-
-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[FP]: org.eclipse.jetty.toolchain/[email protected] is misidentified as jetty 4.0.6 component (but is not) (wrong CPE) #6666
Comments
Maven Coordinates <dependency>
<groupId>org.eclipse.jetty.toolchain</groupId>
<artifactId>jetty-servlet-api</artifactId>
<version>4.0.6</version>
</dependency> Suppression rule: <suppress base="true">
<notes><![CDATA[
FP per issue #6666
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.toolchain/jetty-servlet-api@.*$</packageUrl>
<cpe>cpe:/a:jetty:jetty</cpe>
</suppress> Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/9075500628 |
Maven Coordinates <dependency>
<groupId>org.eclipse.jetty.toolchain</groupId>
<artifactId>jetty-servlet-api</artifactId>
<version>4.0.6</version>
</dependency> Suppression rule: <suppress base="true">
<notes><![CDATA[
FP per issue #6666
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.toolchain/jetty-servlet-api@.*$</packageUrl>
<cpe>cpe:/a:jetty:jetty</cpe>
</suppress> Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/9080168763 |
approved |
Suppress rule has been added to the |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Package URl
pkg:maven/org.eclipse.jetty.toolchain/[email protected]
CPE
cpe:2.3:a:jetty:jetty:4.0.6:*:*:*:*:*:*:*
CVE
CVE-2017-7657
ODC Integration
{"label"=>"Ant Task"}
ODC Version
9.1.0
Description
Hi,
there is a mis-identification of the CPE for the jetty tools package jetty-servlet-api (version 4.0.6).
The Package
org.eclipse.jetty.toolchain/[email protected]
is mis-identified as a jetty 4.0.6 package (cpe:2.3:a:jetty:jetty:4.0.6:*:*:*:*:*:*:*
andcpe:2.3:a:eclipse:jetty:4.0.6:*:*:*:*:*:*:*
), although it actually came with Jetty 12 and the version of the jar is independent of Jetty version but depends on the Servlet API version.So the problem is the incorrect CPE that is identified for the component, since the CVEs all adress earlier jetty versions.
Here's the sonatype ossindex page for the compontent:
https://ossindex.sonatype.org/component/pkg:maven/org.eclipse.jetty.toolchain/[email protected]
We would appreciate it if the CPE (actually I don't know the correct CPE for this jar) could be fixced.
Thanks in advance :-)
Andreas
The text was updated successfully, but these errors were encountered: