Conversation
This comment has been minimized.
This comment has been minimized.
Codecov Report
@@ Coverage Diff @@
## main #437 +/- ##
============================================
+ Coverage 79.93% 79.94% +0.01%
- Complexity 1421 1422 +1
============================================
Files 128 128
Lines 5566 5566
Branches 509 509
============================================
+ Hits 4449 4450 +1
Misses 885 885
+ Partials 232 231 -1
Flags with carried forward coverage won't be shown. Click here to find out more. see 1 file with indirect coverage changes 📣 Codecov offers a browser extension for seamless coverage viewing on GitHub. Try it in Chrome or Firefox today! |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
| <packageUrl regex="true">^pkg:maven/io\.netty/netty.*@.*$</packageUrl> | ||
| <vulnerabilityName>CVE-2023-4586</vulnerabilityName> | ||
| </suppress> | ||
| <suppress until="2023-12-30Z"> |
There was a problem hiding this comment.
Please fix this rather than suppressing
There was a problem hiding this comment.
Was suppressed because there is no mitigation currently available.
https://access.redhat.com/security/cve/CVE-2023-4586
There was a problem hiding this comment.
4586 is the suppression above this one. You're correct that one can be suppressed as described in https://github.com/hypertrace/hypertrace-bom/blob/6e9d9aa4f9a9631c281df4b4c8916490d5cd39d9/owasp-suppressions.xml#L29-L40
The issue here is the newly added one, 44487 - that is the HTTP2 Rapid RST vuln and should not be suppressed. Netty*.100 contains the fix, and our latest framework libs should already include that if upgraded.
| ]]></notes> | ||
| <packageUrl regex="true">^pkg:maven/org\.json/json@.*$</packageUrl> | ||
| <cve>CVE-2022-45688</cve> | ||
| <cve>CVE-2023-5072</cve> |
There was a problem hiding this comment.
Now that I look a bit more closely, this one (and its sibling 45688 above it) is also incorrectly suppressed. Both have released. fixes that should be used. They historically had a FP on older versions of the dependency check plugin, but those were resolved last month. Try removing it, upgrading the dep check plugin to latest and rerun.
3 participants
No description provided.