[FP]: commons-digester and commons-validator apache james

[patrickneihengen]

Package URl

pkg:maven/commons-digester/commons-digester@2.1

CPE

cpe:2.3:a:apache:james:2.1:::::::*

CVE

CVE-2021-40110(7.5), CVE-2021-40525(9.1)

ODC Integration

{"label"=>"Maven Plugin"}

ODC Version

7.0.0

Description

Received two false positives on
commons-digester-2.1.jar (pkg:maven/commons-digester/commons-digester@2.1, cpe:2.3:a:apache:james:2.1:::::::) : CVE-2021-38542, CVE-2021-40110, CVE-2021-40111, CVE-2021-40525
commons-validator-1.7.jar (pkg:maven/commons-validator/commons-validator@1.7, cpe:2.3:a:apache:james:1.7:::::::) : CVE-2021-38542, CVE-2021-40110, CVE-2021-40111, CVE-2021-40525

[ERROR] commons-digester-2.1.jar: CVE-2021-40110(7.5), CVE-2021-40525(9.1)
[ERROR] commons-validator-1.7.jar: CVE-2021-40110(7.5), CVE-2021-40525(9.1)

These are not tied to apache james.

[github-actions]

Maven Coordinates

<dependency>
   <groupId>commons-digester</groupId>
   <artifactId>commons-digester</artifactId>
   <version>2.1</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #4162
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/commons-digester/commons-digester@.*$</packageUrl>
   <cpe>cpe:/a:apache:james</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/1934166423

[aikebah]

Fixed in current snapshot by #4148

[costimuraru]

Has this fix been released?
We are facing this error when migrating to DependencyCheck 7.0.0, which complains about commons-validator

[aikebah]

As can be seen in the right-hand bar this issue is scheduled for the 7.0.1 milestone. It is currently only resolved in the latest snapshot builds

[vemv]

Where can snapshot builds be found?

[aikebah]

In my view you typically don't want to use snapshot builds except for experimentation. until a new release is out you can use the suppression added by #4148 in your own suppression file with v7.0.0

if you insist on using the snapshot (be aware that you may get frequent updates and they might be unstable) you can find them in the oss dot sonatype dot org snapshots repository or you can build one yourself from the sources in this repository