dependency-check-suppression.xml

<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
<!-- For information see https://jeremylong.github.io/DependencyCheck/general/suppression.html -->

<!-- This CVE is against the etcd server. We use the Java client
-->
<suppress>
   <notes><![CDATA[
   file name: etcd4j-2.17.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.mousio/etcd4j@.*$</packageUrl>
   <cpe>cpe:/a:etcd:etcd</cpe>
</suppress>

<!-- GraalVM -->
<!-- This suppresses multiple JDK CVEs related to running untrusted Java code.
     These do not apply to Helidon's use of Java/GraalVM.
-->
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21248</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21271</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21277</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21282</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21283</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21291</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21293</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21294</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21296</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21299</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21305</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21340</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21341</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21349</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21360</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21365</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: graal-sdk-21.3.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\..*/.*@.*$</packageUrl>
   <cve>CVE-2022-21366</cve>
</suppress>

<!-- grpc -->
<!-- This was applying the version of opentracing-grpc to grpc
     which triggered CVEs for older versions of grpc and grpc-js
-->
<suppress>
   <notes><![CDATA[
   file name: opentracing-grpc-0.2.1.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.opentracing\.contrib/opentracing\-grpc@.*$</packageUrl>
   <cpe>cpe:/a:grpc:grpc</cpe>
</suppress>


<!-- This CVE is against Neo4j through 3.4.18. We use Neo4j 4.x
     Helidon's Neo4j integration triggered a false positive due to it's 
     version being < 3.4.18
-->
<suppress>
   <notes><![CDATA[
   file name: io.helidon.integrations.neo4j:helidon-integrations-neo4j:2.4.0-SNAPSHOT
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.helidon\.integrations\.neo4j/helidon\-integrations\-neo4j@.*$</packageUrl>
   <cve>CVE-2021-34371</cve>
</suppress>

<!-- Neo4j driver bundles some netty components. This CVE "only impacts applications
     running on Java version 6". We require Java 11 or newer.
     Helidon's Netty version has already been upgraded to 4.1.77.Final (or newer) which does
     not contain this CVE.
-->
<suppress>
   <notes><![CDATA[
   file name: neo4j-java-driver-4.4.3.jar (shaded: io.netty:netty-transport:4.1.73.Final)
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.netty/netty\-.*@4.1.73.Final$</packageUrl>
   <cve>CVE-2022-24823</cve>
</suppress>

<!-- These files are being detected as an old version of Netty and raises false positives for
     a number of old Netty CVEs.
-->
<suppress>
   <notes><![CDATA[
   file name: netty-incubator-transport-native-io_uring-0.0.8.Final-linux-x86_64.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.netty\.incubator/netty\-incubator\-transport\-native\-io_uring@.*$</packageUrl>
   <cpe>cpe:/a:netty:netty</cpe>
</suppress>

<!-- This package was being detected as an old version of com.google.code.gson:gson. The version 
     of com.google.cod.gson:gson that is brought in transitively is 2.8.9 which does not 
     contain this CVE.
-->
<suppress>
   <notes><![CDATA[
   file name: google-http-client-gson-1.41.8.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.google\.http\-client/google\-http\-client\-gson@.*$</packageUrl>
   <cve>CVE-2022-25647</cve>
</suppress>

<!-- False positive. This CVE is against Go-Yaml, a project we do not use.
     Scanner mistakenly identifies Helidon's Yaml support as Go-Yaml v3.
-->
<suppress>
   <notes><![CDATA[
   file name: io.helidon.config:helidon-config-yaml-mp:3.0.0-SNAPSHOT
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.helidon\.config/helidon\-config\-yaml\-mp@.*$</packageUrl>
   <cve>CVE-2022-28948</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: io.helidon.config:helidon-config-yaml:3.0.0-SNAPSHOT
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.helidon\.config/helidon\-config\-yaml@.*$</packageUrl>
   <cve>CVE-2022-28948</cve>
</suppress>

<!-- False positive. This CVE was against an older version of H2. See
     https://github.com/jeremylong/DependencyCheck/issues/4555
-->
<suppress>
   <notes><![CDATA[
   file name: h2-2.0.206.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.h2database/h2@.*$</packageUrl>
   <vulnerabilityName>CVE-2018-14335</vulnerabilityName>
</suppress>

<!-- This CVE is against micronaut's Content Type header parsing. We never use micronaut classes
     to parse the Content Type header. So this is N/A in our use of micronaut (for micronaut data).
-->
<suppress>
   <notes><![CDATA[
   file name: micronaut-core-3.1.3.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.micronaut/micronaut\-core@.*$</packageUrl>
   <vulnerabilityName>CVE-2022-21700</vulnerabilityName>
</suppress>

<!-- okhttp is a transitive fourth party dependency of Jaeger client. This CVE is considered
     by the okhttp team as not exploitable unless the class in question is used
     directly by an application (highly unlikely). See https://github.com/square/okhttp/issues/6724
     They have only fixed this in 4.9.3 and newer. We can't force upgrade due to a tangle of
     dependencies, compatibility, and issues with dependency convergence.
-->
<suppress>
   <notes><![CDATA[
   file name: okhttp-3.14.9.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.squareup\.okhttp3/okhttp@.*$</packageUrl>
   <vulnerabilityName>CVE-2021-0341</vulnerabilityName>
</suppress>

<!-- False Positive. This CVE is for an AWS patch mechanism for log4j, not log4j itself
     See  https://github.com/jeremylong/DependencyCheck/issues/4637
-->
<suppress>
   <notes><![CDATA[
   file name: log4j-api-2.17.1.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.apache\.logging\.log4j/log4j\-api@.*$</packageUrl>
   <cve>CVE-2022-33915</cve>
</suppress>

<!-- False Positive. Matching "platform" in "junit-platform-" to "fan_platform" project.
     See https://github.com/jeremylong/DependencyCheck/issues/4670
-->
<suppress>
   <notes><![CDATA[
   file name: junit-platform-commons-1.7.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.junit\.platform/junit\-platform\-commons@.*$</packageUrl>
   <cve>CVE-2022-31514</cve>
</suppress>

<!-- False Positive. Matching "pki" in "zipkin" to "pki-core" project.
     See  https://github.com/jeremylong/DependencyCheck/issues/4692
-->
<suppress>
   <notes><![CDATA[
   file name: zipkin-2.12.5.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.zipkin\.zipkin2/zipkin@.*$</packageUrl>
   <cve>CVE-2022-2393</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: zipkin-reporter-2.12.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.zipkin\.reporter2/zipkin\-reporter@.*$</packageUrl>
   <cve>CVE-2022-2393</cve>
</suppress>

<!-- False Positive. This is a CVE again Payara. This is generating a number of false positives.
     See  https://github.com/jeremylong/DependencyCheck/issues/4781 for one example
-->
<suppress>
   <notes><![CDATA[
   file name: jakarta.resource-api-2.0.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/jakarta\.resource/jakarta\.resource\-api@.*$</packageUrl>
   <cve>CVE-2022-37422</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: microprofile-jwt-auth-api-2.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.eclipse\.microprofile\.jwt/microprofile\-jwt\-auth\-api@.*$</packageUrl>
   <cve>CVE-2022-37422</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: microprofile-config-api-3.0.1.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.eclipse\.microprofile\.config/microprofile\-config\-api@.*$</packageUrl>
   <cve>CVE-2022-37422</cve>
</suppress>

<!-- False Positive. This CVE is fixed in snakeyaml-1.32 which we use, but CVE has not been updated.
     See https://github.com/jeremylong/DependencyCheck/issues/4839
-->
<suppress>
   <notes><![CDATA[
   file name: snakeyaml-1.32.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
   <vulnerabilityName>CVE-2022-38752</vulnerabilityName>
</suppress>

<!-- False Positive. This CVE is against graphql-java, not the microprofile-graphql-api
-->
<suppress>
   <notes><![CDATA[
   file name: microprofile-graphql-api-2.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.eclipse\.microprofile\.graphql/microprofile\-graphql\-api@.*$</packageUrl>
   <cve>CVE-2022-37734</cve>
</suppress>

<!-- False Positive. This CVE is against graphql-java, not graphql-java-extended-scalars
     See https://github.com/jeremylong/DependencyCheck/issues/4851
-->
<suppress>
   <notes><![CDATA[
   file name: graphql-java-extended-scalars-17.1.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.graphql\-java/graphql\-java\-extended\-scalars@.*$</packageUrl>
   <cve>CVE-2022-37734</cve>
</suppress>


<!-- False Positive. This CVE is against graphql-java, not java-dataloader
     See https://github.com/jeremylong/DependencyCheck/issues/4851
-->
<suppress>
   <notes><![CDATA[
   file name: java-dataloader-3.1.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.graphql\-java/java\-dataloader@.*$</packageUrl>
   <cve>CVE-2022-37734</cve>
</suppress>

<!-- False Postive. This CVE is against the kafka server. This is the kafka client
-->
<suppress>
   <notes><![CDATA[
   file name: kafka-clients-2.8.1.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.apache\.kafka/kafka\-clients@.*$</packageUrl>
   <cve>CVE-2022-34917</cve>
</suppress>


</suppressions>