-
Notifications
You must be signed in to change notification settings - Fork 10
/
owasp-suppressions.xml
70 lines (64 loc) · 2.23 KB
/
owasp-suppressions.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
<suppress>
<notes><![CDATA[
Any hypertrace dep
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.hypertrace\..*@.*$</packageUrl>
<cpe>cpe:/a:grpc:grpc</cpe>
<cpe>cpe:/a:utils_project:utils</cpe>
</suppress>
<!-- This is the final version, and its coming via transitive dep. -->
<suppress>
<notes><![CDATA[
file name: commons-httpclient-3.1.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/commons\-httpclient/commons\-httpclient@.*$</packageUrl>
<cpe>cpe:/a:apache:commons-httpclient</cpe>
<cpe>cpe:/a:apache:httpclient</cpe>
<cve>CVE-2012-5783</cve>
</suppress>
<!-- This is the final version -->
<suppress>
<notes><![CDATA[
file name: zookeeper-api-1.2.0.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.helix/zookeeper\-api@.*$</packageUrl>
<cpe>cpe:/a:apache:zookeeper</cpe>
<cpe>cpe:/a:apache:helix</cpe>
</suppress>
<!-- This is the final version -->
<suppress>
<notes><![CDATA[
file name: snakeyaml-1.33.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
<cpe>cpe:/a:snakeyaml_project:snakeyaml</cpe>
<cve>CVE-2022-1471</cve>
</suppress>
<!-- Same vulnerability even in latest version -->
<suppress>
<notes><![CDATA[
file name: commons-compiler-3.1.8.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.codehaus\.janino/commons\-compiler@.*$</packageUrl>
<cpe>cpe:/a:janino_project:janino</cpe>
</suppress>
<!-- Same vulnerability even in latest version -->
<suppress>
<notes><![CDATA[
file name: janino-3.1.8.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.codehaus\.janino/janino@.*$</packageUrl>
<cpe>cpe:/a:janino_project:janino</cpe>
<cve>CVE-2023-33546</cve>
</suppress>
<!-- Disputed vulnerability -->
<suppress>
<notes><![CDATA[
file name: jackson-databind-2.14.2.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
<cpe>cpe:/a:fasterxml:jackson-databind</cpe>
</suppress>
</suppressions>