Feature Request: Only Fail if Vendor Fix Available

[Conklin-Spencer-bah]

Description

A configuration that would allow failing of the Inspector scan if only a vendor fix is available.

Expected Behavior

If a vendor fix is unavailable and you choose the flag to only fail on if vendor fix available it would pass.

Actual Behavior

Findings without vendor fixes available fail.

[bluesentinelsec]

Hello, thank you for the feature request.
I see a lot of value in only failing when vulns are present AND a vendor fix is available.
We will add this feature request to our backlog, and we'll notify you if and when we begin the work.

[zaurus43]

Hello, I am looking forward to this feature.

My quick check shows that unfixable vulnerabilities do not have the affects:fixed_version attribute in the scan results. Is it possible to implement a flag depending on the presence or absence of this attribute value? Or is it necessary to modify the inspector-scan scan-sbom command to get explicit results?

[bluesentinelsec]

Update:

A PR is currently in progress for this feature:
#115

I will do a pass for refactoring and testing, after which, I will prepare a new release to ship this feature.
Please allot time for additional testing and review from the project maintainers.