[FP]: apollographql federation flagged with cpe:2.3:a:apollo_project:apollo:5.1.0:*:*:*:*:*:*:*

[goranpetrovikj]

Package URl

pkg:maven/com.apollographql.federation/[email protected]

CPE

cpe:2.3:a:apollo_project:apollo:5.1.0:::::::*

CVE

CVE-2015-10043

ODC Integration

{"label"=>"Maven Plugin"}

ODC Version

10.0.4

Description

This issue is similar to #5381 (fixed here: a464386#diff-6964bcf877e83717b29732e01e45738ee4f07a723acd0a4cf5b9adcc1aee19e6R6208), apollo_project:apollo is a PHP project unrelated to apollographql.

[github-actions]

Maven Coordinates

<dependency>
   <groupId>com.apollographql.federation</groupId>
   <artifactId>federation-graphql-java-support</artifactId>
   <version>5.1.0</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #6991
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.apollographql\.federation/federation-graphql-java-support@.*$</packageUrl>
   <cpe>cpe:/a:apollo_project:apollo</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/11046809333

[aikebah]

approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.