[FP]: False positive on spring-cloud-kubernetes-fabric8-config

[danielmonteroc]

Package URl

pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-fabric8-config@2.1.1

CPE

cpe:2.3:a:vmware:spring_cloud_config:2.1.1:::::::*

CVE

CVE-2019-3799, CVE-2020-5405, CVE-2020-5410

ODC Integration

{"label"=>"Gradle Plugin"}

ODC Version

6.5.3

Description

Seems to be related with #3098

Although in this case its for:
org.springframework.cloud:spring-cloud-kubernetes-fabric8-config:2.1.1

So can either modify suppression regex line from ca7d635 to include both "config" and "autoconfig", or add another suppression for "config".

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.springframework.cloud</groupId>
   <artifactId>spring-cloud-kubernetes-fabric8-config</artifactId>
   <version>2.1.1</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #4152
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.springframework\.cloud/spring-cloud-kubernetes-fabric8-config@.*$</packageUrl>
   <cpe>cpe:/a:vmware:spring_cloud_config</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/1925067370