False Positive on micrometer-registry-prometheus

[ST-DDT]

micrometer-registry-prometheus-1.1.4.jar (pkg:maven/io.micrometer/micrometer-registry-prometheus@1.1.4, cpe:2.3:a:prometheus:prometheus:1.1.4:*:*:*:*:*:*:*) : CVE-2019-3826
simpleclient-0.5.0.jar (pkg:maven/io.prometheus/simpleclient@0.5.0, cpe:2.3:a:prometheus:prometheus:0.5.0:*:*:*:*:*:*:*) : CVE-2019-3826

<dependency>
    <groupId>io.micrometer</groupId>
    <artifactId>micrometer-registry-prometheus</artifactId>
    <version>1.1.4</version>
</dependency>
<dependency>
    <groupId>io.prometheus</groupId>
    <artifactId>simpleclient</artifactId>
    <version>0.5.0</version>
</dependency>

The CVE-2019-3826 does affect the prometheus server software, but it does not affect the java (client) libraries.

• https://github.com/prometheus/prometheus
• https://github.com/micrometer-metrics/micrometer/tree/master/implementations/micrometer-registry-prometheus
• https://github.com/prometheus/client_java/tree/master/simpleclient

[janosmeszaros]

Hi,
I found that io.prometheus.jmx:collector is also reported with CVE-2019-3826. Maybe that's also related to this issue?