[FP]: False positive for CVE-2024-35255 in azure-identity #7000

Activity

1. rokoman13

   added

   FP Report

   on Sep 30, 2024
2. github-actions commented on Sep 30, 2024

   

   github-actionsBot

   on Sep 30, 2024 – with GitHub Actions

   Contributor

   More actions

   Maven Coordinates

   <dependency>
      <groupId>com.azure</groupId>
      <artifactId>azure-identity</artifactId>
      <version>1.12.2</version>
   </dependency>

   Suppression rule:

   <suppress base="true">
      <notes><![CDATA[
      FP per issue #7000
      ]]></notes>
      <packageUrl regex="true">^pkg:maven/com\.azure/azure-identity@.*$</packageUrl>
      <cpe>cpe:/a:microsoft:azure_identity_sdk</cpe>
   </suppress>

   Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/11101489749

   👎React with 👎1Reacted by Chad Wilson
3. github-actions

   added

   mavenchanges to the maven pluginchanges to the maven plugin

   on Sep 30, 2024
4. rokoman13 commented on Oct 14, 2024

   

   rokoman13

   on Oct 14, 2024

   Author

   More actions

   @aikebah hello! could you check this FP report please?
5. aikebah

   added

   enhancement

   on Oct 16, 2024
6. aikebah commented on Oct 16, 2024

   

   aikebah

   on Oct 16, 2024

   Collaborator

   More actions

   @rokoman13 The discriminator in the CPE that would allow to fix it (target_sw with the values java vs python vs javascript vs .net for this library) is currently not taken into account, so that the joined version ranges across the languages determines the versions reported as vulnerable.
7. aikebah

   marked [FP]: False positive on azure-identity-1.15.3.jar #7515 as a duplicate of this issue on Mar 12, 2025
8. pdCGKa commented on Apr 15, 2025

   

   pdCGKa

   on Apr 15, 2025

   More actions

   any update on this?
9. chadlwilson

   closed this as a duplicateof fix: use CPE target_sw to populate ecosystem to reduce FP #7139 on May 27, 2026
10. github-actions

    locked as resolved and limited conversation to collaborators on Jun 27, 2026