[FP]: CVE-2022-22976 in spring-security-oauth2-2.5.2.RELEASE.jar

[OrangeDog]

Package URl

pkg:maven/org.springframework.security.oauth/spring-security-oauth2@2.5.2.RELEASE

CPE

cpe:2.3:a:vmware:spring_security:2.5.2:release:*:*:*:*:*:*

CVE

CVE-2022-22976

ODC Integration

{"label"=>"Maven Plugin"}

ODC Version

7.1.0

Description

Multiple related and sub-projects are incorrectly detected as vmware:spring_security.

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.springframework.security.oauth</groupId>
   <artifactId>spring-security-oauth2</artifactId>
   <version>2.5.2.RELEASE</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #4577
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.springframework\.security\.oauth/spring-security-oauth2@.*$</packageUrl>
   <cpe>cpe:/a:vmware:spring_security</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/2454156802

[aikebah]

Will resolve this FP, but you are adviced to replace it by SpringSecurity's native oauth support, as this project is archived as per https://github.com/spring-attic/spring-security-oauth

[OrangeDog]

Yes, I know. When spring-authorization-server finally has feature parity I'll start planning an upgrade, In the meantime it's very important to have accurate vulnerability analysis of it, as any fixes I'll have to do myself.