[FP]: MongoDB.Bson identified as MongoDB

[echalone]

Package URl

pkg:nuget/MongoDB.Bson@2.22.0

CPE

cpe:2.3:a:mongodb:mongodb:2.22.0:::::::*

CVE

No response

ODC Integration

None

ODC Version

9.0.8

Description

A false positive for the mongodb library (https://github.com/mongodb/mongo) is reported, when in reality it is the MongoDB.Bson NuGet package (https://www.nuget.org/packages/MongoDB.Bson).

[github-actions]

Nuget Coordinates

dotnet add package MongoDB.Bson --version 2.22.0

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #6376
   ]]></notes>
   <packageUrl regex="true">^pkg:nuget/MongoDB\.Bson@.*$</packageUrl>
   <cpe>cpe:/a:mongodb:mongodb</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/7459342995

[BenniG82]

@echalone
I'm pretty sure this related to #6358
We're facing similar problems because the ecosystem of mongodb:mongodb is (often) not consistent for all CPEs

[aikebah]

approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.