[FP]: Old Java CVEs reported against recent OpenJFX Swing integration artifact

[beth-soptim]

Package URl

pkg:maven/org.openjfx/javafx-swing@26.0.1

CPE

cpe:2.3:a:sun:openjdk:26.0.1:*:*:*:*:*:*:*

CVE

CVE-2009-2475

ODC Integration

{"label" => "Maven Plugin"}

ODC Version

12.2.2

Description

all CVEs:

CVE-2009-2475
CVE-2009-2476
CVE-2009-2689
CVE-2009-2690
CVE-2009-3728
CVE-2009-3879
CVE-2009-3880
CVE-2009-3881
CVE-2009-3882
CVE-2009-3883
CVE-2009-3884

all CPEs:

cpe:2.3:a:oracle:javafx:26.0.1:::::::*
cpe:2.3:a:oracle:openjdk:26.0.1:::::::*
cpe:2.3:a:oracle:projects:26.0.1:::::::*
cpe:2.3:a:sun:openjdk:26.0.1:::::::*

[github-actions]

Maven Coordinates

<dependency>
  <groupId>org.openjfx</groupId>
  <artifactId>javafx-swing</artifactId>
  <version>26.0.1</version>
</dependency>

Suppression rule:

<suppress base="true">
    <notes><![CDATA[
    FP per issue #8482
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/org\.openjfx/javafx-swing@.*$</packageUrl>
    <cpe>cpe:/a:sun:openjdk</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/25418456570

[chadlwilson]

Can you please share your JSON report, or HTML report including the evidence section?

Also:

• is it really only for this single javafx-swing artifact that the FPs are being reported, or also other openjfx/JavaFX artifacts?
• do you have the Central Analyzer (Maven Central) enabled?
• is the Central Analyzer working or does it have errors?
• are these only new to being reported, or did you change something in your setup?

There is probably something deeper going on here, like the issues at dependency-check/dependency-check-gradle#481

Will have to reconsider whether it's safe to suppress these entire CPEs for javaFX artifacts. Last time I did analysis at the linked issue I was not convinced it was safe, but having considered again, since OpenJFX I think only started with v11 (alongside JDK 11) it might be safe, as I think the only "unsafe" CVEs I found were to do with JavaFX within JDK 8, I believe before the OpenJFX period.

[beth-soptim]

dependency-check-report.xml

• it is only reported for this single artifact (the Linux variant, since it is built by Jenkins on Linux)
• the Central analyzer is deactivated, instead we use the Artifactory analyzer
• we recently (last week?) switched from the Central to the Artifactory analyzer (to cirumvent the Central Legacy search API availability issues)
• the OSS Index analyzer currently fails (getting credits from Sonytape is still in progress)

[chadlwilson]

Thanks, that's really useful having the XML report.

• it is only reported for this single artifact (the Linux variant, since it is built by Jenkins on Linux)

Not sure if you're looking at the right thing, but in that report I can see all the FPs are actually against pkg:maven/org.openjfx/javafx-graphics@26.0.1 via javafx-graphics-26.0.1-linux.jar not pkg:maven/org.openjfx/javafx-swing@26.0.1 so don't think you quite raised this correctly?

Unless it's a bug/something I don't understand with the XML report, or if it's changing where it reports against, however, that would be a different bug to address.

No big deal since this will need a manual suppression I think.

But yes, it makes it essentially the same issue as dependency-check/dependency-check-gradle#481

The root of the problem is likely that when looking inside the jar javafx-graphics has code using sun. packages, which gets detected by the Jar Analyzer and is concluded as a relatively possible vendor. It then adds oracle as an aliased vendor. It also has duplicated entries at different confidence which might be a hint - that seems overly confident. Package names should be low or medium confidence vendor sources I think.

                <evidence type="vendor" confidence="HIGHEST">
                    <source>jar</source>
                    <name>package name</name>
                    <value>sun</value>
                </evidence>
                <evidence type="vendor" confidence="LOW">
                    <source>jar</source>
                    <name>package name</name>
                    <value>sun</value>
                </evidence>
                <evidence type="vendor" confidence="HIGHEST">
                    <source>jar (hint)</source>
                    <name>package name</name>
                    <value>oracle</value>
                </evidence>
                <evidence type="vendor" confidence="LOW">
                    <source>jar (hint)</source>
                    <name>package name</name>
                    <value>oracle</value>
                </evidence>

Even though it commonly seems to affect the variant-dependent javafx-graphics artifacts, and not others, I think perhaps we can/should just suppress all of the JDK CPEs for org.openjfx artifacts since javafx has its own CPE since it started getting released independently, and no reason that the artifacts should match the JDK anymore. I think CVEs only used to get raised against the JDK when it was an embedded component.

• the Central analyzer is deactivated, instead we use the Artifactory analyzer
• we recently (last week?) switched from the Central to the Artifactory analyzer (to cirumvent the Central Legacy search API availability issues)

Did these only start getting reported after that switch? And before the switch was Central consistently failing for you?

• the OSS Index analyzer currently fails (getting credits from Sonytape is still in progress)

That's OK, that shouldn't affect this I believe (I don't think?).

Anyway - TL;DR - if you can confirm whether you are seeing reports against javafx-swing and javafx-graphics that'd help.

[beth-soptim]

dependency-check-report.xml

This is a report that detected javafx-swing.

[beth-soptim]

The switch to Artifactroy analyzer was 1,5 weeks ago and we do a daily scanning.

[chadlwilson]

dependency-check-report.xml

This is a report that detected javafx-swing.

This report has suppressions that you must have been managing against javafx-graphics but the first report you attached does not have any suppressions. Additionally, for some reason javafx-swing is now matching a new CPE identifier somehow, which causes it to also match the same set of vulns as javafx-graphics was matching, and had suppressions for:

                <vulnerabilityIds confidence="LOW">
                    <id>cpe:2.3:a:sun:openjdk:26.0.1:*:*:*:*:*:*:*</id>
                </vulnerabilityIds>

The switch to Artifactroy analyzer was 1,5 weeks ago and we do a daily scanning.

OK, but that's not really answering my question. The important question is whether that switch changed these getting reported; or whether they have been there a long time.

• nothing related to this matching logic changed in ODC recently
• the relevant bugs seem to have been there with bad version number matches inside the NVD for a long time

Thus it is likely something changed in your setup, and knowing what that is helps us possibly fix the root cause issue. I see between the two reports you attached you have been changing suppressions around, at the very least.