[owasp] Suppress ZooKeeper 3.8.0 vulnerabilities

[nicoloboschi]

Motivation

After the ZK upgrade the OWASP check fails because ZK has known vulnerability. The owasp suppression aims ZK 3.6.2.

Modifications

• Edited the ZK suppression to 3.8.0

• no-need-doc

[lhotari]

Would it be possible to target specific vulnerabilities? Ignoring all would cause it to ignore all new vulnerabilities too.

[eolivelli]

We released 3.8.0 last week and the owasp checker passed (I actually cancelled one RC due to a owasp check failure)

I am not aware of any security issue in ZooKeeper

Please explain more

[eolivelli]

We should remove that exclusion at all.

There is no reported CVE against Apache ZooKeeper 3.8.0

[nicoloboschi]

I get this output

zookeeper-3.8.0.jar (pkg:maven/org.apache.zookeeper/zookeeper@3.8.0, cpe:2.3:a:apache:zookeeper:3.8.0:*:*:*:*:*:*:*) : CVE-2021-28164, CVE-2021-29425, CVE-2021-34429
zookeeper-prometheus-metrics-3.8.0.jar (pkg:maven/org.apache.zookeeper/zookeeper-prometheus-metrics@3.8.0, cpe:2.3:a:apache:zookeeper:3.8.0:*:*:*:*:*:*:*, cpe:2.3:a:prometheus:prometheus:3.8.0:*:*:*:*:*:*:*) : CVE-2021-28164, CVE-2021-29425, CVE-2021-34429

For example
https://nvd.nist.gov/vuln/detail/CVE-2021-34429#match-7614933
https://nvd.nist.gov/vuln/detail/CVE-2021-28164#match-7615085

[nicoloboschi]

I checked and ZK doesn't contain the mentioned libraries. I don't know how it is the process for that but is a ZooKeeper problem.
I will highlight the problem to the ZooKeeper maintainers (or @eolivelli I'll let you proceed if you want)

For now I think we can keep the specific vulnerabilities; actually they are wrong (at a first glance at the ZK repo) so it makes sense to suppress them. btw they are already suppressed now, this will unblock the CI

[eolivelli]

in the ZK project we added these exclusions due to false positives:
apache/zookeeper@3004c90

<suppress>
      <!-- Seems like false positives about zookeeper-jute -->
      <cve>CVE-2021-29425</cve>
      <cve>CVE-2021-28164</cve>
      <cve>CVE-2021-34429</cve>
   </suppress>

So it is fine to add the same exclusions here

[eolivelli]

the approach is good to me, I left some comments

[nicoloboschi]

/pulsarbot rerun-failure-checks

[nicoloboschi]

/pulsarbot rerun-failure-checks

[nicoloboschi]

/pulsarbot rerun-failure-checks