dependency-check-suppressions.xml

<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
    <suppress>
        <notes><![CDATA[
    Suppressing as it seems a false positive as per https://github.com/jeremylong/DependencyCheck/issues/1573
    ]]></notes>
        <gav regex="true">^io\.netty:netty-tcnative-boringssl-static:.*</gav>
        <cve>CVE-2014-3488</cve>
        <cve>CVE-2015-2156</cve>
        <cve>CVE-2018-1258</cve>
        <cve>CVE-2019-16869</cve>
    </suppress>
    <suppress>
        <notes><![CDATA[
     Suppressing as it seems a false positive
   ]]></notes>
        <cve>CVE-2018-1258</cve>
    </suppress>

    <suppress>
        <notes><![CDATA[
        test only dependency pulled in by rest-assured
   ]]></notes>
        <packageUrl regex="true">^pkg:maven/org\.apache\.sling/org\.apache\.sling\.javax\.activation@.*$</packageUrl>
        <cve>CVE-2016-5394</cve>
        <cve>CVE-2016-6798</cve>
    </suppress>

    <suppress>
        <notes><![CDATA[
            CVE is a json vulnerability for Node projects. False positive reported at https://github.com/jeremylong/DependencyCheck/issues/2794
        ]]></notes>
        <cve>CVE-2020-10663</cve>
        <cve>CVE-2020-7712</cve>
    </suppress>

    <suppress until="2022-12-01">
        <notes>Temporary to unblock pipeline</notes>
        <cve>CVE-2020-36518</cve>
        <cve>CVE-2022-22968</cve>
        <cve>CVE-2022-25857</cve>
    </suppress>
    <suppress>
        <notes>There is no non-vulnerable upgrade path for this component/package according to https://github.com/spring-projects/spring-framework/issues/24434</notes>
        <cve>CVE-2016-1000027</cve>
    </suppress>

    <!-- remove when spring boot is upgraded to 3.x-->
    <suppress>
        <notes><![CDATA[Not relevant to us as all yaml is checked directly into the repo]]></notes>
        <packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
        <cve>CVE-2022-25857</cve>
        <cve>CVE-2022-38749</cve>
        <cve>CVE-2022-38750</cve>
        <cve>CVE-2022-38751</cve>
        <cve>CVE-2022-38752</cve>
        <cve>CVE-2022-41854</cve>
        <cve>CVE-2021-4235</cve>
        <cve>CVE-2022-1471</cve>
      <cve>CVE-2022-3064</cve>
    </suppress>
    <suppress>
        <cve>CVE-2022-42003</cve>
        <cve>CVE-2021-37533</cve>
    </suppress>
        <suppress>
        <notes>LatencyUtils</notes>
        <cve>CVE-2021-4277</cve>
    </suppress>

    <suppress>
        <notes><![CDATA[
    file name: tomcat-embed-websocket-9.0.69.jar
    ]]></notes>
        <packageUrl regex="true">^pkg:maven/org\.apache\.tomcat\.embed/tomcat\-embed\-websocket@.*$</packageUrl>
        <cve>CVE-2023-28708</cve>
    </suppress>
    <suppress>
        <notes><![CDATA[
    file name: tomcat-embed-core-9.0.69.jar
    ]]></notes>
        <packageUrl regex="true">^pkg:maven/org\.apache\.tomcat\.embed/tomcat\-embed\-core@.*$</packageUrl>
        <cve>CVE-2023-28708</cve>
    </suppress>
    <suppress>
      <notes><![CDATA[
     Junk CVE, shows the brokenness of the CVE system and is rejected by the author as a valid CVE.
     ]]></notes>
      <cve>CVE-2023-35116</cve>
    </suppress>
</suppressions>