[FP]: Eclipse IDE vulnerability reported for Yasson

[agatarychter]

Package URl

pkg:maven/org.eclipse/yasson@1.0.11

CPE

cpe:2.3:a:eclipse:eclipse_ide:1.0.11:::::::*

CVE

CVE-2008-7271

ODC Integration

{"label"=>"Maven Plugin"}

ODC Version

7.0.0

Description

CVE-2008-7271 is reported for Yasson dependency. In vulnerability description, the Eclipse IDE is mentioned. And AFAIK, there is no Eclipse IDE bounded in the Yasson dependency.

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.eclipse</groupId>
   <artifactId>yasson</artifactId>
   <version>1.0.11</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #4218
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.eclipse/yasson@.*$</packageUrl>
   <cpe>cpe:/a:eclipse:eclipse_ide</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/1997565407

[Janpopan]

near the same #4206 and #4135

so should be solved by #4159

[Janpopan]

@agatarychter should solved with the new released 7.0.1

[aikebah]

verified as resolved in 7.0.1