[FP]: CVE-2022-24198 in kernel-7.2.2.jar

[Vsevolod-Bro]

Package URl

pkg:maven/com.itextpdf/[email protected]

CPE

cpe:2.3:a:itextpdf:itext:7.1.17:::::::*

CVE

CVE-2022-24198

ODC Integration

No response

ODC Version

7.1.1

Description

False positive on component ARCFOUREncryption.encryptARCFOUR but the fact that it throws ArrayIndexOutOfBoundsException is not by itself a vulnerability, and no case supporting that this behavior may be exploited to cause DoS has been presented https://github.com/itext/itext7/pull/78

[github-actions[bot]]

Maven Coordinates

<dependency>
   <groupId>com.itextpdf</groupId>
   <artifactId>kernel</artifactId>
   <version>7.1.17</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #4613
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.itextpdf/kernel@.*$</packageUrl>
   <cpe>cpe:/a:itextpdf:itext</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/2526242832

[github-actions[bot]]

Maven Coordinates

<dependency>
   <groupId>com.itextpdf</groupId>
   <artifactId>kernel</artifactId>
   <version>7.1.17</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #4613
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.itextpdf/kernel@.*$</packageUrl>
   <cpe>cpe:/a:itextpdf:itext</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/2526259456

[github-actions[bot]]

Maven Coordinates

<dependency>
   <groupId>com.itextpdf</groupId>
   <artifactId>kernel</artifactId>
   <version>7.1.17</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #4613
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.itextpdf/kernel@.*$</packageUrl>
   <cpe>cpe:/a:itextpdf:itext</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/2526275762

[mprins]

also for 7.2.3

[mprins]

also occurs for 7.2.4

[aikebah]

Would have to be raised with Sonatype OSSINDEX for re-evaluation, as the raised issue was not fixed, but the CVE disputed as an ArrayIndexOutOfBoundsException does not constitute a security issue as such.

[achifal]

Also applies to 7.2.5

[hstorruste]

This still applies for version 8.0.0 and 8.0.1 as well.

[Dhanxy]

Hello guys, is CVE 2022-24198 a false positive? This is the first time it appears in a DependencyCheck.

[aikebah]

The CVE is disputed, but according to Sonatype OSSIndex it is a valid vulnerability. As to the exact why you would have to communicate with Sonatype. ODC merely reports that in the OSSIndex the CVE was kept as a vulnerability when disputed.