Add "has fix" filter for CVE finding

[tienmtran]

⚠️ Note on feature completeness ⚠️

We are narrowing the scope of acceptable enhancements to DefectDojo. Learn more here:
https://github.com/DefectDojo/django-DefectDojo/blob/master/readme-docs/CONTRIBUTING.md

Is your feature request related to a problem? Please describe
No

Describe the solution you'd like
I would like to have the "has fix" in filter or parser to quick check for which CVEs fix available. Some CVE scanner allow to ignore cve which dont have fix yet in their output result but I want to have full visibility of that. I prefer DD can filter out for that case.

Additional context
I use trivy to scan container and upload it to DD

[valentijnscholten]

Do you have more examples of which parsers/scanners provide a fixable flag? I have found:

• Trivy
• Aqua

[tienmtran]

I see grype, blackduck, jfrog,... also.
It's not really fixable flag in input. But when parsing for mitigation field this could be none
So if we can do at filter level or at parser level to add a tag for the fixable information

[manuel-sommer]

Also Harbor has a fixable information:
https://github.com/DefectDojo/django-DefectDojo/blob/master/unittests/scans/harbor_vulnerability/harbor-5-vuln.json
Maybe also RedHatSatellite in the "installable" field.
I could help make a PR if this feature would be merged. What are your thoughts @valentijnscholten ?

[tienmtran]

Hi, any update? Would we able to add this into Dojo's feature?

[manuel-sommer]

Do we want to add this feature @valentijnscholten and @mtesauro ?

[Kasyap7]

I am using Anchore Engine scan reports, and it would be helpful to include a has_fix tag in these reports as well.

• If the Mitigation field specifies an actionable fix (e.g., “Upgrade to package xyz”), the has_fix tag should be added.
• If the Mitigation field states “Upgrade to package none” or simply “None,” the has_fix tag should not be included, as no fix is available.

This enhancement would make it easier to filter findings based on fix availability.

[manuel-sommer]

How to proceed here? Do we want to add an "update findings functionality" in the reimport or add fix_available to the deduplication setting?

[valentijnscholten]

Do we want to add an "update findings functionality" in the reimport

This.

[manuel-sommer]

I am using Anchore Engine scan reports, and it would be helpful to include a has_fix tag in these reports as well.

* If the Mitigation field specifies an actionable fix (e.g., “Upgrade to package xyz”), the has_fix tag should be added.

* If the Mitigation field states “Upgrade to package none” or simply “None,” the has_fix tag should not be included, as no fix is available.

This enhancement would make it easier to filter findings based on fix availability.

#13060

[manuel-sommer]

Also Harbor has a fixable information: https://github.com/DefectDojo/django-DefectDojo/blob/master/unittests/scans/harbor_vulnerability/harbor-5-vuln.json Maybe also RedHatSatellite in the "installable" field. I could help make a PR if this feature would be merged. What are your thoughts @valentijnscholten ?

#13059
#13053