DependencyTrack / DependencyTrack/dependency-track

False Positive: System.Data.SqlClient 4.8.5

Open
#2,289 4 comments 0 reactions 0 assignees View on GitHub
FP/FN report
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

We get System.Data.SqlClient, 4.8.5 as vulnerability listed (CVE-2022-41064). But regarding MSFT this is the fixed version.

https://github.com/advisories/GHSA-8g2p-5pqh-5jmc

Package PURL: pkg:nuget/System.Data.SqlClient@4.8.5

### Steps to Reproduce

1. Create C# Project and add ``
2. Scan

### Expected Behavior

Should not be listed as vulnerability

### Dependency-Track Version

4.5.x

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.