CVE bug example

This repository reproduces a bug when a library is wrongly recognized and CVEs from other library are reported for it.

Issue description

There is a test-module module which uses dependency test-dependency. Because test-dependency has version matching one of the existing jenkins release plugin version, and it also adds jenkins-release-xyz to a MANIFEST.MF file, it is treated as jenkins release library and two CVE are reported for this project despite it does not exist in CVE database:

• CVE-2018-1000013
• CVE-2020-2292

This is probably because of such defined cpe:

cpe:2.3:a:jenkins:release:*:*:*:*:*:jenkins:*:*

test-dependency has such content in its MANIFEST.mf file:

Manifest-Version: 1.0
Created-By: Maven JAR Plugin 3.3.0
Build-Jdk-Spec: 17
Build-Tag: jenkins-release-1.2.0

Generating report

To reproduce this bug, run:

mvn clean install
mvn dependency-check:aggregate validate -Powasp

The generated report can be found in target directory. There is also a dependency-check-jenkins.html file pushed to this repository to show the result of this operation.