[FP]: Microsoft.AspNetCore.Authentication.OpenIdConnect still reported for CVE-2007-1651

[ChristopheL77]

Package URl

pkg:nuget/Microsoft.AspNetCore.Authentication.OpenIdConnect@8.0.18

CPE

cpe:2.3:a:openid:openid:*:*:*:*:*:*:*:*

CVE

CVE-2007-1651

ODC Integration

None

ODC Version

12.1.3

Description

This issue is closed but the issue remains : #7553
Issue was fixed in a branch but it is not merged or must we add this suppression manually in our suppression.xml file ?

[github-actions]

Nuget Coordinates

dotnet add package Microsoft.AspNetCore.Authentication.OpenIdConnect --version 8.0.18

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7831
   ]]></notes>
   <packageUrl regex="true">^pkg:nuget/Microsoft\.AspNetCore\.Authentication\.OpenIdConnect@.*$</packageUrl>
   <cpe>cpe:/a:openid:openid</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/16468265326

[github-actions]

Nuget Coordinates

dotnet add package Microsoft.AspNetCore.Authentication.OpenIdConnect --version 8.0.18

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7831
   ]]></notes>
   <packageUrl regex="true">^pkg:nuget/Microsoft\.AspNetCore\.Authentication\.OpenIdConnect@.*$</packageUrl>
   <cpe>cpe:/a:openid:openid</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/16489490716

[github-actions]

Nuget Coordinates

dotnet add package Microsoft.AspNetCore.Authentication.OpenIdConnect --version 8.0.18

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7831
   ]]></notes>
   <packageUrl regex="true">^pkg:nuget/Microsoft\.AspNetCore\.Authentication\.OpenIdConnect@.*$</packageUrl>
   <cpe>cpe:/a:openid:openid</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/16489493401

[chadlwilson]

Approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.

[chadlwilson]

The CPE changed or it's a new one.