Hans Aikema comments

Results 265 comments of


                                            Hans Aikema

trafficstars

[FP]: logback-classic-1.3.0.jar flagged with cpe:2.3:a:qos:slf4j:1.3.0:::::::*

approved

Suppression of specific CVE based on CVSS value

A remark on the specific CVE you mention: I would assume your installed Tomcat instances would not include the examples webapplication? So that issue could be fully suppressed regardless of...

Suppression of specific CVE based on CVSS value

@jeremylong Not quite what @rseeton appears to be looking for. The case to be solved is to get a new alert (to trigger re-evaluation by the security team) when a...

[FP]: logback-core-1.3.0.jar flagged with cpe:2.3:a:qos:logback:1.3.0:::::::*

Is due to the know issue of not supporting the extended fields of the CPE, so that it gets matched with the alpha releases of 1.3.0

[FP]: bcprov-jdk14-136 flagged with cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.54:::::::*

In this project we decided to not micromanage projects that release as a whole and are tracked by a single CPE at NIST NVD. This means that the bouncy-castle java...

[FP]: Undertow-core CVE-2022-2053 reported after fix in 2.2.19.Final

Reported upstream as https://github.com/OSSIndex/vulns/issues/321

[FP]: easyuploads reported as vaadin

approved

How to define configuration for dependency check in gradle & kotlin DSL

How about reading up in the [fine documentation](https://docs.gradle.org/current/userguide/migrating_from_groovy_to_kotlin_dsl.html) of Gradle

[FP]: mockito-junit-jupiter reported as `cpe:2.3:a:junit:junit4:4.7.0:::::::*`

approved

Running dependencyCheck concurrent in multiple CI pipelines throws error

@bersti The final exceptioncollection stacktrace should mean that earlier on in the log you can find the actual errors getting logged as well. Those would be the pointers to what...