False Positive on elastic-apm-agent

[OrangeDog]

apm-agent-attach-1.28.1.jar\META-INF/maven/co.elastic.apm/apm-agent-common/pom.xml (pkg:maven/co.elastic.apm/[email protected], cpe:2.3:a:elastic:apm_agent:1.28.1:*:*:*:*:*:*:*) : CVE-2019-7617 apm-agent-attach-1.28.1.jar (pkg:maven/co.elastic.apm/[email protected], cpe:2.3:a:elastic:apm_agent:1.28.1:*:*:*:*:*:*:*) : CVE-2019-7617 elastic-apm-agent-1.28.1.jar (pkg:maven/co.elastic.apm/[email protected], cpe:2.3:a:elastic:apm_agent:1.28.1:*:*:*:*:*:*:*) : CVE-2019-7617

<dependency>
  <groupId>co.elastic.apm</groupId>
  <artifactId>apm-agent-attach</artifactId>
  <version>1.28.1</version>
</dependency>

CVE-2019-7617 is for the Python agent, not the Java agent. The NVD entry specifies this: cpe:2.3:a:elastic:apm_agent:*:*:*:*:*:python:*:*

[aikebah]

Would need enhancement in DependencyCheck to take target_sw CPE attribute into account