[FP]: Azure identity SDK for Java, CVE-2024-35255

[christophweser]

Package URl

pkg:maven/com.azure/[email protected]

CPE

cpe:2.3:a:microsoft:azure_identity_sdk::::::java::*

CVE

CVE-2024-35255

ODC Integration

None

ODC Version

12.0.0

Description

The CVE states for Java that the vulnerability is in till "Up to (excluding) 1.10.2". But it's stil found in 1.15.0.

Could you please verify.

[github-actions]

Error parsing package url: https://mvnrepository.com/artifact/com.azure/azure-identity/1.15.0.

Error: Error: Invalid purl: missing required "pkg" scheme component

Please correct the package URL - consider copying the package url from the HTML report.

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/12809247354

[github-actions]

Maven Coordinates

<dependency>
   <groupId>com.azure</groupId>
   <artifactId>azure-identity</artifactId>
   <version>1.14.2</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7321
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.azure/azure-identity@.*$</packageUrl>
   <cpe>cpe:/a:microsoft:azure_identity_sdk</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/12811242469

[aikebah]

Duplicate of #7000