DependencyTrack / DependencyTrack/dependency-track

False Positive: nuget System.IO.Packaging 8.0.1

Open
#6,170 2 comments 0 reactions 0 assignees View on GitHub
FP/FN report pending more information
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

There are two false positives for vulnerabilities listed for nuget package System.IO.Packaging version 8.0.1.

Package PURL: pkg:nuget/System.IO.Packaging@8.0.1

1\. GHSA-qj66-m88j-hmgj (GITHUB)

In "Vulnerability Details" -> tab "Affected Components", if I filter by "System.IO.Packaging", I have these:
- pkg:nuget/System.IO.Packaging (>=9.0.0-preview.1.24080.9\|<=9.0.0-rc.1.24431.7) - reported by GITHUB
- pkg:nuget/System.IO.Packaging (>=6.0.0-preview.1.21102.12\|<=6.0.0) - reported by GITHUB
- pkg:nuget/System.IO.Packaging (>=8.0.0-preview.1.23110.8\|<=8.0.0) - reported by GITHUB
- pkg:nuget/System.IO.Packaging (>=9.0.0-preview.1.24080.9\|<9.0.0-rc.2.24473.5) - reported by OSV
- pkg:nuget/System.IO.Packaging (>=8.0.0-preview.1.23110.8\|<8.0.1) - reported by OSV
- pkg:nuget/System.IO.Packaging (>=6.0.0-preview.1.21102.12\|<6.0.1) - reported by OSV

The vulnerability is also marked as CVE-2024-43483 (NVD), but that doesn't have "System.IO.Packaging" is not present among "Affected Components".

2\. GHSA-f32c-w444-8ppv (GITHUB)

In "Vulnerability Details" -> tab "Affected Components", I have these:
- pkg:nuget/System.IO.Packaging (>=9.0.0-preview.1.24080.9|<=9.0.0-rc.1.24431.7) - reported by GITHUB
- pkg:nuget/System.IO.Packaging (>=6.0.0-preview.1.21102.12|<=6.0.0) - reported by GITHUB
- pkg:nuget/System.IO.Packaging (>=8.0.0-preview.1.23110.8|<=8.0.0) - reported by GITHUB
- pkg:nuget/System.IO.Packaging (>=9.0.0-preview.1.24080.9|<9.0.0-rc.2.24473.5) - reported by OSV
- pkg:nuget/System.IO.Packaging (>=8.0.0-preview.1.23110.8|<8.0.1) - reported by OSV
- pkg:nuget/System.IO.Packaging (>=6.0.0-preview.1.21102.12|<6.0.1) - reported by OSV

The vulnerability is also marked as CVE-2024-43484 (NVD), but that doesn't have "System.IO.Packaging" is not present among "Affected Components".

Both of these should clearly not include version 8.0.1 as a vulnerable version, but do list the GITHUB vulnerability for it.

### Steps to Reproduce

1. Create C# Project and add ``
2. Scan

### Expected Behavior

The 2 vulnerabilities should not be listed, because they are for other versions.

### Dependency-Track Version

4.14.2

### Dependency-Track Distribution

Container Image

### Database Server

N/A

### Database Server Version

_No response_

### Browser

N/A

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.