Skip to content

Commit

Permalink
remove unnecessary suppressions (#393)
Browse files Browse the repository at this point in the history
  • Loading branch information
AmandaRichards authored Apr 16, 2024
1 parent 09e19ef commit 5f79181
Showing 1 changed file with 0 additions and 20 deletions.
20 changes: 0 additions & 20 deletions config/owasp/suppressions.xml
Original file line number Diff line number Diff line change
@@ -1,23 +1,3 @@
<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
<suppress until="2024-06-01">
<notes><![CDATA[
This vulnerability is about potential Remote Code Execution when serializing and deserializing Java classes
using HttpInvokerServiceExport and org.springframework.remoting.
As we don't use those constructs, we are not affected by it.
The suppression will be a long-term one. An expiry to the suppression is kept to allow re-evaluating whether
we're still unaffected by it.
]]></notes>
<cve>CVE-2016-1000027</cve>
</suppress>
<suppress until="2024-06-01">
<notes>![CDATA[
False positive - https://github.com/jeremylong/DependencyCheck/issues/5502

We don't use the libraries affected by this vulnerability. This is a false positive in dependencycheck that is still current in version 8.2.1.
Try to remove it when a dependencycheck upgrade becomes available.
If it still happens, check that we don't use hutool-json and json-java. If we don't, extend the suppression date by another year.
]]</notes>
<cve>CVE-2022-45688</cve>
</suppress>
</suppressions>

0 comments on commit 5f79181

Please sign in to comment.