Does this look like it catches most of them @GALHP? I haven't done every single one, just focused on the big named frameworks for now.

@chadlwilson thanks for your PR 🙏

I ran it locally and in example case of #7984 it reduced 1040 findings across 35 dependencies to 36 findings across 14 dependencies (30 findings across 13 dependencies with the suggestion).

Are you able to share the remaining findings? I'll see if it's as expected or whether I can clean up more.

Sure, here are remaining packages grouped by CPEs (my suggestion already included)

{
  "cpe:2.3:a:authenticator:authenticator:7.6.0:*:*:*:*:*:*:*": [
    "pkg:composer/scheb/[email protected]"
  ],
  "cpe:2.3:a:authenticator_project:authenticator:7.6.0:*:*:*:*:*:*:*": [
    "pkg:composer/scheb/[email protected]"
  ],
  "cpe:2.3:a:archive_project:archive:1.5.0:*:*:*:*:*:*:*": [
    "pkg:composer/pear/[email protected]"
  ],
  "cpe:2.3:a:tar_project:tar:1.5.0:*:*:*:*:*:*:*": [
    "pkg:composer/pear/[email protected]"
  ],
  "cpe:2.3:a:lookup:lookup:3.0.0:*:*:*:*:*:*:*": [
    "pkg:composer/sebastian/[email protected]"
  ],
  "cpe:2.3:a:file_project:file:1.0.4:*:*:*:*:*:*:*": [
    "pkg:composer/pimcore/[email protected]"
  ],
  "cpe:2.3:a:finder_project:finder:6.4.24:*:*:*:*:*:*:*": [
    "pkg:composer/symfony/[email protected]"
  ],
  "cpe:2.3:a:htmlsanitizer_project:htmlsanitizer:6.4.18:*:*:*:*:*:*:*": [
    "pkg:composer/symfony/[email protected]"
  ],
  "cpe:2.3:a:newsletter:newsletter:1.2.0:*:*:*:*:*:*:*": [
    "pkg:composer/pimcore/[email protected]"
  ],
  "cpe:2.3:a:newsletter_project:newsletter:1.2.0:*:*:*:*:*:*:*": [
    "pkg:composer/pimcore/[email protected]"
  ],
  "cpe:2.3:a:pear:pear:1.10.16:*:*:*:*:*:*:*": [
    "pkg:composer/pear/[email protected]"
  ],
  "cpe:2.3:a:git-php_project:git-php:1.0.3:*:*:*:*:*:*:*": [
    "pkg:composer/gal-digital-gmbh/[email protected]"
  ],
  "cpe:2.3:a:file_project:file:4.1.0:*:*:*:*:*:*:*": [
    "pkg:composer/phpunit/[email protected]"
  ],
  "cpe:2.3:a:php-proxy:php-proxy:1.0.18:*:*:*:*:*:*:*": [
    "pkg:composer/friendsofphp/[email protected]"
  ],
  "cpe:2.3:a:sitemap_project:sitemap:2.0.1:*:*:*:*:*:*:*": [
    "pkg:composer/gal-digital-gmbh/[email protected]"
  ],
  "cpe:2.3:a:sitemap_project:sitemap:4.1.3:*:*:*:*:*:*:*": [
    "pkg:composer/presta/[email protected]"
  ]
}

OK, all but one of those are separate so I'll probably leave them for now. Feel free to suggest a PR to suppress them. You'll see some existing suppressions for the various _project type of CPEs.

  "cpe:2.3:a:pear:pear:1.10.16:*:*:*:*:*:*:*": [
    "pkg:composer/pear/[email protected]"
  ],

I am not sure if I agree that this is a false positive - and I intentionally excluded it from the suppressions. Since it is released and versioned alongside pear/pear, even though it is a minimal variant, it still may be subject to vulnerabilities in Pear, no? (PEAR.php, System.php, ErrorStack.php)

https://github.com/pear/pear-core-minimal
https://packagist.org/packages/pear/pear-core-minimal

It may indeed lead to false positives for some vulns affecting non minimal pieces. Unless the minimal variant is managed with a different CPE I'm not sure we can safely suppress this for all CVEs.

I am not sure if I agree that this is a false positive - and I intentionally excluded it from the suppressions. Since it is released and versioned alongside pear/pear, even though it is a minimal variant, it still may be subject to vulnerabilities in Pear, no? (PEAR.php, System.php, ErrorStack.php)

I agree with you that this should be decided based on the underlying vulnerability.