(druid) branch 34.0.0 updated: Suppress grpc cve that is a false positive picked up by scanner. This CVE applies to the grpc cpp libs not java (#18361) (#18364)

[ca...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

capistrant pushed a commit to branch 34.0.0
in repository https://gitbox.apache.org/repos/asf/druid.git


The following commit(s) were added to refs/heads/34.0.0 by this push:
     new ab7f40ea737 Suppress grpc cve that is a false positive picked up by scanner. This CVE applies to the grpc cpp libs not java (#18361) (#18364)
ab7f40ea737 is described below

commit ab7f40ea737a38b6c08d96f561225a3fcd1bb3b2
Author: Lucas Capistrant <ca...@users.noreply.github.com>
AuthorDate: Mon Aug 4 11:15:56 2025 -0500

    Suppress grpc cve that is a false positive picked up by scanner. This CVE applies to the grpc cpp libs not java (#18361) (#18364)
---
 owasp-dependency-check-suppressions.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/owasp-dependency-check-suppressions.xml b/owasp-dependency-check-suppressions.xml
index 6476c18b579..7ea810a6d79 100644
--- a/owasp-dependency-check-suppressions.xml
+++ b/owasp-dependency-check-suppressions.xml
@@ -753,4 +753,11 @@
     ]]></notes>
     <vulnerabilityName>CVE-2024-45772</vulnerabilityName>
   </suppress>
+
+  <suppress>
+    <notes><![CDATA[
+    file name: grpc-core-1.65.1.jar
+    ]]></notes>
+    <vulnerabilityName>CVE-2024-11407</vulnerabilityName> <!-- This CVE is a false positive for java. The CVE is related to their cpp library, not java -->
+  </suppress>
 </suppressions>


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org