[FP]: CVE-2020-15250 on junit reported for dependency com.googlecode.json-simple:json-simple:1.1.1

[sferrydxc]

Package URl

pkg:maven/junit/junit@4.10

CPE

cpe:2.3:a:junit:junit4:4.10:::::::*

CVE

CVE-2020-15250

ODC Integration

{"label" => "Maven Plugin"}

ODC Version

12.1.3

Description

The CVE-2020-15250 is raised when having json-simple 1.1.1 dependency:

com.googlecode.json-simple
json-simple
1.1.1

Seems that it is due to the pom.xml of json-simple 1.1.1 incorrectly containing the following runtime dependency:

junit
junit
4.10

Wehn googling, the issue seems to have already been raised to json-simple developers a very long time ago several years) without remediation

[github-actions]

Maven Coordinates

<dependency>
   <groupId>junit</groupId>
   <artifactId>junit</artifactId>
   <version>4.10</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7922
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/junit/junit@.*$</packageUrl>
   <cpe>cpe:/a:junit:junit4</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/17639138151

[aikebah]

This is not a false positive, but a scoping issue in the library that makes JUnit a compile+runtime dependency of this library instead of only a test-dependency. DependencyCheck properly reports the dependency. If you intend to continue depending on this end-of-life library (no new releases since 2012 means it's very likely to never receive any update) to avoid this getting raised you should exclude the dependency in your pom.xml upon which ODC will also no longer consider it a dependency (your exclusion removes it from the transitive dependency list)

        <dependency>
            <groupId>com.googlecode.json-simple</groupId>
            <artifactId>json-simple</artifactId>
            <version>1.1.1</version>
            <exclusions>
                <exclusion>
                    <artifactId>junit</artifactId>
                    <groupId>junit</groupId>
                </exclusion>
            </exclusions>
        </dependency>