[FP]: commons-configuration 1.10 jar flagged for 2 CVEs only applicable to version 2.x

[kwwall]

Package URl

pkg:maven/commons-configuration/[email protected] 

CPE

cpe:2.3:a:apache:commons_configuration:1.10:::::::*

CVE

CVE-2024-29131

ODC Integration

{"label"=>"Maven Plugin"}

ODC Version

9.2.0

Description

The other CVE that was flagged CVE-2024-29133. All indications are that these 2 CVEs only apply to versions "from 2.0 before 2.10.1".

However, it seems plausible that this FP is caused by misinformation in the Sonatype link https://ossindex.sonatype.org/component/pkg:maven/commons-configuration/[email protected]?utm_source=dependency-check&utm_medium=integration&utm_content=9.2.0 which the pkg: URI refers to as it notes "Version 1.10" at the tope of the page.

This result was produced when run against the ESAPI 2.5.4.0 release.

[github-actions]

Maven Coordinates

<dependency>
   <groupId>commons-configuration</groupId>
   <artifactId>commons-configuration</artifactId>
   <version>1.10</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #6704
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/commons-configuration/commons-configuration@.*$</packageUrl>
   <cpe>cpe:/a:apache:commons_configuration</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/9310704981

[aikebah]

If you search the issues you'll find multiple duplicates. We just report that OSSINDEX states that version 1.10 is subject to the same CVEs, so you'd have to take it up with Sonatype OSSINDEX.

[kwwall]

@jeremylong - Thanks for closing this. About a week ago I confirmed that these CVEs were legit in the Apache Commons Configuration 1.x releases as well, and I notified the Apache security team. They said that Sonatype had never informed them. I just forgot to tie up this loose end. Fortunately, these are not exploitable in ESAPI, so I'm going to leave the suppression rules that I added in our last release intact, but maybe change the comment.