Dependency appears in Trivy but not when running maven tree.

[viniciusnavarro]

I'm using Trivy to scan a java project using the trivy filesystem method that uses pom to analyze third-party dependencies. I will use the generated sbom to import into dependency-track.

Trivy is showing me that there is a component that is vulnerable, which is dom4j.

But when running the maven dependency tree to know where to fix this component it doesn't exist in the project(
using the VS code search tool).

And I'm also noticing that Trivy is showing more artifacts than the cyclonedx plugin for maven and I'm getting a little confused, am I missing something?

Commands:
trivy sbom --output sbom.json --artifact-type fs ./
mvn dependency:tree

[DmitriyLewen]

Hello @viniciusnavarro
Thanks for your interest to Trivy!

This is strange situation.
Trivy gets all dependencies from dependencies and dependencyManagement tags.

Can you send your POM file(or part of reproduced issue file) to investigate your problem?

Also I don't think I understood you correctly: you don't have the dom4j package as a result of the mvn dependency:tree command?

Regards, Dmitriy

[viniciusnavarro]

Hi @DmitriyLewen

It's a great tool!

And on this last question the answer is yes, to help understand the situation:

1. Maven

mvn dependency:tree

In the generated file I can't find the "dom4j"

Attached file: mvntree.log

2.Cyclonedx Maven Plugin

After building the application, a bom.json file is generated and in this file I also don't find the "dom4j" dependency

Attached file: bomMavenPluginCycloneDx.json.log

3.Trivy
Only when I use Trivy(trivy sbom --output sbom.json --artifact-type fs .) sbom.json is generated and dom4j appears.

Attached file: sbomTrivy.json.log

[DmitriyLewen]

Hello @viniciusnavarro
Thanks for waiting.

I investigated your logs.
I can't understand why trivy report contains multiple version for single dependency.
if possible i need your pom.xml file to reproduce your case.

[github-actions[bot]]

This issue is stale because it has been labeled with inactivity.

[DmitriyLewen]

Hello @viniciusnavarro

We have added some changes to parsing of pom.xml files in v0.31.3.

Can you update your Trivy and check your file?
Perhaps these changes will solve your issue.

Regards, Dmitriy