Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(sbom): cyclonedx recommendations should include fixed versions for each package #4794

Merged
merged 2 commits into from
Jul 13, 2023
Merged

fix(sbom): cyclonedx recommendations should include fixed versions for each package #4794

merged 2 commits into from
Jul 13, 2023

Conversation

DmitriyLewen
Copy link
Contributor

Description

CycloneDX merges same CVE for different packages to 1 vulnerability.
We need to add all package names and fixed versions to recommendation field.

Related issues

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

@DmitriyLewen DmitriyLewen mentioned this pull request Jul 7, 2023
Closed
@DmitriyLewen DmitriyLewen marked this pull request as ready for review July 7, 2023 06:29
@DmitriyLewen DmitriyLewen requested a review from knqyf263 as a code owner July 7, 2023 06:29
@DmitriyLewen DmitriyLewen self-assigned this Jul 10, 2023
@knqyf263 knqyf263 added this pull request to the merge queue Jul 13, 2023
Merged via the queue into aquasecurity:main with commit fd0fd10 Jul 13, 2023
AnaisUrlichs pushed a commit to AnaisUrlichs/trivy that referenced this pull request Aug 10, 2023
@DmitriyLewen @AnaisUrlichs
fix(sbom): cyclonedx recommendations should include fixed versions fo…
a9c82eb 
…r each package (aquasecurity#4794)

* add all fixed versions to recommendations

* fix tests
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@knqyf263 knqyf263 knqyf263 approved these changes

Assignees

@DmitriyLewen DmitriyLewen

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

trivy return different vulns output when scanning regular compare to scanning with sbom cyclonedx
2 participants
@DmitriyLewen @knqyf263