[jira] [Created] (ZOOKEEPER-5087) Suppress false positive OpenTelemetry CVE-s in OWASP dependency check

["Dávid Paksy (Jira)" <ji...@apache.org>]

Dávid Paksy created ZOOKEEPER-5087:
--------------------------------------

             Summary: Suppress false positive OpenTelemetry CVE-s in OWASP dependency check
                 Key: ZOOKEEPER-5087
                 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-5087
             Project: ZooKeeper
          Issue Type: Task
          Components: security
            Reporter: Dávid Paksy


OWASP dependency check reported some CVE-s for prometheus-metrics-tracer-otel-1.3.10.jar

 
{noformat}
22:58:42  [ERROR] prometheus-metrics-tracer-otel-1.3.10.jar (pkg:maven/io.prometheus/prometheus-metrics-tracer-otel@1.3.10, cpe:2.3:a:opentelemetry:opentelemetry:1.3.10:*:*:*:*:*:*:*): CVE-2026-54285(5.3), CVE-2026-41078(5.9), CVE-2026-39882(5.3), CVE-2026-40894(5.3), CVE-2026-44967(5.3), CVE-2026-41178(5.3){noformat}
However all of these CVE-s are false positives as they are not affecting the Java library.

- CVE-2026-54285 - it affects only opentelemetry-js: the OpenTelemetry JavaScript Client
- CVE-2026-41078 and CVE-2026-40894 - it affects only OpenTelemetry dotnet
- CVE-2026-39882 and CVE-2026-41178 - it affects only OpenTelemetry-Go: the Go implementation of OpenTelemetry
- CVE-2026-44967 - it affects only OpenTelemetry-cpp: the C++ implementation of OpenTelemetry



--
This message was sent by Atlassian Jira
(v8.20.10#820010)