Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

False positive on org.eclipse.jetty.alpn

See original GitHub issue

False positive on https://mvnrepository.com/artifact/org.eclipse.jetty.alpn/alpn-api

Identifiers

cpe: cpe:/a:jetty:jetty:1.1.3.v20160715 Confidence:Low suppress
maven: org.eclipse.jetty.alpn:alpn-api:1.1.3.v20160715 Confidence:Highest
cpe: cpe:/a:eclipse:jetty:1.1.3.v20160715 Confidence:Low

See comment from the author: https://github.com/http4s/blaze/issues/235#issuecomment-426927348

Workaround suppression:

   <suppress>
       <notes>False-positive: it's about the implementation not the api</notes>
       <cve>CVE-2017-14798</cve>
       <cpe>cpe:/a:eclipse:jetty</cpe>
   </suppress>

Issue Analytics

State:
Created 5 years ago
Comments:7 (3 by maintainers)

Top GitHub Comments

1reaction

jeremylongcommented, Oct 24, 2018

Suppressing the CVE will suppress this single entry. Suppressing by CPE will prevent future CVEs from being reported against alpn-api - which will reduce the number of FP in the output. If someone is using alpn-api in addition to, for instance, embedded jetty - the embedded version of jetty would still get flagged.

0reactions

lock[bot]commented, Nov 27, 2018

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

Top Results From Across the Web

Maven - org.eclipse.jetty/jetty-alpn-client - Sonatype OSS Index

Find vulnerabilities, licenses, and versions for org.eclipse.jetty/jetty-alpn-client : Jetty ALPN client services.

HTTP/2 Request with JMeter fails with "nullSession" (jetty-alpn)

But if I start JMeter without the alpn argument, I see results like this (HTTP/2 with HTTPS): Response code:Non HTTP response code: java.util....

Jetty11 Operations Guide | The Eclipse Foundation

Eclipse Jetty as a standalone server has no graphical user interface, so configuring and running the server is done from the command line....

Eclipse Jetty: Programming Guide

If the client application does not explicitly specify the HTTP version, then ALPN will be used by the client. If the server also...

Index (Jetty :: Javadoc Build 11.0.13 API) - Eclipse

ALPNServerConnection - Class in org.eclipse.jetty.alpn.server · ALPNServerConnection(Connector, EndPoint, ... Removes all authentication results stored.