fix: use CPE target_sw to populate ecosystem to reduce FP #7139

Activity

1. jeremylong

   added

   enhancement

   on Nov 7, 2024
2. jeremylong

   changed the title [-]feat: use CPE target_sw to populate ecosystem to reduce FP[/-] [+]fix: use CPE target_sw to populate ecosystem to reduce FP[/+] on Nov 7, 2024
3. OrangeDog commented on Nov 13, 2024

   

   OrangeDog

   on Nov 13, 2024

   Contributor

   More actions

   This would fix e.g. #3460, #3876, #6851, and allow a general cleanup of bundled suppressions.
4. chadlwilson

   marked [FP]: CVE-2025-10543 paho go client affected, not paho java client #8281 as a duplicate of this issue on May 20, 2026
5. chadlwilson

   marked [FP]: False positive for CVE-2024-35255 in azure-identity #7000 as a duplicate of this issue on May 27, 2026
6. chadlwilson

   marked [FP]: CVE-2023-36415 still found in azure-identity 1.10.3 #5992 as a duplicate of this issue on May 27, 2026
7. chadlwilson

   marked [FP]: snowflake-connector-python@3.17.4 not vulnerable to CVE-2025-46326 #7969 as a duplicate of this issue on May 27, 2026
8. chadlwilson

   marked [FP]: False positive for msal4j@1.17.1 against CVE-2024-35255 #7050 as a duplicate of this issue on May 27, 2026
9. chadlwilson

   added

   FP Report

   nvd

   and removed

   FP Report

   on May 27, 2026
10. chadlwilson

    marked [FP]: CVE-2024-35255 reported on Microsoft.Kiota.Authentication.Azure NuGet DLL #7013 as a duplicate of this issue on May 27, 2026
11. chadlwilson

    marked False positive: io.burt:jmespath-core (Java) matches jmespath:jmespath CPE ranges scoped to ruby and php (CVE-2022-32511, CVE-2026-54133) #8742 as a duplicate of this issue on Aug 14, 2026
12. chadlwilson

    marked False positive: opentelemetry-semconv-incubating (Java) matches opentelemetry:opentelemetry CPE ranges scoped to go (CVE-2026-29181, CVE-2026-39883, CVE-2026-24051) #8744 as a duplicate of this issue on Aug 14, 2026
13. chadlwilson

    marked [FP]: pgvector java library matching CPE for pgvector postgres extension #8769 as a duplicate of this issue on Aug 24, 2026
14. chadlwilson

    marked [FP]: opentelemetry-js reported against JVM dependencies #8775 as a duplicate of this issue on Aug 31, 2026
15. chadlwilson

    marked [FP]: jmespath for Ruby/PHP flagged in Python project #8779 as a duplicate of this issue on Sep 1, 2026
16. Akhil-1527 commented on Sep 29, 2026

    

    Akhil-1527

    on Sep 29, 2026

    More actions

    Hi @jeremylong, I'd like to pick this up if it's still wanted.

    Here's my plan:

    1. CveItemOperator.extractEcosystem already maps target_sw to an ecosystem when the database is built, but NvdCveAnalyzer.ecosystemMatchesTargetSoftware only checks target_sw for Node.js dependencies and lets everything else through. I'd move the target_sw mapping into one shared place (adding rust, which isn't mapped yet) and have the analyzer drop a vulnerable software entry when target_sw names a different language runtime than the dependency's ecosystem. *, -, values that map to native (like linux or c/c++) and anything unmapped would keep matching like today, and the Node.js behavior stays the same.
    2. For Java dependencies I'd still let node.js and JavaScript entries match, since webjars ship npm packages inside jars and those CVEs shouldn't disappear. Happy to drop that exception if you see it differently.
    3. Unit tests built from False Positive on elastic-apm-agent #3876 (CVE-2019-7617 is cpe:2.3:a:elastic:apm_agent:*:*:*:*:*:python:*:* but was reported on the Java agent) and [FP]: Rust vulnerability CVE-2020-36448 has resurfaced, this time on dependency cache4k-jvm, even with latest (10.0.3) Dependency Check version #6851 (CVE-2020-36448 is cpe:2.3:a:cache_project:cache:*:*:*:*:*:rust:*:* but was reported on cache4k-jvm).

    I'd leave removing the bundled suppressions this makes redundant to a separate PR, unless you'd rather see it in the same one. Does that sound right?
17. neilscallywag commented on Oct 10, 2026

    

    neilscallywag

    on Oct 10, 2026

    More actions

    ^ Bump, This has been bugging my team for a while as well and takes up a bit of our time doing due diligence. Would be keen to help as well.
18. Akhil-1527 commented on Oct 11, 2026

    

    Akhil-1527

    on Oct 11, 2026

    More actions

    @neilscallywag I've opened #8834 for this. If you can try it on a project that's been hitting these false positives, feedback is welcome.

    🎉React with 🎉1Reacted by Neil
19. Akhil-1527

    added a commit that references this issue on Oct 14, 2026

    test: pin down current target_sw ecosystem handling

    ...

    f5e570b