Skip to content
This repository has been archived by the owner on Apr 5, 2024. It is now read-only.

Commit

Permalink
Add suppression for disputed CVE-2023-35116 (#513)
Browse files Browse the repository at this point in the history
  • Loading branch information
siladu authored Jun 29, 2023
1 parent 50f5890 commit a6781cc
Showing 1 changed file with 4 additions and 7 deletions.
11 changes: 4 additions & 7 deletions gradle/owasp-suppression.xml
Original file line number Diff line number Diff line change
@@ -1,15 +1,12 @@
<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
<!-- See https://jeremylong.github.io/DependencyCheck/general/suppression.html for examples -->
<suppress until="2023-04-15">
<suppress>
<notes><![CDATA[
Suppress various improper matches to the CPE that belongs only to pkg:maven/org.json/json. Our code does not
use this library.
Suppress until a future version of dependency-check plugin solves it.
- https://github.com/jeremylong/DependencyCheck/issues/5545
Suppress CVE-2023-35116 as this is not considered a CVE according to discussion in https://github.com/FasterXML/jackson-databind/issues/3972
]]></notes>
<packageUrl regex="true">^(?!pkg:maven/org\.json/json@).+$</packageUrl>
<cpe>cpe:/a:json-java_project:json-java</cpe>
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
<vulnerabilityName>CVE-2023-35116</vulnerabilityName>
</suppress>
<suppress>
<notes><![CDATA[
Expand Down

0 comments on commit a6781cc

Please sign in to comment.