[FP]: No web project GO module used in Keycloak 6.0.1 CVE-2021-4236

[githubuserVenkat]

Package URl

pkg:maven/org.wildfly.security.elytron-web/[email protected]

CPE

cpe:2.3:a:web_project:web:1.4.0:::::::*

CVE

CVE-2021-4236

ODC Integration

None

ODC Version

9.0.5

Description

No web project GO module is used in Keycloak 6.0.1

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.wildfly.security.elytron-web</groupId>
   <artifactId>undertow-server</artifactId>
   <version>1.4.0.Final</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #6369
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.wildfly\.security\.elytron-web/undertow-server@.*$</packageUrl>
   <cpe>cpe:/a:redhat:undertow</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/7443758006

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.wildfly.security.elytron-web</groupId>
   <artifactId>undertow-server</artifactId>
   <version>1.4.0.Final</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #6369
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.wildfly\.security\.elytron-web/undertow-server@.*$</packageUrl>
   <cpe>cpe:/a:web_project:web</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/7476995683

[aikebah]

approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.