[FP]: jaxb is not glassfish server

[ftreede]

Package URl

pkg:maven/com.sun.xml.bind.external/rngom@4.0.9

CPE

cpe:2.3:a:eclipse:glassfish:4.0.9:::::::*

CVE

No response

ODC Integration

{"label" => "Maven Plugin"}

ODC Version

12.2.2

Description

It suggests #8588 as duplicate, but that seems to be a different issue. The fix for that only suppresses the fp for actual org.glassfish maven packages, not the old com.sun.xml.bind ones.

Type	Source	Name	Value	Confidence
Vendor	pom	artifactid	rngom	Low
Vendor	pom	groupid	com.sun.xml.bind.external	Highest
Vendor	pom	name	RNGOM	High
Vendor	pom	parent-artifactid	jaxb-external-parent	Low
Vendor	pom	parent-groupid	org.glassfish.jaxb	Medium
Vendor	pom	url	https://eclipse-ee4j.github.io/jaxb-ri/	Highest
Product	pom	artifactid	rngom	Highest
Product	pom	groupid	com.sun.xml.bind.external	Highest
Product	pom	name	RNGOM	High
Product	pom	parent-artifactid	jaxb-external-parent	Medium
Product	pom	parent-groupid	org.glassfish.jaxb	Medium
Product	pom	url	https://eclipse-ee4j.github.io/jaxb-ri/	Medium
Version	pom	version	4.0.9	Highest

[github-actions]

Maven Coordinates

<dependency>
  <groupId>com.sun.xml.bind.external</groupId>
  <artifactId>rngom</artifactId>
  <version>4.0.9</version>
</dependency>

Suppression rule:

<suppress base="true">
    <notes><![CDATA[
    FP per issue #8774
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/com\.sun\.xml\.bind\.external/rngom@.*$</packageUrl>
    <cpe regex="true">cpe:/a:eclipse:glassfish(:.*)?$</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/33156829256

[ftreede]

The same also happens for pkg:maven/com.sun.xml.bind.external/relaxng-datatype@4.0.9 (which is #8613 i think)

[chadlwilson]

Approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.

[chadlwilson]

I shouldn’t have approved this in retrospect. This should already be handled by #8603

I think there is something wrong with your setup. Is your generatedSuppressions hostedSuppressions updating properly or are you running offline? Can you share an html report showing the vulns?

[github-actions]

Suppress already exists in generatedSuppressions branch. See issue #8774.

[ftreede]

Ok I double checked it; we do in fact have a central update process for the nvd database which is shared between multiple build nodes, so it seems the cache doesn't get updated. Is there a way to use a central database and still have each build update global suppressions and other things that do not go into the database?