Skip to content

Commit 910dee8

Browse files
brjeterstustison
authored andcommitted
DDF-4087 Suppressing jetty CVEs that don't apply to DDF (codice#3653)
Failing CI for unrelated cause.
1 parent 6a8f3a8 commit 910dee8

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

dependency-check-maven-config.xml

+10
Original file line numberDiff line numberDiff line change
@@ -513,6 +513,16 @@
513513
<cve>CVE-2018-1270</cve>
514514
<cve>CVE-2018-1275</cve>
515515
</suppress>
516+
517+
<suppress>
518+
<notes>
519+
These CVEs affect Jetty 9.3.x up to 9.3.23 and 9.4.x up to 9.4.10. DDF is using a
520+
version of jetty that does not fall within those ranges.
521+
</notes>
522+
<cve>CVE-2017-7658</cve>
523+
<cve>CVE-2017-7657</cve>
524+
</suppress>
525+
516526
<suppress>
517527
<notes><![CDATA[
518528
Nearly all of these are not an issue because either we are not using those features entirely or (and in addition to the fact) that solr is now running as an external process and completely locked down, so no one could access solr to take advantage of these vulnerabilites. All communication is controlled by DDF.

0 commit comments

Comments
 (0)