natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update OWASP dependency-check to 12.1.6, suppress unrelevant CVEs 

patch by Stefan Miklosovic; reviewed by Brandon Williams for CASSANDRA-20924
This commit is contained in:
Stefan Miklosovic 2025-09-26 14:34:39 +02:00
parent 90f231ad56
commit 0026c0dc4c
No known key found for this signature in database
GPG Key ID: 32F35CB2F546D93E
3 changed files with 35 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.build/build-owasp.xml
View File

@ -19,7 +19,7 @@
<project basedir="." name="apache-cassandra-owasp-tasks" <project basedir="." name="apache-cassandra-owasp-tasks"
xmlns:unless="ant:unless" xmlns:unless="ant:unless"
xmlns:if="ant:if"> xmlns:if="ant:if">
<property name="dependency-check.version" value="12.1.0"/> <property name="dependency-check.version" value="12.1.6"/>
<property name="dependency-check.home" value="${tmp.dir}/dependency-check-ant-${dependency-check.version}"/> <property name="dependency-check.home" value="${tmp.dir}/dependency-check-ant-${dependency-check.version}"/>
<property name="dependency-check.archive.dir" value="${local.repository}/org/owasp/dependency-check-ant/${dependency-check.version}"/> <property name="dependency-check.archive.dir" value="${local.repository}/org/owasp/dependency-check-ant/${dependency-check.version}"/>
<property name="dependency-check.archive.name" value="dependency-check-ant-${dependency-check.version}-release.zip"/> <property name="dependency-check.archive.name" value="dependency-check-ant-${dependency-check.version}-release.zip"/>

16
.build/dependency-check-suppressions.xml
View File

@ -39,18 +39,24 @@
</suppress> </suppress>
<!-- netty's http stuff is not applicable here --> <!-- netty's http stuff is not applicable here -->
<suppress> <suppress>
<packageUrl regex="true">^pkg:maven/io\.netty/netty\-all@.*$</packageUrl> <packageUrl regex="true">^pkg:maven/io\.netty/netty\-.*@.*$</packageUrl>
<cve>CVE-2021-21290</cve> <cve>CVE-2021-21290</cve>
<cve>CVE-2021-21295</cve> <cve>CVE-2021-21295</cve>
<cve>CVE-2021-21409</cve> <cve>CVE-2021-21409</cve>
<cve>CVE-2022-24823</cve>
<cve>CVE-2025-24970</cve>
<cve>CVE-2025-25193</cve>
<cve>CVE-2024-29025</cve>
<cve>CVE-2023-34462</cve>
<cve>CVE-2021-37136</cve> <cve>CVE-2021-37136</cve>
<cve>CVE-2021-37137</cve> <cve>CVE-2021-37137</cve>
<cve>CVE-2021-43797</cve>
<cve>CVE-2022-24823</cve>
<cve>CVE-2022-41881</cve> <cve>CVE-2022-41881</cve>
<cve>CVE-2023-34462</cve> <cve>CVE-2021-43797</cve>
<cve>CVE-2023-44487</cve> <cve>CVE-2023-44487</cve>
<cve>CVE-2025-25193</cve> <cve>CVE-2024-47535</cve>
<cve>CVE-2025-55163</cve>
<cve>CVE-2025-58056</cve>
<cve>CVE-2025-58057</cve>
</suppress> </suppress>
<!-- https://issues.apache.org/jira/browse/CASSANDRA-19142 --> <!-- https://issues.apache.org/jira/browse/CASSANDRA-19142 -->

34
.snyk
View File

@ -5,21 +5,21 @@ ignore:
CVE-2020-8908: CVE-2020-8908:
- reason: not applicable https://nvd.nist.gov/vuln/detail/CVE-2020-8908 -- ^pkg:maven/com\.google\.guava/guava@.*$ - reason: not applicable https://nvd.nist.gov/vuln/detail/CVE-2020-8908 -- ^pkg:maven/com\.google\.guava/guava@.*$
CVE-2021-21290: CVE-2021-21290:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2021-21295: CVE-2021-21295:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2021-21409: CVE-2021-21409:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2021-37136: CVE-2021-37136:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2021-37137: CVE-2021-37137:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2021-43797: CVE-2021-43797:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2022-1471: CVE-2022-1471:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$ - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-24823: CVE-2022-24823:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2022-25857: CVE-2022-25857:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$ - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-38749: CVE-2022-38749:
@ -33,18 +33,30 @@ ignore:
CVE-2022-41854: CVE-2022-41854:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$ - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-41881: CVE-2022-41881:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2023-2976: CVE-2023-2976:
- reason: not applicable https://nvd.nist.gov/vuln/detail/CVE-2020-8908 -- ^pkg:maven/com\.google\.guava/guava@.*$ - reason: not applicable https://nvd.nist.gov/vuln/detail/CVE-2020-8908 -- ^pkg:maven/com\.google\.guava/guava@.*$
CVE-2023-34462: CVE-2023-34462:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2023-44487: CVE-2023-44487:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2023-6378: CVE-2023-6378:
- reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml - reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
CVE-2024-12798: CVE-2024-12798:
- reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml - reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
CVE-2024-12801: CVE-2024-12801:
- reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml - reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
CVE-2024-29025:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2024-47535:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2025-24970:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2025-25193: CVE-2025-25193:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2025-55163:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2025-58056:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2025-58057:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-.*@.*$