jfrog / jfrog/artifactory-client-java
False positive reported on XNIO CVE-2023-5685 — component not present
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 331
- Forks
- 163
- Avg merge
- 20h 9m
- Merged PRs (30d)
- 1
Description
Describe the bug
Xray reports CVE-2023-5685 (JBoss XNIO buffer overflow) against our project. However, org.jboss.xnio:xnio-api is not present in our delivery. The scanner appears to have confused standard Java NIO (part of the JDK) with JBoss XNIO (a separate third-party library).
To Reproduce
Xray scan flags CVE-2023-5685 against a project that uses Java NIO but does NOT contain org.jboss.xnio:xnio-api in its dependency tree.
Expected behavior
CVE-2023-5685 should only be reported when org.jboss.xnio:xnio-api is actually present in the scanned artifacts. Java NIO (java.nio.*) from the JDK is a different component.
Versions
- Package: org.jboss.xnio:xnio-api — NOT PRESENT
- Scanner likely confused with: java.nio (JDK built-in)
Additional context
Red Hat advisory: https://issues.redhat.com/browse/WFCORE-6738
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file or test is named. Start by inspecting the project's dependency tree and reproducing the scan with Java NIO present but org.jboss.xnio:xnio-api absent; done means CVE-2023-5685 is reported only when the XNIO artifact is present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100