[FP]: Microsoft.Extensions.Hosting.Systemd nuget is not systemd #8841

Activity

1. mormegil-cz

   added

   FP Report

   on Oct 14, 2026
2. github-actions commented on Oct 14, 2026

   

   github-actionsbot

   on Oct 14, 2026 – with GitHub Actions

   Contributor

   More actions

   Nuget Coordinates

   dotnet add package Microsoft.Extensions.Hosting.Systemd --version 10.0.12

   Suppression rule:

   <suppress base="true">
       <notes><![CDATA[
       FP per issue #8841
       ]]></notes>
       <packageUrl regex="true">^pkg:nuget/Microsoft\.Extensions\.Hosting\.Systemd@.*$</packageUrl>
       <cpe regex="true">cpe:/a:systemd_project:systemd(:.*)?$</cpe>
   </suppress>

   Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/38555702976
3. github-actions

   added

   dotnet

   on Oct 14, 2026
4. chadlwilson commented on Oct 14, 2026

   

   chadlwilson

   on Oct 14, 2026

   Collaborator

   More actions

   Can you please share an xml or json or html report from ODC? Our FP automation is not seeing this false positive with a CLI scan.
5. chadlwilson

   added

   unable to reproduce

   on Oct 14, 2026
6. mormegil-cz commented on Oct 14, 2026

   

   mormegil-cz

   on Oct 14, 2026

   Author

   More actions

   Report for a trivial reproducible project: owasp-report.json
7. chadlwilson commented on Oct 14, 2026

   

   chadlwilson

   on Oct 14, 2026

   Last edited by chadlwilson

   Collaborator

   More actions

   Thanks, will take a look. For some reason the automation is running against ODC 12.2.2 instead of 13.0.0 which might be the reason for the discrepancy as some tidy-ups were done in 13.0.0 to reduce false negatives which did unfortunately re-introduce some false positives.
8. chadlwilson commented on Oct 14, 2026

   

   chadlwilson

   on Oct 14, 2026

   Last edited by chadlwilson

   Collaborator

   More actions

   It does look like this report is showing them against pkg:generic/Microsoft.Extensions.Hosting.Systemd@10.0.13 not against a nuget package.

   That's important as the suppression rule must match the ecosystem. Where did you get the nuget PURL from? A report? Or you "guessed" it?
9. chadlwilson

   removed

   unable to reproduce

   on Oct 14, 2026
10. mormegil-cz commented on Oct 14, 2026

    

    mormegil-cz

    on Oct 14, 2026

    Author

    More actions

    Oh, that one is funny: I did not want to upload the report for my real project (which reported the PURLs as in the original bugreport, I copy&pasted them from the report), so I created a small repro project. However, I created the project using the new .slnx solution format. In that case, ODC creates the PURLs as pkg:generic. So I recreated the repro project using the old .sln format, and ODC uses pkg:nuget again: owasp-report.json

    So, apparently, ODC does not support .slnx (or, rather, it behaves a bit strangely in that case).

    And… I tried 12.2.2 which seems to generate exactly the same report. AFAICT, the only difference between my case and the Github Action is that I’m running ODC on the current .NET 10 instead of .NET 8 (which is supported only until November, IIANM) used by the action.