False Positive on undertow-core

[OrangeDog]

False positive on library undertow-core-2.0.21.Final.jar - reported as cpe:2.3:a:redhat:undertow:2.0.21:*:*:*:*:*:*:*

<dependency>
   <groupId>io.undertow</groupId>
   <artifactId>undertow-core</artifactId>
   <version>2.0.21.Final</version>
</dependency>

New in 5.0.0 (compared to 4.0.2) this dependency has CVE-2018-1067 detected.
It looks like the NVD is using the JBoss version instead of the Undertow version? However, this wasn't a problem on the previous plugin release.

[OrangeDog]

See also OSSIndex/vulns#12

[OrangeDog]

The RedHat distribution uses the JBoss version for all components.
The Maven distributions should not be identified with redhat CPEs.

<suppress>
    <packageUrl regex="true">^pkg:maven/io\.undertow/.*$</packageUrl>
    <cpe>cpe:/a:redhat:undertow</cpe>
</suppress>