Update OWASP suppression file

Author: rjeberhard

build-tools/dependency-check/dependency-check-suppression.xml

@@ -1,29 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
-    <suppress>
-        <packageUrl regex="true">^pkg:maven/jakarta\.ws\.rs/jakarta\.ws\.rs-api@.*$</packageUrl>
-        <cpe>cpe:/a:eclipse:eclipse_ide</cpe>
-    </suppress>
-    <suppress>
-        <packageUrl regex="true">^pkg:maven/io\.kubernetes/client\-java@.*$</packageUrl>
-        <cpe>cpe:/a:kubernetes:kubernetes</cpe>
-    </suppress>
-    <suppress>
-        <packageUrl regex="true">^pkg:maven/io\.kubernetes/client\-java\-api@.*$</packageUrl>
-        <cpe>cpe:/a:kubernetes:kubernetes</cpe>
-    </suppress>
-    <suppress>
-        <packageUrl regex="true">^pkg:maven/io\.kubernetes/client\-java\-api\-fluent@.*$</packageUrl>
-        <cpe>cpe:/a:kubernetes:kubernetes</cpe>
-    </suppress>
-    <suppress>
-        <packageUrl regex="true">^pkg:maven/io\.kubernetes/client\-java\-proto@.*$</packageUrl>
-        <cpe>cpe:/a:kubernetes:kubernetes</cpe>
-    </suppress>
-    <suppress>
-        <packageUrl regex="true">^pkg:maven/com\.google\.protobuf/protobuf\-java@.*$</packageUrl>
-        <cpe>cpe:/a:google:protobuf-java</cpe>
-    </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/oracle\.kubernetes/weblogic\-kubernetes\-operator@.*$</packageUrl>
         <cpe>cpe:/a:kubernetes:kubernetes</cpe>
@@ -44,4 +20,18 @@
         <packageUrl regex="true">^pkg:maven/oracle\.kubernetes/json\-schema@.*$</packageUrl>
         <cpe>cpe:/a:kubernetes:kubernetes</cpe>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+        This CVE has been resolved by not using the vulnerable constructor and by updating all dependencies that use SnakeYAML to versions that also do not use the vulnerable constructor.
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
+        <vulnerabilityName>CVE-2022-1471</vulnerabilityName>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+        This CVE is in dispute for the very reason that it does not apply to us. We do not use databind for processing protocol data, but use it to write our own objects.
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson-databind@.*$</packageUrl>
+        <vulnerabilityName>CVE-2023-35116</vulnerabilityName>
+    </suppress>
 </suppressions>

pom.xml

@@ -292,7 +292,7 @@
         <configuration>
           <skip>${skip.dependency-check}</skip>
           <skipTestScope>true</skipTestScope>
-          <failBuildOnAnyVulnerability>false</failBuildOnAnyVulnerability>
+          <failBuildOnCVSS>0</failBuildOnCVSS>
           <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
           <formats>
             <format>HTML</format>