[FP]: pkg:maven/com.azure.resourcemanager/[email protected] and CVE-2024-43591

[dampcake]

Package URl

pkg:maven/com.azure.resourcemanager/[email protected]

CPE

cpe:2.3:a:microsoft:azure_cli:2.31.0:*:*:*:*:*:*:*

CVE

CVE-2024-43591

ODC Integration

{"label"=>"Maven Plugin"}

ODC Version

10.0.4

Description

See #7066, #7110, #7124, #7215, and #7216 for this CVE being incorrectly matched against the java libraries.

[github-actions]

Maven Coordinates

<dependency>
   <groupId>com.azure.resourcemanager</groupId>
   <artifactId>azure-resourcemanager-storage</artifactId>
   <version>2.31.0</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7280
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.azure\.resourcemanager/azure-resourcemanager-storage@.*$</packageUrl>
   <cpe>cpe:/a:microsoft:azure_cli</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/12574452074

[github-actions]

Maven Coordinates

<dependency>
   <groupId>com.azure.resourcemanager</groupId>
   <artifactId>azure-resourcemanager-storage</artifactId>
   <version>2.31.0</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7280
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.azure\.resourcemanager/azure-resourcemanager-storage@.*$</packageUrl>
   <cpe>cpe:/a:microsoft:azure_cli</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/12574454562

[chadlwilson]

approved

We probably need to consolidate these into a more generic custom suppression as there are many, many libs that are part of the Azure SDK for Java :-(

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.