Skip to content

[cleanup][owasp] Supress false positive netty-tcnative - #17282

Merged
eolivelli merged 2 commits into
apache:masterfrom
nicoloboschi:owasp-suppress-netty-tc
Aug 29, 2022
Merged

[cleanup][owasp] Supress false positive netty-tcnative#17282
eolivelli merged 2 commits into
apache:masterfrom
nicoloboschi:owasp-suppress-netty-tc

Conversation

@nicoloboschi

Copy link
Copy Markdown
Contributor

Motivation

Owasp check fails with

One or more dependencies were identified with known vulnerabilities in Pulsar :: Distribution :: Server:

netty-tcnative-boringssl-static-2.0.52.Final-osx-x86_64.jar (pkg:maven/io.netty/netty-tcnative-boringssl-static@2.0.52.Final, cpe:2.3:a:chromium_project:chromium:2.0.52:*:*:*:*:*:*:*) : CVE-2011-1797

It's clearly a false positive jeremylong/DependencyCheck#4776

Modifications

  • Suppress the violation
  • doc-not-needed

@tisonkun tisonkun left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

It seems this FP has been resolved on upstream jeremylong/DependencyCheck#4154 but it suffers a regression.

@github-actions github-actions Bot added the doc-not-needed Your PR changes do not impact docs label Aug 25, 2022
Comment thread src/owasp-dependency-check-false-positives.xml
@tisonkun

Copy link
Copy Markdown
Member

cc @codelipenghui @eolivelli we can merge this patch and unblock other patches touching dependencies.

@eolivelli eolivelli left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1

@eolivelli
eolivelli merged commit 409bb12 into apache:master Aug 29, 2022
@Technoboy- Technoboy- added this to the 2.11.0 milestone Aug 29, 2022
nicoloboschi added a commit to datastax/pulsar that referenced this pull request Aug 30, 2022
Jason918 pushed a commit that referenced this pull request Sep 20, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants