#3868 Suppress log4j-api & log4j-to-slf4j false positive

[nhumblot]

Fixes Issue

Description of Change

Fix #3868

log4j-api & log4j-to-slf4j are identified as vulnerable to CVE-2021-44228.

More explanations on why these two dependencies should be declared as false positive.

Have test cases been added to cover the new functionality?

No automated test but a manual verification of these FPs not being raised on a compiled snapshot has been performed.

[bjansen]

What if someday someone finds a CVE in log4j-api, won't it be suppressed because the CPE will also be cpe:/a:apache:log4j and lead to a false negative?

[whimet]

With version 6.5.1, it still reports CVE-2021-45046 and CVE-2021-45105 agaist log4j-api, which are false positives as well. For example: log4j-api-2.13.3.jar (pkg:maven/org.apache.logging.log4j/[email protected], cpe:2.3:a:apache:log4j:2.13.3:*:*:*:*:*:*:*) : CVE-2021-45046, CVE-2021-45105

[jeremylong]

@bjansen What i ended up doing was suppressing by CVE - not the entire log4j CPE. Which is why @whimet is reporting that the two newer CVEs are still being reported. I just updated the suppression file: #3910

[bjansen]

OK thanks for the clarification.