Skip to content

[FP]: Wrongly reporting vulnerability CVE-2021-41033 on org.eclipse.jface #7673

Closed
#7736
Closed
[FP]: Wrongly reporting vulnerability CVE-2021-41033 on org.eclipse.jface#7673
#7736
Labels
FP Report

Description

@abhishek171287
abhishek171287
opened on May 24, 2025

Package URl

pkg:maven/org.eclipse.jface/org.eclipse.jface@3.5.0.I20090525-2000

CPE

cpe:2.3:a:eclipse:equinox:3.7.0:370::::::

CVE

CVE-2021-41033

ODC Integration

{"label" => "Maven Plugin"}

ODC Version

10.0.3

Description

The above CVE doesn't affect equinox OSGI framework at all according to eclipse-equinox/equinox#532 (reply in thread) and similar FP was raised previously too #5881

Seems like this affects only P2 eclipse equinox artifacts according to this report https://bugs.eclipse.org/bugs/show_bug.cgi?id=575688 rather than OSGI eclipse-equinox

Activity

  1. abhishek171287
    added
    FP Report
    on May 24, 2025

  2. github-actions commented on May 24, 2025

    @github-actions
    github-actionsbot
    on May 24, 2025 – with GitHub Actions
    Contributor

    Failed to automatically evaluate the false positive. See: https://github.com/dependency-check/DependencyCheck/actions/runs/15232011020

  3. jeremylong
    added a commit that references this issue on Jun 11, 2025

    fix(fp): resolves several false positives related to CVE-2021-41033

    1294ca7
  4. jeremylong
    closed this as completedin #7736on Jun 12, 2025
  5. github-actions
    locked as resolved and limited conversation to collaborators on Jul 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    FP Report

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions