[FP]: CVE-2023-46669 on co.elastic.apm:apm-agent-api

[aggeboe]

Package URl

pkg:maven/co.elastic.apm/apm-agent-api@1.51.0

CPE

cpe:2.3:a:elastic:apm_agent:1.51.0:*:*:*:*:*:*:*

CVE

CVE-2023-46669

ODC Integration

{"label" => "Gradle Plugin"}

ODC Version

12.1.6

Description

apm-agent-api identified as Elastic Agent (https://github.com/elastic/elastic-agent)

[github-actions]

Maven Coordinates

<dependency>
   <groupId>co.elastic.apm</groupId>
   <artifactId>apm-agent-api</artifactId>
   <version>1.51.0</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7996
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/co\.elastic\.apm/apm-agent-api@.*$</packageUrl>
   <cpe>cpe:/a:elastic:apm_agent</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/18184788185

[chadlwilson]

approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.

[chadlwilson]

Although I have approved this (maybe too early), you might want to check your NVD data. The CVEs you link are actually marked against cpe:2.3:a:elastic:elastic_agent:*:*:*:*:*:*:*:* which is not causing an FP - not the CPE you mention here.

Are you operating on stale NVD data?

[github-actions]

Suppress already exists in generatedSuppressions branch. See issue #7996.

[chadlwilson]

Actually, I am more confused - both CPEs are returned, however the CVEs aren't being found in the test run here which is unusual. Will worry about that later - probably not your problem.

[aggeboe]

@chadlwilson FYI - the vulnerabilities reported by dependency-check

apm-agent-api-1.51.0.jar (pkg:maven/co.elastic.apm/apm-agent-api@1.51.0, cpe:2.3:a:elastic:apm_agent:1.51.0:*:*:*:*:*:*:*, cpe:2.3:a:elastic:elastic_agent:1.51.0:*:*:*:*:*:*:*) : CVE-2024-52976, CVE-2023-46669

Regarding stale NVD data. We're using the open-vulnerability-data-mirror. Thanks, will check with the ops team.

[chadlwilson]

OK, we will probably also need to also suppress the cpe:2.3:a:elastic:elastic_agent CPE as well or you'll still get the FPs recorded against that. When filing the ticket here you probably chose the wrong CPE of the ones matched (which I should have checked, my bad).