Baike.dev
Log in
Back to tool/Back to issues
#1827·DependencyCheck

False Positive due to missing "AND/OR" capabilities defined in the NVD data feed

Author: sauljabinCreated Mar 27, 2019Updated Jun 10, 2026
Labelsenhancementpending more informationFP Report

Hello community.

  • Dependencies (gradle with mavenCentral):

    • org.springframework.security:spring-security-config:5.1.4.RELEASE
    • org.springframework.security:spring-security-web:5.1.4.RELEASE
    • org.springframework.security:spring-security-core:5.1.4.RELEASE

  • cpe:2.3:a:pivotal_software:spring_security:5.1.4:*:*:*:*:*:*:* NVD link

  • CVE-2018-1258 NVD link

According with https://pivotal.io/security/cve-2018-1258 this was fixed in the 5.0.6.RELEASE version.

Original dependency check output:

spring-security-web-5.1.4.RELEASE.jar (pkg:maven/org.springframework.security/[email protected], cpe:2.3:a:pivotal_s
oftware:spring_security:5.1.4:*:*:*:*:*:*:*) : CVE-2018-1258                                                                        
spring-security-config-5.1.4.RELEASE.jar (pkg:maven/org.springframework.security/[email protected], cpe:2.3:a:piv
otal_software:spring_security:5.1.4:*:*:*:*:*:*:*) : CVE-2018-1258                                                                  
spring-security-core-5.1.4.RELEASE.jar (pkg:maven/org.springframework.security/[email protected], cpe:2.3:a:pivotal
_software:spring_security:5.1.4:*:*:*:*:*:*:*) : CVE-2018-1258

Actual spring frameworks version for this project (gradle output):

+--- org.springframework.boot:spring-boot-starter-web -> 2.1.3.RELEASE                                                              
|    +--- org.springframework.boot:spring-boot-starter:2.1.3.RELEASE                                                                
|    |    +--- org.springframework.boot:spring-boot:2.1.3.RELEASE                                                                   
|    |    |    +--- org.springframework:spring-core:5.1.5.RELEASE                                                                   
|    |    |    |    \--- org.springframework:spring-jcl:5.1.5.RELEASE                                                               
|    |    |    \--- org.springframework:spring-context:5.1.5.RELEASE                                                                
|    |    |         +--- org.springframework:spring-aop:5.1.5.RELEASE                                                               
|    |    |         |    +--- org.springframework:spring-beans:5.1.5.RELEASE                                                        
|    |    |         |    |    \--- org.springframework:spring-core:5.1.5.RELEASE (*)                                                
|    |    |         |    \--- org.springframework:spring-core:5.1.5.RELEASE (*)                                                     
|    |    |         +--- org.springframework:spring-beans:5.1.5.RELEASE (*)                                                         
|    |    |         +--- org.springframework:spring-core:5.1.5.RELEASE (*)                                                          
|    |    |         \--- org.springframework:spring-expression:5.1.5.RELEASE                                                        
|    |    |              \--- org.springframework:spring-core:5.1.5.RELEASE (*)  
+--- org.springframework.boot:spring-boot-starter-security -> 2.1.3.RELEASE
|    +--- org.springframework.boot:spring-boot-starter:2.1.3.RELEASE (*)
|    +--- org.springframework:spring-aop:5.1.5.RELEASE (*)
|    +--- org.springframework.security:spring-security-config:5.1.4.RELEASE
|    |    +--- org.springframework.security:spring-security-core:5.1.4.RELEASE
|    |    |    +--- org.springframework:spring-aop:5.1.5.RELEASE (*)
|    |    |    +--- org.springframework:spring-beans:5.1.5.RELEASE (*)
|    |    |    +--- org.springframework:spring-context:5.1.5.RELEASE (*)
|    |    |    +--- org.springframework:spring-core:5.1.5.RELEASE (*)
|    |    |    \--- org.springframework:spring-expression:5.1.5.RELEASE (*)
|    |    +--- org.springframework:spring-aop:5.1.5.RELEASE (*)
|    |    +--- org.springframework:spring-beans:5.1.5.RELEASE (*)
|    |    +--- org.springframework:spring-context:5.1.5.RELEASE (*)
|    |    \--- org.springframework:spring-core:5.1.5.RELEASE (*)
|    \--- org.springframework.security:spring-security-web:5.1.4.RELEASE
|         +--- org.springframework.security:spring-security-core:5.1.4.RELEASE (*)
|         +--- org.springframework:spring-aop:5.1.5.RELEASE (*)
|         +--- org.springframework:spring-beans:5.1.5.RELEASE (*)
|         +--- org.springframework:spring-context:5.1.5.RELEASE (*)
|         +--- org.springframework:spring-core:5.1.5.RELEASE (*)
|         +--- org.springframework:spring-expression:5.1.5.RELEASE (*)
|         \--- org.springframework:spring-web:5.1.5.RELEASE (*)

Source: dependency-check/DependencyCheck

View original on GitHubView discussion on GitHub