Repository navigation
[FP]: Wrongly reporting vulnerability CVE-2021-41033 on org.eclipse.jface.databinding #7672
Description
Package URl
pkg:maven/org.eclipse.jface/org.eclipse.jface.databinding@1.2.1-20081006
CPE
cpe:2.3:a:eclipse:equinox:1.3.1:::::::*
CVE
ODC Integration
{"label" => "Maven Plugin"}
ODC Version
10.0.3
Description
The above CVE doesn't affect equinox OSGI framework at all according to eclipse-equinox/equinox#532 (reply in thread) and similar FP was raised previously too #5881
Seems like this affects only P2 eclipse equinox artifacts according to this report https://bugs.eclipse.org/bugs/show_bug.cgi?id=575688 rather than OSGI eclipse-equinox
Activity
github-actions commentedon May 24, 2025
Failed to automatically evaluate the false positive. See: https://github.com/dependency-check/DependencyCheck/actions/runs/15231962805
fix(fp): resolves several false positives related to CVE-2021-41033