Java wrong java library version reported

[pkroiss]

We've a java project that uses jackson-databind-2.15.2.jar. Syft reports that we use

jackson-databind 2.11.1 java-archive (+3 duplicates)
jackson-databind 2.15.2 java-archive

We only use version 2.15.2

After investation we found in the ehcache-2.10.9.2.jar library 2 files where jackson-databind-2.11.1 is referenced
rest-management-private-classpath/META-INF/maven/com.fasterxml.jackson.core/jackson-databind/pom.xml
rest-management-private-classpath/META-INF/maven/com.fasterxml.jackson.core/jackson-databind/pom.properties
because of (+3 duplicates) we expect that similar META-INF entries exist in other libraries as well.