False Positive on any artifact with an ID or group ID that contains the name of a vulnerable library

Looks like something has happened to the library pattern matching recently.

Example:

False positive CVE-2005-2311 on one of our internal library dependencies - reported as cpe:2.3:a:sms:sms:0.1.0:snapshot:*:*:*:*:*:*

<dependency>
  <groupId>com.sinch.sms</groupId>
  <artifactId>msisdn-validation-management-api</artifactId>
  <version>0.1.0-SNAPSHOT</version>
</dependency>

Same thing with another internal library named ha-scheduled-message-grpc, which was reported to contain an old vulnerability in GRPC library from 2017.

[Chr1stian]

@jeremylong What is a good way to write a suppression rule that ignores the warnings related to grpc version, but still will warn about any new OWASP positives for the given package/dependency?

My current attempt after reading the docs/wiki, but really unsure if it works as intended:

<suppress>
        <notes><![CDATA[
        This suppresses false positives identified on gRPC security. https://github.com/jeremylong/DependencyCheck/issues/2995
        ]]></notes>
        <packageUrl regex="true">^pkg:maven/com\.lightbend\.akka\.grpc/akka\-grpc\-runtime_2\.13@.*$</packageUrl>
        <cpe>cpe:/a:akka:akka</cpe>
        <cpe>cpe:/a:grpc:grpc</cpe>
        <cpe>cpe:/a:lightbend:akka</cpe>
        <cpe>cpe:/a:lightbend:akka-http</cpe>
        <cpe>cpe:/a:lightbend:akka_http</cpe>
    </suppress>

[mikaelcarlstedt]

@theHilikus That first filename containing grpc indicates it’s the same issue.