jersey-apache-client4-1.19.1.jar reporting a false positive on httpclient

[Satish Swargam]

Two issues were reported on the use of Jersey client.

CVE-2015-5262 & CVE-2014-3577.

Both issues relate to the use of  Apache HttpComponents HttpClient before v4.3.5.

The dependency was resolved to use latest Apache HttpComponents HttpClient v4.5.2 and the issue is still being flagged in the OWASP dependency check report.

Thanks.

[Jeremy Long]

Thanks for reporting this. I have committed a change to the current snapshot to suppress this false positive. In the meantime you could use a suppression file with the following:

    <suppress>

        <notes><![CDATA[

        Supresses false positives on jersey-apache-client4

        ]]></notes>

        <gav regex="true">com\.sun\.jersey\.contribs:jersey-apache-client.*</gav>

        <cpe>cpe:/a:apache:httpclient</cpe>

    </suppress>

--Jeremy

[Satish Swargam]

Thanks, Jeremy.