CODEWITHSUNDEEP
javamavenowasp
Matthias
Matthias

Reputation: 7521

Suppress OWASP findings for JAR in certain dependency

The dependency-check-maven plugin correctly lists the following issue:

swagger-codegen-generators-1.0.19.jar: gradle-wrapper.jar: CVE-2016-6199, CVE-2019-16370, CVE-2019-11065, CVE-2019-15052

Anyway, I want to suppress the CVEs for gradle-wrapper.jar within swagger-codegen-generators-1.0.19.jar.

What I have tried so far:

<!-- works, but does not restrict to swagger-codegen-generators dependency -->
<suppress>
  <filePath regex="true">.*\bgradle-wrapper\.jar</filePath>
  <cve>CVE-2016-6199</cve>
  <cve>CVE-2019-11065</cve>
  <cve>CVE-2019-15052</cve>
  <cve>CVE-2019-16370</cve>
</suppress>

<!-- does not match, due to other ignored CVEs the gav seems to be correct -->
<suppress>
  <gav regex="true">^io\.swagger\.codegen\.v3:swagger-codegen-generators:.*$</gav>
  <cve>CVE-2016-6199</cve>
  <cve>CVE-2019-11065</cve>
  <cve>CVE-2019-15052</cve>
  <cve>CVE-2019-16370</cve>
</suppress>

<!-- generated from the report; works, but does not restrict to swagger-codegen-generators dependency (sha1 of gradle-wrapper.jar) -->
<suppress>
  <notes><![CDATA[
    file name: swagger-codegen-generators-1.0.19.jar: gradle-wrapper.jar
  ]]></notes>
  <sha1>0f6f1fa2b59ae770ca14f975726bed8d6620ed9b</sha1>
  <cve>CVE-2016-6199</cve>
  <cve>CVE-2019-11065</cve>
  <cve>CVE-2019-15052</cve>
  <cve>CVE-2019-16370</cve>
</suppress>

Upvotes: 1

Views: 2055

Answers (1)

Matthias
Matthias

Reputation: 7521

I was able to describe it over the file path that I got from the report file target/dependency-check-report.html.

<suppress>
  <filePath regex="true">.*\bswagger-codegen-generators.*\bgradle-wrapper\.jar</filePath>
  <cve>CVE-2016-6199</cve>
  <cve>CVE-2019-11065</cve>
  <cve>CVE-2019-15052</cve>
  <cve>CVE-2019-16370</cve>
</suppress>

Upvotes: 1

Related Questions