DependencyTrack / DependencyTrack/dependency-track
False Positive: nuget System.IO.Packaging 8.0.1
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
There are two false positives for vulnerabilities listed for nuget package System.IO.Packaging version 8.0.1.
Package PURL: pkg:nuget/System.IO.Packaging@8.0.1
1\. GHSA-qj66-m88j-hmgj (GITHUB)
In "Vulnerability Details" -> tab "Affected Components", if I filter by "System.IO.Packaging", I have these:
- pkg:nuget/System.IO.Packaging (>=9.0.0-preview.1.24080.9\|<=9.0.0-rc.1.24431.7) - reported by GITHUB
- pkg:nuget/System.IO.Packaging (>=6.0.0-preview.1.21102.12\|<=6.0.0) - reported by GITHUB
- pkg:nuget/System.IO.Packaging (>=8.0.0-preview.1.23110.8\|<=8.0.0) - reported by GITHUB
- pkg:nuget/System.IO.Packaging (>=9.0.0-preview.1.24080.9\|<9.0.0-rc.2.24473.5) - reported by OSV
- pkg:nuget/System.IO.Packaging (>=8.0.0-preview.1.23110.8\|<8.0.1) - reported by OSV
- pkg:nuget/System.IO.Packaging (>=6.0.0-preview.1.21102.12\|<6.0.1) - reported by OSV
The vulnerability is also marked as CVE-2024-43483 (NVD), but that doesn't have "System.IO.Packaging" is not present among "Affected Components".
2\. GHSA-f32c-w444-8ppv (GITHUB)
In "Vulnerability Details" -> tab "Affected Components", I have these:
- pkg:nuget/System.IO.Packaging (>=9.0.0-preview.1.24080.9|<=9.0.0-rc.1.24431.7) - reported by GITHUB
- pkg:nuget/System.IO.Packaging (>=6.0.0-preview.1.21102.12|<=6.0.0) - reported by GITHUB
- pkg:nuget/System.IO.Packaging (>=8.0.0-preview.1.23110.8|<=8.0.0) - reported by GITHUB
- pkg:nuget/System.IO.Packaging (>=9.0.0-preview.1.24080.9|<9.0.0-rc.2.24473.5) - reported by OSV
- pkg:nuget/System.IO.Packaging (>=8.0.0-preview.1.23110.8|<8.0.1) - reported by OSV
- pkg:nuget/System.IO.Packaging (>=6.0.0-preview.1.21102.12|<6.0.1) - reported by OSV
The vulnerability is also marked as CVE-2024-43484 (NVD), but that doesn't have "System.IO.Packaging" is not present among "Affected Components".
Both of these should clearly not include version 8.0.1 as a vulnerable version, but do list the GITHUB vulnerability for it.
### Steps to Reproduce
1. Create C# Project and add ``
2. Scan
### Expected Behavior
The 2 vulnerabilities should not be listed, because they are for other versions.
### Dependency-Track Version
4.14.2
### Dependency-Track Distribution
Container Image
### Database Server
N/A
### Database Server Version
_No response_
### Browser
N/A
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.