Stuck on an issue?
Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.
And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.
False Positive on muliple libraries as cpe:2.3:a:json_project:json
See original GitHub issueExample
This is a multi-level problem. I think com.dslplatform:dsl-json has been shaded into this jar, but I don’t think json_project:json is the correct CPE for it. You then get #2792 on top (completely unrelated CVEs).
apm-agent-attach-1.17.0.jar: elastic-apm-agent.jar\META-INF/maven/com.dslplatform/dsl-json/pom.xml (pkg:maven/com.dslplatform/dsl-json@1.9.3, cpe:2.3:a:json_project:json:1.9.3:*:*:*:*:*:*:*) : CVE-2020-10663, CVE-2020-7712
<dependency>
<groupId>co.elastic.apm</groupId>
<artifactId>apm-agent-attach</artifactId>
<version>${elastic-apm.version}</version>
<optional>true</optional>
</dependency>
Issue Analytics
- State:
- Created 3 years ago
- Reactions:3
- Comments:14 (4 by maintainers)
Top Results From Across the Web
False Positives in Quarkus - Google Groups
Hello All,. We've been working for awhile to have the OWASP dependency check plugin to work with the Quarkus [1] project dependencies, as...
Read more >Dependency Check Plugin for SonarQube False Positive ...
I have a question on how SonarQube Plugin deals with third party libraries that are marked as False Positives.
Read more >Use of polymerase chain reaction to screen phage libraries
This is not only laborious and time-consuming, but also is prone to artifacts such as false positives commonly encountered in filter hybridization.
Read more >False Positive Management | Enterprise Documentation
for Java packages, the manifest, which contains multiple different version specifications among other metadata), but sometimes gets this wrong.
Read more >How we detect vulnerable libraries using OWASP ...
A simple way for managing a large number of 3rd party libraries might be using a ... False positives can be suppressed in...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Rather than make more issues, all of these are also detected as
json_project:json:@aarongoldenthal completely understood - I’m currently going through the Java FP reported and then I’ll work on the node and finally the .net.