[FP]: multi old CVE making false report

[ZheSun88]

Package URl

pkg:maven/com.vaadin.flow.ai/form-filler-addon@1.0.1

CPE

cpe:2.3:a:vaadin:flow:1.0.1::::::

CVE

CVE-2019-25027, CVE-2021-31412, CVE-2018-25007, CVE-2021-31404

ODC Integration

{"label"=>"Maven Plugin"}

ODC Version

8.4.2

Description

old CVE has wildcard for artifacts. it should not report to new products.

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/6637734502

[ZheSun88]

seems the GHA failed with maven search. probably need to restart

[github-actions]

Maven Coordinates

<dependency>
   <groupId>com.vaadin.flow.ai</groupId>
   <artifactId>form-filler-addon</artifactId>
   <version>1.0.1</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #6016
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.vaadin\.flow\.ai/form-filler-addon@.*$</packageUrl>
   <cpe>cpe:/a:vaadin:flow</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/6639595624

[ZheSun88]

Hi @aikebah , can you help to approve this FP report, so that we can get rid of this for our artifact.

[ZheSun88]

Hi @jeremylong , sorry to bother, we have new versions released for our product, having this FP is confusing our customers, so can I ask for a help on approving this FP report? Thanks