suppression.xml 3.0 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273
  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <!-- This file lists false positives found by org.owasp:dependency-check-maven build plugin -->
  3. <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
  4. <suppress>
  5. <notes><![CDATA[ Suppress known vulnerabilities in FUSE libraries for fuse-nio-adapter. For more info, see suppression.xml of https://github.com/cryptomator/fuse-nio-adapter ]]></notes>
  6. <gav regex="true">^org\.cryptomator:fuse-nio-adapter:.*$</gav>
  7. <cvssBelow>9</cvssBelow>
  8. </suppress>
  9. <suppress>
  10. <notes><![CDATA[ Suppress known vulnerabilities in FUSE libraries for jfuse (dependency of fuse-nio-adapter). ]]></notes>
  11. <gav regex="true">^org\.cryptomator:jfuse.*$</gav>
  12. <cvssBelow>9</cvssBelow>
  13. </suppress>
  14. <!-- Jetty false positives below -->
  15. <suppress>
  16. <notes><![CDATA[
  17. Suppress all for this javax.servlet api package:
  18. There are lots of false positives, simply because its version number is way beyond the remaining
  19. org.eclipse.jetty jar files. Note, that our actual Jetty version is different.
  20. As long as we don't suppress anything in org.eclipse.jetty:jetty-server or :jetty-servlet,
  21. vulnerabilities will still trigger if we actually use an outdated Jetty version.
  22. ]]></notes>
  23. <gav>org.eclipse.jetty.toolchain:jetty-servlet-api:4.0.6</gav>
  24. <cpe regex="true">.*</cpe>
  25. </suppress>
  26. <suppress>
  27. <notes><![CDATA[
  28. Incorrectly matched CPE, see https://github.com/jeremylong/DependencyCheck/issues/4177git
  29. ]]></notes>
  30. <gav regex="true">^org\.cryptomator:.*$</gav>
  31. <cpe>cpe:/a:cryptomator:cryptomator</cpe>
  32. <cve>CVE-2022-25366</cve>
  33. </suppress>
  34. <!-- Apache Commons-cli false positives below -->
  35. <suppress>
  36. <notes><![CDATA[
  37. False positive for commons-cli due, see https://github.com/jeremylong/DependencyCheck/pull/4148
  38. ]]></notes>
  39. <gav regex="true">^commons\-cli:commons\-cli:.*$</gav>
  40. <cpe>cpe:/a:apache:james</cpe>
  41. <!-- while we are at it exclude also these fp -->
  42. <cpe>cpe:/a:spirit-project:spirit</cpe>
  43. <cpe>cpe:/a:apache:commons_net</cpe>
  44. </suppress>
  45. <suppress>
  46. <notes><![CDATA[
  47. False positive for jackson-core-2.13.4.jar, see https://github.com/jeremylong/DependencyCheck/issues/5502
  48. ]]></notes>
  49. <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-core@.*$</packageUrl>
  50. <cve>CVE-2022-45688</cve>
  51. </suppress>
  52. <suppress>
  53. <notes><![CDATA[
  54. False positive for jackson-databind-2.14.2.jar, see https://github.com/FasterXML/jackson-databind/issues/3972
  55. ]]></notes>
  56. <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
  57. <cve>CVE-2023-35116</cve>
  58. </suppress>
  59. <suppress>
  60. <notes><![CDATA[
  61. False positive for jackrabbit-webdav-2.21.15.jar. This component is not affected, see https://lists.apache.org/thread/j03b3qdhborc2jrhdc4d765d3jkh8bfw
  62. ]]></notes>
  63. <packageUrl regex="true">^pkg:maven/org\.apache\.jackrabbit/jackrabbit\-webdav@.*$</packageUrl>
  64. <cve>CVE-2023-37895</cve>
  65. </suppress>
  66. </suppressions>