Thanks @aibaars for the CVEs. The apache/tomcat one can be detected with the existing query while three others can be detected with some new code. Two of them (apache/qpid-proton-j and apache/activemq) utilize the mechanism setEndpointIdentificationAlgorithm of SSLEngine and the spring-projects/spring-amqp one uses a third-party com.rabbitmq.client.ConnectionFactory library.

For pgjdbc/pgjdbc, the fix to the CVE is not to take an external hostname verifier that could be too lenient. As the code of external hostname verifier is not available in the repository, it cannot be detected with this query. And the first one apache/beam doesn't have a Java database (only JavaScript and Python) so probably there is something wrong with its file structure thus it cannot be analyzed.

In summary, the query is being updated to handle four of these CVEs and I'm in the middle of finalizing code changes and thorough testing. I will commit the code when it's done, probably in the next two days.

@luchua-bc