Inconsistent NVD known affected software in Dtrack

[calderonth]

Current Behavior

It seems Dtrack is not properly syncing (or updating) known affected software configurations:

For instance, if we take CVE-2024-23113 and look at the list of known affected versions, we get the following:

cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*   Show Matching CPE(s) | From (including)7.0.0 | Up to (including)7.0.14
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*   Show Matching CPE(s) | From (including)7.2.0 | Up to (including)7.2.8
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*   Show Matching CPE(s) | From (including)7.4.0 | Up to (including)7.4.2
cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*   Show Matching CPE(s) | From (including)7.0.0 | Up to (including)7.0.3
cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*   Show Matching CPE(s) | From (including)7.2.0 | Up to (including)7.2.3
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*   Show Matching CPE(s) | From (including)7.0.0 | Up to (including)7.0.13
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*   Show Matching CPE(s) | From (including)7.2.0 | Up to (including)7.2.6
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*   Show Matching CPE(s) | From (including)7.4.0 | Up to (including)7.4.2
cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:*   Show Matching CPE(s) | From (including)1.0.0 | Up to (including)1.0.3
cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:*   Show Matching CPE(s) | From (including)1.1.0 | Up to (including)1.1.2
cpe:2.3:o:fortinet:fortipam:1.2.0:*:*:*:*:*:*:*

Now if we look at this vulnerability in Dtrack, we get the following known affected components list:

cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:* (>=7.0.0\|<=7.0.3) | NVD | 11 Oct 2024 at 01:35:25
cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:* (>=7.2.0\|<=7.2.3) | NVD | 11 Oct 2024 at 01:35:25
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* (>=7.0.0\|<=7.0.14) | NVD | 11 Oct 2024 at 01:35:25
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* (>=7.2.0\|<=7.2.8) | NVD | 11 Oct 2024 at 01:35:25
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* (>=7.4.0\|<=7.4.2)

It is clearly missing entries, so adding a component to a project with a matching CPE would not yield the vulnerability (for example: cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*)

Steps to Reproduce

1. Create a project
2. Add a component with following CPE: cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*
3. Observe missing vulnerability match

Expected Behavior

I would expect the NVD data synced in Dtrack to correctly reflect known affected software so that CPE matching can reliably be used.

Dependency-Track Version

4.11.x

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

No response

Browser

Google Chrome

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported