[FP]: False positive for apache-el-11.0.0.jar against multiple jetty 11 CVE's

[vbode]

Package URl

pkg:maven/org.mortbay.jasper/[email protected]

CPE

cpe:2.3:a:eclipse:jetty:11.0.0:-:*:*:*:*:*:*

CVE

CVE-2021-28165

ODC Integration

{"label"=>"Docker"}

ODC Version

11.0.0

Description

It seems like Jetty 11 is being detected as a CPE for apache-el, causing many jetty 11 CVEs to be detected.
See the attached screenshot.

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.mortbay.jasper</groupId>
   <artifactId>apache-el</artifactId>
   <version>11.0.0</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7145
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.mortbay\.jasper/apache-el@.*$</packageUrl>
   <cpe>cpe:/a:eclipse:jetty</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/11739964544

[aikebah]

approved

[github-actions]

Suppress already exists in generatedSuppressions branch. See issue #7047.

[vbode]

Hi @aikebah, I see this has now been approved. Does this mean the suppression is live, or do I need to wait for a new dependency check release?

[vbode]

Hi @aikebah.
I just updated to 11.1.1 but the dependency scan still finds this vulnerability.
What could be wrong?

[aikebah]

@vbode the bot indicated

Suppress already exists

gut feel: you picked the wrong CPE and one or more of the other jetty-CPEs are what causes this FP to surface

[vbode]

@aikebah Ah I see that my suppression is now suppressing a different CVE. I think however this is also still a false positive from apache-el.

[aikebah]

@vbode That's a suppression from your own suppression file.

[aikebah]

If your hosted suppressions file would function properly you would have an empty report, just like in our pipeline

[vbode]

@aikebah
Indeed that is a suppression from our own file, however, I think this suppression should not be needed since it is detecting a CVE from Jetty corresponding to the apache-el version.

Regarding the report you shared, I think your report is empty because no vulnerabilities were suppressed at all, because there were no vulnerabilities to suppress.
In our case there are vulnerabilities to suppress:

[aikebah]

Report is empty, because the suppressions that are performed by the FP mitigations from the hosted suppressions file (base suppressions) are not added to the list.
The suppressed vulnerabilities enumeration is aimed at 'accepted or mitigated valid risks of a library'

[vbode]

I've had a look again. I see now that we had this error:
2024-12-06 12:48:27.520 | [WARN] Hosted Suppressions file is empty or missing - attempting to force the update
2024-12-06 12:48:27.520 | [WARN] Empty Hosted Suppression file after update, results may contain false positives already resolved by the DependencyCheck project due to failed download of the hosted suppression file

After adding the --hostedSuppressionsForceUpdate flag, this error no longer shows up, and our suppression no longer needs to suppress the apache-el false positive. We were already using the --noupdate flag, because we use a hosted SQL database.

Thanks for the help @aikebah !