node.js stax vulnerability showing up in java

[stephengroat]

False positive on library stax:stax-api:1.0.1 - reported as cpe:/a:st_project:st:1.0.1 for CVE-2017-16224 - seems to me like it should be node only

<dependency>
    <groupId>stax</groupId>
    <artifactId>stax-api</artifactId>
    <version>1.0.1</version>
</dependency>

[jeremylong]

Thanks for the report - I will cycle through all of the FP reports before the next release.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.