Repository: dependency-check/DependencyCheck (language: java)

Issue:
[FP]: glassfish project implementations (JAXB etc) mistaken for glassfish server
### Package URl

pkg:maven/org.glassfish.jaxb/jaxb-core@4.0.5

### CPE

`cpe:2.3:a:eclipse:glassfish:4.0.5:*:*:*:*:*:*:*`

### CVE

CVE-2024-9329

### ODC Integration

{"label"=>"Gradle Plugin"}

### ODC Version

10.0.4

### Description

https://nvd.nist.gov/vuln/detail/CVE-2024-9329 has been reported on Glassfish server however is being reported on all manner of projects maintained separately under `org.glassfish.x` groups in Maven Central.

I'll attempt to submit a custom generatedSuppression to turn https://github.com/jeremylong/DependencyCheck/issues/6626 into something more generic. (this CVE had a lower bound affected version so didn't lead to too many false positives)


Discussion / hints:
Maven Coordinates

```xml
<dependency>
   <groupId>org.glassfish.jaxb</groupId>
   <artifactId>jaxb-core</artifactId>
   <version>4.0.5</version>
</dependency>
```

Suppression rule:
```xml
<suppress base="true">
   <notes><![CDATA[
   FP per issue #7015
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.glassfish\.jaxb/jaxb-core@.*$</packageUrl>
   <cpe>cpe:/a:eclipse:glassfish</cpe>
</suppress>
```

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/11227870573

Fix patch:
diff --git a/generatedSuppressions.xml b/generatedSuppressions.xml
index 1743bdfd645..fa9e4ac53eb 100644
--- a/generatedSuppressions.xml
+++ b/generatedSuppressions.xml
@@ -1556,9 +1556,9 @@
 </suppress>
 <suppress base="true">
    <notes><![CDATA[
-   FP per issue #6626
+   hand-curated better suppression for FP per issues #6626 and #7015
    ]]></notes>
-   <packageUrl regex="true">^pkg:maven/org\.glassfish\.expressly/expressly@.*$</packageUrl>
+   <packageUrl regex="true">^pkg:maven/org\.glassfish\.(?!main).*$</packageUrl>
    <cpe>cpe:/a:eclipse:glassfish</cpe>
 </suppress>
 <suppress base="true">


Test patch: