[FP]: micronaut-json-schema-utils reporting as cron-utils_project:cron-utils

[ajnhO]

Package URl

pkg:maven/io.micronaut.jsonschema/micronaut-json-schema-utils@1.7.3

CPE

cpe:2.3:a:cron-utils_project:cron-utils:1.7.3:*:*:*:*:*:*:*

CVE

CVE-2021-41269

ODC Integration

{"label" => "Gradle Plugin"}

ODC Version

12.1.3

Description

io.micronaut.jsonschema/micronaut-json-schema-utils has only one dependency which has no dependencies. Neither has any of the referenced cpes.

 +--- io.micronaut.jsonschema:micronaut-json-schema-utils:1.7.3
      \--- io.micronaut.jsonschema:micronaut-json-schema-annotations:1.7.3

Report

micronaut-json-schema-utils-1.7.3.jar (pkg:maven/io.micronaut.jsonschema/micronaut-json-schema-utils@1.7.3, cpe:2.3:a:cron-utils_project:cron-utils:1.7.3:*:*:*:*:*:*:*, cpe:2.3:a:json-schema_project:json-schema:1.7.3:*:*:*:*:*:*:*, cpe:2.3:a:utils_project:utils:1.7.3:*:*:*:*:*:*:*) : CVE-2021-41269, CVE-2020-26238

CVE-2020-26238 raised separately.

[github-actions]

Maven Coordinates

<dependency>
   <groupId>io.micronaut.jsonschema</groupId>
   <artifactId>micronaut-json-schema-utils</artifactId>
   <version>1.7.3</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #8169
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.micronaut\.jsonschema/micronaut-json-schema-utils@.*$</packageUrl>
   <cpe>cpe:/a:cron-utils_project:cron-utils</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/19883784928

[chadlwilson]

approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.