Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FP]: memcache-asg-java-client incorrectly indentified as memcached #7225

Closed
tobias opened this issue Dec 4, 2024 · 3 comments
Closed

[FP]: memcache-asg-java-client incorrectly indentified as memcached #7225

tobias opened this issue Dec 4, 2024 · 3 comments
Labels
FP Report maven changes to the maven plugin

Comments

@tobias
Copy link

tobias commented Dec 4, 2024

Package URl

pkg:maven/com.datomic/[email protected]

CPE

cpe:2.3:a:memcached:memcached:1.1.0.36:::::::*

CVE

No response

ODC Integration

None

ODC Version

10.0.2

Description

GHSA-47qj-rqv2-98f2 is a vulnerability in the memcached server, however it is being matching on a memcached client published by a third party vendor. This is similar to #7207, but with a different CPE.

Copy link
Contributor

github-actions bot commented Dec 4, 2024

Maven Coordinates

<dependency>
   <groupId>com.datomic</groupId>
   <artifactId>memcache-asg-java-client</artifactId>
   <version>1.1.0.36</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7225
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.datomic/memcache-asg-java-client@.*$</packageUrl>
   <cpe>cpe:/a:memcached:memcached</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/12161499003

@github-actions github-actions bot added the maven changes to the maven plugin label Dec 4, 2024
@aikebah
Copy link
Collaborator

aikebah commented Dec 8, 2024

approved

Copy link
Contributor

github-actions bot commented Dec 8, 2024

Suppress rule has been added to the generatedSuppressions branch.

@github-actions github-actions bot closed this as completed Dec 8, 2024
github-actions bot added a commit that referenced this issue Dec 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
FP Report maven changes to the maven plugin
Projects
None yet
Development

No branches or pull requests

2 participants