False Positive on elastic-apm-agent

[OrangeDog]

apm-agent-attach-1.28.1.jar\META-INF/maven/co.elastic.apm/apm-agent-common/pom.xml (pkg:maven/co.elastic.apm/apm-agent-common@1.28.1, cpe:2.3:a:elastic:apm_agent:1.28.1:*:*:*:*:*:*:*) : CVE-2019-7617
apm-agent-attach-1.28.1.jar (pkg:maven/co.elastic.apm/apm-agent-attach@1.28.1, cpe:2.3:a:elastic:apm_agent:1.28.1:*:*:*:*:*:*:*) : CVE-2019-7617
elastic-apm-agent-1.28.1.jar (pkg:maven/co.elastic.apm/elastic-apm-agent@1.28.1, cpe:2.3:a:elastic:apm_agent:1.28.1:*:*:*:*:*:*:*) : CVE-2019-7617

<dependency>
  <groupId>co.elastic.apm</groupId>
  <artifactId>apm-agent-attach</artifactId>
  <version>1.28.1</version>
</dependency>

CVE-2019-7617 is for the Python agent, not the Java agent.
The NVD entry specifies this: cpe:2.3:a:elastic:apm_agent:*:*:*:*:*:python:*:*

[aikebah]

Would need enhancement in DependencyCheck to take target_sw CPE attribute into account

[bremme]

I just ran into this issue using version 1.52.1 of the Java APM agent as well.