Issue with converting json to cyclonedx format

[Kankarollo]

Description

When you try to convert json report to cyclonedx format with "convert" function of trivy it won't be the same as generating cyclonedx sbom with "image" function. Difference is that during convert "ratings" value in new sbom is empty. We are importing later these sboms to next tools that saves the vulnerabilities info, because of that issue the next tools couldn't recognize vulnerabilities in the report.

Additional misdirecting issue is that during converting json to sbom reports with convert you will receive info:

--format cyclonedx" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the CycloneDX report.
trivy convert --format cyclonedx -o ubuntu-convert-test-sbom.json --scanners vuln ubuntu-convert-test.json

You will receive error as convert don't have --scanners flag.

Desired Behavior

Converting json report to cyclonedx will give the same output as generating cyclonedx report from the beginning with scan.

Actual Behavior

There is difference between file generated from convert function and file generated from "trivy image --format cyclonedx"

Reproduction Steps

# Generate trivy report in json form and convert it to sbom with convert function
trivy image ubuntu:20.04 --format json --list-all-pkgs --scanners vuln -o ubuntu-convert-test.json
trivy convert --format cyclonedx -o ubuntu-convert-test-sbom.json ubuntu-convert-test.json

# Generate trivy cyclonedx report 
trivy image ubuntu:20.04 --format cyclonedx --scanners vuln --list-all-pkgs -o ubuntu-trivy-sbom.json

# Compare both of them, you will see that "ratings" value is empty in ubuntu-convert-test-sbom.json

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

trivy convert --format cyclonedx -o ubuntu-convert-test-sbom.json ubuntu-convert-test.json --debug
2023-11-27T10:32:47.572+0100    DEBUG   ["cyclonedx" "spdx" "spdx-json" "github"] automatically enables '--list-all-pkgs'.
2023-11-27T10:32:47.572+0100    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-11-27T10:32:47.572+0100    INFO    "--format cyclonedx" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the CycloneDX report.
2023-11-27T10:32:47.575+0100    DEBUG   Writing report to output...

Operating System

Ubuntu 22.04

Version

Version: 0.47.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-11-27 06:12:38.878282157 +0000 UTC
  NextUpdate: 2023-11-27 12:12:38.878281646 +0000 UTC
  DownloadedAt: 2023-11-27 09:06:55.908364915 +0000 UTC

Tested on 0.42.0 also. Same issue.

Checklist

• Run trivy image --reset
• Read the troubleshooting

[DmitriyLewen]

Hello @Kankarollo
Thanks for your report!

We currently don't include VendorSeverity in json format:

trivy/pkg/types/report.go

Lines 118 to 122 in b5874e3

	// VendorSeverity includes all vendor severities.
	// It would be noisy to users, so it should be removed from the JSON output.
	for i := range r.Vulnerabilities {
	r.Vulnerabilities[i].VendorSeverity = nil
	}

But we have already removed the removal of Highliters - #5531.
We may not need to remove VendorSeverity.
@knqyf263 wdyt?

[knqyf263]

OK, we can keep VendorSeverity in JSON.

[DmitriyLewen]

Created #5765 for this task.

[FranAguiar]

I'm running Trivy 0.53.0. When I try to convert from JSON to CycloneDX, I lose the vulnerabilities. Is there a way to retain them?

[DmitriyLewen]

Did you try to use --scanners vuln flag?

[FranAguiar]

I read somewhere that I have to add the flag --list-all-pkgs to the analysis before do the convert, I tried and it works like a charm. The flag --scanners vuln is not available for the convert command, the log warning and the docs are a bit confusing

[DmitriyLewen]

The flag --scanners vuln is not available for the convert command, the log warning and the docs are a bit confusing

exactly!

I read somewhere that I have to add the flag --list-all-pkgs to the analysis before do the convert, I tried and it works like a charm

Cool!