OSS Vulnerabilities not found in CWE database cause casting error
name: Bug Report
about: Create a report to help us improve
- Version: v1.1.8 and Main
- Platform: Linux x86_64
When running OSS Scanner against a cycloneDX SBOM, an exception is being generated:
[vagrant@dd-rocky8-bldl01bdd2r2-c44141 hoppr-cop]$ poetry run hoppr-cop --format cyclone_dx framework.cdx.json
GrypeScanner is not activated because grype is not on the PATH
TrivyScanner is activated
OSSIndexScanner is activated
GemnasiumScanner is activated
processing framework.cdx.json
OSSIndexScanner generated an exception: invalid literal for int() with base 10: 'noinfo'
This error appears to be caused when a Vulnerability is processed and formated into a CycloneDX Vulnerability here. If the OSS Vulnerability doesn't have a CWE (ex:https://ossindex.sonatype.org/vulnerability/CVE-2023-20860) the "noinfo" causes a casting exception.
Recommend updating OSS scanner python code to handle this case.