search

rm-hull / nvd-clojure

National Vulnerability Database dependency checker for Clojure projects
MIT License
273 stars 35 forks source link

CVE-2021-43138 and org.clojure/core.async #140

Closed fdabrao closed 2 years ago

fdabrao commented 2 years ago

Hello,

I've got this security problem that is pointing out to https://github.com/caolan/async vulnerability. image Is that a false positive?

Thank you

vemv commented 2 years ago

Hi, thanks for the report!

What nvd-clojure version are you using?

fdabrao commented 2 years ago

The last one {:mvn/version "RELEASE"}, at this moment -> v2.5.0

vemv commented 2 years ago

Thanks!

Indeed it's a false positive. Thanks for reporting it in https://github.com/jeremylong/DependencyCheck/issues/4384.

In the meantime you can add it to your suppressions .xml file, there's doc/examples that can be found in the readme.

Cheers - V