search

jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
https://owasp.org/www-project-dependency-check/
Apache License 2.0
6.27k stars 1.25k forks source link

CVE-2016-9878 #6427

Open Dhanxi opened 7 months ago

Dhanxi commented 7 months ago

Hello team,

I have a question regarding a vulnerability with CVE 2016-9878. It has recently appeared in my project which I am compiling with java 17 and with spring springframework.boot 3.2.1. I also have the library spring.dependency-management.gradle.plugin:1.1.4' released on November 23.

If I have everything updated, why I have not been mitigated, is it a false positive, please if you can help me with this please.

Dhanxi commented 7 months ago

Does anyone know why a vulnerability from 2016 is being reported now? and that the latest library versions are from 2023.

I have also opened an issue with Primavera.

Dhanxi commented 7 months ago

Excuse @jeremylong , this is a false positive or any information?

Dhanxi commented 7 months ago

imore information: Included by: pkg:maven/org.springframework.boot/spring-boot-gradle-plugin@3.2.0 pkg:maven/org.springframework.boot/spring-boot-gradle-plugin@3.2.0

but in 3.2.2 vulnerability remains

jeremylong commented 6 months ago

I'd suggest reading:

  1. https://jeremylong.github.io/DependencyCheck/general/internals.html
  2. https://jeremylong.github.io/DependencyCheck/general/thereport.html
  3. https://jeremylong.github.io/DependencyCheck/general/suppression.html