OF-2725: Update dependency-check, and deal with the results #2331

Fishbowler · 2023-11-13T16:15:29Z

OF-2725 updates dependency-check-maven to 8.4.2, then adds suppressions for known false positives

OF-2726 updates dom4j to 2.1.4

OF-2727 updates mysql-connector-j to 8.2.0

Notes:

Remaining CVEs are all against org.mortbay.jasper/[email protected] which is a dependency of Jetty 10. I've suppressed the obvious/easy ones, but suspect we're vulnerable to zero.
There might be other out of date dependencies that weren't flagged. I've not looked.

Fishbowler added 13 commits November 13, 2023 14:14

OF-2725: Update dependency-check to 8.4.2

0875531

OF-2725: Add suppression for a false positive CVE for Jetty

25c0cea

OF-2725: Add a suppression for a retracted CVE for dom4j

c17ad69

OF-2726: Update dom4j from 2.1.3 to 2.1.4

7a9be76

OF-2727: Update mysql-connector-j from 8.0.32 to 8.2.0

38837ee

OF-2725: Add suppression for false positives on jetty-servlet-api

d9e4efc

OF-2725: Suppress CVE related to to Tomcat clustering

c75b2fe

OF-2725: Suppress Rapid Reset false positive

e575a64

OF-2725: Suppress CVE related to Tomcat persisted sessions

83a9f98

OF-2725: Suppress CVE related to a Tomcat shipped example app

e385831

OF-2725: Suppress CVE related to ROOT webapp in Tomcat

7be3eea

OF-2727: Update the tests to mysql-connector-j too

36a4340

guusdk self-requested a review November 13, 2023 17:39

guusdk approved these changes Nov 13, 2023

View reviewed changes

guusdk merged commit 4e7d866 into igniterealtime:main Nov 13, 2023
16 checks passed

Fishbowler deleted the OF-2725_update-dependency-check branch November 13, 2023 21:03

Provide feedback