From d302b837b2b9a6854a98f83ecf687b08a58562fc Mon Sep 17 00:00:00 2001
From: Brandon Williams <brandonwilliams@apache.org>
Date: Wed, 5 Jul 2023 10:57:39 -0500
Subject: [PATCH] Suppress CVE-2022-45688

Patch by brandonwilliams; reviewed by bereng for CASSANDRA-18643
---
 .build/dependency-check-suppressions.xml | 6 ++++++
 CHANGES.txt                              | 1 +
 2 files changed, 7 insertions(+)

diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
index 9b10f433f7..d2825ee3fb 100644
--- a/.build/dependency-check-suppressions.xml
+++ b/.build/dependency-check-suppressions.xml
@@ -125,4 +125,10 @@
         <cve>CVE-2023-35116</cve>
     </suppress>
 
+    <!-- https://issues.apache.org/jira/browse/CASSANDRA-18643 -->
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-core@.*$</packageUrl>
+        <cve>CVE-2022-45688</cve>
+    </suppress>
+
 </suppressions>
diff --git a/CHANGES.txt b/CHANGES.txt
index 6d63392d79..44ffd6e824 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,4 +1,5 @@
 3.11.16
+ * Suppress CVE-2022-45688 (CASSANDRA-18643)
  * Remove unrepaired SSTables from garbage collection when only_purge_repaired_tombstones is true (CASSANDRA-14204)
  * Wait for live endpoints in gossip waiting to settle (CASSANDRA-18543)
  * Fix error message handling when trying to use CLUSTERING ORDER with non-clustering column (CASSANDRA-17818