False positive on spring-cloud-function-core-3.0.8.RELEASE.jar: CVE-2020-3992 : cpe:2.3:a:vmware:cloud_foundation:3.0.8:release:*:*:*:*:*:*)

[yl-coder]

When reporting a false positive please include:

• The location of the dependency : https://mvnrepository.com/artifact/org.springframework.cloud/spring-cloud-function-core
• The CPE that is believed to be false positive : cpe:2.3:a:vmware:cloud_foundation:3.0.8:release:*:*:*:*:*:*): CVE-2020-3992

Example

False positive on library spring-cloud-function-core-3.0.8.RELEASE.jar- reported as cpe:2.3:a:vmware:cloud_foundation:3.0.8:release:*:*:*:*:*:*): CVE-2020-3992

This is a sub dependency from spring-cloud-stream-binder-rabbit.

  <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-stream-binder-rabbit</artifactId>
            <version>3.0.8.RELEASE</version>
        </dependency>