[FP]: shared-resourcemapping for multiple cve

[rochish-suresh]

Package URl

pkg:maven/com.google.cloud.opentelemetry/[email protected]

CPE

cpe:2.3:a:opentelemetry:opentelemetry:0.32.0:::::::*

CVE

CVE-2023-43810

ODC Integration

{"label"=>"Gradle Plugin"}

ODC Version

11.1.1

Description

Multiple CVE reported are
CVE-2023-45142
CVE-2023-47108
CVE-2023-43810

Why I think it is False Positive?
The CVEs are reported in python and go of opentelemetry

[github-actions]

Maven Coordinates

<dependency>
   <groupId>com.google.cloud.opentelemetry</groupId>
   <artifactId>shared-resourcemapping</artifactId>
   <version>0.32.0</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7265
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.google\.cloud\.opentelemetry/shared-resourcemapping@.*$</packageUrl>
   <cpe>cpe:/a:opentelemetry:opentelemetry</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/12415167660

[aikebah]

approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.