Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

False positives for Aries #1652

Closed
coheigea opened this issue Jan 2, 2019 · 0 comments
Closed

False positives for Aries #1652

coheigea opened this issue Jan 2, 2019 · 0 comments
Labels
FP Report
Milestone
6.0.3

Comments

@coheigea
Copy link

coheigea commented Jan 2, 2019 •
edited

There are a bunch of false positives for Apache Aries.

  1. Aries RSA - it is including vulnerabilities for the Apache HTTP server for some reason:

org.apache.aries.rsa.spi-1.12.0.jar (cpe:/a:apache:apache_http_server:1.12.0, org.apache.aries.rsa:org.apache.aries.rsa.spi:1.12.0) : CVE-2014-3581, CVE-2010-1151
org.apache.aries.rsa.discovery.local-1.12.0.jar (cpe:/a:apache:apache_http_server:1.12.0, org.apache.aries.rsa.discovery:org.apache.aries.rsa.discovery.local:1.12.0) : CVE-2014-3581, CVE-2010-1151

  1. Including vulnerabilities from Geronimo:

org.apache.aries.transaction.manager-1.3.3.jar (cpe:/a:form_manager_project:form_manager:1.3.3, cpe:/a:apache:geronimo:1.3.3, org.apache.aries.transaction:org.apache.aries.transaction.manager:1.3.3) : CVE-2011-5034, CVE-2008-0732

  1. Including vulernabilities from the Apache SSL Server

org.apache.aries.jndi.legacy.support-1.0.0.jar (cpe:/a:apache-ssl:apache-ssl:1.0.0, org.apache.aries.jndi:org.apache.aries.jndi.legacy.support:1.0.0) : CVE-2004-0009
@coheigea coheigea changed the title False positive for Aries RSA False positives for Aries Jan 2, 2019
jeremylong added a commit that referenced this issue Nov 1, 2020
@jeremylong
fp per #1652
a744bf8
@jeremylong jeremylong added this to the 6.0.3 milestone Nov 1, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
FP Report
Projects
None yet
Milestone
6.0.3
Development

No branches or pull requests
2 participants
@coheigea @jeremylong