Precondition

• I checked the issues list for existing open or closed reports of the same problem.

This was reported before but has been closed without a fix: #7192. Please see the explanation on why it needs fixing below.

Describe the bug

Vulnerability scanners flag the transitive dependency org.glassfish:jakarta.json:2.0.1 as vulnerable.

• CVE-2023-4043
• CVE-2023-7272

These CVEs are being reported because org.glassfish:jakarta.json is the older, unmaintained implementation that was replaced by Eclipse Parsson. The vulnerabilities exist in the underlying JSON parsing code that both share.

Version of dependency-check used

Gradle plugin: org.owasp:dependency-check-gradle:12.1.8

Log file

N/A

To Reproduce

N/A

Expected behavior

org.glassfish:jakarta.json → migrated to → org.eclipse.parsson:parsson

The org.glassfish artifact is the original implementation and is no longer maintained. Security scanners flag it because it contains the same vulnerable code patterns that were later fixed in Eclipse Parsson. The latest Eclipse Parsson versions (1.0.5+ or 1.1.4+) have both vulnerabilities fixed.

Additional context

N/A