False positive on stax-api-1.0-2

[coheigea]

A false positive is reported on library stax-api-1.0-2.jar - reported as (javax.xml.stream:stax-api:1.0-2, cpe:/a:st_project:st:1.0.2) : CVE-2017-16224

This was previously reported here:

#1424

It looks like the rule needs to be updated to also remove it for the "javax.xml.stream" groupId.

[jeremylong]

I believe this regression was caused by #1580.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.