Dávid Paksy created ZOOKEEPER-5087:
--------------------------------------
Summary: Suppress false positive OpenTelemetry CVE-s in OWASP
dependency check
Key: ZOOKEEPER-5087
URL: https://issues.apache.org/jira/browse/ZOOKEEPER-5087
Project: ZooKeeper
Issue Type: Task
Components: security
Reporter: Dávid Paksy
OWASP dependency check reported some CVE-s for
prometheus-metrics-tracer-otel-1.3.10.jar
{noformat}
22:58:42 [ERROR] prometheus-metrics-tracer-otel-1.3.10.jar
(pkg:maven/io.prometheus/[email protected],
cpe:2.3:a:opentelemetry:opentelemetry:1.3.10:*:*:*:*:*:*:*):
CVE-2026-54285(5.3), CVE-2026-41078(5.9), CVE-2026-39882(5.3),
CVE-2026-40894(5.3), CVE-2026-44967(5.3), CVE-2026-41178(5.3){noformat}
However all of these CVE-s are false positives as they are not affecting the
Java library.
- CVE-2026-54285 - it affects only opentelemetry-js: the OpenTelemetry
JavaScript Client
- CVE-2026-41078 and CVE-2026-40894 - it affects only OpenTelemetry dotnet
- CVE-2026-39882 and CVE-2026-41178 - it affects only OpenTelemetry-Go: the Go
implementation of OpenTelemetry
- CVE-2026-44967 - it affects only OpenTelemetry-cpp: the C++ implementation of
OpenTelemetry
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
