Is lang-tag-1.5.jar a false positive

[Kaj Hejer]

Hi

Is lang-tag-1.5.jar a false positive?

We get "lang-tag-1.5.jar (pkg:maven/com.nimbusds/lang-tag@1.5, cpe:2.3:a:tag_project:tag:1.5:*:*:*:*:*:*:*) : CVE-2020-29242, CVE-2020-29243, CVE-2020-29244, CVE-2020-29245" with dependency-check-maven 6.0.4.

The CVEs referes to dhowden tag which seems to be someting other than com.nimbusds lang-tag or am I wrong?

Thanks!


-Kaj :)

[Hans Aikema]

Hi Kaj,

Yes it is, we ran into the same FP for other projects containing 'tag' in their name (at least some JSF taglibs). Wanted to open up a FP issue for that, but didn't get around to doing it yet.

It definitely is an FP for your library as well.

It's likely a new CPE due to the first registered CVEs for project_tag, so now we see FPs surfacing for other projects that don't have a vulnerability (and therefor no presence in the CPE caches) and now get matched to project_tag because it is the 'best match' for the known CPEs

Kind regards,
Hans

> On 7 Jan 2021, at 11:59, Kaj Hejer <kaj...@gmail.com> wrote:
>
> Hi

> --
> You received this message because you are subscribed to the Google Groups "Dependency Check" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to dependency-che...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/dependency-check/7E3AE44B-5B57-4DBD-B71A-D13F7A5494CB%40gmail.com.

[Kaj Hejer]

Thanks!

I created an issue on this, please https://github.com/jeremylong/DependencyCheck/issues/3061


-Kaj :)