No vulns found for pkg:github/gruntjs/[email protected], expected 3 vulns

[muellerst-hg]

I created a project to test github purls. The project has two components, both only have a purl identifier:

1. pkg:github/gruntjs/[email protected]
2. pkg:npm/[email protected]

Here's the BOM file to reproduce: grunt-bom.json

The grunt version 1.2.1 is outdated and contains three known security vulnerabilities, which also can be found on NVD using CPE cpe:2.3:a:gruntjs:grunt:*:*:*:*:*:node.js:*:*:

• CVE-2022-1537
• CVE-2022-0436
• CVE-2020-7729

DependencyTrack lists all three findings for the component with purl pkg:npm/[email protected] as expected.
However the component with the github purl pkg:github/gruntjs/[email protected] does not list any findings.

My expectation would be that the component with github purl also lists three findings.

What's wrong with the component?
How do github purls work?

Grunt is hosted on Github and provides releases: https://github.com/gruntjs/grunt/releases
I'm using DependencyTrack 4.10.1

EDIT:

• Internal and Sonatype Analyzer enabled
• All fuzzy CPE matching disabled
• NVD + Github Vulnerability Sources enabled

[muellerst-hg]

Could anyone please explain why components with github purls are not showing any vulns?

[riteshnoronha]

@muellerst-hg try enabling OSV.

[muellerst-hg]

@riteshnoronha It was already enabled

[riteshnoronha]

interesting .. i tested this on 4.10.1 and it works. Wondering if its not download vulns information from nvd or osv. Do u see the vulnerability tab on the left, and if u search any of your expected vulns do u find them?

[muellerst-hg]

Did you test using pkg:github/gruntjs/[email protected]? That's the purl which does not work for me.
In contrast, pkg:npm/[email protected] works as expected, giving the same result as you posted

[riteshnoronha]

DT doesn't have an internal mechanism to convert PURL to CPE; it relies on external services like the OSS Sonatype Analyzer and OSV for this purpose. These services need to map packages likepkg:github/gruntjs/[email protected] to cpe:2.3:a:gruntjs:grunt:1.2.1:*:*:*:*:node.js:*:* and pkg:npm/[email protected] to cpe:2.3:a:gruntjs:grunt:1.2.1:*:*:*:*:node.js:*:*.

The current mapping only associates the npm package PURL with vulnerabilities. While this aligns with the logic that most vulnerabilities discovered are filed against the package manager hosting the code, it can be confusing for end-users since, logically, they represent the same component.

AFAIK DT can't address this without independently building and maintaining the mapping or if Sonatype and OSV need to incorporate it.