-
-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[FP]: False Positive on grpc-netty / grpc-netty-shaded : 1.50.2.jar #5206
Comments
Error parsing package url: grpc-netty-shaded-1.50.2.jar. Error: Error: purl is missing the required "pkg" scheme component. Please correct the package URL - consider copying the package url from the HTML report. |
Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/3835877544 |
Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/3835894847 |
Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/3836317510 |
Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/3836388339 |
Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/3836843123 |
@keerthanavenky Can you share more info on how you run it? The FP is expected to not happen for any of the 7.x versions. I tried reprocuction with both Maven-plugin and CLI and fail to get the FP CPE match you mention. |
@aikebah we are leveraging the gradle plugin |
Could not reproduce with the following build.gradle.kts
|
I was able to reproduce the finding with the CLI scanning the jar directly, I did have to run the scan twice, after the second run CVE-2019-20444 showed in the report Steps:
|
CLI without central search might trigger it, as no maven coordinates get linked so that the suppression will not work (visible in your report as no package is listed for it). That is precisely the type of FP that the recommendation to not disable central is about. |
I was able to reproduce the issue by setting up a structure similar to how our scan is performed.
I bundled the plugin jar with some additional libraries. What I noticed is the "package" field is discovered on some libraries but not all. I'm wondering if this is something on the DependencyCheck end or on the central search end, if it's on central search we can close this issue out. |
@kevin-doyle Thanks for the detailed reproduction. Hope to get a detailed look into it over the weekend. I'd say that as the jar is downloaded from central it should've been matched in central search, so I'll try and see whether I can reproduce what you observed and can find out why it doesn't match. |
It appears as if documentation is not in line with actual implementation. I can reproduce your case because with the defaults in the gradle plugin the central analyzer appears to not be enabled. Can reproduce the FP and fix it by configuring centralAnalyzer to enabled in build.gradle
|
Check the code-base and it's been disabled by default since v3.2.1 so the documentation is lacking an update on that. |
…radle plugin documentation Also extend the description to indicate cases that can benefit from enablement. Fixes documentation in relation to issue #5206
@aikebah Thanks for all the help! I was able to resolve this on our end. |
Package URl
pkg:maven/io.grpc/grpc-netty-shaded@1.50.2
CPE
cpe:2.3:a:netty:netty:1.50.2:*:*:*:*:*:*:*
CVE
CVE-2019-20444
ODC Integration
None
ODC Version
7.4.1
Description
False positive on library grpc-netty-shaded-1.50.2.jar
Find below the vulnerabilities reported by the dependency check tool:
CVE-2019-20444
CVE-2019-20445
CVE-2015-2156
CVE-2019-16869
CVE-2021-37136
CVE-2021-37137
CVE-2022-41881
CVE-2021-43797
CVE-2022-41915
CVE-2021-21295
CVE-2021-21409
CVE-2021-21290
CVE-2022-24823
CVE-2014-3488
I have gone through all these CVEs and could not find anything related to grpc-netty-shaded
The issues shown are related to other netty libraries.
The text was updated successfully, but these errors were encountered: