Repository: dependency-check/DependencyCheck (language: java)

Issue:
[FP]: CVE-2023-40743 org.apache.axis2/addressing@1.8.0
### Package URl

`pkg:maven/org.apache.axis2/addressing@1.8.0`

### CPE

`cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:* versions up to (excluding) 2023-08-01`

### CVE

CVE-2023-40743

### ODC Integration

None

### ODC Version

8.2.1

### Description

[CVE description](https://www.cve.org/CVERecord?id=CVE-2023-40743) says the package is org.apache.axis group, but the CVE is been reported in org.apache.axis2. 
Recommendation in the CVE database asks to use axis2 package instead of axis as workaround. 
Does this mean the CVE is reported false positive or a valid one?

Gradle code: 
`implementation group: 'org.apache.axis2', name: 'addressing', version: '1.8.0', classifier: 'classpath-module'`


Discussion / hints:
Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/6244592367
Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/6244683424
CVE description says nothing about the group, only that it's about Axis 1, but your derivation that Axis 1 is the org.apache.axis groupId and Axis 2/Java is the org.apache.axis2 groupId is correct, so it is indeed a false-positive.
Any Updates to resolve this false positive?
I believe the issue is that of **Library Identification** (i.e. the link between a CVE and then mapping that to actual Maven GAV coordinates). 

AFAIK, the OWASP Dependency Checker doesn't have any such information so it simply makes a guess based on some text matching. The reason for that is that such mapping hasn't existed ..until the folks at Google decided to do something about it and launched their OSV.dev initiative. The OSV can indeed do the mapping between this particular CVE and to the exact Maven coordinates that are vulnerable. See [CVE-2023-40743 in OSV database](https://osv.dev/vulnerability/GHSA-rmqp-9w4c-gc7w). But the OWASP DependencyChecker doesn't use this information. (to be fair Google's initiative has only launched recently)

I've created Enhancement Request [6039](https://github.com/jeremylong/DependencyCheck/issues/6039) to this end.
The same CVE is reported on package `pkg:maven/org.apache.axis2/mex@1.6.4-impl` Do we have any update on when this will be resolved.
Any updates on this false positive?
Any updates on this false positive?

Fix patch:
diff --git a/generatedSuppressions.xml b/generatedSuppressions.xml
index 3b1e9049870..c61f36095cc 100644
--- a/generatedSuppressions.xml
+++ b/generatedSuppressions.xml
@@ -1680,11 +1680,20 @@ only pkg:maven/org.clojure:clojure@.* is the CPE cpe:/a:clojure:clojure
 </suppress>
 <suppress base="true">
    <notes><![CDATA[
-   FP per issue #6757 + manual improvement for related
+   FP per issue #6757 + manual improvement for related.
+   NOTE: the additional colon in the CPE is required to not match on prefix
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/org\.apache\.sandesha2/sandesha2.*$</packageUrl>
-   <cpe>cpe:/a:apache:axis2</cpe>
-   <cpe>cpe:/a:apache:axis</cpe>
+   <cpe>cpe:/a:apache:axis2:</cpe>
+   <cpe>cpe:/a:apache:axis:</cpe>
+</suppress>
+<suppress base="true">
+<notes><![CDATA[
+   FP per issue #5945 + manual improvement for related
+   NOTE: the additional colon in the CPE is required to not match on prefix
+   ]]></notes>
+<packageUrl regex="true">^pkg:maven/org\.apache\.axis2.*$</packageUrl>
+<cpe>cpe:/a:apache:axis:</cpe>
 </suppress>
 <suppress base="true">
    <notes><![CDATA[


Test patch: