[FP]: Wrongly reporting vulnerability CVE-2023-43810, CVE-2023-45142, CVE-2023-47108 on simpleclient_tracer_otel-0.16.0

[prabutdr]

Package URl

pkg:maven/io.prometheus/simpleclient_tracer_otel@0.16.0

CPE

cpe:2.3:a:opentelemetry:opentelemetry:0.16.0:::::::*

CVE

CVE-2023-43810

ODC Integration

{"label" => "Maven Plugin"}

ODC Version

12.2.2

Description

These CVEs impacts only on "opentelemetry:opentelemetry" packages as per cpe provided by NVD. But tool is reporting it on "io.prometheus/simpleclient_tracer_otel" jars as well, which is wrong.

The simpleclient_tracer_otel-0.16.0 jar (io.prometheus:simpleclient_tracer_otel) is a Java Prometheus metrics library that provides OpenTelemetry span context supplier functionality. The dependency-check tool incorrectly matches this Java library against the CPE cpe:2.3:a:opentelemetry:opentelemetry:0.16.0 with Low confidence, which corresponds to the Python/Go OpenTelemetry project - a completely different product. The CVE affects Python OpenTelemetry autoinstrumentation (opentelemetry-instrumentation package), not the Java Prometheus simpleclient library.

From Dependency Check tool team, we need confirmation on these false positives. Could you please validate and confirm?

[github-actions]

Maven Coordinates

<dependency>
  <groupId>io.prometheus</groupId>
  <artifactId>simpleclient_tracer_otel</artifactId>
  <version>0.16.0</version>
</dependency>

Suppression rule:

<suppress base="true">
    <notes><![CDATA[
    FP per issue #8518
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/io\.prometheus/simpleclient_tracer_otel@.*$</packageUrl>
    <cpe>cpe:/a:opentelemetry:opentelemetry:</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/26095612484

[chadlwilson]

approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.