Package URl

pkg:maven/org.eclipse.platform/org.eclipse.osgi@3.18.0

CPE

cpe:2.3:a:eclipse:equinox:::::::: versions up to (excluding) 4.21

CVE

CVE-2021-41033

ODC Integration

{"label"=>"Maven Plugin"}

ODC Version

8.3.1

Description

Per CVE Affected component:
Eclipse Equinox, at least until version 4.21
cpe:2.3:a:eclipse:equinox:::::::: versions up to (excluding) 4.21

only 3PP "org.eclipse.osgi-3.18.0.jar" used, but NOT packing/using the vulnerable 3PP component "Eclipse Equinox", even they are NOT packed as indirect dependency in the environment. And this vulnerability is more specific to IDE and the plugin installation of eclipse. But tool is reporting this vulnerability on org.eclipse.osgi-3.18.0.jar, which is wrong.

From Dependency Check tool team, we need confirmation on these false positives. Could you please validate and confirm?