[FP]: CVE-2022-1799 false positive reported after play-services-basement is updated to 18.0.2

[y25zhao]

Package URl

pkg:maven/com.google.android.gms/[email protected]

CPE

cpe:2.3:a:com.google.android.gms:play-services-basement:18.0.2:::::::*

CVE

CVE-2022-1799

ODC Integration

{"label"=>"Gradle Plugin"}

ODC Version

7.1.1

Description

According to https://developers.google.com/android/guides/releases release note, May 03, 2022 (18.0.2) release for play-services-basement should have addressed this vulnerability. However, dependency-check report still shows 18.0.2 as affected version. The NVD - CVE-2022-1799 link: https://nvd.nist.gov/vuln/detail/CVE-2022-1799#range-8195910 also says affected software configurations is Up to (excluding) 18.0.2. Please consider fixing this at earliest possible as it is blocking our build pipeline. Thanks

[github-actions[bot]]

Error parsing package url: https://mvnrepository.com/artifact/com.google.android.gms/play-services-basement.

Error: Error: purl is missing the required "pkg" scheme component.

Please correct the package URL - consider copying the package url from the HTML report.

[y25zhao]

URL Updated

[aikebah]

This appears to be a metadata mismatch in OSSIndex, please raise the issue with them as they still flag 18.0.2 as subject to the CVE.