dependency-check / dependency-check/DependencyCheck
fix: use CPE target_sw to populate ecosystem to reduce FP
Open
enhancement
nvd
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
The NVD has some CVEs such as https://nvd.nist.gov/vuln/detail/CVE-2022-31115, that use the target_sw to specify the runtime (e.g. ruby, java, etc.). This can be used to populate the ecosystem used to reduce false positives in the ODC analysis. See `org.owasp.dependencycheck.data.nvd.ecosystem.CveEcosystemMapper`.
Contributor guide
Assessment
This issue has not been assessed yet.