[FP]: junit jupiter being falsely matched as CPE 1e:platform

[chadlwilson]

Package URl

pkg:maven/org.junit.jupiter/[email protected]

CPE

cpe:2.3:a:1e:platform:5.10.3:*:*:*:*:*:*:*

CVE

CVE-2023-45161, CVE-2023-45163, CVE-2023-5964

ODC Integration

{"label"=>"Gradle Plugin"}

ODC Version

9.2.0

Description

1E Platform is something completely different: https://www.1e.com/platform/

There are actually three jars that are being detected as FPs now:

pkg:maven/org.junit.jupiter/[email protected]
pkg:maven/org.junit.platform/[email protected]
pkg:maven/org.junit.platform/[email protected] 

The FPs weren't reporting with junit 5.10.2 which implies the version number is part of the heuristic for CPE matching here :-(

Could submit 3 different FPs for the automation, but not sure if that's the best way forward here?

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.junit.jupiter</groupId>
   <artifactId>junit-jupiter-engine</artifactId>
   <version>5.10.3</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #6743
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.junit\.jupiter/junit-jupiter-engine@.*$</packageUrl>
   <cpe>cpe:/a:1e:platform</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/9707350278

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.junit.jupiter</groupId>
   <artifactId>junit-jupiter-engine</artifactId>
   <version>5.10.3</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #6743
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.junit\.jupiter/junit-jupiter-engine@.*$</packageUrl>
   <cpe>cpe:/a:1e:platform</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/9707356505

[chadlwilson]

Perhaps this would be better here.

  <suppress>
    <notes><![CDATA[
    FP per issue #6743
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/org\.junit\..*/junit-.*@.*$</packageUrl>
    <cpe>cpe:/a:1e:platform</cpe>
  </suppress>

[aikebah]

Resolved via the PR, followed by FP publishing pipeline of another FP