[FP]: Hibernate Commons Annotations confused with Hibernate ORM itself

[chadlwilson]

Package URl

pkg:maven/org.hibernate/[email protected]

CPE

cpe:/a:hibernate:hibernate_orm

CVE

No response

ODC Integration

{"label"=>"Gradle Plugin"}

ODC Version

7.1.1

Description

Hibernate Commons Annotations is a different project, versioned separately to the core "Hibernate ORM", so CVEs against this are misleading and false positives.

See https://mvnrepository.com/artifact/org.hibernate/hibernate-commons-annotations

[github-actions[bot]]

Maven Coordinates

<dependency>
   <groupId>org.hibernate</groupId>
   <artifactId>hibernate-commons-annotations</artifactId>
   <version>3.2.0.Final</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #4651
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.hibernate/hibernate-commons-annotations@.*$</packageUrl>
   <cpe>cpe:/a:hibernate:hibernate_orm</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/2623974667

[github-actions[bot]]

Maven Coordinates

<dependency>
   <groupId>org.hibernate</groupId>
   <artifactId>hibernate-commons-annotations</artifactId>
   <version>3.2.0.Final</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #4651
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.hibernate/hibernate-commons-annotations@.*$</packageUrl>
   <cpe>cpe:/a:hibernate:hibernate_orm`</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/3172107195

[github-actions[bot]]

Maven Coordinates

<dependency>
   <groupId>org.hibernate</groupId>
   <artifactId>hibernate-commons-annotations</artifactId>
   <version>3.2.0.Final</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #4651
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.hibernate/hibernate-commons-annotations@.*$</packageUrl>
   <cpe>cpe:/a:hibernate:hibernate_orm</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/3172119490

[aikebah]

approved

[github-actions[bot]]

Suppress rule has been added to the generatedSuppressions branch.