From 88f8a7a1bf93f02b13852b59739c8b5a0eff5066 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicol=C3=B2=20Boschi?= <boschi1997@gmail.com>
Date: Wed, 9 Mar 2022 18:26:14 +0100
Subject: [PATCH 1/3] [owasp] Supress ZooKeeper 3.8.0 vulnerabilities

---
 src/owasp-dependency-check-suppressions.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/owasp-dependency-check-suppressions.xml b/src/owasp-dependency-check-suppressions.xml
index 08edea57095d5..d208d21eb7767 100644
--- a/src/owasp-dependency-check-suppressions.xml
+++ b/src/owasp-dependency-check-suppressions.xml
@@ -37,8 +37,8 @@
         <vulnerabilityName regex="true">.*</vulnerabilityName>
     </suppress>
     <suppress>
-        <notes>Suppress Zookeeper 3.6.2 vulnerabilities</notes>
-        <gav regex="true">org\.apache\.zookeeper:.*:3\.6\.2</gav>
+        <notes>Suppress Zookeeper 3.8.0 vulnerabilities</notes>
+        <gav regex="true">org\.apache\.zookeeper:.*:3\.8\.0</gav>
         <vulnerabilityName regex="true">.*</vulnerabilityName>
     </suppress>
 

From c66f7effda5b13574d62e59008926b82afc25619 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicol=C3=B2=20Boschi?= <boschi1997@gmail.com>
Date: Wed, 9 Mar 2022 22:15:19 +0100
Subject: [PATCH 2/3] specific suppressions

---
 ...owasp-dependency-check-false-positives.xml | 64 +++++++++++++++++++
 src/owasp-dependency-check-suppressions.xml   |  5 --
 2 files changed, 64 insertions(+), 5 deletions(-)

diff --git a/src/owasp-dependency-check-false-positives.xml b/src/owasp-dependency-check-false-positives.xml
index 7b945a2bbc9ec..85a8cc4c9c156 100644
--- a/src/owasp-dependency-check-false-positives.xml
+++ b/src/owasp-dependency-check-false-positives.xml
@@ -59,4 +59,68 @@
     <packageUrl regex="true">^pkg:maven/io\.netty/netty\-tcnative\-classes@.*$</packageUrl>
     <cpe>cpe:/a:netty:netty</cpe>
   </suppress>
+  <suppress>
+    <notes><![CDATA[
+   file name: zookeeper-3.8.0.jar
+   ]]></notes>
+    <sha1>e395c1d8a71557b7569cc6a83487b2e30e2e58fe</sha1>
+    <cve>CVE-2021-28164</cve>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[
+   file name: zookeeper-3.8.0.jar
+   ]]></notes>
+    <sha1>e395c1d8a71557b7569cc6a83487b2e30e2e58fe</sha1>
+    <cve>CVE-2021-29425</cve>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[
+   file name: zookeeper-3.8.0.jar
+   ]]></notes>
+    <sha1>e395c1d8a71557b7569cc6a83487b2e30e2e58fe</sha1>
+    <cve>CVE-2021-34429</cve>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[
+   file name: zookeeper-prometheus-metrics-3.8.0.jar
+   ]]></notes>
+    <sha1>849e8ece2845cb0185d721233906d487a7f1e4cf</sha1>
+    <cve>CVE-2021-28164</cve>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[
+   file name: zookeeper-prometheus-metrics-3.8.0.jar
+   ]]></notes>
+    <sha1>849e8ece2845cb0185d721233906d487a7f1e4cf</sha1>
+    <cve>CVE-2021-29425</cve>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[
+   file name: zookeeper-prometheus-metrics-3.8.0.jar
+   ]]></notes>
+    <sha1>849e8ece2845cb0185d721233906d487a7f1e4cf</sha1>
+    <cve>CVE-2021-34429</cve>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[
+   file name: zookeeper-jute-3.8.0.jar
+   ]]></notes>
+    <sha1>6560f966bcf1aa78d27bcfa75fb6c4463a72c6c5</sha1>
+    <cve>CVE-2021-28164</cve>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[
+   file name: zookeeper-jute-3.8.0.jar
+   ]]></notes>
+    <sha1>6560f966bcf1aa78d27bcfa75fb6c4463a72c6c5</sha1>
+    <cve>CVE-2021-29425</cve>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[
+   file name: zookeeper-jute-3.8.0.jar
+   ]]></notes>
+    <sha1>6560f966bcf1aa78d27bcfa75fb6c4463a72c6c5</sha1>
+    <cve>CVE-2021-34429</cve>
+  </suppress>
+
 </suppressions>
\ No newline at end of file
diff --git a/src/owasp-dependency-check-suppressions.xml b/src/owasp-dependency-check-suppressions.xml
index d208d21eb7767..4cad4aa01de6c 100644
--- a/src/owasp-dependency-check-suppressions.xml
+++ b/src/owasp-dependency-check-suppressions.xml
@@ -36,11 +36,6 @@
         <gav>org.apache.thrift:libthrift:0.12.0</gav>
         <vulnerabilityName regex="true">.*</vulnerabilityName>
     </suppress>
-    <suppress>
-        <notes>Suppress Zookeeper 3.8.0 vulnerabilities</notes>
-        <gav regex="true">org\.apache\.zookeeper:.*:3\.8\.0</gav>
-        <vulnerabilityName regex="true">.*</vulnerabilityName>
-    </suppress>
 
     <!-- see https://github.com/alibaba/canal/issues/4010 -->
     <suppress>

From c5054eed90f006b6587aa5d7475fa5e62c6818e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicol=C3=B2=20Boschi?= <boschi1997@gmail.com>
Date: Wed, 16 Mar 2022 10:58:03 +0100
Subject: [PATCH 3/3] add comment

---
 src/owasp-dependency-check-false-positives.xml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/owasp-dependency-check-false-positives.xml b/src/owasp-dependency-check-false-positives.xml
index 85a8cc4c9c156..e508e1c8a5cc7 100644
--- a/src/owasp-dependency-check-false-positives.xml
+++ b/src/owasp-dependency-check-false-positives.xml
@@ -60,6 +60,8 @@
     <cpe>cpe:/a:netty:netty</cpe>
   </suppress>
   <suppress>
+<!--    Zookkeeper false positive about Jetty and commons-io-->
+<!--    https://github.com/apache/zookeeper/pull/1824-->
     <notes><![CDATA[
    file name: zookeeper-3.8.0.jar
    ]]></notes>