jsonorg-fp2

json.org CVE-2022-45688 false positive

The project contains a json.org dependency with CVE-2022-45688. It does invoke the vulnerable class, but the input data is hardcoded and not suitable to trigger a DoS attack. The vulnerability can therefore not be exploited for a DoS attack.

Both metadata-based and callgraph-based software composition analyses will produce a false positive. To precisely detect whether the application is vulnerable, a more sophisticated inter-procedural dataflow / taint analysis is required.

Note that there is a proof-of-vulnerability test to demonstrate the vulnerability, this test (and therefore the build with mvn test) fails. See https://github.com/scabench/jsonorg-tp1 for how the test works.

Running Software Composition Analyses

There are several sh scripts to run different analyses, result resports can be found in scan-results.

Generating the SBOM

The pom.xml has a plugin to generate a SBOM in format. To do this, run , the SBOM can be found in in and format.