[directory-scimple] branch fix-dep-check-again created (now 4ccb63d2)

[bd...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

bdemers pushed a change to branch fix-dep-check-again
in repository https://gitbox.apache.org/repos/asf/directory-scimple.git


      at 4ccb63d2 Force newer transitive dep commons-code to be used

This branch includes the following new commits:

     new 4ccb63d2 Force newer transitive dep commons-code to be used

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

[directory-scimple] 01/01: Force newer transitive dep commons-code to be used

[bd...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

bdemers pushed a commit to branch fix-dep-check-again
in repository https://gitbox.apache.org/repos/asf/directory-scimple.git

commit 4ccb63d22f48ea6ef1a69a644237fbf03658a352
Author: Brian Demers <bd...@apache.org>
AuthorDate: Wed Dec 7 17:19:54 2022 -0500

    Force newer transitive dep commons-code to be used
    
    Cleanup false positives detected by dependency-check
---
 pom.xml                   |  5 +++++
 src/owasp/suppression.xml | 25 +++++++++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/pom.xml b/pom.xml
index 8cfb5d57..de51a5aa 100644
--- a/pom.xml
+++ b/pom.xml
@@ -297,6 +297,11 @@
         <artifactId>commons-collections4</artifactId>
         <version>4.4</version>
       </dependency>
+      <dependency>
+        <groupId>commons-codec</groupId>
+        <artifactId>commons-codec</artifactId>
+        <version>1.15</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>
 
diff --git a/src/owasp/suppression.xml b/src/owasp/suppression.xml
index 6dbb60f4..96d58142 100644
--- a/src/owasp/suppression.xml
+++ b/src/owasp/suppression.xml
@@ -57,4 +57,29 @@
     <cpe>cpe:/a:fan_platform_project:fan_platform</cpe>
   </suppress>
 
+  <suppress>
+    <notes><![CDATA[ file name: commons-codec-1.15.jar ]]></notes>
+    <packageUrl regex="true">^pkg:maven/commons\-codec/commons\-codec@.*$</packageUrl>
+    <cpe>cpe:/a:apache:commons_net</cpe>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[ file name: commons-logging-1.2.jar ]]></notes>
+    <packageUrl regex="true">^pkg:maven/commons\-logging/commons\-logging@.*$</packageUrl>
+    <cpe>cpe:/a:apache:commons_net</cpe>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[ file name: jcl-over-slf4j-1.7.36.jar ]]></notes>
+    <packageUrl regex="true">^pkg:maven/org\.slf4j/jcl\-over\-slf4j@.*$</packageUrl>
+    <cpe>cpe:/a:apache:commons_net</cpe>
+  </suppress>
+
+  <suppress>
+    <notes><![CDATA[
+    file name: snakeyaml-1.33.jar
+    Snakeyaml is a transitive dependency, the mitigation for this vuln is to use a different constructor.
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
+    <vulnerabilityName>CVE-2022-1471</vulnerabilityName>
+  </suppress>
+
 </suppressions>