When a security scan is performed, it reports back with a high number of false positive security vulnerabilities.
The security scan flagged the jar files as vulnerable due to the class and method names we use to identify sources for instrumentation. However, the jar files only contain New Relic instrumentation code.
Suppress the false positive warnings coming from the
instrumentation package in the newrelic.jar with your scanning tool.
For example, false positives discovered by the
DependencyCheck project at github.com/jeremylong/DependencyCheck can be suppressed with:
<suppress><notes><![CDATA[newrelic-agent false positives due to the instrumentation package]]></notes><filePath regex="true">.*newrelic-agent-.*\.jar[\\\/]instrumentation.*\.jar</filePath><cpe regex="true">.*</suppress>
Consult your security scan vendor for the appropriate configuration to suppress false positives.