[FP]: CVE-2023-36415 still found in azure-identity 1.10.3

Package URl

pkg:maven/com.azure/azure-identity@1.10.3

CPE

cpe:2.3:a:microsoft:azure_identity_sdk:1.10.3:*:*:*:*:*:*:* cpe:2.3:a:microsoft:azure_sdk_for_java:1.10.3:*:*:*:*:*:*:*

CVE

CVE-2023-36415

ODC Integration

{"label"=>"Maven Plugin"}

ODC Version

8.4.0

Description

According to https://nvd.nist.gov/vuln/detail/CVE-2023-36415, this CVE affects Up to (excluding) 1.10.2, but both in 1.10.2 and 1.10.3 it is reported as present.

Maven Coordinates

<dependency>
   <groupId>com.azure</groupId>
   <artifactId>azure-identity</artifactId>
   <version>1.10.3</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #5992
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.azure/azure-identity@.*$</packageUrl>
   <cpe>cpe:/a:microsoft:azure_identity_sdk</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/6531560682

Would require an enhancement where the language field of NVD data is taken into account as this CPE has per platform(programming language) a different unbounded up-to-excluding listing https://nvd.nist.gov/vuln/detail/CVE-2023-36415 leading to the java version being checked against the python version range

That language constraint for CPEs seems pretty important! Perhaps worth being on its own ticket? I have several exclusions in my false positives file where the CPE is for a different language.

@martin-traverse

@martin-traverse only relevant for multi-language frameworks like this one, as for single language libs the language component is typically left out in the CPE coordinates

Hey guys,

so I understand it's just a"missing feature", right? At least this is what I understood.

I know it's a technical forum but please allow me a kind of "political comment".

With the new Cyber Resilience Act that will become effective in the whole EU a lot of companies will have to argue about every found vulnerability. When 10 customers are calling then for sure we can explain that they only have found this in our product because of the scanner and after that we're fine I hope. But all that will need quite lot of time and explanations and wouldn't be needed if the vulnerability wouldn't even be found.

This just as an explanation why I see this missing feature as not that irrelevant.

(And yes guys.......you're absolutely right when you say: "You're right. Why don't you start contributing to this wonderful project.". I really would start thinking about that.....really, but at the moment I just don't have any resources left. This is the reason why I don't complain but just like to give my point of view to this issue......and thank you for the great work!)

@christophweser

@christophweser you can also create a suppression file on your own so that it is no longer in the report. Alternatively, we accept PRs. We have several features we'd like to implement, and I only work on this during my off-work hours so I have to pick and choose what I am working on.

Hey Jeremy,

we're using the suppression file already. What I meant is, that customers may not use it and then find false positive vulnerabilities getting in touch with us to talk about them and thus consuming time and often there's the need of extensive explanations.

For us internally using the suppression file is absolutely fine.

Fully understood you're doing this in your off-work hours and highly appreciated by me!
If I may have more resources in the future I will have at last a look.

@christophweser

@christophweser Here's a thought...

thus consuming time and often there's the need of extensive explanations.

I convince my superiors that it's far more sustainable and effective to spend such time on fixing the root cause. In many cases that means contributing to FOSS projects. Might work for your, too?

@marcelstoer

@marcelstoer I really do think that's an excellent idea and shame on me it wasn't mine even I heard for sure of such initiatives from bigger software manufacturer. Today I talked with my boss about it. This won't be a sprint but a long marathon as our company is also quite big and thus such things need time but I least I planted the idea. Let's see if and how it grows.

In my 20+ years in the industry I learned that the larger the company, the more revenue driven it usually is. Hence, the fastest way to initiate change often is to convince those with budget responsibility that the proposed changes are going save them money.
I hope you'll be successful in seeding this idea with your employer.

Navigation Menu

Repository navigation

[FP]: CVE-2023-36415 still found in azure-identity 1.10.3 #5992

Package URl

CPE

CVE

ODC Integration

ODC Version

Description

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[FP]: CVE-2023-36415 still found in azure-identity 1.10.3 #5992

Description

Package URl

CPE

CVE

ODC Integration

ODC Version

Description

Activity

github-actions commented on Oct 16, 2023

aikebah commented on Oct 16, 2023

martin-traverse commented on Oct 31, 2023

aikebah commented on Oct 31, 2023

christophweser commented on Jan 24, 2025

jeremylong commented on Jan 24, 2025

christophweser commented on Jan 24, 2025

marcelstoer commented on Jan 24, 2025

christophweser commented on Jan 27, 2025

marcelstoer commented on Jan 27, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions