|
|
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
|
|
|
<!--
|
|
|
|
|
Licensed to the Apache Software Foundation (ASF) under one or more
|
|
|
|
|
contributor license agreements. See the NOTICE file distributed with
|
|
|
|
|
this work for additional information regarding copyright ownership.
|
|
|
|
|
The ASF licenses this file to You under the Apache License, Version 2.0
|
|
|
|
|
(the "License"); you may not use this file except in compliance with
|
|
|
|
|
the License. You may obtain a copy of the License at
|
|
|
|
|
|
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
|
|
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
|
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
|
See the License for the specific language governing permissions and
|
|
|
|
|
limitations under the License.
|
|
|
|
|
-->
|
|
|
|
|
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
|
|
|
|
|
<suppress>
|
|
|
|
|
<notes><![CDATA[
|
|
|
|
|
The attack described in CVE-2023-35116, like in most application, cannot
|
|
|
|
|
be achieved by an external attacker.
|
|
|
|
|
]]></notes>
|
|
|
|
|
<cve>CVE-2023-35116</cve>
|
|
|
|
|
</suppress>
|
|
|
|
|
<suppress>
|
|
|
|
|
<notes><![CDATA[
|
|
|
|
|
This older version of BCEL is only included in spotbugs.
|
|
|
|
|
CVE-2022-42920 is irrelevant for spotbugs
|
|
|
|
|
(https://github.com/spotbugs/spotbugs/discussions/2251),
|
|
|
|
|
This suppression will no longer be needed when spotbugs 4.7.4 is
|
|
|
|
|
released.
|
|
|
|
|
]]></notes>
|
|
|
|
|
<cve>CVE-2022-42920</cve>
|
|
|
|
|
</suppress>
|
|
|
|
|
<suppress>
|
|
|
|
|
<notes><![CDATA[
|
|
|
|
|
This older version of Guava is only included in checkstyle.
|
|
|
|
|
CVE-2023-2976 and CVE-2020-8908 are irrelevant for checkstyle,
|
|
|
|
|
as it is not executed with elevated privileges.
|
|
|
|
|
This suppression will no longer be needed when checkstyle
|
|
|
|
|
is updated to 10.5.0 or later.
|
|
|
|
|
]]></notes>
|
|
|
|
|
<cve>CVE-2020-8908</cve>
|
|
|
|
|
<cve>CVE-2023-2976</cve>
|
|
|
|
|
</suppress>
|
|
|
|
|
<suppress>
|
|
|
|
|
<notes><![CDATA[
|
|
|
|
|
Kafka does not use CgiServlet
|
|
|
|
|
]]></notes>
|
|
|
|
|
<cve>CVE-2023-36479</cve>
|
|
|
|
|
</suppress>
|
|
|
|
|
</suppressions>
|
