False positive CVE-2007-1651 and CVE-2007-1652 Microsoft.IdentityModel.Protocols.OpenIdConnect

[guidemetothemoon]

Hello.

In the DependencyCheck I'm getting alerts for CVE-2007-1651 and CVE-2007-1652 vulnerabilities referred to Microsoft.IdentityModel.Protocols.OpenIdConnect package (performing dll scanning, package is coming from Nuget).

Package in OSS Index

From what I was able to find on the Internet this vulnerability is referred to OpenID but not to the Microsoft.IdentityModel.Protocols.OpenIdConnect package itself. According to OSS Index this package version doesn't have these vulnerabilities registered either.

CPEs are also different: cpe:2.3:a:microsoft:identitymodel:6.8.0.11012:::::::* -> false positive? cpe:2.3:a:openid:openid:6.8.0.11012:::::::* cpe:2.3:a:openid:openid_connect:6.8.0.11012:::::::* -> false positive?

CVE-2007-1651: CVE-2007-1651

CVE-2007-1652: CVE-2007-1652

Kind regards, Kris

[ngoclamnn]

I have the same issue with [email protected]

[alixwar]

Related: https://github.com/openid/AppAuth-Android/issues/813