[FP]: exporter-metrics java multiple CVE

[rochish-suresh]

Package URl

pkg:maven/com.google.cloud.opentelemetry/[email protected]

CPE

cpe:2.3:a:opentelemetry:opentelemetry:0.31.0:::::::*

CVE

CVE-2023-43810

ODC Integration

{"label"=>"Gradle Plugin"}

ODC Version

11.1.1

Description

Multiple CVE reported are
CVE-2023-45142
CVE-2023-47108
CVE-2023-43810

Why I think it is False Positive?
The CVEs are reported in python and go of opentelemetry

[github-actions]

Maven Coordinates

<dependency>
   <groupId>com.google.cloud.opentelemetry</groupId>
   <artifactId>exporter-metrics</artifactId>
   <version>0.31.0</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7264
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.google\.cloud\.opentelemetry/exporter-metrics@.*$</packageUrl>
   <cpe>cpe:/a:opentelemetry:opentelemetry</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/12415147722

[aikebah]

approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.