Open volkert-fastned opened 1 month ago
Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/10040271163
Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/10040275711
Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/10040307470
The likely reason why github-actions
couldn't automatically evaluate the false positives was probably because I suffixed the Maven package with an asterisk (*
), to make it clear that all packages that start with pkg:maven/org.jetbrains.kotlinx/kotlinx-datetime
are apparently flagged by this FP.
This broader CVE-level suppression worked for me, but it does assume that the JS-specific dependencies of this KMP library don't actually depend on the affected JS library:
<suppress>
<notes><![CDATA[
FP per issue #6864
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlinx/kotlinx-datetime.*$</packageUrl>
<cve>CVE-2020-26289</cve>
</suppress>
Package URl
pkg:maven/org.jetbrains.kotlinx/kotlinx-datetime*
CPE
cpe:2.3:a:date-and-time_project:date-and-time:0.6.0:*:*:*:*:*:*:*
CVE
CVE-2020-26289
ODC Integration
{"label"=>"Gradle Plugin"}
ODC Version
10.0.3
Description
This NPM-specific CPE is apparently being erroneously applied to multiple Kotlin dependencies:
Since
kotlinx-datetime
is a Kotlin Multiplatform (KMP) library, the JS-specific dependencies of that library, such askotlinx-datetime-js
, could at least in theory be affected by this vulnerability if they depend on affected versions of thedate-and-time
NPM dependency, but it doesn't look like that's the reason why this vulnerability is getting flagged. (Even if it did, it should only flag it on the applicable-js
dependencies of the library.)