From e0e63f44155a00a540407b402a6cae8480aa2c32 Mon Sep 17 00:00:00 2001
From: Brandon Williams <brandonwilliams@apache.org>
Date: Thu, 12 Jan 2023 12:39:09 -0600
Subject: [PATCH] Suppress CVE-2021-37533

Patch by brandonwilliams; reviewed by bereng for CASSANDRA-18146
---
 .build/dependency-check-suppressions.xml | 18 ++++++++++++++++++
 CHANGES.txt                              |  1 +
 2 files changed, 19 insertions(+)

diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
index d9eea56920..3717985c95 100644
--- a/.build/dependency-check-suppressions.xml
+++ b/.build/dependency-check-suppressions.xml
@@ -74,6 +74,24 @@
         <cve>CVE-2020-8908</cve>
     </suppress>
 
+    <!-- https://issues.apache.org/jira/browse/CASSANDRA-18146 -->
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/org\.apache\.commons.*$</packageUrl>
+        <cve>CVE-2021-37533</cve>
+    </suppress>
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/commons-io/.*$</packageUrl>
+        <cve>CVE-2021-37533</cve>
+    </suppress>
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/commons-cli/.*$</packageUrl>
+        <cve>CVE-2021-37533</cve>
+    </suppress>
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/commons-codec/.*$</packageUrl>
+        <cve>CVE-2021-37533</cve>
+    </suppress>
+
     <!-- https://issues.apache.org/jira/browse/CASSANDRA-16606 -->
     <suppress>
         <packageUrl regex="true">^pkg:maven/org\.apache\.thrift/libthrift@.*$</packageUrl>
diff --git a/CHANGES.txt b/CHANGES.txt
index 41e67079fb..eae6441f83 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,4 +1,5 @@
 3.0.29
+ * Suppress CVE-2021-37533 (CASSANDRA-18146)
  * Add to the IntelliJ Git Window issue navigation links to Cassandra's Jira (CASSANDRA-18126)
  * Avoid anticompaction mixing data from two different time windows with TWCS (CASSANDRA-17970)
  * Do not spam the logs with MigrationCoordinator not being able to pull schemas (CASSANDRA-18096)