Simple false positive?

[dependency-check]

Simple false positive?

[jeremylong]

With the 2.1.1 release a change was made to reduce false negatives - unfortunately, it did increase the false positive rate. See jeremylong/DependencyCheck#894 (comment). I believe most of the false positive that were introduced can be corrected with a few simple suppression rules that will be added to the core engine.

[DangerPete]

Cool. Thanks.

If you don't mind I'll just add more suspected FP's here since trying to upgrade another library to 2.1.1. Happy to open a report under the other project if it makes housekeeping easier:

CVE-2015-7545, CVE-2015-7082, CVE-2014-9938, CVE-2013-0308, CVE-2010-3906, CVE-2010-2542

hystrix-codahale-metrics-publisher-1.5.13.jar (com.netflix.hystrix:hystrix-codahale-metrics-publisher:1.5.13, cpe:/a:git:git:1.5.13, cpe:/a:git_project:git:1.5.13) : CVE-2015-7545, CVE-2015-7082, CVE-2014-9938, CVE-2013-0308, CVE-2010-3906, CVE-2010-2542
hystrix-metrics-event-stream-1.5.13.jar (com.netflix.hystrix:hystrix-metrics-event-stream:1.5.13, cpe:/a:git:git:1.5.13, cpe:/a:git_project:git:1.5.13) : CVE-2015-7545, CVE-2015-7082, CVE-2014-9938, CVE-2013-0308, CVE-2010-3906, CVE-2010-2542
hystrix-serialization-1.5.13.jar (com.netflix.hystrix:hystrix-serialization:1.5.13, cpe:/a:git:git:1.5.13, cpe:/a:git_project:git:1.5.13) : CVE-2015-7545, CVE-2015-7082, CVE-2014-9938, CVE-2013-0308, CVE-2010-3906, CVE-2010-2542

CVE-2015-2808, CVE-2013-2566

javax.annotation-api-1.2.jar (cpe:/a:oracle:glassfish:1.2, javax.annotation:javax.annotation-api:1.2) : CVE-2015-2808, CVE-2013-2566
javax.servlet-api-3.1.0.jar (cpe:/a:oracle:glassfish:3.1.0, javax.servlet:javax.servlet-api:3.1.0) : CVE-2015-2808, CVE-2013-2566

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.