[FP]: Nuget packages with Redis in name is marked as vulnerable

[McMlok]

Package URl

pkg:generic/Microsoft.Extensions.Caching.StackExchangeRedis@6.0.1
pkg:generic/HealthChecks.Redis@5.0.2

CPE

cpe:2.3:a:redis:redis:5.0.2:::::::*
cpe:2.3:a:microsoft:.net_core:6.0.1:::::::*
cpe:2.3:a:microsoft:exchange:6.0.1:::::::*
cpe:2.3:a:redis:redis:6.0.1:::::::*

CVE

CVE-2021-32626
CVE-2021-32627
CVE-2021-32628
CVE-2021-32675
CVE-2021-32687
CVE-2021-32762
CVE-2021-41099

ODC Integration

{"label"=>"CLI"}

ODC Version

• 6.5.3
• 7.0.4

Description

It looks like that all Nuget packages with "Redis" in name and with the version similar to a version number used in Redis server are marked with vulnerabilities found in Redis Server.

[NickCraver]

For what it's worth we're getting issues on this as a client library, for example: StackExchange/StackExchange.Redis#2358

I'm not sure how this tool gets data it's depending on, but could we please update the Redis definitions? If that's upstream, just need a pointer of where to look.

[accade]

Any news from DependencyCheck?

[jsch-adt]

Also hitting this issue with ODC for the Python redis library, and there are even more FPs now.

CPE
pkg:pypi/redis@5.0.1

CVE
Same as above, plus:
CVE-2022-24735
CVE-2022-24834
CVE-2021-31294
CVE-2021-32672
CVE-2022-24736
CVE-2022-36021
CVE-2023-25155
CVE-2023-28856

ODC Version
9.0.8

[jsch-adt]

@jeremylong I created a PR to address this ticket - is there anything else I need to do to submit for review? Thanks!