Components which are not having any vulnerabilities is showing as vulnerable component with CVE's in Dependency Track 4.12.1

[itmanju]

Current Behavior

Components which are not having any vulnerabilities is showing as vulnerable component with CVE's in Dependency Track 4.12.1.
Example:
Name: @react-leaflet/core
Version : 2.1.0
Purl: pkg:npm/%40react-leaflet/[email protected]

Attached is the list of CVE shown by DT for the above Example component

Steps to Reproduce

1.Create the component and provide the purl as given above
2.Check for vulnerabilities it shows 10 vulnerabilities
3.checked the component and version in other vulnerability sources but they show no vulnerability ( Synk)

Expected Behavior

1.Only the current vulnerability showed be shown.
2.Historical vulnerabilities should not be shown.

Dependency-Track Version

4.12.1

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

12

Browser

Google Chrome

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[aja08379]

Still seeing similar with pandas as well, ref: #3267

[coopercr]

Vulns may still pop if the plugin only checks the version in use, so if you've forked the plugin will pop even if the vulnerability is somehow not present - it still sees the affected version. I only looked at the first one, for Pimcore, but that plugin is a version check.Check out the others for same.

[melvin2001]

I believe I am seeing this same issue, Pandas 1.3.0 showing as vulnerable to CVE-2020-13091 when it should be version under 1.0.3

Easily reproduceable with the following minimal sbom:

{ "bomFormat": "CycloneDX", "specVersion": "1.6", "components": [ { "type": "library", "name": "pandas", "version": "1.3.0", "purl": "pkg:pypi/[email protected]", "cpe": "cpe:2.3:a:python:pandas:1.3.0:*:*:*:*:*:*:*" } ] }