[FP]: CVE-2022-48285 mismatch in Zookeeper

[sadeesh89]

Package URl

https://downloads.apache.org/zookeeper/zookeeper-3.8.4/apache-zookeeper-3.8.4-bin.tar.gz

CPE

cpe:2.3:a:jszip_project:jszip::::::node.js::*

CVE

CVE-2022-48285

ODC Integration

None

ODC Version

12.1.9

Description

The vulnerability scanner has incorrectly matched the artifact zookeeper-3.8.4.-bin.tar.gz in this it has zookeeper server contains jszip.js and zookeeper-jute contains jszip.min.js

zookeeper-3.8.4-bin.tar.gz/zookeeper-3.8.4-bin.tar/apache-zookeeper-3.8.4-bin/docs/apidocs/zookeeper-server/jquery/jszip/dist/jszip.js

zookeeper-3.8.4-bin.tar.gz/zookeeper-3.8.4-bin.tar/apache-zookeeper-3.8.4-bin/docs/apidocs/zookeeper-jute/jquery/jszip/dist/jszip.min.js

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/dependency-check/DependencyCheck/actions/runs/19709665430

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/dependency-check/DependencyCheck/actions/runs/19709764869

[github-actions]

Error parsing package url: https://downloads.apache.org/zookeeper/zookeeper-3.8.4/apache-zookeeper-3.8.4-bin.tar.gz.

Error: Error: Invalid purl: missing required "pkg" scheme component

Please correct the package URL - consider copying the package url from the HTML report.

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/dependency-check/DependencyCheck/actions/runs/19709818679

[chadlwilson]

You are not scanning a maven artifact here, you are scanning an entire server distribution of zookeeper, so the PURL is incorrect.

The distribution includes API documentation which appears to include/use jQuery which then includes some minified jszip version or another.

You would need to determine the actual jszip version included here, to see if it's actually a.problem (you have not reported the CPE correctly per the ODC report details), but you are going to get lots of false positives if you try and scan arbitrary binary distributions like this.

You will generally need to maintain your own suppressions for such things, unless you can determine which jszip version the minified file actually is, vs what ODC detects. Given the jszip file name is not versioned I suspect this will be impossible for ODC to reliably detect and that's what user suppressions are for.