[FP]: Unapplicable CVEs reported for spring-boot-starter-oauth2-resource-server-2.7.0.jar

[xcq1]

Package URl

pkg:maven/org.springframework.boot/[email protected]

CPE

cpe:2.3:a:pivotal:spring_security_oauth:2.7.0:*:*:*:*:*:*:*, cpe:2.3:a:pivotal_software:spring_security:2.7.0:*:*:*:*:*:*:*, cpe:2.3:a:pivotal_software:spring_security_oauth:2.7.0:*:*:*:*:*:*:*, cpe:2.3:a:vmware:server:2.7.0:*:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_boot:2.7.0:*:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_security:2.7.0:*:*:*:*:*:*:*

CVE

CVE-2022-22978, CVE-2018-1258, CVE-2021-22112, CVE-2022-22976

ODC Integration

{"label"=>"Gradle Plugin"}

ODC Version

7.1.1

Description

The library spring-boot-starter-oauth2-resource-server-2.7.0.jar actually depends on Spring-Security 5.7.1. This version is not affected by the reported CVEs. It seems as if DependencyCheck assumes Spring-Security 2.7.0 was imported.

[github-actions[bot]]

Maven Coordinates

<dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
   <version>2.7.0</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #4617
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.springframework\.boot/spring-boot-starter-oauth2-resource-server@.*$</packageUrl>
   <cpe>cpe:/a:pivotal:spring_security_oauth</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/2533718827

[xcq1]

Please note the bot's suggested suppression rule does not work for me, I have to include both these CPEs for it to work:

        <cpe>cpe:/a:pivotal_software:spring_security</cpe>
        <cpe>cpe:/a:vmware:spring_security</cpe>

[aikebah]

Running the 7.1.1 gradle plugin doesn't yield the listed CPEs for me (and therefor not the CVEs associated with older versions of spring-security libraries) spring-boot-starter-oauth2-resource-server-2.7.0.jar gets associated only with

cpe:2.3:a:vmware:server:2.7.0:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_boot:2.7.0:*:*:*:*:*:*:*

the first of which is clearly invalid, but not triggering any FP CVEs

[alessioerosferri]

Any news on this? I am having the same problem

[aikebah]

@alessioerosferri can you share an example reproducer gradle project? Because as indicated in my comment... I failed to reproduce it on dependencycheck gradle plugin 7.1.1.

[xcq1]

@aikebah I have tried to boil down the responsible code where I can still reproduce this behavior to this really simple project: https://github.com/xcq1/repro-dc-4617

Running ./gradlew dependencyCheckAnalyze in the repo yields a report with the following line:

spring-boot-starter-oauth2-resource-server-2.7.3.jar (pkg:maven/org.springframework.boot/[email protected], cpe:2.3:a:pivotal:spring_security_oauth:2.7.3:*:*:*:*:*:*:*, cpe:2.3:a:pivotal_software:spring_security:2.7.3:*:*:*:*:*:*:*, cpe:2.3:a:pivotal_software:spring_security_oauth:2.7.3:*:*:*:*:*:*:*, cpe:2.3:a:vmware:server:2.7.3:*:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_boot:2.7.3:*:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_security:2.7.3:*:*:*:*:*:*:*) : CVE-2022-22978, CVE-2018-1258, CVE-2021-22112, CVE-2022-22976

The GH Actions build seems to produce the same output but unfortunately, it doesn't retain the logs for some reason.

[aikebah]

@xcq1 Thanks.... that one makes it reproducible to me as well