[FP]: Found vulnerabilities for org.json:json:20231013 even if it is ahead of versions in NVD-description

[AndreasIgelCC]

Package URl

pkg:maven/org.json/json@20231013

CPE

cpe:2.3:a:json-java_project:json-java:*:*:*:*:*:*:*:* versions up to (including) 20230618

CVE

CVE-2023-5072

ODC Integration

{"label"=>"Maven Plugin"}

ODC Version

8.1.2

Description

It seems like that the version-borders of that NVD are not handled correctly in compare. The reason for that might be, that version is in that library a string generated by date and not the usual maven-version.

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.json</groupId>
   <artifactId>json</artifactId>
   <version>20231013</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #6969
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.json/json@.*$</packageUrl>
   <cpe>cpe:/a:json-java_project:json-java</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/10896951649

[aikebah]

ODC 8.1.2 is severely outdated and unmaintained, you should upgrade to latest 10.x.

Our FP workflow uses latest release version which connects to the NVD API and surfaces no FP.