[FP]: CVE-2025-10492 reported on jasperreports-7.0.6.jar

[SergeS]

Package URl

pkg:maven/net.sf.jasperreports/jasperreports@7.0.6

CPE

cpe:2.3:a:cloud:jasperreports_library:7.0.6:::::::*

CVE

CVE-2025-10492

ODC Integration

{"label" => "Gradle Plugin"}

ODC Version

12.1.9

Description

It gets mixed with professional version, which is on major version 9, instead of 7 - issue is fixed prior in 7.0.4 , this is 7.0.6

[github-actions]

Maven Coordinates

<dependency>
  <groupId>net.sf.jasperreports</groupId>
  <artifactId>jasperreports</artifactId>
  <version>7.0.6</version>
</dependency>

Suppression rule:

<suppress base="true">
    <notes><![CDATA[
    FP per issue #8501
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/net\.sf\.jasperreports/jasperreports@.*$</packageUrl>
    <cpe>cpe:/a:cloud:jasperreports_library</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/25727263765

[chadlwilson]

ODC cannot understand the additional fields in CPEs to distinguish between the two versions,.so there's nothing we can do about this for now.

You'll have to manage suppressions yourself on this one.

[chadlwilson]

I should probably consolidate all the FPs, but this is similar to #8281 except for the sw_edition field rather than the target_sw field.