[FP]: Serilog.Sinks.Async

[Akash-2001-git]

Package URl

pkg:generic/[email protected]

CPE

cpe:2.3🅰️async_project:async:1.5.0:::::::*

CVE

CVE-2021-43138

ODC Integration

None

ODC Version

8.3.1

Description

Vulnerability in https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264 is reported for package "Serilog.Sinks.Async". Source : https://github.com/serilog/serilog-sinks-async

It should refer the package from the source repository but instead of that it is referring from https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264. Hence showing the "Serilog.Sinks.Async" package as vulnerable.

Earlier we created this issue but wrong package URI got suppressed. Please refer this comment : https://github.com/jeremylong/DependencyCheck/issues/6056#issuecomment-1827150307

[HarshalSuple]

@jeremylong : Hi, any update on this issue?

[Akash-2001-git]

@jeremylong @aikebah any update on this false positive ticket??