NVDSuppressions.xml

<?xml version="1.0" encoding="utf-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
  <suppress>
    <notes>
      <![CDATA[
   file name: GetDocument.Insider.dll
   Suppressing this CVE as it is a .NetCore runtime issue affecting .NetCore runtimes below .NET Core 3.1.4 or lower. The MSI Runs in an AppService which will have the fixes already applied, and the global.json has been addeded to require .NetCore SDK > 6.0.101 or greater.
   More details can be found here: https://github.com/dotnet/announcements/issues/156
   ]]>
    </notes>
    <cve>CVE-2020-1108</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
    file name: Microsoft.AspNetCore.Hosting.Abstractions.dll
    See https://github.com/dotnet/announcements/issues/175 for full MS Details on CVE.
    .NET Core and Visual Studio Denial of Service Vulnerability. 
    This CVE applies to any .NET Core 3.1 but patch is provided at 3.1.405, MSI is pinned to .Net core SDK > 6.0.101 which is not vunerable, and deployed to Azure App Service which will have the security patch applied.
    ]]>
    </notes>
    <cve>CVE-2021-1721</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
    file name: Microsoft.AspNetCore.Hosting.Abstractions.dll
    See https://github.com/dotnet/announcements/issues/176 for full MS Details on CVE.
    A remote code execution vulnerability exists when parsing certain types of graphics files.
    This vulnerability only exists on systems running on MacOS or Linux.
    This CVE applies to any .NET Core 3.1 but patch is provided at 3.1.405, MSI is pinned to .Net core SDK > 6.0.101 which is not vunerable, and deployed to Azure App Service which will have the security patch applied.
    ]]>
    </notes>
    <cve>CVE-2021-24112</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
    file name: Microsoft.AspNetCore.Hosting.Abstractions.dll
    See https://github.com/dotnet/announcements/issues/194 for full MS Details on CVE.
    A denial of service vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 where .NET (Core) server applications providing WebSocket endpoints could be tricked into endlessly looping while trying to read a single WebSocket frame.
    This CVE applies to any .NET Core 3.1 but patch is provided at 3.1.412, MSI is pinned to .Net core SDK > 6.0.101 which is not vunerable, and deployed to Azure App Service which will have the security patch applied.
    ]]>
    </notes>
    <cve>CVE-2021-26423</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
    file name: Microsoft.AspNetCore.Hosting.Abstractions.dll
    See https://github.com/dotnet/announcements/issues/178 for full MS Details on CVE.
    A remote code execution vulnerability exists in .NET 5 and .NET Core due to how text encoding is performed.This vulnerability is for System.Text.Encodings.Web and fixed on 5.0.1 and we are using 5.0.1
    This CVE applies to any .NET Core 3.1 but patch is provided at 3.1.407, MSI is pinned to .Net core SDK > 6.0.101 which is not vunerable, and deployed to Azure App Service which will have the security patch applied.
    ]]>
    </notes>
    <cve>CVE-2021-26701</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
    file name: Microsoft.AspNetCore.Hosting.Abstractions.dll
    See https://github.com/dotnet/announcements/issues/196 for full MS Details on CVE.
    An information disclosure vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 when dumps created by the tool to collect crash dumps and dumps on demand are created with global read permissions on Linux and macOS.
    This CVE applies to any .NET Core 3.1 but patch is provided at 3.1.412, MSI is pinned to .Net core SDK > 6.0.101 which is not vunerable, and deployed to Azure App Service which will have the security patch applied.
    ]]>
    </notes>
    <cve>CVE-2021-34485</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Serilog.Sinks.Async.dll
   A vulnerability exists in Async through 3.2.1 (fixed in 3.2.2) , which could let a malicious user obtain privileges via the mapValues() method.
   This is a false positive as the vulnerability exists in a NPM Javascript package named 'Async' and not the nuget .NET package named 'Serilog.Sinks.Async'.
    ]]>
    </notes>
    <cve>CVE-2021-43138</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
    file name:  Microsoft.AspNetCore.Authentication.OpenIdConnect.dll
    See https://github.com/dotnet/announcements/issues/111 for MS details on this CVE.
        Package name: System.Net.Http:4.3.3 (included as part of the .Net Core runtime)
      	Vulnerable versions: 4.3.3 and below
        Secure versions: 4.3.4+
    This CVE applies to .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0. MSI is pinned to .Net core SDK > 3.1.408 which is not vulnerable and are false positives, and deployed to Azure App Service which will have the security patch applied.
    ]]>
    </notes>
    <cve>CVE-2007-1651</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
    file name:  Microsoft.AspNetCore.Authentication.OpenIdConnect.dll
    See https://github.com/dotnet/announcements/issues/111 for MS details on this CVE.
        Package name: System.Net.Http:4.3.3 (included as part of the .Net Core runtime)
      	Vulnerable versions: 4.3.3 and below
        Secure versions: 4.3.4+
    This CVE applies to .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0. MSI is pinned to .Net core SDK > 3.1.408 which is not vulnerable and are false positives,and Cross-site request forgery (CSRF) vulnerability in OpenID allows remote attackers to restore the login session of a user on an OpenID enabled site via unspecified vectors related to an arbitrary remote web site and cached tokens, after the user has signed into an OpenID server, logged into the OpenID enabled site.
    ]]>
    </notes>
    <cve>CVE-2007-1652</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Microsoft.AspNetCore.Hosting.Abstractions.dll
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/Microsoft\.AspNetCore\.Hosting\.Abstractions@.*$</packageUrl>
    <cve>CVE-2018-8409</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Microsoft.AspNetCore.Hosting.Server.Abstractions.dll
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/Microsoft\.AspNetCore\.Hosting\.Server\.Abstractions@.*$</packageUrl>
    <cve>CVE-2018-8409</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Microsoft.AspNetCore.Hosting.dll
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/Microsoft\.AspNetCore\.Hosting@.*$</packageUrl>
    <cve>CVE-2018-8409</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Microsoft.AspNetCore.Http.Abstractions.dll
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/Microsoft\.AspNetCore\.Http\.Abstractions@.*$</packageUrl>
    <cve>CVE-2018-8409</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Microsoft.AspNetCore.Http.Extensions.dll
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/Microsoft\.AspNetCore\.Http\.Extensions@.*$</packageUrl>
    <cve>CVE-2018-8409</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Microsoft.AspNetCore.Http.Features.dll
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/Microsoft\.AspNetCore\.Http\.Features@.*$</packageUrl>
    <cve>CVE-2018-8409</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Microsoft.AspNetCore.WebUtilities.dll
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/Microsoft\.AspNetCore\.WebUtilities@.*$</packageUrl>
    <cve>CVE-2018-8409</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Microsoft.Extensions.Hosting.Abstractions.dll
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/Microsoft\.Extensions\.Hosting\.Abstractions@.*$</packageUrl>
    <cve>CVE-2018-8409</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Microsoft.Net.Http.Headers.dll
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/Microsoft\.Net\.Http\.Headers@.*$</packageUrl>
    <cve>CVE-2018-8409</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Various
   False positive - .NET Framework only
   ]]>
    </notes>
    <cve>CVE-2022-41064</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Various
   False positive - applies to .NET 6 < 6.0.6 and VS 2022 < 17.2.4
   ]]>
    </notes>
    <cve>CVE-2022-30184</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Microsoft.Identity.Web.UI.dll
   ]]>
    </notes>
    <cve>CVE-2010-3324</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: System.Security.Cryptography.X509Certificates:4.1.0
   file name: System.Security.Cryptography.X509Certificates:4.3.0
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:nuget/System\.Security\.Cryptography\.X509Certificates@.*$</packageUrl>
    <vulnerabilityName>CVE-2017-11770</vulnerabilityName>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Azure.Identity.dll
   false positive: fixed in 1.10.3
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/Azure\.Identity@.*$</packageUrl>
    <cpe>cpe:/a:microsoft:azure_identity_sdk</cpe>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Azure.Identity.dll
   false positive: fixed in 1.10.3
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/Azure\.Identity@.*$</packageUrl>
    <cpe>cpe:/a:microsoft:azure_sdk_for_.net</cpe>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Azure.Identity:1.10.3
   false positive: fixed in 1.10.3
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:nuget/Azure\.Identity@.*$</packageUrl>
    <cpe>cpe:/a:microsoft:azure_identity_sdk</cpe>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Serilog.Extensions.Logging.File.dll
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/Serilog\.Extensions\.Logging\.File@.*$</packageUrl>
    <cve>CVE-2015-0897</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Various Azure.
   Refers to Azure CLI.
   ]]>
    </notes>
    <cve>CVE-2023-36052</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: GetDocument.Insider.dll
   Fixed in latest version of .NET SDK >= 6.0.415
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/GetDocument\.Insider@.*$</packageUrl>
    <cve>CVE-2023-44487</cve>
    <cve>CVE-2023-36558</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: dotnet-getdocument.dll
   Fixed in latest version of .NET SDK >= 6.0.415
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/dotnet\-getdocument@.*$</packageUrl>
    <cve>CVE-2023-44487</cve>
    <cve>CVE-2023-36558</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: System.Threading.Tasks.Extensions.dll
   False positive - applies to Android app
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/System\.Threading\.Tasks\.Extensions@.*$</packageUrl>
    <cve>CVE-2020-22475</cve>
    <cve>CVE-2022-39349</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: System.Threading.Tasks.Extensions:Various
   False positive - applies to Android app
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:nuget/System\.Threading\.Tasks\.Extensions@.*$</packageUrl>
    <cve>CVE-2020-22475</cve>
    <cve>CVE-2022-39349</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: System.Threading.Tasks.dll
   False positive - applies to Android app
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/System\.Threading\.Tasks@.*$</packageUrl>
    <cve>CVE-2020-22475</cve>
    <cve>CVE-2022-39349</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: System.Threading.Tasks:Various
   False positive - applies to Android app
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:nuget/System\.Threading\.Tasks@.*$</packageUrl>
    <cve>CVE-2020-22475</cve>
    <cve>CVE-2022-39349</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: System.Threading.Tasks.Parallel.dll
   False positive - applies to Android app
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/System\.Threading\.Tasks\.Parallel@.*$</packageUrl>
    <cve>CVE-2020-22475</cve>
    <cve>CVE-2022-39349</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Microsoft.Data.SqlClient.SNI.runtime:2.1.1
   Fixed in SDK >= 6.0.418
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:nuget/Microsoft\.Data\.SqlClient\.SNI\.runtime@.*$</packageUrl>
    <cve>CVE-2024-0056</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: GetDocument.Insider.dll
   Fixed in latest .NET release
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/GetDocument\.Insider@.*$</packageUrl>
    <cve>CVE-2024-21386</cve>
    <cve>CVE-2024-21404</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: dotnet-getdocument.dll
   Fixed in latest .NET release
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/dotnet\-getdocument@.*$</packageUrl>
    <cve>CVE-2024-21386</cve>
    <cve>CVE-2024-21404</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: System.Formats.Asn1:various
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:nuget/System\.Formats\.Asn1@.*$</packageUrl>
    <vulnerabilityName>CVE-2024-38095</vulnerabilityName>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: WireMock.Net:1.5.60
   Used in testing only, not deployed.
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:nuget/WireMock\.Net@.*$</packageUrl>
    <cve>CVE-2020-27853</cve>
    <cve>CVE-2021-41093</cve>
    <cve>CVE-2018-9116</cve>
    <cve>CVE-2020-15258</cve>
    <cve>CVE-2018-8909</cve>
    <cve>CVE-2023-41329</cve>
    <cve>CVE-2021-32665</cve>
    <cve>CVE-2021-32666</cve>
    <cve>CVE-2022-23625</cve>
    <cve>CVE-2022-31009</cve>
    <cve>CVE-2023-22737</cve>
    <cve>CVE-2018-9117</cve>
    <cve>CVE-2022-43673</cve>
    <cve>CVE-2021-21301</cve>
    <cve>CVE-2021-32755</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Various
   Refers to Azure CLI and service connector: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-43591
   ]]>
    </notes>
    <cve>CVE-2024-43591</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: System.Text.Json:9.0.0
   This is the current version and will be updated once the next release is available
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:nuget/System\.Text\.Json@.*$</packageUrl>
    <vulnerabilityName>CVE-2024-43485</vulnerabilityName>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Azure.Identity:1.10.3
   False positive - 1.10.3 not used.
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:nuget/Azure\.Identity@.*$</packageUrl>
    <vulnerabilityName>CVE-2024-35255</vulnerabilityName>
    <vulnerabilityName>CVE-2024-29992</vulnerabilityName>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Microsoft.AspNetCore.Http.dll
   False positive - applies to old versions of .NET and System.IO.Pipelines. See https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8409
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/Microsoft\.AspNetCore\.Http@.*$</packageUrl>
    <cve>CVE-2018-8409</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Microsoft.Identity.Client.dll
   False positive - fixed in latest version of Azure Identity. See https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-35255
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/Microsoft\.Identity\.Client@.*$</packageUrl>
    <cve>CVE-2024-35255</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Microsoft.IdentityModel.Protocols.OpenIdConnect.dll
   False positive. Fixed in latest package versions and .NET 8. See https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-21319
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:generic/Microsoft\.IdentityModel\.Protocols\.OpenIdConnect@.*$</packageUrl>
    <cve>CVE-2024-21319</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: Microsoft.IdentityModel.Protocols.OpenIdConnect:7.0.3
   False positive. Fixed in latest package versions and .NET 8. See https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-21319
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:nuget/Microsoft\.IdentityModel\.Protocols\.OpenIdConnect@.*$</packageUrl>
    <cve>CVE-2024-21319</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: System.Net.Security:4.3.0
   False positive - fixed in later package versions. See https://learn.microsoft.com/en-us/security-updates/securityadvisories/2017/4021279
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:nuget/System\.Net\.Security@.*$</packageUrl>
    <cve>CVE-2017-0247</cve>
    <vulnerabilityName>CVE-2017-0248</vulnerabilityName>
    <cve>CVE-2017-0249</cve>
    <cve>CVE-2017-0256</cve>
  </suppress>
  <suppress>
    <notes>
      <![CDATA[
   file name: runtime.native.System.Net.Security:4.3.0
   False positive - fixed in later package versions. See https://learn.microsoft.com/en-us/security-updates/securityadvisories/2017/4021279
   ]]>
    </notes>
    <packageUrl regex="true">^pkg:nuget/runtime\.native\.System\.Net\.Security@.*$</packageUrl>
    <cve>CVE-2017-0247</cve>
    <cve>CVE-2017-0249</cve>
    <cve>CVE-2017-0256</cve>
  </suppress>
</suppressions>