Closed matts-au closed 1 year ago
Hi! Sorry for the delay, but I respond with good news.
OSS Index is going through a major upgrade, as described here: https://ossindex.sonatype.org/updates-notice
The most clear and obvious benefit is far fewer false negatives and false positives, and vulnerabilities will be added to the system on a much more frequent and rapid basis. Once the upgrade is completed you should see most (if not all) of the reported data issues be resolved.
Closing old issues. This particular issue was resolved by the aforementioned upgrade.
Advisory details
More information The CVEs are actually being assigned to io.netty/netty component instead of netty-codec.