[FP]: CVE-2019-14822 is flagged falsely in JARs due to a naming conflict with Linux "ibus" framework

[ahuja-himanshu]

Package URl

pkg:maven/com.internal/ibus-client@1.0.0

CPE

cpe:2.3:a:ibus_project:ibus:1.0.0:::::::*

CVE

CVE-2019-14822

ODC Integration

{"label" => "CLI"}

ODC Version

12.1.3

Description

This issue was previously reported in #7823, which was closed with the suggestion to use the suppression rule provided in the HTML report. Apologies for the delayed follow-up. I am reopening this issue because the problem persists.

We already maintain an internal suppression file that is intended to suppress any false-positive findings for artifacts originating from the com.internal.* package. However, in this particular scenario, the rule does not seem to apply, likely due to the presence of the ibus string in our artifact name. We would like to avoid updating our internal suppression file, which currently works effectively for all other internal artifacts, solely because of this one artifact name. Our preference is to keep our suppression rules simple and broadly applicable, without needing special exceptions for individual cases like this one. The issue was also explained in detail in #7821

I have uploaded a dummy JAR file which can be used to reproduce the issue locally. I'd appreciate any guidance on this DepCheck issue.

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/dependency-check/DependencyCheck/actions/runs/18000764842

[chadlwilson]

The same advice applies - use a suppression rule.

What is the suppression rule that you think should work, but does not work? The one in your example?

We would like to avoid updating our internal suppression file, which currently works effectively for all other internal artifacts, solely because of this one artifact name.

This is likely not a valid reason. The rules support regexs, so matching all of your internal package group names that stops them matching against ANY CPEs (if that’s what you want) with a single rule should be trivial. Try updating your rules to suppress against all CVEs (not vulnerability names) or all CPEs.

Why would software used by many thousands of people be updated with a specific workaround a name only used by you internally? Unfortunately name conflicts like these are inevitable. There is no deterministic way to go from a set of maven coordinates to a CPE. The trade off is false negatives vs false positives.