Project- and version-based false positives when shadow-cljs is a dependency

[p-himik]

At the bottom, a trimmed output generated by using the -Tclj-watson command from the README is attached.

By CVE ID:

• CVE-2017-12424 - a completely unrelated product
• CVE-2020-8910 - only relevant for version v20200224 and below, but the used version is 0.0-20211011-0726fdeb which is newer

Dependency Information
-----------------------------------------------------
NAME: thheller/shadow-cljsjs
VERSION: 0.0.22

DEPENDENCY FOUND IN:

[thheller/shadow-cljs]


FIX SUGGESTION: No secure version available
Vulnerabilities
-----------------------------------------------------

SEVERITY: CRITICAL
IDENTIFIERS: CVE-2017-12424 
CVSS: 9.8
PATCHED VERSION: Information not available.

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

Dependency Information
-----------------------------------------------------
NAME: org.clojure/google-closure-library
VERSION: 0.0-20211011-0726fdeb

DEPENDENCY FOUND IN:

[thheller/shadow-cljs]


FIX SUGGESTION: No secure version available
Vulnerabilities
-----------------------------------------------------

SEVERITY: MEDIUM
IDENTIFIERS: CVE-2020-8910 
CVSS: 6.5
PATCHED VERSION: Information not available.

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

Dependency Information
-----------------------------------------------------
NAME: thheller/shadow-cljs
VERSION: 2.17.5

DEPENDENCY FOUND IN:

Direct dependency.

FIX SUGGESTION: No secure version available
Vulnerabilities
-----------------------------------------------------

SEVERITY: CRITICAL
IDENTIFIERS: CVE-2017-12424 
CVSS: 9.8
PATCHED VERSION: Information not available.

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

Dependency Information
-----------------------------------------------------
NAME: thheller/shadow-util
VERSION: 0.7.0

DEPENDENCY FOUND IN:

[thheller/shadow-cljs]


FIX SUGGESTION: No secure version available
Vulnerabilities
-----------------------------------------------------

SEVERITY: CRITICAL
IDENTIFIERS: CVE-2017-12424 
CVSS: 9.8
PATCHED VERSION: Information not available.

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

Dependency Information
-----------------------------------------------------
NAME: thheller/shadow-client
VERSION: 1.3.3

DEPENDENCY FOUND IN:

[thheller/shadow-cljs]


FIX SUGGESTION: No secure version available
Vulnerabilities
-----------------------------------------------------

SEVERITY: CRITICAL
IDENTIFIERS: CVE-2017-12424 
CVSS: 9.8
PATCHED VERSION: Information not available.

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

Dependency Information
-----------------------------------------------------
NAME: thheller/shadow-undertow
VERSION: 0.2.0

DEPENDENCY FOUND IN:

[thheller/shadow-cljs]


FIX SUGGESTION: No secure version available
Vulnerabilities
-----------------------------------------------------

SEVERITY: CRITICAL
IDENTIFIERS: CVE-2017-12424 
CVSS: 9.8
PATCHED VERSION: Information not available.

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

[mthbernardes]

Which scan method did you use?

[p-himik]

As mentioned, I used the command from the README, namely

$ clojure -Tclj-watson scan '{:output "stdout" :dependency-check-properties nil :fail-on-result true :deps-edn-path "deps.edn" :suggest-fix true :aliases ["*"] :database-strategy "dependency-check"}'

[mthbernardes]

Could you try to execute it using github-advisory mode?
Just asking it because the strategy you used relies entirely on the DependencyCheck match algorithm.

[p-himik]

I see. Yeah, the issue is not reproducible with that strategy. I'll try to reproduce it with just DependencyCheck.

[p-himik]

Reported jeremylong/DependencyCheck#4237