JP,
On 8/8/26 3:46 AM, Mark Thomas wrote:
8 Aug 2026 02:42:51 João Paulo Simões Martins via users
<[email protected]>:
Hi, thanks for the reply.
So am I correct in assuming that the tomcat-embbeed 11.0.24 does not
include the examples in it?
Yes.
And if so, in your view, the CVE on owasp security scan should be
considered a false positive?
Yes.
This is common for security scans which only take into account of
version numbers for packages and dependencies, and not the usage of
those dependencies.
Security scans of this nature need to be INPUT to your security
management process, not the primary driver of your security process.
For example, CVE-2026-49844 [1] affects Apache log4j versions before
2.25.5 and 2.26.1, and I have a fleet of applications that are all
running version 2.25.4, so it comes up on our security scanner. We have
a policy of deploying updates for CVEs within a short amount of time, so
of course we *need* to deploy this update, right?
Well, no. It turns out that this CVE only applies to logging to JSON
with a specific type of message resolver. We use neither, so our
security process allows us to delay the roll-out of this update until a
time that is more convenient to us.
I realize that every team wants "NO SECURITY ISSUES" to be displayed on
their security dashboard, but it's really okay to have something that
says "This is an issue, but it's very low priority and we expect it do
be resolved by X date."
-chris
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-49844
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
