[FP]: Wrongly reporting vulnerability CVE-2014-125035 on org.eclipse.core.jobs

[Subrhamanya]

Package URl

pkg:maven/org.eclipse.core/org.eclipse.core.jobs@3.5.100

CPE

cpe:2.3:a:jobs-plugin_project:jobs-plugin:3.5.100:::::::*

CVE

CVE-2014-125035

ODC Integration

{"label" => "Maven Plugin"}

ODC Version

10.0.3

Description

CVE-2014-125035 affects Jobs plugin rather than org.eclipse.core.jobs jar.

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/dependency-check/DependencyCheck/actions/runs/15208587859

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.eclipse.core</groupId>
   <artifactId>org.eclipse.core.jobs</artifactId>
   <version>3.5.100</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7662
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.eclipse\.core/org\.eclipse\.core\.jobs@.*$</packageUrl>
   <cpe>cpe:/a:jobs-plugin_project:jobs-plugin</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/15208627391

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.eclipse.core</groupId>
   <artifactId>org.eclipse.core.jobs</artifactId>
   <version>3.5.100</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7662
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.eclipse\.core/org\.eclipse\.core\.jobs@.*$</packageUrl>
   <cpe>cpe:/a:jobs-plugin_project:jobs-plugin</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/15208631163

[Subrhamanya]

@jeremylong any updates on this?