FP for CVE-2016-3720 on non-affected Jackson version

[asieira]

This is related to the same vulnerability and package as jeremylong/DependencyCheck#517 but is not exactly the same problem.

I have all the Jackson dependencies at version 2.7.6, which according to the NVD entry and CPE is not affected by the vulnerability. Still, I'm getting the following output on my check dependencies log:

One or more dependencies were identified with known vulnerabilities in <redacted>:

jackson-core-2.7.6.jar (com.fasterxml.jackson.core:jackson-core:2.7.6, cpe:/a:fasterxml:jackson:2.7.6) : CVE-2016-3720

These are the dependencies that triggered this:

        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>2.7.6</version>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-annotations</artifactId>
            <version>2.7.6</version>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.dataformat</groupId>
            <artifactId>jackson-dataformat-cbor</artifactId>
            <version>2.7.6</version>
        </dependency>

[jeremylong]

What version of dependency-check are you using? I just tested these three dependencies (with the current snapshot) and they were not flagged as vulnerable.

[asieira]

                <groupId>org.owasp</groupId>
                <artifactId>dependency-check-maven</artifactId>
                <version>1.4.2</version>

[jeremylong]

Can you delete the dependency-check database and retest this? While there is a CPE match for jackson-core - no vulnerabilities are showing up (because we are using a safer version) when I run this exact same test with a fresh database. Just wondering if something got out of sync with the NVD.

[jeremylong]

Unable to reproduce. Additional fixes have been implemented around CVE-2016-3720.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.