/
suppression.xml
61 lines (61 loc) · 2.26 KB
/
suppression.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.1.xsd">
<suppress>
<notes><![CDATA[
file name: re-frame-0.10.5.jar
]]></notes>
<gav regex="true">^re-frame:re-frame:.*$</gav>
<cpe>cpe:/a:git_project:git</cpe>
</suppress>
<suppress>
<notes><![CDATA[
file name: re-frame-0.10.5.jar
]]></notes>
<gav regex="true">^re-frame:re-frame:.*$</gav>
<cpe>cpe:/a:git:git</cpe>
</suppress>
<suppress>
<notes><![CDATA[
file name: closure-compiler-unshaded-v20180204.jar
]]></notes>
<gav regex="true">^com\.google\.javascript:closure-compiler-unshaded:.*$</gav>
<cpe>cpe:/a:google:google_apps</cpe>
</suppress>
<suppress>
<notes><![CDATA[
file name: closure-compiler-unshaded-v20180610.jar
]]></notes>
<gav regex="true">^com\.google\.javascript:closure-compiler-unshaded:.*$</gav>
<cpe>cpe:/a:google:gmail</cpe>
</suppress>
<suppress>
<notes><![CDATA[
Suppress CVE in google-closure-library that we shouldn't be vulnerable to and that is a transitive dependency of closurescript that hasn't updated this yet. Recheck in a few months if things have improved upstream.
]]></notes>
<cve>CVE-2020-8910</cve>
</suppress>
<suppress>
<notes><![CDATA[
This CVE is related to the C# version of MessagePack, we are not affected by it.
]]></notes>
<cve>CVE-2020-5234</cve>
</suppress>
<suppress>
<notes><![CDATA[
This CVE is related to Apache HTTP Components which are a transitive dependency to make cljs-ajax work on clj as well - we aren't using it this way so aren't affected.
]]></notes>
<cve>CVE-2020-13956</cve>
</suppress>
<suppress>
<notes><![CDATA[
This is a low-severity issue relating to permissions of temp-files created by Guava. Guava is only used by the clojurescript build so this shouldn't have any effect on lambdacd users
]]></notes>
<cve>CVE-2020-8908</cve>
</suppress>
<suppress>
<notes><![CDATA[
This is an issue in rust-cache, a false positive.
]]></notes>
<cve>CVE-2020-36448</cve>
</suppress>
</suppressions>