Giters

jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

Home Page:https://owasp.org/www-project-dependency-check/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

[FP]: jackson-databind for CVE-2017-7525

githubuserVenkat opened this issue · comments

commented

Package URl

pkg:maven/org.codehaus.jackson/jackson-mapper-asl@1.9.13

CPE

cpe:2.3:a:fasterxml:jackson-mapper-asl:1.9.13:::::::*

CVE

CVE-2017-7525

ODC Integration

None

ODC Version

9.0.9

Description

Actual vulnerable component is jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9

commented

Maven Coordinates

<dependency>
   <groupId>org.codehaus.jackson</groupId>
   <artifactId>jackson-mapper-asl</artifactId>
   <version>1.9.13</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #6476
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.codehaus\.jackson/jackson-mapper-asl@.*$</packageUrl>
   <cpe>cpe:/a:fasterxml:jackson-mapper-asl</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/7956434408