You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@struts.apache.org by lu...@apache.org on 2024/01/22 08:28:21 UTC
(struts) branch fix/plexus-exclusion created (now cf74a4450)
This is an automated email from the ASF dual-hosted git repository.
lukaszlenart pushed a change to branch fix/plexus-exclusion
in repository https://gitbox.apache.org/repos/asf/struts.git
at cf74a4450 Fixes excluding Plexus container in OWASP scan
This branch includes the following new commits:
new cf74a4450 Fixes excluding Plexus container in OWASP scan
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(struts) 01/01: Fixes excluding Plexus container in OWASP scan
Posted by lu...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
lukaszlenart pushed a commit to branch fix/plexus-exclusion
in repository https://gitbox.apache.org/repos/asf/struts.git
commit cf74a4450c60c616a283ccadd96cae8410fa9e05
Author: Lukasz Lenart <lu...@apache.org>
AuthorDate: Mon Jan 22 09:28:14 2024 +0100
Fixes excluding Plexus container in OWASP scan
---
src/etc/project-suppression.xml | 21 ++++++++-------------
1 file changed, 8 insertions(+), 13 deletions(-)
diff --git a/src/etc/project-suppression.xml b/src/etc/project-suppression.xml
index be1c572b1..7b2a1c5fb 100644
--- a/src/etc/project-suppression.xml
+++ b/src/etc/project-suppression.xml
@@ -132,21 +132,16 @@
<notes><![CDATA[ file name: plexus-utils-1.2.jar]]></notes>
<packageUrl regex="true">^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$</packageUrl>
<cpe>cpe:/a:plexus-utils_project:plexus-utils</cpe>
+ <cve>CVE-2022-4244</cve>
+ <cve>CVE-2022-4245</cve>
+ <cve>CVE-2017-1000487</cve>
</suppress>
<suppress>
- <notes><![CDATA[file name: plexus-utils-1.2.jar]]></notes>
- <packageUrl regex="true">^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$</packageUrl>
- <vulnerabilityName>CVE-2017-1000487</vulnerabilityName>
- </suppress>
- <suppress>
- <notes><![CDATA[file name: plexus-utils-1.2.jar]]></notes>
- <packageUrl regex="true">^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$</packageUrl>
- <vulnerabilityName>Directory traversal in org.codehaus.plexus.util.Expand</vulnerabilityName>
- </suppress>
- <suppress>
- <notes><![CDATA[file name: plexus-utils-1.2.jar]]></notes>
- <packageUrl regex="true">^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$</packageUrl>
- <vulnerabilityName>Possible XML Injection</vulnerabilityName>
+ <notes><![CDATA[ file name: plexus-container-default-1.0-alpha-10.jar]]></notes>
+ <packageUrl regex="true">^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$</packageUrl>
+ <cpe>cpe:/a:plexus-utils_project:plexus-utils</cpe>
+ <cve>CVE-2022-4244</cve>
+ <cve>CVE-2022-4245</cve>
</suppress>
<suppress>
<notes><![CDATA[file name: oval-1.90.jar]]></notes>