[FP]: org.json CVE-2022-45688 reported for version 20230227 while reporting a fix in version 20230227

[michalszelagsonos]

Package URl

pkg:maven/org.json/json@20230227

CPE

cpe:2.3:a:hutool:hutool:5.8.10:::::::*

CVE

CVE-2022-45688

ODC Integration

{"label"=>"Gradle Plugin"}

ODC Version

8.2.1

Description

The CVE was detected for org.json version 20230227 which is a version that has a fix for the said CVE:
https://github.com/stleary/JSON-java/releases/tag/20230227

Even the HTML report says so, from the report:
cpe:2.3:a:json-java_project:json-java:::::::: versions up to (excluding) 20230227

This looks like a false positive. I also found this issue, which mentioned a misleading CPE in this report: #5401.

[github-actions]

Error parsing package url: https://mvnrepository.com/artifact/org.json/json/20230227.

Error: Error: purl is missing the required "pkg" scheme component.

Please correct the package URL - consider copying the package url from the HTML report.

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/4873319434

[github-actions]

Error parsing package url: https://mvnrepository.com/artifact/org.json/json/20230227.

Error: Error: purl is missing the required "pkg" scheme component.

Please correct the package URL - consider copying the package url from the HTML report.

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/4873333789

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.json</groupId>
   <artifactId>json</artifactId>
   <version>20230227</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #5693
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.json/json@.*$</packageUrl>
   <cpe>cpe:/a:hutool:hutool</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/4873354009

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.json</groupId>
   <artifactId>json</artifactId>
   <version>20230227</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #5693
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.json/json@.*$</packageUrl>
   <cpe>cpe:/a:hutool:hutool</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/4873385478

[aikebah]

Duplicate of #5545