[FP]: CVE-2016-8735 CVE is still reported in latest Tomcat version

[githubuserVenkat]

Package URl

pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.106

CPE

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.106:::::::*

CVE

CVE-2016-8735

ODC Integration

None

ODC Version

12.1.9

Description

CVE-2016-8735 --> actually fixed in tomcat 9.0.0.M2 we are using 9.0.106 still showing as critical CVE

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.apache.tomcat</groupId>
   <artifactId>tomcat-el-api</artifactId>
   <version>9.0.106</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #8152
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.apache\.tomcat/tomcat-el-api@.*$</packageUrl>
   <cpe>cpe:/a:apache_tomcat:apache_tomcat</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/19727030206

[chadlwilson]

If you are scanning an entire tomcat distribution zip with the CLI please read the existing issues related to this, emg #8096 (comment)

It is likely your scanning setting is not determining the version numbers correctly. Make sure your Central analyzer is working correctly.

Otherwise please share a log and report in full.