logback-json-core-0.1.5.jar false positive

[ramshazar]

Hi,

there is a false positive for logback-json-core-0.1.5.jar
logback-json-core-0.1.5.jar (ch.qos.logback.contrib:logback-json-core:0.1.5, cpe:/a:logback:logback:0.1.5) : CVE-2017-5929

[cdanger]

Same issue with logback-ext-spring-0.1.5.jar

(cpe:/a:logback:logback:0.1.5, org.logback-extensions:logback-ext-spring:0.1.5) : CVE-2017-5929

[lavinia-k]

Fixed in 5.4.0, which is yet to be released.

See #2594 for resolution and qos-ch/logback-contrib#25 for workaround using suppression files in the meantime.

[bjtu-zhuchenxu]

logback-ext-spring-0.1.5.jar 8.4.0 version still hit this issue, can someone take a look?