Skip to content
Snippets Groups Projects
Normal view Permalink
owasp_suppressing_false_positives.xml 9.55 KiB
Newer Older
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 : Supressing false positives - Jetty 6
Fuentes Serna Juan Mariano (ID SIS) committed
1 2 
<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.1.xsd">
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
3 
   <!-- GWT Development - Jetty 6 -->
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 : Supressing false positives - Jetty 6
Fuentes Serna Juan Mariano (ID SIS) committed
4 5 6 7 8 9 10 11 12 13 14 15 
   <suppress>
      <gav regex="true">^org\.mortbay\.jetty:jetty-util:.*$</gav>
      <cpe>cpe:/a:mortbay:jetty</cpe>
   </suppress>
   <suppress>
	   <gav regex="true">^org\.mortbay\.jetty:jetty:.*$</gav>
	   <cpe>cpe:/a:mortbay:jetty</cpe>
	</suppress>
	<suppress>
	   <gav regex="true">^org\.mortbay\.jetty:servlet-api-2\.5:.*$</gav>
	   <cpe>cpe:/a:mortbay:jetty</cpe>
	</suppress>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
16 17 18 19 20 21 22 23 24 25 26 27 28 
	<!-- GWT Development - Apache Client -->
	<suppress>
	   <gav regex="true">^org\.apache\.httpcomponents:httpclient:.*$</gav>
	   <cve>CVE-2011-1498</cve>
	   <cve>CVE-2014-3577</cve>
	   <cve>CVE-2015-5262</cve>
	</suppress>
	<suppress>
	   <gav regex="true">^org\.apache\.httpcomponents:httpmime:.*$</gav>
	   <cve>CVE-2011-1498</cve>
	   <cve>CVE-2014-3577</cve>
	   <cve>CVE-2015-5262</cve>
	</suppress>
juanf's avatar
SSDM-6756 : New CVE update  
juanf committed
29 
	<!-- Jetty 8 - False positive, found in a ehcache POM file -->
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
30 
	<suppress>
Juan Fuentes's avatar
owasp suppressing false positives  
Juan Fuentes committed
31 32 33 34 35 36 
	   	<notes><![CDATA[ ehcache-2.10.0.jar ]]></notes>
	   	<gav regex="true">^org\.eclipse\.jetty:jetty-continuation:.*$</gav>
	   	<cve>CVE-2017-9735</cve>
		<cve>CVE-2017-7656</cve>
		<cve>CVE-2017-7657</cve>
		<cve>CVE-2017-7658</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
37 38 
	</suppress>
	<suppress>
Juan Fuentes's avatar
owasp suppressing false positives  
Juan Fuentes committed
39 40 41 42 43 44 
	   	<notes><![CDATA[ ehcache-2.10.0.jar ]]></notes>
	   	<gav regex="true">^org\.eclipse\.jetty:jetty-http:.*$</gav>
	   	<cve>CVE-2017-9735</cve>
		<cve>CVE-2017-7656</cve>
		<cve>CVE-2017-7657</cve>
		<cve>CVE-2017-7658</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
45 46 
	</suppress>
	<suppress>
Juan Fuentes's avatar
owasp suppressing false positives  
Juan Fuentes committed
47 48 49 50 51 52 
	   	<notes><![CDATA[ ehcache-2.10.0.jar ]]></notes>
	   	<gav regex="true">^org\.eclipse\.jetty:jetty-security:.*$</gav>
	   	<cve>CVE-2017-9735</cve>
		<cve>CVE-2017-7656</cve>
		<cve>CVE-2017-7657</cve>
		<cve>CVE-2017-7658</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
53 54 
	</suppress>
	<suppress>
Juan Fuentes's avatar
owasp suppressing false positives  
Juan Fuentes committed
55 56 57 58 59 60 
	   	<notes><![CDATA[ ehcache-2.10.0.jar ]]></notes>
	   	<gav regex="true">^org\.eclipse\.jetty:jetty-server:.*$</gav>
	   	<cve>CVE-2017-9735</cve>
		<cve>CVE-2017-7656</cve>
		<cve>CVE-2017-7657</cve>
		<cve>CVE-2017-7658</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
61 62 
	</suppress>
	<suppress>
Juan Fuentes's avatar
owasp suppressing false positives  
Juan Fuentes committed
63 64 65 66 67 68 
	   	<notes><![CDATA[ ehcache-2.10.0.jar ]]></notes>
	   	<gav regex="true">^org\.eclipse\.jetty:jetty-servlet:.*$</gav>
	   	<cve>CVE-2017-9735</cve>
		<cve>CVE-2017-7656</cve>
		<cve>CVE-2017-7657</cve>
		<cve>CVE-2017-7658</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
69 70 
	</suppress>
	<suppress>
Juan Fuentes's avatar
owasp suppressing false positives  
Juan Fuentes committed
71 72 73 74 75 76 
	   	<notes><![CDATA[ ehcache-2.10.0.jar ]]></notes>
	   	<gav regex="true">^org\.eclipse\.jetty:jetty-util:.*$</gav>
	   	<cve>CVE-2017-9735</cve>
		<cve>CVE-2017-7656</cve>
		<cve>CVE-2017-7657</cve>
		<cve>CVE-2017-7658</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
77 78 79 80 81 
	</suppress>
	<!-- Jetty 9.4.9 -->
	<suppress>
   		<gav regex="true">^org\.eclipse\.jetty\.alpn:alpn-api:.*$</gav>
   		<cve>CVE-2017-9735</cve> <!-- False positive, only affects 9.4.6 and earlier -->
Juan Fuentes's avatar
owasp suppressing false positives  
Juan Fuentes committed
82 83 84 
		<cve>CVE-2017-7656</cve> <!-- False positive, only affects 9.4.10 and earlier -->
		<cve>CVE-2017-7657</cve> <!-- False positive, only affects 9.4.10 and earlier -->
		<cve>CVE-2017-7658</cve> <!-- False positive, only affects 9.4.10 and earlier -->
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
85 86 87 88 
	</suppress>
	<suppress>
   		<gav regex="true">^org\.eclipse\.jetty\.orbit:javax\.security\.auth\.message:.*$</gav>
   		<cve>CVE-2017-9735</cve> <!-- False positive, only affects 9.4.6 and earlier -->
Juan Fuentes's avatar
owasp suppressing false positives  
Juan Fuentes committed
89 90 91 
		<cve>CVE-2017-7656</cve> <!-- False positive, only affects 9.4.10 and earlier -->
		<cve>CVE-2017-7657</cve> <!-- False positive, only affects 9.4.10 and earlier -->
		<cve>CVE-2017-7658</cve> <!-- False positive, only affects 9.4.10 and earlier -->
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
92 93 94 95 
	</suppress>
	<suppress>
   		<gav regex="true">^org\.eclipse\.jetty\.orbit:javax\.mail\.glassfish:.*$</gav>
   		<cve>CVE-2017-9735</cve> <!-- False positive, only affects 9.4.6 and earlier -->
Juan Fuentes's avatar
owasp suppressing false positives  
Juan Fuentes committed
96 97 98 
		<cve>CVE-2017-7656</cve> <!-- False positive, only affects 9.4.10 and earlier -->
		<cve>CVE-2017-7657</cve> <!-- False positive, only affects 9.4.10 and earlier -->
		<cve>CVE-2017-7658</cve> <!-- False positive, only affects 9.4.10 and earlier -->
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
99 100 101 102 103 104 105 
	</suppress>
	<suppress>
   		<gav regex="true">^org\.eclipse\.jetty\.toolchain:jetty-schemas:.*$</gav>
   		<cve>CVE-2007-5613</cve>  <!-- False positive, only affects 6.1.6 and earlier -->
   		<cve>CVE-2007-5614</cve>  <!-- False positive, only affects 6.1.6 and earlier -->
   		<cve>CVE-2007-5615</cve>  <!-- False positive, only affects 6.1.6 and earlier -->
   		<cve>CVE-2017-9735</cve> <!-- False positive, only affects 9.4.6 and earlier -->
Juan Fuentes's avatar
owasp suppressing false positives  
Juan Fuentes committed
106 107 108 
		<cve>CVE-2017-7656</cve> <!-- False positive, only affects 9.4.10 and earlier -->
		<cve>CVE-2017-7657</cve> <!-- False positive, only affects 9.4.10 and earlier -->
		<cve>CVE-2017-7658</cve> <!-- False positive, only affects 9.4.10 and earlier -->
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 
	</suppress>
	<!-- Jackson 2.0.2 -->
	<suppress>
   		<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-annotations:.*$</gav>
   		<cve>CVE-2017-15095</cve> <!-- Only affects you if you allow to deserialize generic classes, object, serializable, etc.. -->
   		<cve>CVE-2017-17485</cve> <!-- Only affects you if you allow to deserialize generic classes, object, serializable, etc.. -->
   		<cve>CVE-2017-7525</cve> <!-- Only affects you if you allow to deserialize generic classes, object, serializable, etc.. -->
   		<cve>CVE-2018-5968</cve> <!-- No Gadgets used, or DTOs are plain DTOs -->
   		<cve>CVE-2018-7489</cve> <!-- We don't use c3p0 libraries -->
	</suppress>
	<suppress>
   		<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:.*$</gav>
   		<cve>CVE-2017-15095</cve><cve>CVE-2017-17485</cve><cve>CVE-2017-7525</cve><cve>CVE-2018-5968</cve><cve>CVE-2018-7489</cve>
	</suppress>
	<!-- Spring 4.1 -->
	<suppress>
	   <gav regex="true">^springframework:spring-aop:.*$</gav>
	   <cve>CVE-2015-0201</cve> <!-- The Java SockJS client, we don't use the web sockets client -->
	   <cve>CVE-2015-3192</cve> <!-- DOS Attacks using crafted DTD for XML, where we use DTDs? -->
	   <cve>CVE-2015-5211</cve> <!-- This only affects downloads where the user could give the name of the file, not the case of the DSS -->
	   <cve>CVE-2016-5007</cve> <!-- We don't use spring security to protect controllers -->
	   <cve>CVE-2018-1270</cve> <!-- We don't use web sockets endpoints -->
	   <cve>CVE-2018-1271</cve> <!-- We don't deploy on Windows -->
	   <cve>CVE-2018-1272</cve> <!-- We don't forward user input blindly to create packages from our web client -->
juanf's avatar
SSDM-6756 : New CVE update  
juanf committed
133 
	   <cve>CVE-2018-1258</cve> <!-- We don't use the web-security jar -->
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
134 135 136 
	</suppress>
	<suppress>
	   <gav regex="true">^springframework:spring-beans:.*$</gav>
juanf's avatar
SSDM-6756 : New CVE update  
juanf committed
137 
	   <cve>CVE-2018-1258</cve><cve>CVE-2015-0201</cve><cve>CVE-2015-3192</cve><cve>CVE-2015-5211</cve><cve>CVE-2016-5007</cve><cve>CVE-2018-1270</cve><cve>CVE-2018-1271</cve><cve>CVE-2018-1272</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
138 139 140 
	</suppress>
	<suppress>
	   <gav regex="true">^org\.springframework:spring-context:.*$</gav>
juanf's avatar
SSDM-6756 : New CVE update  
juanf committed
141 
	   <cve>CVE-2018-1258</cve><cve>CVE-2015-0201</cve><cve>CVE-2015-3192</cve><cve>CVE-2015-5211</cve><cve>CVE-2016-5007</cve><cve>CVE-2018-1270</cve><cve>CVE-2018-1271</cve><cve>CVE-2018-1272</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
142 143 144 
	</suppress>
	<suppress>
	   <gav regex="true">^springframework:spring-core:.*$</gav>
juanf's avatar
SSDM-6756 : New CVE update  
juanf committed
145 
	   <cve>CVE-2018-1258</cve><cve>CVE-2015-0201</cve><cve>CVE-2015-3192</cve><cve>CVE-2015-5211</cve><cve>CVE-2016-5007</cve><cve>CVE-2018-1270</cve><cve>CVE-2018-1271</cve><cve>CVE-2018-1272</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
146 147 148 
	</suppress>
	<suppress>
	   <gav regex="true">^springframework:spring-web:.*$</gav>
juanf's avatar
SSDM-6756 : New CVE update  
juanf committed
149 
	   <cve>CVE-2018-1258</cve><cve>CVE-2015-0201</cve><cve>CVE-2015-3192</cve><cve>CVE-2015-5211</cve><cve>CVE-2016-5007</cve><cve>CVE-2018-1270</cve><cve>CVE-2018-1271</cve><cve>CVE-2018-1272</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
150 151 152 
	</suppress>
	<suppress>
	   <gav regex="true">^springframework:spring-webmvc:.*$</gav>
juanf's avatar
SSDM-6756 : New CVE update  
juanf committed
153 
	   <cve>CVE-2018-1258</cve><cve>CVE-2015-0201</cve><cve>CVE-2015-3192</cve><cve>CVE-2015-5211</cve><cve>CVE-2016-5007</cve><cve>CVE-2018-1270</cve><cve>CVE-2018-1271</cve><cve>CVE-2018-1272</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
154 155 156 
	</suppress>
	<suppress>
	   <gav regex="true">^springframework:spring-expression:.*$</gav>
juanf's avatar
SSDM-6756 : New CVE update  
juanf committed
157 
	   <cve>CVE-2018-1258</cve><cve>CVE-2015-0201</cve><cve>CVE-2015-3192</cve><cve>CVE-2015-5211</cve><cve>CVE-2016-5007</cve><cve>CVE-2018-1270</cve><cve>CVE-2018-1271</cve><cve>CVE-2018-1272</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
158 159 160 
	</suppress>
	<suppress>
	   <gav regex="true">^springframework:spring-tx:.*$</gav>
juanf's avatar
SSDM-6756 : New CVE update  
juanf committed
161 
	   <cve>CVE-2018-1258</cve><cve>CVE-2015-0201</cve><cve>CVE-2015-3192</cve><cve>CVE-2015-5211</cve><cve>CVE-2016-5007</cve><cve>CVE-2018-1270</cve><cve>CVE-2018-1271</cve><cve>CVE-2018-1272</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
162 163 164 
	</suppress>
	<suppress>
	   <gav regex="true">^springframework:spring-context-support:.*$</gav>
juanf's avatar
SSDM-6756 : New CVE update  
juanf committed
165 
	   <cve>CVE-2018-1258</cve><cve>CVE-2015-0201</cve><cve>CVE-2015-3192</cve><cve>CVE-2015-5211</cve><cve>CVE-2016-5007</cve><cve>CVE-2018-1270</cve><cve>CVE-2018-1271</cve><cve>CVE-2018-1272</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
166 167 168 
	</suppress>
	<suppress>
	   <gav regex="true">^springframework:spring-jdbc:.*$</gav>
juanf's avatar
SSDM-6756 : New CVE update  
juanf committed
169 
	   <cve>CVE-2018-1258</cve><cve>CVE-2015-0201</cve><cve>CVE-2015-3192</cve><cve>CVE-2015-5211</cve><cve>CVE-2016-5007</cve><cve>CVE-2018-1270</cve><cve>CVE-2018-1271</cve><cve>CVE-2018-1272</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
170 171 172 
	</suppress>
	<suppress>
	   <gav regex="true">^org\.springframework:spring-orm:.*$</gav>
juanf's avatar
SSDM-6756 : New CVE update  
juanf committed
173 
	   <cve>CVE-2018-1258</cve><cve>CVE-2015-0201</cve><cve>CVE-2015-3192</cve><cve>CVE-2015-5211</cve><cve>CVE-2016-5007</cve><cve>CVE-2018-1270</cve><cve>CVE-2018-1271</cve><cve>CVE-2018-1272</cve>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
174 175 176 177 178 
	</suppress>
	<!-- Postgresql JDBC -->
	<suppress>
   		<gav regex="true">^org\.postgresql:postgresql:.*$</gav>
   		<cve>CVE-2017-14798</cve> <!-- Clients can't use JDBC directly and execute their own SQL -->
juanf's avatar
SSDM-6756 CVE Suppression - We don't use any admin pack for postgres  
juanf committed
179 
   		<cve>CVE-2018-1115</cve> <!-- We don't use any admin pack -->
Juan Fuentes's avatar
owasp suppressing false positives  
Juan Fuentes committed
180 181 182 183 184 185 186 187 
		<cve>CVE-2016-7048</cve> <!-- Don't apply to the driver -->
	</suppress>
	<!-- Jython -->
	<suppress>
		<gav regex="true">^org\.jruby\.extras:jaffl:.*$</gav>
		<cpe>CVE-2010-1330</cpe>
		<cpe>CVE-2011-4838</cpe>
		<cpe>CVE-2012-5370</cpe>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 - Supressing false positives  
Fuentes Serna Juan Mariano (ID SIS) committed
188 
	</suppress>
Fuentes Serna Juan Mariano (ID SIS)'s avatar
SSDM-6756 : Supressing false positives - Jetty 6
Fuentes Serna Juan Mariano (ID SIS) committed
189 
</suppressions>