Open rmn7 opened 9 months ago
Maven Coordinates
<dependency>
<groupId>com.azure</groupId>
<artifactId>azure-core</artifactId>
<version>1.44.1</version>
</dependency>
Suppression rule:
<suppress base="true">
<notes><![CDATA[
FP per issue #6100
]]></notes>
<packageUrl regex="true">^pkg:maven/com\.azure/azure-core@.*$</packageUrl>
<cpe>cpe:/a:microsoft:azure_sdk_for_java</cpe>
</suppress>
Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/6955184981
This is a false positive?. I have uploaded to the latest version and I still have the same vulnerability
@aikebah how could a proper suppression look like? Would we need a (more) wildcard package URL or several individual suppressions?
Excerpt from the HTML report below.
@aikebah @jeremylong do you think this is something we can expect a suppression for any time soon?
Package URl
pkg:maven/com.azure/azure-core@1.44.1
CPE
cpe:2.3:a:microsoft:azure_sdk_for_java:1.44.1:*:*:*:*:*:*:*
CVE
CVE-2023-36052
ODC Integration
{"label"=>"Maven Plugin"}
ODC Version
8.2.1
Description
This only affects the azure cli but is matching for the azure java sdk. Check: https://nvd.nist.gov/vuln/detail/CVE-2023-36052
It also incorrectly matches on other
com.azure
packages: