oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-08-19 16:48:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(java): map legacy Jackson 1.x (-asl) artifacts to org.codehaus.jackson (#5146)

Browse Source 
jackson-mapper-asl, jackson-core-asl, and their sibling artifacts
(jackson-jaxrs, jackson-xc, jackson-smile) predate the convention of
embedding META-INF/maven/.../pom.properties in the jar (they were
built with Ant before ~2014). With no POM metadata to read, syft's
groupIDFromJavaMetadata falls through to using the artifact name
itself as the group ID, e.g.

  pkg:maven/jackson-mapper-asl/jackson-mapper-asl@1.9.13

instead of the correct

  pkg:maven/org.codehaus.jackson/jackson-mapper-asl@1.9.13

(confirmed against the published POM on Maven Central for all five
artifacts). Because the generated purl's namespace doesn't match the
vulnerability database's namespace for these packages, this causes
false negatives in downstream scanning (e.g. Grype cannot match known
CVEs such as CVE-2019-10202 against jackson-mapper-asl).

Add the five artifacts to DefaultArtifactIDToGroupID, the same known-
package-list fallback already used for other jars with incomplete
metadata (e.g. the existing ant-*, spring-ldap* entries).

Fixes #4598

Signed-off-by: ankit090701 <ankitanku090701@gmail.com>
This commit is contained in:
Ankit 2026-08-07 20:08:14 +05:30 committed by GitHub
parent 07fb23487f
commit 949ac70369
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
syft/pkg/cataloger/internal/cpegenerate/java_groupid_map.go
View File

@ -1921,4 +1921,16 @@ var DefaultArtifactIDToGroupID = map[string]string{
"kafka_2.8.2": "org.apache.kafka",
"kafka_2.9.1": "org.apache.kafka",
"kafka_2.9.2": "org.apache.kafka",
// legacy "Jackson 1.x" (aka "jackson-asl") artifacts predate the convention of embedding
// META-INF/maven/.../pom.properties in the jar, so groupIDFromKnownPackageList is the only
// way to recover the correct group ID for jars built without that metadata (e.g. Ant-built
// jars from before ~2014). Without this, the group ID falls back to the artifact name itself,
// producing purls that do not match the vulnerability database's namespace.
// See https://github.com/anchore/syft/issues/4598
"jackson-core-asl": "org.codehaus.jackson",
"jackson-mapper-asl": "org.codehaus.jackson",
"jackson-jaxrs": "org.codehaus.jackson",
"jackson-xc": "org.codehaus.jackson",
"jackson-smile": "org.codehaus.jackson",
}

17
syft/pkg/cataloger/java/package_url_test.go
View File

@ -185,6 +185,23 @@ func Test_groupIDFromJavaMetadata(t *testing.T) {
metadata: pkg.JavaArchive{},
expect: "org.springframework.ldap",
},
{
// regression for github.com/anchore/syft/issues/4598: legacy Jackson 1.x ("-asl")
// jars built before ~2014 have no embedded pom.properties, so without the known
// package list the group ID falls back to the artifact name itself, producing a
// purl that doesn't match the vulnerability database's namespace (e.g. the correct
// group for jackson-mapper-asl is org.codehaus.jackson, not jackson-mapper-asl).
name: "known package list jackson-mapper-asl",
pkgName: "jackson-mapper-asl",
metadata: pkg.JavaArchive{},
expect: "org.codehaus.jackson",
},
{
name: "known package list jackson-core-asl",
pkgName: "jackson-core-asl",
metadata: pkg.JavaArchive{},
expect: "org.codehaus.jackson",
},
{
name: "java manifest",
metadata: pkg.JavaArchive{