CVE-2019-2124 - Incorrect PURL mapping

[mir-am]

CVE-2019-2124 affects Google Android but the PURL pkg:maven/org.bouncycastle/[email protected] is marked as vulnerable. This is an invalid mapping. There are currently quite a number of these issues in Postgres.

[MagielBruntink]

Yep, I am seeing the same wrong mappings produced by vulnerability-producer.

[MagielBruntink]

I think that the PURL inference strategies are the problem here, also in #118
Try running the vulnerability-producer with the -i none flag to turn those off.

[mir-am]

I think that the PURL inference strategies are the problem here, also in #118 Try running the vulnerability-producer with the -i none flag to turn those off.

Yes, this is related to the devised heuristics for PURL inference.
By turning off the flag -i, I think the tool won't infer PURLs.
I am currently investigating what we can possibly do to mitigate these false positives.