From 3a851b36cc5957dc8d585738ff9038b2d4893f3c Mon Sep 17 00:00:00 2001
From: Joe DiPol <joe.dipol@oracle.com>
Date: Wed, 2 Oct 2024 12:53:06 -0700
Subject: [PATCH] Supress prometheus false positives (#9315)

---
 etc/dependency-check-suppression.xml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/etc/dependency-check-suppression.xml b/etc/dependency-check-suppression.xml
index 87c129b8a5e..4cc1181b9a5 100644
--- a/etc/dependency-check-suppression.xml
+++ b/etc/dependency-check-suppression.xml
@@ -174,4 +174,22 @@
    <cpe>cpe:/a:mysql:mysql</cpe>
 </suppress>
 
+<!-- False Positive.
+     This is against an old version of prometheusa (not prometheus metrics nor micrometer)
+ -->
+<suppress>
+   <notes><![CDATA[
+   file name: micrometer-registry-prometheus-simpleclient-1.13.4.jar
+   ]]></notes>
+   <packageUrl regex="true">^pkg:maven/io\.micrometer/micrometer-registry-prometheus-simpleclient@.*$</packageUrl>
+   <cve>CVE-2019-3826</cve>
+</suppress>
+<suppress>
+   <notes><![CDATA[
+   file name: prometheus-metrics-core-1.2.1.jar
+   ]]></notes>
+   <packageUrl regex="true">^pkg:maven/io\.prometheus/prometheus-metrics-(.*)@.*$</packageUrl>
+   <cve>CVE-2019-3826</cve>
+</suppress>
+
 </suppressions>