Importing Blackduck Binary Analysis reports does not populate the Vulnerability Id field

[tomasrinne]

Bug description

When importing a BlackDuck Binary Analysis CSV report, the vuln_id_from_tool field gets populated with the CVE, but not the vulnerability_id field as it is not set.

django-DefectDojo/dojo/tools/blackduck_binary_analysis/parser.py

Line 93 in 924c2c8

vuln_id_from_tool=str(cve),

Steps to reproduce
Steps to reproduce the behavior:

1. Import a BlackDuck Binary Analysis CSV report
2. In the findings, the Vuln ID from tool shows the CVE of the finding, but the Vulnerability Id is empty

Expected behavior

Expected behavior would be that also the Vulnerability Id contains the CVE (for de-duplication etc.)

Deployment method (select with an X)

• Docker Compose
• Kubernetes
• GoDojo

Environment information

• DefectDojo version: 2.38.4

Sample scan files

The problem can be reproduced with the scan test files for BlackDuck Binary Analysis https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/blackduck_binary_analysis

Screenshots

With the one_vuln.csv scan: