[FP]: pkg:maven/com.azure.resourcemanager/[email protected] and CVE-2024-43591

[dampcake]

Package URl

pkg:maven/com.azure.resourcemanager/[email protected]

CPE

cpe:2.3:a:microsoft:azure_cli:2.31.0:*:*:*:*:*:*:*

CVE

CVE-2024-43591

ODC Integration

{"label"=>"Maven Plugin"}

ODC Version

10.0.4

Description

See #7066, #7110, and #7124 for this CVE being incorrectly matched against the java libraries.

[github-actions]

Maven Coordinates

<dependency>
   <groupId>com.azure.resourcemanager</groupId>
   <artifactId>azure-resourcemanager-msi</artifactId>
   <version>2.31.0</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7216
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.azure\.resourcemanager/azure-resourcemanager-msi@.*$</packageUrl>
   <cpe>cpe:/a:microsoft:azure_cli</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/12150600530

[aikebah]

approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.