[FP]: False Positive Nuget Azure.Identity

[creasoft-dag]

Package URl

pkg:generic/[email protected]

CPE

cpe:2.3:a:microsoft:azure_identity_sdk:1.1000.323.51804:::::::* (Confidence:Low)

CVE

CVE-2023-36415

ODC Integration

{"label"=>"CLI"}

ODC Version

8.3.1

Description

Hi,

we get a false positive for the Azure.Identity nuget package.
File version of the dll is set to: 1.1000.323.51804
Product version to: 1.10.3+a4954......

The vulnerability should be fixed from 1.10.2 and up.

Best regards,
Daniel

[github-actions]

Error parsing package url: https://www.nuget.org/packages/Azure.Identity/1.10.3.

Error: Error: purl is missing the required "pkg" scheme component.

Please correct the package URL - consider copying the package url from the HTML report.

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/6931500863

[a20nitin]

We are also facing same false positive vulnerability. When can we expect a solution?

[chadlwilson]

Duplicate of #7000 (and #6999 #6334 and many others)

ODC doesn't understand the language discriminators in CPEs. You have to suppress the individual CVEs yourself for now.

It thinks this is vulnerable because the Javascript library uses 3.x style versioning which is still affected.