Current Behavior

A BOM generated with trivy image --format cyclonedx --output sbom.json amazoncorretto:21.0.7 will result in no vulnerbilities found when uploaded to DT although there are (at the time of writing) 3 CVEs known.

Steps to Reproduce

1. generate an SBOM with trivy image --format cyclonedx --output result.cdx amazoncorretto:21.0.7 OR use this minimal example: minimal.json

2. upload SBOM into a project in DT

Expected Behavior

At the time of writing, at least 3 CVEs should have been reported for the full SBOM, two of them are from libxml, which is included as an example in the minimal SBOM attached above.

Dependency-Track Version

4.13.3

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

16

Browser

Microsoft Edge

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

My analysis up to this point:

Assume the minimal example attached above: This SBOM has two components: one component with the category operating_system, the name amazon and the version 2 (Karoo) and another component (a library) with the PURL pkg:rpm/amazon/[email protected]?arch=x86_64&distro=amazon-2+%28Karoo%29".

This code

Maybe using an URL-encoded version of the OS string as the key would help?

import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
// ...
} else if (component.getClassifier() == Classifier.OPERATING_SYSTEM) {
    LOGGER.debug("add operative system %s".formatted(component.toString()));
    var key = URLEncoder.encode("%s-%s".formatted(component.getName(), component.getVersion()), StandardCharsets.UTF_8);
    os.put(key, OS.newBuilder().setFamily(component.getName()).setName(component.getVersion()).build());
}
// ...
String distro = component.getPurl().getQualifiers().get("distro");
if (os.get(distro) != null) {
    builder.setOs(os.get(distro));
}

Cross check: Manually editing the SBOM to remove everything after the digit "2" in both, the OS component's version and the library's component PURL's "distro" part, will result in an SBOM that works just fine.