[FP]: commons-collections:commons-collections:3.2.2

[abhimankhutia]

Package URl

pkg:maven/commons-collections/[email protected]

CPE

cpe:2.3:a:apache:commons_collections:3.2:::::::*

CVE

CVE-2017-15708

ODC Integration

No response

ODC Version

6.5.3

Description

CVE-2017-15708 is wrongly reported for commons-collections:commons-collections:3.2.2, it should have been reported for Apache Synapse s/w component.

[github-actions[bot]]

Maven Coordinates

<dependency>
   <groupId>commons-collections</groupId>
   <artifactId>commons-collections</artifactId>
   <version>3.2</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #4326
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/commons-collections/commons-collections@.*$</packageUrl>
   <cpe>cpe:/a:apache:commons_collections</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/2114251647

[aikebah]

Created an issue upstream at OSSINDEX: https://github.com/OSSIndex/vulns/issues/270

[Janpopan]

@abhimankhutia can you try ODC 7.0.4 if this issue is solved there?

[aikebah]

@Janpopan the FP workflow already ran an analysis with ODC 7.0.4 that surfaces this FP due to OSSINDEX returning the CVE for commons-collections, which is why I opened the ticket at OSSINDEX because it's better to fix the source rather than having ODC suppress it.

[aikebah]

Appears to have been resolved in ossindex in the meantime