[FP]: Zabbix-utils getting flaged by Zabbix related CVE

[Armasse]

Package URl

pkg:pypi/zabbix-utils@2.0.3

CPE

cpe:2.3:a:zabbix:zabbix:2.0.3:::::::*

CVE

CVE-2023-29450

ODC Integration

None

ODC Version

12.1.8

Description

No response

[chadlwilson]

@jeremylong is it particularly complex to add the pypi automation for FP reports? (At least to suggest the suppression if not run the whole report)

[Umesh042005]

"Hi @jeremylong , I have analyzed this False Positive. CVE-2020-13959 affects Apache Velocity versions 1.7 through 2.2, but it is being incorrectly flagged for version 2.4.1. I have already set up the project locally and would like to work on adding the necessary suppression rule for this.
Could you please assign this issue to me? This would be my first contribution to the project as I am preparing for GSoC 2026."

[chadlwilson]

This issue isn't related to velocity. You might want to post on the correct issue?

[Umesh042005]

Apologies for the previous comment, @chadlwilson . I got confused with another issue. I am interested in working on this specific issue (#8087) regarding the false positives for zabbix-utils.
I have my local environment ready and I'm currently studying the project's suppression logic to make sure I understand the root cause. Thank you for pointing out my mistake , it helped me get back on the right track.

[Umesh042005]

Hi @chadlwilson
I've analyzed this FP. The issue is that zabbix-utils (PyPI) is being incorrectly mapped to the main zabbix CPE.
I am working on a fix in my local environment and will soon submit a PR with either a Hint (to refine mapping) or a Base Suppression for CVE-2023-29450. I'll update the thread once the PR is ready.