hostsharing/hs.hsadmin.ng
1
0
Fork 0
Code Activity

fix vulnerability CVE-2022-1471 by forcing snakeyaml 2.2

Browse Source
This commit is contained in:
Michael Hoennig
2024-01-04 09:10:20 +01:00
parent 73f147c557
commit 4c44f42b79
3 changed files with 37 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
etc/owasp-dependency-check-suppression.xml
View File

@ -49,4 +49,13 @@
<packageUrl regex="true">^pkg:maven/org\.pitest/pitest\-command\-line@.*$</packageUrl>
<cpe>cpe:/a:line:line</cpe>
</suppress>
<suppress>
<notes><![CDATA[
We've explicitly bumped to 2.2, but the dependency checker does not seem to notice that.
TODO: Remove this suppression once we are on SpringBoot 3.2,
as well as the explicit version bump and the transient dependency exclude.
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
<cve>CVE-2022-1471</cve>
</suppress>
</suppressions>