New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Tukaani XZ false positive #1668

Closed

coheigea opened this issue Jan 4, 2019 · 1 comment

coheigea commented Jan 4, 2019

There is a false positive for Tukaani XZ:

xz-1.8.jar (cpe:/a:tukaani:xz:1.8, org.tukaani:xz:1.8) : CVE-2015-4035

The CVE refers to Tukaani itelf. But org.tukaani.xz is a Java library that has a separate versioning system (https://tukaani.org/xz/java.html).

Owner

jeremylong commented Oct 31, 2020

This is resolved in the 6.x release.

jeremylong closed this as completed

OfriOuzan mentioned this issue

Multiple False Positive CVEs anchore/grype#942

Closed

B4ckslash mentioned this issue

[FP]: org.tukaani:xz:1.9 #6925

Closed

# for free to join this conversation on GitHub. Already have an account? # to comment