CAST HIGHLIGHT - SCA - Components that are not there in the file is resulting in CVE violations – CAST

CVE violations are seen in some components but no entry for these components are seen in the file section that is the code. The physical files that led to CVE violation in Code could not be found.

Details

CVE findings in Highlight are associated with identified OSS components and their versions. CVE finding need not always mean that Highlight has identified a specific vulnerable method, function, interface, or code path in the source code.
1. Check in the UI or in the BOM, whether the "origin" column says the defective component comes from a dependency (pom.xml for instance). If it is a dependency the physical files of this component need not necessarily be in the scan to get detected.
2. Confirm by checking the "Logs" tab in BOM which shows only fingerprinted files, not dependencies. A physical file path would be expected when the component was detected from a scanned/fingerprinted file, whereas dependency-based detection can occur without that physical file being present in the scan scope. Please refer SCA – Change in CAST Highlight Code Reader & CLI: Dependency Detection Defaults
3. --includeArchiveContent can create apparent false positives because it causes Highlight to inspect third-party archives and report vulnerabilities in components that may not be direct or runtime dependencies. Enabling the scanning of archive content using the option --includeArchiveContent expands the analysis scope into third-party archives if it is present. As a result, Highlight can identify OSS components and associated vulnerabilities that are contained within those third-party artifacts, even though those components may not be direct dependencies of the scanned application. The vulnerability association itself may be valid for the detected component version, but the finding can be irrelevant to the application's effective runtime dependency set.
Check for the possibility whether the files may have existed in the production system such as a prior branch or extraction that was subjected to analysis.

NB : Also refer CAST HIGHLIGHT - SCA - Results - False positive because HL identified a wrong component for file finger print related issues. Beginning with CAST Highlight CLI 5.10.8 and Code Reader 1.2.18, dependency-based detection is the default for Software Composition Analysis (SCA). File fingerprint matching is still available as an optional detection method but is no longer enabled by default, reducing the likelihood of fingerprint-related false positives. Please refer SCA – Change in CAST Highlight Code Reader & CLI: Dependency Detection Defaults

If the detection is incorrect for your specific scenario, these components can be excluded from the application. Please refer CAST HIGHLIGHT - SCA - How to exclude and report a third party component?

To know more about how SCA works in Highlight please refer

Software Composition in Highlight: How Open Source component detection works

CAST HIGHLIGHT - SCA - Results - Reasons for False positives in Software Composition Analysis