[FP]: CVE-2018-14335 on newest versions of H2 Database

[kelvinqian00]

Package URl

pkg:maven/com.h2database/[email protected]

CPE

cpe:2.3:a:h2database:h2:2.1.212:::::::*

CVE

CVE-2018-14335

ODC Integration

No response

ODC Version

7.1.0

Description

According to the maintainer of the H2 database, this CVE should only affect versions 1.4.197 and older. However, ever since OSS Index was updated on May 25, 2022, newer versions such as 2.1.212 have been marked as affected.

Link: https://github.com/h2database/h2database/issues/3175#issuecomment-1142186324

[github-actions[bot]]

Maven Coordinates

<dependency>
   <groupId>com.h2database</groupId>
   <artifactId>h2</artifactId>
   <version>2.1.212</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #4555
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.h2database/h2@.*$</packageUrl>
   <cpe>cpe:/a:h2database:h2</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/2415604019

[aikebah]

Is reported upstream to the vulnerability datasource that reports it as https://github.com/OSSIndex/vulns/issues/277

[aikebah]

Has been resolved by OSSINDEX