Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-06 23:27:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updates OWASP supressions as some reports are false positive

Browse Source
This commit is contained in:
Lukasz Lenart
2022-11-27 08:51:34 +01:00
parent d166d79a66
commit efd4c61a26
3 changed files with 36 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/oval/pom.xml
+6
View File
@@ -36,6 +36,12 @@
<dependency>
<groupId>net.sf.oval</groupId>
<artifactId>oval</artifactId>
<exclusions>
<exclusion>
<groupId>com.thoughtworks.xstream</groupId>
<artifactId>xstream</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
pom.xml
+1 -1
View File
@@ -1081,7 +1081,7 @@
<dependency>
<groupId>org.testng</groupId>
<artifactId>testng</artifactId>
<version>7.4.0</version>
<version>7.5</version><!-- the latest version supporting Java 1.8 -->
</dependency>
<dependency>
src/etc/project-suppression.xml
+29 -2
View File
@@ -168,6 +168,16 @@
<packageUrl regex="true">^pkg:maven/net\.sf\.oval/oval@.*$</packageUrl>
<cpe>cpe:/a:xstream_project:xstream</cpe>
</suppress>
<suppress>
<notes><![CDATA[file name: oval-1.90.jar: xstream-1.4.19.jar]]></notes>
<packageUrl regex="true">^pkg:maven/com\.thoughtworks\.xstream/xstream@.*$</packageUrl>
<cve>CVE-2022-40151</cve>
<cve>CVE-2022-40152</cve>
<cve>CVE-2022-40153</cve>
<cve>CVE-2022-40154</cve>
<cve>CVE-2022-40155</cve>
<cve>CVE-2022-40156</cve>
</suppress>
<!-- TestNG -->
<suppress>
<notes><![CDATA[file name: guava-19.0.jar]]></notes>
@@ -189,5 +199,22 @@
<packageUrl regex="true">^pkg:javascript/jquery@.*$</packageUrl>
<cve>CVE-2020-11023</cve>
</suppress>
<!-- TestNG -->
</suppressions>
<suppress>
<notes><![CDATA[file name: testng-7.5.jar]]></notes>
<packageUrl regex="true">^pkg:maven/org\.testng/testng@.*$</packageUrl>
<cve>CVE-2022-4065</cve>
</suppress>
<suppress>
<notes><![CDATA[file name: spring-core-4.3.30.RELEASE.jar, spring-aop-4.3.30.RELEASE.jar]]></notes>
<packageUrl regex="true">^pkg:maven/org\.springframework/spring\-.*@.*$</packageUrl>
<cve>CVE-2022-22965</cve>
<cve>CVE-2022-22950</cve>
<cve>CVE-2022-22968</cve>
<cve>CVE-2022-22970</cve>
</suppress>
<suppress>
<notes><![CDATA[file name: spring-web-5.3.23.jar]]></notes>
<packageUrl regex="true">^pkg:maven/org\.springframework/spring\-web@.*$</packageUrl>
<cve>CVE-2016-1000027</cve>
</suppress>
</suppressions>