From 949ac703694941369ea979f4cd6172097a2823da Mon Sep 17 00:00:00 2001 From: Ankit Date: Fri, 7 Aug 2026 20:08:14 +0530 Subject: [PATCH] fix(java): map legacy Jackson 1.x (-asl) artifacts to org.codehaus.jackson (#5146) jackson-mapper-asl, jackson-core-asl, and their sibling artifacts (jackson-jaxrs, jackson-xc, jackson-smile) predate the convention of embedding META-INF/maven/.../pom.properties in the jar (they were built with Ant before ~2014). With no POM metadata to read, syft's groupIDFromJavaMetadata falls through to using the artifact name itself as the group ID, e.g. pkg:maven/jackson-mapper-asl/jackson-mapper-asl@1.9.13 instead of the correct pkg:maven/org.codehaus.jackson/jackson-mapper-asl@1.9.13 (confirmed against the published POM on Maven Central for all five artifacts). Because the generated purl's namespace doesn't match the vulnerability database's namespace for these packages, this causes false negatives in downstream scanning (e.g. Grype cannot match known CVEs such as CVE-2019-10202 against jackson-mapper-asl). Add the five artifacts to DefaultArtifactIDToGroupID, the same known- package-list fallback already used for other jars with incomplete metadata (e.g. the existing ant-*, spring-ldap* entries). Fixes #4598 Signed-off-by: ankit090701 --- .../internal/cpegenerate/java_groupid_map.go | 12 ++++++++++++ syft/pkg/cataloger/java/package_url_test.go | 17 +++++++++++++++++ 2 files changed, 29 insertions(+) diff --git a/syft/pkg/cataloger/internal/cpegenerate/java_groupid_map.go b/syft/pkg/cataloger/internal/cpegenerate/java_groupid_map.go index 52c8ad250..0e4aa8abd 100644 --- a/syft/pkg/cataloger/internal/cpegenerate/java_groupid_map.go +++ b/syft/pkg/cataloger/internal/cpegenerate/java_groupid_map.go @@ -1921,4 +1921,16 @@ var DefaultArtifactIDToGroupID = map[string]string{ "kafka_2.8.2": "org.apache.kafka", "kafka_2.9.1": "org.apache.kafka", "kafka_2.9.2": "org.apache.kafka", + + // legacy "Jackson 1.x" (aka "jackson-asl") artifacts predate the convention of embedding + // META-INF/maven/.../pom.properties in the jar, so groupIDFromKnownPackageList is the only + // way to recover the correct group ID for jars built without that metadata (e.g. Ant-built + // jars from before ~2014). Without this, the group ID falls back to the artifact name itself, + // producing purls that do not match the vulnerability database's namespace. + // See https://github.com/anchore/syft/issues/4598 + "jackson-core-asl": "org.codehaus.jackson", + "jackson-mapper-asl": "org.codehaus.jackson", + "jackson-jaxrs": "org.codehaus.jackson", + "jackson-xc": "org.codehaus.jackson", + "jackson-smile": "org.codehaus.jackson", } diff --git a/syft/pkg/cataloger/java/package_url_test.go b/syft/pkg/cataloger/java/package_url_test.go index 0e0532ffc..5433b1481 100644 --- a/syft/pkg/cataloger/java/package_url_test.go +++ b/syft/pkg/cataloger/java/package_url_test.go @@ -185,6 +185,23 @@ func Test_groupIDFromJavaMetadata(t *testing.T) { metadata: pkg.JavaArchive{}, expect: "org.springframework.ldap", }, + { + // regression for github.com/anchore/syft/issues/4598: legacy Jackson 1.x ("-asl") + // jars built before ~2014 have no embedded pom.properties, so without the known + // package list the group ID falls back to the artifact name itself, producing a + // purl that doesn't match the vulnerability database's namespace (e.g. the correct + // group for jackson-mapper-asl is org.codehaus.jackson, not jackson-mapper-asl). + name: "known package list jackson-mapper-asl", + pkgName: "jackson-mapper-asl", + metadata: pkg.JavaArchive{}, + expect: "org.codehaus.jackson", + }, + { + name: "known package list jackson-core-asl", + pkgName: "jackson-core-asl", + metadata: pkg.JavaArchive{}, + expect: "org.codehaus.jackson", + }, { name: "java manifest", metadata: pkg.JavaArchive{