Suppress false positive OWASP dependency-check findings on azure artifacts - #4825
Merged
mattsains-msft merged 2 commits intoAug 5, 2026
Merged
Conversation
…facts The daily OWASP dependency check has been failing with 6 CVEs, all of which are CPE mismatches rather than real vulnerabilities. CVE-2026-33117 affects azure-security-keyvault-keys < 4.10.6, which is not a dependency of this project. NVD maps it to the generic cpe:2.3:a:microsoft:azure_sdk_for_java "up to (excluding) 4.10.6", so it matches every com.azure artifact whose own unrelated version happens to be below 4.10.6: azure-core 1.58.1, azure-core-http-netty 1.16.5, azure-identity 1.18.3 and azure-json 1.5.1. Those version lines will never reach 4.10.6, so no upgrade can ever clear this finding. CVE-2026-39882, CVE-2026-40894, CVE-2026-41078, CVE-2026-41178 and CVE-2026-44967 are OpenTelemetry Go, .NET and C++ issues with no Java component. dependency-check infers cpe:2.3:a:opentelemetry:opentelemetry from the azure-monitor-opentelemetry-autoconfigure artifact name, and 1.5.0 sorts below every one of their fixed versions (1.6.0, 1.15.3, 1.27.0, 1.42.0, 1.43.0). Suppressing that inferred CPE for this one artifact also stops future OpenTelemetry CVEs from other languages from breaking the build, while leaving genuine CVEs against the Azure Java library reported via its Maven purl. The first suppression is scoped to com.azure purls excluding azure-security-keyvault-keys, so it cannot mask the real vulnerability if that dependency is ever added.
xiang17
requested review from
harsimar,
mattsains-msft,
rajkumar-rangaraj,
ramthi and
trask
as code owners
August 5, 2026 05:17
mattsains-msft
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Suppressing the false positives that update issue #4729 every day.
Problem
The OWASP dependency check (daily) workflow has been failing:
All 6 are CPE mismatches. None affect any code shipped by the agent.
Analysis
CVE-2026-33117 — flagged on
azure-core,azure-core-http-netty,azure-identity,azure-jsonThe actual vulnerability is in
azure-security-keyvault-keys< 4.10.6 (incorrect authentication tag comparison in the local cryptographic verification path). That artifact is not a dependency of this project — confirmed absent from allgradle.lockfilefiles.NVD assigned the CVE the generic CPE
cpe:2.3:a:microsoft:azure_sdk_for_java:*with range up to (excluding) 4.10.6, so it matches everycom.azureartifact whose own unrelated version number is below 4.10.6.CVE-2026-39882 / 40894 / 41078 / 41178 / 44967 — flagged on
azure-monitor-opentelemetry-autoconfigure1.5.0These are OpenTelemetry issues in three other languages, none with a Java component:
OpenTelemetry.Exporter.Jaeger)OpenTelemetry.Api,.Extensions.Propagators)dependency-check infers
cpe:2.3:a:opentelemetry:opentelemetryfrom the artifact name, and 1.5.0 sorts below all of the fixed versions above.Fix
Two entries added to buildscripts/dependency-check-suppressions.xml.
Note that neither finding can be cleared by upgrading. The
azure-core/azure-json/azure-identity/azure-core-http-nettyversion lines will never reach 4.10.6, and bumpingazure-monitor-opentelemetry-autoconfigurepast 1.6.0 would clear only 1 of its 5 findings. Suppression is the only available remedy.com.azurepurls excludingazure-security-keyvault-keys, so it cannot mask the genuine vulnerability if that dependency is ever introduced.azure-monitor-opentelemetry-autoconfiguresuppression targets the mis-inferred CPE rather than the individual CVE IDs. This is deliberate: it also prevents future OpenTelemetry Go/.NET/C++ CVEs from re-breaking the build on this artifact, while genuine CVEs filed against the Azure Java library — which match via its Maven purl — continue to be reported.Testing
Suppression file validated as well-formed; the negative-lookahead pattern verified to match
pkg:maven/com.azure/azure-core@1.58.1and not matchpkg:maven/com.azure/azure-security-keyvault-keys@4.10.5. End-to-end verification requires re-running the daily workflow viaworkflow_dispatch(needs theNVD_API_KEYsecret).Out of scope
The build also logs that the Sonatype OSS Index analyzer is now disabled due to missing credentials — it now requires an authentication token. That did not cause this failure, but it does mean a data source is silently unused.