Advisories details doesn't show affected packages, products, SBOMs

[ctron]

Opening details about an advisory (e.g. http://localhost:8080/advisories/urn:uuid:1f5cedd6-fbcc-40a0-9f3c-56af4fbfc942), I cannot get seem to get any information on which packages, SBOMs, products this advisory affects.

[carlosthe19916]

@ctron could you explain what you are requesting here?

The following image is a screenshot of the Advisory Details Page in V1. You are asking to render packages, SBOMs, products this advisory affects.

• I can not find any references to Packages in the image below
• I can not find any reference of SBOMs in the image below
• V1 has a section called Product Info represented with a Tree. I'll be happy to implement that Tree. Could you tell me which field of /api/v1/advisory/{id} I can use to replicate the same Tree?

https://trust.rhcloud.com/advisory/content/CVE-2024-1753

[ctron]

Maybe navigate to the "vulnerabilties" tab?

[carlosthe19916]

Maybe navigate to the "vulnerabilties" tab?

@ctron Sure. The image below is the "Vulnerabilities" tab.

You are asking to render data about: packages, SBOMs, products this advisory affects.

• I can not find any references to PACKAGES in the image below
• I can not find any reference of SBOMs in the image below
• I do see a section called "PRODUCT STATUS" that lists Products that this Advisory has a relation with. I guess this is what you are asking to implement right? Can you confirm it?
  • If you confirm that is what you are asking, could you help me to understand where to get that data from? If I hit /api/v1/advisory/{id} I can not see any field that relates to "Product statuses".

[ctron]

SBOMs we sometimes call products. Packages sometimes PURLs.

Taking a look at the left hand side, you'll see the product status. Taking a look at the right hand side tree, detailed information about packages (CSAF world) referencing to packages via PURLs.

So for each vulnerability, I can see how this affects "my products". Which boils down to SBOMs I guess. Or I can find more specific information about packages in the tree.

I believe this information is valuable to the user. Today I don't see whatsoever, as there's not details page. A thing that we have in v1.