I'm able to add org.owasp:dependency-check-maven:8.2.1 to a project that depends on guava-32.0.0-android, set failBuildOnAnyVulnerability, watch it download a bunch of stuff, and AFAICT report no problems:

[INFO] Processing Complete for NVD CVE - 2023  (1516 ms)
[INFO] Download Started for NVD CVE - Modified
[INFO] Download Complete for NVD CVE - Modified  (140 ms)
[INFO] Processing Started for NVD CVE - Modified
[INFO] Processing Complete for NVD CVE - Modified  (571 ms)
[INFO] Begin database maintenance
[INFO] Updated the CPE ecosystem on 133788 NVD records
[INFO] Removed the CPE ecosystem on 3760 NVD records
[INFO] End database maintenance (9807 ms)
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (3453 ms)
[INFO] Check for updates complete (111806 ms)
[INFO]

Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.


   About ODC: https://jeremylong.github.io/DependencyCheck/general/internals.html
   False Positives: https://jeremylong.github.io/DependencyCheck/general/suppression.html

💖 Sponsor: https://github.com/sponsors/jeremylong


[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing report to: /usr/local/google/home/cpovirk/clients/truth-green/truth/core/target/dependency-check-report.html

I also looked at https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&orderBy=CPEURI&keyword=cpe%3A2.3%3Aa%3Agoogle%3Aguava%3A*%3A*%3A*%3A*%3A*%3A*%3A*%3A*&status=FINAL%2CDEPRECATED&startIndex=80 and didn't see any entries after 30.1 (which is the second release in which Files.createTempDir was deprecated).

In contrast, if I downgrade to 29.0, I see an error:

guava-29.0-android.jar (pkg:maven/com.google.guava/guava@29.0-android, cpe:2.3:a:google:guava:29.0:*:*:*:*:*:*:*) : CVE-2023-2976, CVE-2020-8908

I wonder if it would help for people to run the OWASP plugin's update-only goal (or to delete any caches used by their CI, forcing it to re-download the data)? Maybe OSS Index temporarily considered CVE-2023-2976 to apply to 32.0.0 but some people's plugins haven't picked up their fix yet?

CVE-2023-2976 in version 32.0.0 #6532

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions