Deviation of reported vulnerabilities between DT and NVD when no version is specified in CPE

[KS-DR]

Current Behavior

DT reports other vulnerabilities for a CPE like cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:* than the NVD search. The attached screenshot shows the deviations.

Steps to Reproduce

1.Creat a component in a project and use CPE cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*
2. Compare the reported vulnerabilities in DT with the NVD results under https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe%3A2.3%3Aa%3Azlib%3Azlib%3A*%3A*%3A*%3A*%3A*%3A*%3A*%3A*

Expected Behavior

DT should report the same vulnerabilities as the NVD when using NVD as a data source.

Dependency-Track Version

4.12.2

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

14.7

Browser

Microsoft Edge

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[nscuro]

Thanks for reporting @KS-DR. I was able to reproduce the issue and we'll ship a fix in the next bugfix release.