-2.1-or-later" } } ], "purl": "pkg:composer/ezyang/htmlpurifier@v4.17.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/ezyang/htmlpurifier.git" } ], "type": "library", "bom-ref": "pkg:composer/ezyang/htmlpurifier@v4.17.0", "evidence": { "identity": { "field": "purl", "confidence": 1, "methods": [ { "technique": "manifest-analysis", "confidence": 1, "value": "/Users/yuri/dev/composer_issue/composer.lock" } ] } }, "properties": [ { "name": "SrcFile", "value": "/Users/yuri/dev/composer_issue/composer.lock" }, { "name": "Namespaces", "value": "HTMLPurifier" } ] }, { "group": "paragonie", "name": "random_compat", "version": "v9.99.100", "description": "PHP 5.x polyfill for random_bytes() and random_int() from PHP 7", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:composer/paragonie/random_compat@v9.99.100", "externalReferences": [ { "type": "vcs", "url": "https://github.com/paragonie/random_compat.git" } ], "type": "library", "bom-ref": "pkg:composer/paragonie/random_compat@v9.99.100", "evidence": { "identity": { "field": "purl", "confidence": 1, "methods": [ { "technique": "manifest-analysis", "confidence": 1, "value": "/Users/yuri/dev/composer_issue/composer.lock" } ] } }, "properties": [ { "name": "SrcFile", "value": "/Users/yuri/dev/composer_issue/composer.lock" } ] }, { "group": "yiisoft", "name": "yii2", "version": "2.0.49.2", "description": "Yii PHP Framework Version 2", "scope": "required", "licenses": [ { "license": { "id": "BSD-3-Clause", "url": "https://opensource.org/licenses/BSD-3-Clause" } } ], "purl": "pkg:composer/yiisoft/yii2@2.0.49.2", "externalReferences": [ { "type": "vcs", "url": "https://github.com/yiisoft/yii2-framework.git" } ], "type": "framework", "bom-ref": "pkg:composer/yiisoft/yii2@2.0.49.2", "evidence": { "identity": { "field": "purl", "confidence": 1, "methods": [ { "technique": "manifest-analysis", "confidence": 1, "value": "/Users/yuri/dev/composer_issue/composer.lock" } ] } }, "properties": [ { "name": "SrcFile", "value": "/Users/yuri/dev/composer_issue/composer.lock" }, { "name": "Namespaces", "value": "yii\\" } ] }, { "group": "yiisoft", "name": "yii2-composer", "version": "2.0.10", "description": "The composer plugin for Yii extension installer", "scope": "required", "licenses": [ { "license": { "id": "BSD-3-Clause", "url": "https://opensource.org/licenses/BSD-3-Clause" } } ], "purl": "pkg:composer/yiisoft/yii2-composer@2.0.10", "externalReferences": [ { "type": "vcs", "url": "https://github.com/yiisoft/yii2-composer.git" } ], "type": "framework", "bom-ref": "pkg:composer/yiisoft/yii2-composer@2.0.10", "evidence": { "identity": { "field": "purl", "confidence": 1, "methods": [ { "technique": "manifest-analysis", "confidence": 1, "value": "/Users/yuri/dev/composer_issue/composer.lock" } ] } }, "properties": [ { "name": "SrcFile", "value": "/Users/yuri/dev/composer_issue/composer.lock" }, { "name": "Namespaces", "value": "yii\\composer\\" } ] } ], "services": [], "dependencies": [ { "ref": "pkg:composer/example/php_sbom_issue@latest", "dependsOn": [ "pkg:composer/yiisoft/yii2@2.0.49.2" ] }, { "ref": "pkg:composer/bower-asset/inputmask@5.0.9", "dependsOn": [ "pkg:composer/bower-asset/jquery@3.7.1" ] }, { "ref": "pkg:composer/bower-asset/jquery@3.7.1", "dependsOn": [] }, { "ref": "pkg:composer/bower-asset/punycode@v2.2.3", "dependsOn": [] }, { "ref": "pkg:composer/bower-asset/yii2-pjax@2.0.8", "dependsOn": [ "pkg:composer/bower-asset/jquery@3.7.1" ] }, { "ref": "pkg:composer/cebe/markdown@1.2.1", "dependsOn": [] }, { "ref": "pkg:composer/ezyang/htmlpurifier@v4.17.0", "dependsOn": [] }, { "ref": "pkg:composer/paragonie/random_compat@v9.99.100", "dependsOn": [] }, { "ref": "pkg:composer/yiisoft/yii2@2.0.49.2", "dependsOn": [ "pkg:composer/bower-asset/inputmask@5.0.9", "pkg:composer/bower-asset/jquery@3.7.1", "pkg:composer/bower-asset/punycode@v2.2.3", "pkg:composer/bower-asset/yii2-pjax@2.0.8", "pkg:composer/cebe/markdown@1.2.1", "pkg:composer/ezyang/htmlpurifier@v4.17.0", "pkg:composer/paragonie/random_compat@v9.99.100", "pkg:composer/yiisoft/yii2-composer@2.0.10" ] }, { "ref": "pkg:composer/yiisoft/yii2-composer@2.0.10", "dependsOn": [] } ] }Generated
syft.jsonSBOM:Click me
{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:93dd2a98-ace9-48b4-8a3d-f9c21b6f5925", "version": 1, "metadata": { "timestamp": "2024-08-07T01:07:10+03:00", "tools": { "components": [ { "type": "application", "author": "anchore", "name": "syft", "version": "1.9.0" } ] }, "component": { "bom-ref": "280526f80efd5b66", "type": "file", "name": "composer.lock", "version": "sha256:fa49da4efa632d3f4871a5faaf2b891adddcb25024d480decb71cb7921139eb7" } }, "components": [ { "bom-ref": "pkg:composer/bower-asset/inputmask@5.0.9?package-id=f8aba670d7b79f5d", "type": "library", "name": "bower-asset/inputmask", "version": "5.0.9", "licenses": [ { "license": { "name": "http://opensource.org/licenses/mit-license.php" } } ], "cpe": "cpe:2.3:a:bower-asset\\/inputmask:bower-asset\\/inputmask:5.0.9:*:*:*:*:*:*:*", "purl": "pkg:composer/bower-asset/inputmask@5.0.9", "properties": [ { "name": "syft:package:foundBy", "value": "php-composer-lock-cataloger" }, { "name": "syft:package:language", "value": "php" }, { "name": "syft:package:type", "value": "php-composer" }, { "name": "syft:package:metadataType", "value": "php-composer-lock-entry" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower-asset\\/inputmask:bower_asset\\/inputmask:5.0.9:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower_asset\\/inputmask:bower-asset\\/inputmask:5.0.9:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower_asset\\/inputmask:bower_asset\\/inputmask:5.0.9:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower:bower-asset\\/inputmask:5.0.9:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower:bower_asset\\/inputmask:5.0.9:*:*:*:*:*:*:*" }, { "name": "syft:location:0:path", "value": "/composer.lock" } ] }, { "bom-ref": "pkg:composer/bower-asset/jquery@3.7.1?package-id=c88c3e90f3660303", "type": "library", "name": "bower-asset/jquery", "version": "3.7.1", "licenses": [ { "license": { "id": "MIT" } } ], "cpe": "cpe:2.3:a:bower-asset\\/jquery:bower-asset\\/jquery:3.7.1:*:*:*:*:*:*:*", "purl": "pkg:composer/bower-asset/jquery@3.7.1", "properties": [ { "name": "syft:package:foundBy", "value": "php-composer-lock-cataloger" }, { "name": "syft:package:language", "value": "php" }, { "name": "syft:package:type", "value": "php-composer" }, { "name": "syft:package:metadataType", "value": "php-composer-lock-entry" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower-asset\\/jquery:bower_asset\\/jquery:3.7.1:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower_asset\\/jquery:bower-asset\\/jquery:3.7.1:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower_asset\\/jquery:bower_asset\\/jquery:3.7.1:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower:bower-asset\\/jquery:3.7.1:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower:bower_asset\\/jquery:3.7.1:*:*:*:*:*:*:*" }, { "name": "syft:location:0:path", "value": "/composer.lock" } ] }, { "bom-ref": "pkg:composer/bower-asset/punycode@v2.2.3?package-id=9852900b72cb9bf9", "type": "library", "name": "bower-asset/punycode", "version": "v2.2.3", "cpe": "cpe:2.3:a:bower-asset\\/punycode:bower-asset\\/punycode:v2.2.3:*:*:*:*:*:*:*", "purl": "pkg:composer/bower-asset/punycode@v2.2.3", "properties": [ { "name": "syft:package:foundBy", "value": "php-composer-lock-cataloger" }, { "name": "syft:package:language", "value": "php" }, { "name": "syft:package:type", "value": "php-composer" }, { "name": "syft:package:metadataType", "value": "php-composer-lock-entry" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower-asset\\/punycode:bower_asset\\/punycode:v2.2.3:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower_asset\\/punycode:bower-asset\\/punycode:v2.2.3:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower_asset\\/punycode:bower_asset\\/punycode:v2.2.3:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower:bower-asset\\/punycode:v2.2.3:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower:bower_asset\\/punycode:v2.2.3:*:*:*:*:*:*:*" }, { "name": "syft:location:0:path", "value": "/composer.lock" } ] }, { "bom-ref": "pkg:composer/bower-asset/yii2-pjax@2.0.8?package-id=3678ef28348a125a", "type": "library", "name": "bower-asset/yii2-pjax", "version": "2.0.8", "licenses": [ { "license": { "id": "MIT" } } ], "cpe": "cpe:2.3:a:bower-asset\\/yii2-pjax:bower-asset\\/yii2-pjax:2.0.8:*:*:*:*:*:*:*", "purl": "pkg:composer/bower-asset/yii2-pjax@2.0.8", "properties": [ { "name": "syft:package:foundBy", "value": "php-composer-lock-cataloger" }, { "name": "syft:package:language", "value": "php" }, { "name": "syft:package:type", "value": "php-composer" }, { "name": "syft:package:metadataType", "value": "php-composer-lock-entry" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower-asset\\/yii2-pjax:bower_asset\\/yii2_pjax:2.0.8:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower_asset\\/yii2_pjax:bower-asset\\/yii2-pjax:2.0.8:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower_asset\\/yii2_pjax:bower_asset\\/yii2_pjax:2.0.8:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower-asset\\/yii2:bower-asset\\/yii2-pjax:2.0.8:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower-asset\\/yii2:bower_asset\\/yii2_pjax:2.0.8:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower_asset\\/yii2:bower-asset\\/yii2-pjax:2.0.8:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower_asset\\/yii2:bower_asset\\/yii2_pjax:2.0.8:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower:bower-asset\\/yii2-pjax:2.0.8:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:bower:bower_asset\\/yii2_pjax:2.0.8:*:*:*:*:*:*:*" }, { "name": "syft:location:0:path", "value": "/composer.lock" } ] }, { "bom-ref": "pkg:composer/cebe/markdown@1.2.1?package-id=56cffb7a90fbdc65", "type": "library", "name": "cebe/markdown", "version": "1.2.1", "licenses": [ { "license": { "id": "MIT" } } ], "cpe": "cpe:2.3:a:cebe\\/markdown:cebe\\/markdown:1.2.1:*:*:*:*:*:*:*", "purl": "pkg:composer/cebe/markdown@1.2.1", "properties": [ { "name": "syft:package:foundBy", "value": "php-composer-lock-cataloger" }, { "name": "syft:package:language", "value": "php" }, { "name": "syft:package:type", "value": "php-composer" }, { "name": "syft:package:metadataType", "value": "php-composer-lock-entry" }, { "name": "syft:location:0:path", "value": "/composer.lock" } ] }, { "bom-ref": "pkg:composer/ezyang/htmlpurifier@v4.17.0?package-id=1a01f1ab7bc76032", "type": "library", "name": "ezyang/htmlpurifier", "version": "v4.17.0", "licenses": [ { "license": { "id": "LGPL-2.1-or-later" } } ], "cpe": "cpe:2.3:a:ezyang\\/htmlpurifier:ezyang\\/htmlpurifier:v4.17.0:*:*:*:*:*:*:*", "purl": "pkg:composer/ezyang/htmlpurifier@v4.17.0", "properties": [ { "name": "syft:package:foundBy", "value": "php-composer-lock-cataloger" }, { "name": "syft:package:language", "value": "php" }, { "name": "syft:package:type", "value": "php-composer" }, { "name": "syft:package:metadataType", "value": "php-composer-lock-entry" }, { "name": "syft:location:0:path", "value": "/composer.lock" } ] }, { "bom-ref": "pkg:composer/paragonie/random_compat@v9.99.100?package-id=dc7a937336b89997", "type": "library", "name": "paragonie/random_compat", "version": "v9.99.100", "licenses": [ { "license": { "id": "MIT" } } ], "cpe": "cpe:2.3:a:paragonie\\/random-compat:paragonie\\/random-compat:v9.99.100:*:*:*:*:*:*:*", "purl": "pkg:composer/paragonie/random_compat@v9.99.100", "properties": [ { "name": "syft:package:foundBy", "value": "php-composer-lock-cataloger" }, { "name": "syft:package:language", "value": "php" }, { "name": "syft:package:type", "value": "php-composer" }, { "name": "syft:package:metadataType", "value": "php-composer-lock-entry" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:paragonie\\/random-compat:paragonie\\/random_compat:v9.99.100:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:paragonie\\/random_compat:paragonie\\/random-compat:v9.99.100:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:paragonie\\/random_compat:paragonie\\/random_compat:v9.99.100:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:paragonie\\/random:paragonie\\/random-compat:v9.99.100:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:paragonie\\/random:paragonie\\/random_compat:v9.99.100:*:*:*:*:*:*:*" }, { "name": "syft:location:0:path", "value": "/composer.lock" } ] }, { "bom-ref": "pkg:composer/yiisoft/yii2@2.0.49.2?package-id=69ac11cfcc2cf90c", "type": "library", "name": "yiisoft/yii2", "version": "2.0.49.2", "licenses": [ { "license": { "id": "BSD-3-Clause" } } ], "cpe": "cpe:2.3:a:yiisoft\\/yii2:yiisoft\\/yii2:2.0.49.2:*:*:*:*:*:*:*", "purl": "pkg:composer/yiisoft/yii2@2.0.49.2", "properties": [ { "name": "syft:package:foundBy", "value": "php-composer-lock-cataloger" }, { "name": "syft:package:language", "value": "php" }, { "name": "syft:package:type", "value": "php-composer" }, { "name": "syft:package:metadataType", "value": "php-composer-lock-entry" }, { "name": "syft:location:0:path", "value": "/composer.lock" } ] }, { "bom-ref": "pkg:composer/yiisoft/yii2-composer@2.0.10?package-id=9e649fc0c2007f55", "type": "library", "name": "yiisoft/yii2-composer", "version": "2.0.10", "licenses": [ { "license": { "id": "BSD-3-Clause" } } ], "cpe": "cpe:2.3:a:yiisoft\\/yii2-composer:yiisoft\\/yii2-composer:2.0.10:*:*:*:*:*:*:*", "purl": "pkg:composer/yiisoft/yii2-composer@2.0.10", "properties": [ { "name": "syft:package:foundBy", "value": "php-composer-lock-cataloger" }, { "name": "syft:package:language", "value": "php" }, { "name": "syft:package:type", "value": "php-composer" }, { "name": "syft:package:metadataType", "value": "php-composer-lock-entry" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:yiisoft\\/yii2-composer:yiisoft\\/yii2_composer:2.0.10:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:yiisoft\\/yii2_composer:yiisoft\\/yii2-composer:2.0.10:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:yiisoft\\/yii2_composer:yiisoft\\/yii2_composer:2.0.10:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:yiisoft\\/yii2:yiisoft\\/yii2-composer:2.0.10:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:yiisoft\\/yii2:yiisoft\\/yii2_composer:2.0.10:*:*:*:*:*:*:*" }, { "name": "syft:location:0:path", "value": "/composer.lock" } ] } ] }Anything else we need to know?:
It looks like the significant difference between SBOMs is that cdxgen splits the name and group:
OTOH, Syft doesn't:
Other scanners (osv-scanner, Trivy,
composer audit) detect only Yii2 vulns incomposer.lock.Environment:
grype version:The text was updated successfully, but these errors were encountered: