{"action":"created","issue":{"url":"https://api.github.com/repos/jeremylong/DependencyCheck/issues/807","repository_url":"https://api.github.com/repos/jeremylong/DependencyCheck","labels_url":"https://api.github.com/repos/jeremylong/DependencyCheck/issues/807/labels{/name}","comments_url":"https://api.github.com/repos/jeremylong/DependencyCheck/issues/807/comments","events_url":"https://api.github.com/repos/jeremylong/DependencyCheck/issues/807/events","html_url":"https://github.com/jeremylong/DependencyCheck/issues/807","id":243024645,"number":807,"title":"DB2/OpenSSL False positives ","user":{"login":"javixeneize","id":12761574,"avatar_url":"https://avatars0.githubusercontent.com/u/12761574?v=4","gravatar_id":"","url":"https://api.github.com/users/javixeneize","html_url":"https://github.com/javixeneize","followers_url":"https://api.github.com/users/javixeneize/followers","following_url":"https://api.github.com/users/javixeneize/following{/other_user}","gists_url":"https://api.github.com/users/javixeneize/gists{/gist_id}","starred_url":"https://api.github.com/users/javixeneize/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/javixeneize/subscriptions","organizations_url":"https://api.github.com/users/javixeneize/orgs","repos_url":"https://api.github.com/users/javixeneize/repos","events_url":"https://api.github.com/users/javixeneize/events{/privacy}","received_events_url":"https://api.github.com/users/javixeneize/received_events","type":"User","site_admin":false},"labels":[{"id":168886085,"url":"https://api.github.com/repos/jeremylong/DependencyCheck/labels/pending%20more%20information","name":"pending more information","color":"fbca04","default":false},{"id":13090912,"url":"https://api.github.com/repos/jeremylong/DependencyCheck/labels/question","name":"question","color":"cc317c","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-07-14T15:06:41Z","updated_at":"2017-07-18T11:13:40Z","closed_at":null,"body":"Hi\r\n\r\nI am analysing a tool as part of a bug bounty program and i have ended analysing a horrible DB2 driver  (version 9.7.0.11). The report shows a lot of false positives. Looks like it is ignoring the version and is returning all the known vulnerabilities for DB2, as CVE-2007-3676, CVE-2007-2582 or CVE-2008-4692 that were in the very first versions of DB2 only\r\n\r\nApparently, that version only has two known vulnerabilities\r\nhttps://www.cvedetails.com/vulnerability-list/vendor_id-14/product_id-3424/version_id-194076/IBM-DB2-9.7.0.11.html\r\n\r\nI have seen something like that with openssl libraries as well, where it is reporting vulnerabiltiies from 1999 in the 1.1.0e version\r\n"},"comment":{"url":"https://api.github.com/repos/jeremylong/DependencyCheck/issues/comments/316032811","html_url":"https://github.com/jeremylong/DependencyCheck/issues/807#issuecomment-316032811","issue_url":"https://api.github.com/repos/jeremylong/DependencyCheck/issues/807","id":316032811,"user":{"login":"javixeneize","id":12761574,"avatar_url":"https://avatars0.githubusercontent.com/u/12761574?v=4","gravatar_id":"","url":"https://api.github.com/users/javixeneize","html_url":"https://github.com/javixeneize","followers_url":"https://api.github.com/users/javixeneize/followers","following_url":"https://api.github.com/users/javixeneize/following{/other_user}","gists_url":"https://api.github.com/users/javixeneize/gists{/gist_id}","starred_url":"https://api.github.com/users/javixeneize/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/javixeneize/subscriptions","organizations_url":"https://api.github.com/users/javixeneize/orgs","repos_url":"https://api.github.com/users/javixeneize/repos","events_url":"https://api.github.com/users/javixeneize/events{/privacy}","received_events_url":"https://api.github.com/users/javixeneize/received_events","type":"User","site_admin":false},"created_at":"2017-07-18T11:13:40Z","updated_at":"2017-07-18T11:13:40Z","body":"Hi\r\n\r\nThis is a private repo. This one you have referred is version 10.1\r\n\r\nI cant share the html report as in the pipeline, this file is not accessible from jenkins (could be a nice improvement though)\r\n\r\nI think the problem is exactly that... Its picking it as cpe:/a:ibm:db2:9.7:fp2 when its fp11). Not sure if anything could be done to improve it\r\n\r\nSame thing happens with openssl\r\n\r\nThanks"}}
{"actor":{"display_login":"javixeneize"}}