More false positives since DC 2.1.1

I’m seeing a change in behavior for the DC 2.1.1 release:

More Jars are reported as false positives than before the release: e.g.:

• mailapi-1.5.6.jar, which was already used in the exact same version in DC 2.1.0, is now falsely reported as CVE-2015-9097 since DC 2.1.1.
• joda-time-1.6.jar is now falsely reported as CVE-2014-5169
• javax.json-1.0.4.jar is now falsely reported as CVE-2015-2808 and CVE-2013-2566

See https://gist.github.com/albuch/b9b080cf8d07c528c89b38aa9abb2790 for full report.

The issue occurs when running sbt-dependency-check on itself with dependency-check-core updated to v2.1.1 (for reference: https://github.com/albuch/sbt-dependency-check/pull/28).

@jeremylong do you have any idea why these are newly reported as false positives?

[jeremylong]

I’ll look into this as soon as I’ve gotten the database branch to build on travis…

[cardamon]

FWIW, some (more) false positives:

Filename: lombok-1.16.18.jar | Reference: CVE-2016-0749 | CVSS Score: 10.0 | Category: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer | The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.

Filename: lombok-1.16.18.jar | Reference: CVE-2016-2150 | CVSS Score: 3.6 | Category: CWE-284 Improper Access Control | SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261.