False negative scans when using bomber on SBOM with Cyclone CDX SpecVersion 1.6

[clobraico-hf]

Problem

Running bomber on SBOMs with specVersion "1.6" is failing.

• Scan works on the sbom_specver1.5.json file
  • ■ Scanning 77 packages for vulnerabilities...
• Scan does not work on sbom_specver1.6.json file
  • ■ No packages were detected. Nothing has been scanned.

(Example SBOMs attached below)

Additional background

• The files in question are both merged SBOMs. Merging has been carried out with cyclonedx-cli merge tool. There have been issues observed with using bomber on Merged SBOMs

Version info:

• bomber ver 0.5

sbom_specver1.5.json
sbom_specver1.6.json

[djschleen]

Thanks for reporting this @clobraico-hf - I’m not sure the underlying library we use to parse CycloneDX files supports 1.6 yet. I may need to add a version check in the code to warn of this.

I’m actively working on a new release with a new GitHub Advisory Database vulnerability provider so I’ll get this triaged pretty quickly.

[djschleen]

Hey @clobraico-hf , I put some checks in 0.5.1 that will display warnings if the ecosystem isn't supported for the provider used. The SBOM's you attached have packages in the conan ecosystem. This ecosystem isn't supported by OSV, but is supported by OSSINDEX.

[djschleen]

Debug info of new checks