Details
-
Type:
Bug
-
Status: Open (View Workflow)
-
Priority:
Major
-
Resolution: Unresolved
-
Component/s: hp-application-automation-tools-plugin
-
Labels:
-
Environment:Jenkins version: 2.222.3
plugin version: 6.2
Octane version: 15.0
Fortify SSC 19
Fortify SCA 19
-
Similar Issues:
Description
Hello
It's a jenkins pipeline which has one stage with fortify SCA scan related steps, the fpr files uploaded to SSC successfully, i can see the issues list in Jenkins as well. But in ALM Octane, i dont see the vulnerbilites showing up. The pipeline is Security type, and i set the max number of vulnerbilites per pipeline run with 500.
Could you please help on this? Thanks!
Best Regards,
Tracy
Attachments
Activity
Looks like the vulnerabilities calculated (filtered out) from the actual result of the remote ssc return empty list.
This could happen when there is some baseline (the time that the pipeline was created or became security pipeline), and since then there were no new issues detected.
Meaning it look like issues exist but they are not calculated (as relevant) for the pipeline and so it return empty list.
Daniel Shmaya
added a comment - Looks like the vulnerabilities calculated (filtered out) from the actual result of the remote ssc return empty list.
This could happen when there is some baseline (the time that the pipeline was created or became security pipeline), and since then there were no new issues detected.
Meaning it look like issues exist but they are not calculated (as relevant) for the pipeline and so it return empty list. Hello,
My octane plugin version is 6.2 and fortify ssc plugin version is 19.2.30.
Hi Daniel,
I found that if i upload from jenkins pipeline with new SSC app & version, it will show the vunerabilities in Octane. This makes me confusing. About the baseline, pipeline creation or became security pipeline, i got it, but which time it's comparing to? is it the time of issue created in Fortify SSC?
Best Regards,
Tracy
Hi Tracy, the time that compared to the baseline is the time we get from SSC vulnerability (converted to UTC), so if you got new vulnerabilities, they are for sure created after the security pipeline was created / configured as security.
Daniel Shmaya
added a comment - Hi Tracy, the time that compared to the baseline is the time we get from SSC vulnerability (converted to UTC), so if you got new vulnerabilities, they are for sure created after the security pipeline was created / configured as security. 
Hi, first , see here matrix of plugin support , octane plugin and fortify SSC plugin - and check if u'r version is there: