From 19441b856467edb337ed31fa5a62a86aed8fbfd0 Mon Sep 17 00:00:00 2001
From: Martin Traverse <martin.traverse@accenture.com>
Date: Mon, 11 Sep 2023 10:48:41 +0100
Subject: [PATCH] Fix OWASP false positive for Netty (#395)

---
 dev/compliance/owasp-false-positives.xml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/dev/compliance/owasp-false-positives.xml b/dev/compliance/owasp-false-positives.xml
index 5cf3c8441..dd64949b2 100644
--- a/dev/compliance/owasp-false-positives.xml
+++ b/dev/compliance/owasp-false-positives.xml
@@ -228,4 +228,13 @@
         <vulnerabilityName>CVE-2020-21469</vulnerabilityName>
     </suppress>
 
+    <!-- Netty does not do host name verification for SSL by default, it has to be enabled in code -->
+    <!-- There is a discussion whether to change the default before Netty 5 -->
+    <!-- https://github.com/netty/netty/issues/8537 -->
+
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/io\.netty/netty\-handler@.*$</packageUrl>
+        <vulnerabilityName>CVE-2023-4586</vulnerabilityName>
+    </suppress>
+
 </suppressions>
\ No newline at end of file