[FP]: CVE-2023-46669 and CVE-2024-52976 on co.elastic.apm:apm-agent-api

[aggeboe]

Package URl

pkg:maven/co.elastic.apm/apm-agent-api@1.51.0

CPE

cpe:2.3:a:elastic:elastic_agent:1.51.0:*:*:*:*:*:*:*

CVE

No response

ODC Integration

{"label" => "Gradle Plugin"}

ODC Version

12.1.6

Description

apm-agent-api identified as Elastic Agent (https://github.com/elastic/elastic-agent)
Relates to #7996

[github-actions]

Maven Coordinates

<dependency>
   <groupId>co.elastic.apm</groupId>
   <artifactId>apm-agent-api</artifactId>
   <version>1.51.0</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7998
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/co\.elastic\.apm/apm-agent-api@.*$</packageUrl>
   <cpe>cpe:/a:elastic:elastic_agent</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/18187057865

[chadlwilson]

approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.

[OrangeDog]

Would be better to match the whole co.elastic.apm group in a single rule, none of which are elastic:apm_agent, but most hit this FP.

[chadlwilson]

@OrangeDog Feel free to submit a PR to the generatedSuppressions branch to refactor the suppression to that. The automation isn't smart enough to do that, but takes a few seconds rather than multiple minutes.