[jira] [Updated] (ZOOKEEPER-5087) Suppress false positive OpenTelemetry CVE-s in OWASP dependency check

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/ZOOKEEPER-5087?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

ASF GitHub Bot updated ZOOKEEPER-5087:
--------------------------------------
    Labels: pull-request-available  (was: )

> Suppress false positive OpenTelemetry CVE-s in OWASP dependency check
> ---------------------------------------------------------------------
>
>                 Key: ZOOKEEPER-5087
>                 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-5087
>             Project: ZooKeeper
>          Issue Type: Task
>          Components: security
>            Reporter: Dávid Paksy
>            Assignee: Dávid Paksy
>            Priority: Major
>              Labels: pull-request-available
>          Time Spent: 10m
>  Remaining Estimate: 0h
>
> OWASP dependency check reported some CVE-s for prometheus-metrics-tracer-otel-1.3.10.jar
>  
> {noformat}
> 22:58:42  [ERROR] prometheus-metrics-tracer-otel-1.3.10.jar (pkg:maven/io.prometheus/prometheus-metrics-tracer-otel@1.3.10, cpe:2.3:a:opentelemetry:opentelemetry:1.3.10:*:*:*:*:*:*:*): CVE-2026-54285(5.3), CVE-2026-41078(5.9), CVE-2026-39882(5.3), CVE-2026-40894(5.3), CVE-2026-44967(5.3), CVE-2026-41178(5.3){noformat}
> However all of these CVE-s are false positives as they are not affecting the Java library.
> - CVE-2026-54285 - it affects only opentelemetry-js: the OpenTelemetry JavaScript Client
> - CVE-2026-41078 and CVE-2026-40894 - it affects only OpenTelemetry dotnet
> - CVE-2026-39882 and CVE-2026-41178 - it affects only OpenTelemetry-Go: the Go implementation of OpenTelemetry
> - CVE-2026-44967 - it affects only OpenTelemetry-cpp: the C++ implementation of OpenTelemetry



--
This message was sent by Atlassian Jira
(v8.20.10#820010)