[FP]: spdx-java-model-2_X

[goneall]

Package URl

pkg:maven/org.spdx/spdx-java-model-2_X@1.0.1

CPE

cpe:2.3:a:x.org:x.org:1.0.1:::::::*

CVE

CVE-2006-0197

ODC Integration

{"label" => "Maven Plugin"}

ODC Version

12.1.8

Description

The package URI pkg:maven/org.spdx/spdx-java-model-2_X@1.0.1 seems to somehow been associated with cpe:2.3:a:x.org:x.org:1.0.1:::::::* which is x.org software. The spdx-java-model-2_X does not include any x.org software directly or indirectly.

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.spdx</groupId>
   <artifactId>spdx-java-model-2_X</artifactId>
   <version>1.0.1</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #8051
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.spdx/spdx-java-model-2_X@.*$</packageUrl>
   <cpe>cpe:/a:x.org:x.org</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/18537381554

[chadlwilson]

This isn't showing as matching that CPE in the test run here, so adding a suppression for a false positive is unlikely to help.

Are you sure this is being matched with a maven-defined artifact, or is this being scanned from inside another archive/uber-jar or something like that?

Can you perhaps share what your report looks like, and your configuration?

[goneall]

Thanks @chadlwilson for the quick response.

This isn't showing as matching that CPE in the test run here

Interesting - could I be using a stale CVE/CPE database?

Attached is a copy of the report and the configuration file.

dependency-check-report.html

dependency-check-supress.xml

I was able to suppress the errors successfully.

I'm running the Maven plugin dependency check which generates the FP mvn dependency-check:check

Here's a link to the POM file: https://github.com/spdx/tools-java/blob/master/pom.xml

Also, here's the output from the maven command - I just noticed a couple of warnings - let me know if those may impact this issue.

C:\Users\garys\git\tools-java>mvn dependency-check:check
[INFO] Scanning for projects...
[INFO] Inspecting build with total of 1 modules
[INFO] Installing Central Publishing features
[WARNING] The requested profile "doclint-java8-disable" could not be activated because it does not exist.
[INFO]
[INFO] ------------------------< org.spdx:tools-java >-------------------------
[INFO] Building tools-java 2.0.3-SNAPSHOT
[INFO]   from pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- dependency-check:12.1.8:check (default-cli) @ tools-java ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (1243 ms)
[INFO]

Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.


   About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
   False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html


[INFO] Analysis Started
[INFO] Finished Archive Analyzer (1 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (2 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Using MemorySegmentIndexInput with Java 21 or later; to disable start with -Dorg.apache.lucene.store.MMapDirectory.enableMemorySegments=false
[WARNING] Java vector incubator module is not readable. For optimal vector performance, pass '--add-modules jdk.incubator.vector' to enable Vector API.
[INFO] Created CPE Index (5 seconds)
[INFO] Finished CPE Analyzer (9 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (16 seconds)
[INFO] Writing HTML report to: C:\Users\garys\git\tools-java\target\dependency-check-report.html
[WARNING]

One or more dependencies were identified with known vulnerabilities in tools-java:

icu4j-75.1.jar (pkg:maven/com.ibm.icu/icu4j@75.1, cpe:2.3:a:icu-project:international_components_for_unicode:75.1:*:*:*:*:*:*:*, cpe:2.3:a:unicode:international_components_for_unicode:75.1:*:*:*:*:*:*:*) : CVE-2025-5222
spdx-java-model-2_X-1.0.1.jar (pkg:maven/org.spdx/spdx-java-model-2_X@1.0.1, cpe:2.3:a:x.org:x.org:1.0.1:*:*:*:*:*:*:*) : CVE-2006-0197


See the dependency-check report for more details.

[chadlwilson]

Hmm, interesting.

When I compare the reports between yours and the FP automation here, they have identical "Evidence" collected, so all other things being equal - should match the same CPEs/CVEs, unless one of them has an outdated database or there is some other not-so-good indeterminism in the code I am not aware of.

Based on the Evidence collected It seems possible for this FP to be legitimate rather than an environmental thing. I'll dig a bit further tomorrow possibly, and see if I can replicate, as it might point to some other not-so-good indeterminism.

If you're feeling enthusiastic you could try with a fresh dependency check data directory and bootstrap all the NVD data again to see if the results are any different, but that's probably not high on your priority list ;-)

[chadlwilson]

approved

Can replicate locally. Seems to be a difference either when enabling the Central Analyzer (which the automation does) or when running with the wider context from the other dependencies. Shouldn't change the results here, but there are some weird heuristics around...

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.

[goneall]

Thanks @chadlwilson