Scout false positive on Spring Core 7.x.x for CVE-2011-2730, CVE-2010-1622

[pwragg]

It seems this morning that Docker Scout has been flagging CVE-2011-2730 & CVE-2010-1622 against Spring Core 7, specifically 7.0.6

This would appear to be a false positive.

CVE-2011-2730

Spring EL/JSP tag vulnerability in very old Spring 2.5/3.0 lines. Scout attached it to spring-core@7.0.6, but the advisory's affected range is <= 2.5.7.SR022, and the issue is about Spring JSP taglibs, not modern spring-core.

CVE-2010-1622

Spring data-binding RCE in Spring 2.5.x / 3.0.x before fixed releases. Scout again attached it to spring-core@7.0.6 even though the reported affected range is <= 2.5.6.SEC01 / 3.0.3.RELEASE.

[cdupuis]

@pwragg, could you share the package url where Scout is reporting this against? This will help us debug this further.

Thanks, cd

[pwragg]

Sure - sorry should have included that to begin with!

pkg:maven/org.springframework/spring-core@7.0.6

Let me know if you need anything else.

[pwragg]

Just to add @cdupuis that we also have users reporting the same false positive for version 6.2.17