[FP]: CVE-2021-3765, validator.js dependency gets flagged on hibernate-validator dependencies

[volkert-fastned]

Package URl

pkg:maven/org.hibernate.validator/[email protected]

CPE

cpe:2.3:a:validator_project:validator:8.0.1:::::::*

CVE

CVE-2021-3765

ODC Integration

{"label"=>"Gradle Plugin"}

ODC Version

9.2.0

Description

Vulnerability CVE-2021-3765, which applies to validator.js (a Node.js library) gets flagged on hibernate-validator dependencies:

hibernate-validator-8.0.1.Final-sources.jar (pkg:maven/org.hibernate.validator/[email protected], cpe:2.3:a:validator_project:validator:8.0.1:*:*:*:*:*:*:*) : CVE-2021-3765
hibernate-validator-annotation-processor-8.0.1.Final-sources.jar (pkg:maven/org.hibernate.validator/[email protected], cpe:2.3:a:validator_project:validator:8.0.1:*:*:*:*:*:*:*) : CVE-2021-3765

Strangely enough, this suddenly got flagged (along with a bunch of other vulnerabilities) while I tried to upgrade a project from Kotlin 1.9.x to Kotlin 2.0. But the dependencies that suddenly got flagged with that upgrade weren't related to the Kotlin 2.0 upgrade.

Also worth noting: according to NIST, the CPE should in fact be cpe:2.3:a:validator_project:validator:*:*:*:*:*:node.js:*:* but the CPE that the DendencyCheck Gradle plugin flags has a wildcard in place of the .node.js part. Perhaps that's what's causing this false positive?

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.hibernate.validator</groupId>
   <artifactId>hibernate-validator</artifactId>
   <version>8.0.1.Final</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #6692
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.hibernate\.validator/hibernate-validator@.*$</packageUrl>
   <cpe>cpe:/a:validator_project:validator</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/9268402034

[volkert-fastned]

This is one of multiple FPs of Node.js vulnerabilities that suddenly got flagged on Java/JVM dependencies while I was upgrading Kotlin from 1.9.x to 2.0, apparently because the CPE had an asterisk in the third position, which should have contained the string node.js, according to NIST:

• CVE-2021-3765, FP reported at [FP]: CVE-2021-3765, validator.js dependency gets flagged on hibernate-validator dependencies #6692
• CVE-2017-16111, FP reported at [FP]: CVE-2017-16111, which applies to the content module of the hapijs/hapi.js framework, gets falgged on ktor dependencies with content in the name #6693
• CVE-2016-10543, FP reported at [FP]: CVE-2016-10543, which applies to the call module of the hapijs/hapi.js framework, gets falgged on ktor dependencies with call in the name #6694
• CVE-2022-21704, FP reported at [FP]: CVE-2022-21704, a log4js (node.js) dependency, gets flagged in a log4j (Java) dependency #6695

[jeremylong]

approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.

[volkert-fastned]

@jeremylong It still flags the other one with the suppression in the automated fix commit:

hibernate-validator-annotation-processor-8.0.1.Final-sources.jar (pkg:maven/org.hibernate.validator/[email protected], cpe:2.3:a:validator_project:validator:8.0.1:*:*:*:*:*:*:*) : CVE-2021-3765

[volkert-fastned]

@jeremylong Adding another .* between validator and @ appears to do the trick:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #6692
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.hibernate\.validator/hibernate-validator.*@.*$</packageUrl>
   <cpe>cpe:/a:validator_project:validator</cpe>
</suppress>