diff --git a/owasp-suppressions.xml b/owasp-suppressions.xml new file mode 100644 index 0000000000000000000000000000000000000000..1fd2d48f441fcd20ee0aaf5ad3b7d82a5482d2ac --- /dev/null +++ b/owasp-suppressions.xml @@ -0,0 +1,7 @@ +<?xml version="1.0" encoding="utf-8"?> +<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd"> + <suppress> + <notes>It seems that only versions before 2.2.35 are effected. Additionally, csw2dcat does not make use of values in HTTP headers.</notes> + <cve>CVE-2024-4109</cve> + </suppress> +</suppressions> diff --git a/pom.xml b/pom.xml index 07cf7a142178f2903ad6ebc4a7d3db15a5937db4..fbff4b760805ef20c68b6a236f50b00224670614 100644 --- a/pom.xml +++ b/pom.xml @@ -179,6 +179,9 @@ <artifactId>dependency-check-maven</artifactId> <version>12.1.0</version> <configuration> + <suppressionFiles> + <suppressionFile>owasp-suppressions.xml</suppressionFile> + </suppressionFiles> <failBuildOnCVSS>8</failBuildOnCVSS> <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled> <failOnError>true</failOnError>