[myfaces-build-tools] branch main updated: CVE for snakeyaml

[lo...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lofwyr pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/myfaces-build-tools.git


The following commit(s) were added to refs/heads/main by this push:
     new a1e70c81 CVE for snakeyaml
     new 9409644a Merge remote-tracking branch 'origin/main'
a1e70c81 is described below

commit a1e70c815c77423c292c1116f8a8d430a986c5ee
Author: Udo Schnurpfeil <ud...@irian.eu>
AuthorDate: Fri Oct 7 16:45:43 2022 +0200

    CVE for snakeyaml
---
 .../resources/tobago/dependency-check-suppression-for-tobago-5.x.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/other/checkstyle-rules/src/main/resources/tobago/dependency-check-suppression-for-tobago-5.x.xml b/other/checkstyle-rules/src/main/resources/tobago/dependency-check-suppression-for-tobago-5.x.xml
index 9a448835..319caf26 100644
--- a/other/checkstyle-rules/src/main/resources/tobago/dependency-check-suppression-for-tobago-5.x.xml
+++ b/other/checkstyle-rules/src/main/resources/tobago/dependency-check-suppression-for-tobago-5.x.xml
@@ -89,4 +89,9 @@
     <packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback\-.*@.*$</packageUrl>
     <cve>CVE-2021-42550</cve>
   </suppress>
+  <suppress>
+    <notes><![CDATA[ file name: snakeyaml-1.32.jar ]]></notes>
+    <packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
+    <vulnerabilityName>CVE-2022-38752</vulnerabilityName>
+  </suppress>
 </suppressions>