Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Suppress CVE's in master #15231

Merged
merged 3 commits into from
Oct 27, 2023
Merged

Suppress CVE's in master #15231

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5840e2d
suppress CVEs
LakshSingla Oct 23, 2023
0693de0
comments
LakshSingla Oct 26, 2023
f5958a9
suppress netty CVE
LakshSingla Oct 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions distribution/bin/check-licenses.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,6 +266,8 @@ def build_compatible_license_names():
compatible_licenses['Eclipse Public License - Version 1.0'] = 'Eclipse Public License 1.0'
compatible_licenses['Eclipse Public License, Version 1.0'] = 'Eclipse Public License 1.0'
compatible_licenses['Eclipse Public License v1.0'] = 'Eclipse Public License 1.0'
compatible_licenses['Eclipse Public License - v1.0'] = 'Eclipse Public License 1.0'
compatible_licenses['Eclipse Public License - v 1.0'] = 'Eclipse Public License 1.0'
compatible_licenses['EPL 1.0'] = 'Eclipse Public License 1.0'

compatible_licenses['Eclipse Public License 2.0'] = 'Eclipse Public License 2.0'
Expand Down
23 changes: 23 additions & 0 deletions owasp-dependency-check-suppressions.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -759,13 +759,15 @@
<cve>CVE-2023-1370</cve>
<cve>CVE-2023-37475</cve> <!-- Suppressing since CVE wrongly linked to apache:avro project - https://github.com/jeremylong/DependencyCheck/issues/5843 -->
<cve>CVE-2023-39410</cve> <!-- This seems to be a legitimate vulnerability. But there is no fix as of yet in Hadoop repo -->
<cve>CVE-2023-44487</cve> <!-- Occurs in the version of Hadoop used by Jetty, but it hasn't been fixed by Hadoop yet-->
</suppress>
<suppress>
<!-- from extensions using hadoop-client-api, these dependencies are shaded in the jar -->
<notes><![CDATA[
file name: hadoop-client-api-3.3.6.jar: jquery.dataTables.min.js (pkg:javascript/[email protected])
]]></notes>
<vulnerabilityName>prototype pollution</vulnerabilityName>
<cve>CVE-2020-28458</cve>
</suppress>
<suppress>
<notes><![CDATA[
Expand Down Expand Up @@ -811,4 +813,25 @@
<packageUrl regex="true">^pkg:maven/org\.codehaus\.plexus/plexus-interpolation@.*$</packageUrl>
<cve>CVE-2022-4244</cve>
</suppress>

<!-- CVE-2023-5072 has a too broad CPE that flags all versions of json-java - https://github.com/jeremylong/DependencyCheck/issues/5991 -->
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we don't use json-java at all. "flags all versions of json-java" text seems unrelated to why we are suppressing it.

<suppress base="true">
<notes><![CDATA[
FP per issue #5991
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what does this mean? What issue does it refer to?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is picked up from a description in https://github.com/jeremylong/DependencyCheck which suppresses it. There's another suppression in the suppression file here which also does the same, so I assumed that it's standard to add it in the notes.
I'll clean up the suppression.

]]></notes>
<cve>CVE-2023-5072</cve>
</suppress>

<!--
~ CVE-2023-44981 seems to affect Zookeeper servers. While we ship with a previous version of the Zookeeper, Druid only
~ only uses the client classes of the Zookeeper. We do use the older version in the quickstart & example docker file,
~ however in production it is recomended to use your own Zookeeper server with the CVE patched up, which the Druid's
~ older ZK library is still compatible with.
Comment on lines +820 to +824
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

-->
<suppress>
<notes><![CDATA[
file name: zookeeper-3.5.10.jar
]]></notes>
<cve>CVE-2023-44981</cve>
</suppress>
</suppressions>
Loading