OWASP Dependency Scan on cve-2024-38816 and cve-2024-38819

[blueberry80]

Hi everyone,
Need your advice.

I have heard that the OWASP Dependency Check Scan is not able to detect cve-2024-38816 and cve-2024-38819 out. Can I check whether is it false alarm? I am using the latest OWASP library to do my scanning. Is the latest library include these 2 CVEs detection?

Thank you.

[jeremylong]

We use the NVD as the source of data:

• https://nvd.nist.gov/vuln/detail/cve-2024-38816
• https://nvd.nist.gov/vuln/detail/cve-2024-38819

Both of these are awaiting analysis at the NVD. Once complete then ODC should be able to detect them

[aikebah]

They should already be reported, assuming you have OSSIndexAnalyzer enabled. cve-2024-38819 will in that case only be reported for versions that have the fix for cve-2024-38816 but are lacking that of cve-2024-38819 - Sonatype OSSIndex seems to treat it as a follow-up issue that it only flags on versions that have the fix for cve-2024-38816