[FP]: org.apache.ftpserver:ftpserver-core:jar is matched with apache mina

[davidweisgerber]

Package URl

pkg:maven/org.apache.ftpserver/[email protected]

CPE

cpe:2.3:a:apache:mina:1.2.0:::::::* (Confidence:Low)

CVE

CVE-2021-41973

ODC Integration

{"label"=>"Maven Plugin"}

ODC Version

10.0.4

Description

After #7026 (comment) was resolved, the package ftplet-api is now matched with apache mina. Interestingly, ftplet-core has a dependency to apache mina, but in another (patched) version: 2.1.6 which means I get the following false positive:

ftplet-api-1.2.0.jar (pkg:maven/org.apache.ftpserver/[email protected], cpe:2.3:a:apache:mina:1.2.0:::::::*) : CVE-2021-41973

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.apache.ftpserver</groupId>
   <artifactId>ftplet-api</artifactId>
   <version>1.2.0</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7043
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.apache\.ftpserver/ftplet-api@.*$</packageUrl>
   <cpe>cpe:/a:apache:mina</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/11321891338

[aikebah]

As FTPServer is an independently managed subproject under the umbrella of the Apache MINA project it would indeed get a CPE separate from the MINA product assigned should a CVE get reported for it in the future, but the suppression suggested by the bot should not be used as it is very likely that NVD would opt for product mina-ftpserver (after the github repo) and the CPE suppression quoted would suppress it due to comparing using case-insensitive prefix matching.

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7043
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.apache\.ftpserver/ftplet-api@.*$</packageUrl>
   <cpe regex="true">^cpe:/a:apache:mina:.*</cpe>
</suppress>

Should do the right suppression IIRC. I'll doublecheck that for proper working and will add it manually to the hosted suppressions (and update this comment should I discover that the suppression rule should be further adapted to be correct).