Skip to content

Commit 34e845b

Browse files
albin-mullvadalbin-mullvad
committed
Merge branch 'update-android-supressions'
2 parents c235dfc + c33f890 commit 34e845b

File tree

2 files changed

+1
-152
lines changed

2 files changed

+1
-152
lines changed

‎android/config/dependency-check-suppression.xml

+1-43
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3-
<suppress until="2024-05-01Z">
4-
<notes><![CDATA[
5-
This CVE only part of the debugAndroidTestRuntimeClasspath so suppressing in automatic
6-
checks and tracking externally.
7-
8-
File name: guava-28.2-android.jar
9-
]]></notes>
10-
<packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@.*$</packageUrl>
11-
<cve>CVE-2020-8908</cve>
12-
</suppress>
13-
<suppress until="2024-03-01Z">
14-
<notes><![CDATA[
15-
This CVE only part of the debugAndroidTestRuntimeClasspath so suppressing in automatic
16-
checks and tracking externally.
17-
18-
Fix released in: https://github.com/google/guava/releases/tag/v32.0.0
19-
20-
File name: guava-28.2-android.jar
21-
]]></notes>
22-
<packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@.*$</packageUrl>
23-
<cve>CVE-2023-2976</cve>
24-
</suppress>
25-
<suppress until="2024-05-01Z">
26-
<notes><![CDATA[
27-
This CVE only part of the debugAndroidTestRuntimeClasspath so suppressing in automatic
28-
checks and tracking externally.
29-
30-
File name: jsoup-1.12.2.jar
31-
]]></notes>
32-
<packageUrl regex="true">^pkg:maven/org\.jsoup/jsoup@.*$</packageUrl>
33-
<cve>CVE-2022-36033</cve>
34-
<cve>CVE-2021-37714</cve>
35-
</suppress>
36-
<suppress until="2024-05-01Z">
3+
<suppress until="2024-11-01Z">
374
<notes><![CDATA[
385
This CVE only affect Multiplatform Gradle Projects, which this project is not.
396
https://nvd.nist.gov/vuln/detail/CVE-2022-24329
@@ -68,13 +35,4 @@
6835
<packageUrl regex="true">^pkg:maven/androidx\.test\.services/storage@.*$</packageUrl>
6936
<cve>CVE-2014-9152</cve>
7037
</suppress>
71-
<suppress until="2024-05-01Z">
72-
<notes><![CDATA[
73-
Suppressing since the affected function isn't used in this project. No upstream fixes
74-
are available at the time of adding this suppression.
75-
https://nvd.nist.gov/vuln/detail/CVE-2024-23080
76-
]]></notes>
77-
<packageUrl regex="true">^pkg:maven/joda-time/joda-time@.*$</packageUrl>
78-
<cve>CVE-2024-23080</cve>
79-
</suppress>
8038
</suppressions>

‎android/test/test-suppression.xml

-109
Original file line numberDiff line numberDiff line change
@@ -1,97 +1,5 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3-
<!--
4-
CVEs in the e2e project are deemed less severe than CVEs in the main projects as CVEs in the e2e
5-
project doesn't affect release or debug versions of the app.
6-
-->
7-
<suppress until="2023-06-01Z">
8-
<notes><![CDATA[
9-
This CVE is tracked externally and is therefore suppressed in the automatic audit checks.
10-
]]></notes>
11-
<packageUrl regex="true">^pkg:maven/com\.google\.protobuf/protobuf\-java@.*$</packageUrl>
12-
<cve>CVE-2022-3171</cve>
13-
<cve>CVE-2022-3509</cve>
14-
<cve>CVE-2022-3510</cve>
15-
<cve>CVE-2021-22569</cve>
16-
</suppress>
17-
<suppress until="2023-06-01Z">
18-
<notes><![CDATA[
19-
These CVEs affects the Apache Commons Net's FTP client that this app doesn't use.
20-
https://www.openwall.com/lists/oss-security/2022/12/03/1
21-
22-
File names:
23-
- commons-beanutils-1.9.4.jar
24-
- commons-collections-3.2.2.jar
25-
- commons-digester-2.1.jar
26-
- commons-logging-1.2.jar
27-
- commons-validator-1.7.jar
28-
]]></notes>
29-
<packageUrl regex="true">^pkg:maven/commons\-.*/commons\-.*@.*$</packageUrl>
30-
<cve>CVE-2021-37533</cve>
31-
</suppress>
32-
<suppress until="2023-06-01Z">
33-
<notes><![CDATA[
34-
This CVE is tracked externally and is therefore suppressed in the automatic audit checks.
35-
https://nvd.nist.gov/vuln/detail/CVE-2021-29425
36-
37-
File name: commons-io-2.4.jar
38-
]]></notes>
39-
<packageUrl regex="true">^pkg:maven/commons\-io/commons\-io@.*$</packageUrl>
40-
<cve>CVE-2021-29425</cve>
41-
</suppress>
42-
<suppress until="2023-06-01Z">
43-
<notes><![CDATA[
44-
These CVEs are tracked externally and is therefore suppressed in the automatic audit checks.
45-
]]></notes>
46-
<packageUrl regex="true">^pkg:maven/io\.netty/netty\-.*@.*$</packageUrl>
47-
<cve>CVE-2021-37136</cve>
48-
<cve>CVE-2021-37137</cve>
49-
<cve>CVE-2021-43797</cve>
50-
<cve>CVE-2021-21295</cve>
51-
<cve>CVE-2021-21409</cve>
52-
<cve>CVE-2021-21290</cve>
53-
<cve>CVE-2022-24823</cve>
54-
<cve>CVE-2022-41881</cve>
55-
<cve>CVE-2022-41915</cve>
56-
</suppress>
57-
<suppress until="2023-06-01Z">
58-
<notes><![CDATA[
59-
This CVE is tracked externally and is therefore suppressed in the automatic audit checks.
60-
https://nvd.nist.gov/vuln/detail/CVE-2022-25647
61-
62-
File name: gson-2.8.6.jar
63-
]]></notes>
64-
<packageUrl regex="true">^pkg:maven/com\.google\.code\.gson/gson@.*$</packageUrl>
65-
<cve>CVE-2022-25647</cve>
66-
</suppress>
67-
<suppress until="2023-06-01Z">
68-
<notes><![CDATA[
69-
This CVE only affect Multiplatform Gradle Projects, which this project is not.
70-
https://nvd.nist.gov/vuln/detail/CVE-2022-24329
71-
]]></notes>
72-
<packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin\-stdlib.*@.*$</packageUrl>
73-
<cve>CVE-2022-24329</cve>
74-
</suppress>
75-
<suppress until="2023-06-01Z">
76-
<notes><![CDATA[
77-
This CVE is limited to processing of screenshots, which this app doesn't use.
78-
https://nvd.nist.gov/vuln/detail/CVE-2021-4277
79-
80-
File name: legacy-support-core-utils-1.0.0.aar
81-
]]></notes>
82-
<packageUrl regex="true">^pkg:maven/androidx\.legacy/legacy\-support\-core\-utils@.*$</packageUrl>
83-
<cve>CVE-2021-4277</cve>
84-
</suppress>
85-
<suppress until="2023-06-01Z">
86-
<notes><![CDATA[
87-
This CVE is limited to processing of screenshots, which this app doesn't use.
88-
https://nvd.nist.gov/vuln/detail/CVE-2021-4277
89-
90-
File name: common-30.3.1.jar
91-
]]></notes>
92-
<packageUrl regex="true">^pkg:maven/com\.android\.tools/common@.*$</packageUrl>
93-
<cve>CVE-2021-4277</cve>
94-
</suppress>
953
<suppress until="2024-06-01Z">
964
<notes><![CDATA[
975
This CVE only affect the leakCanary build type which is limited to memory leak testing etc.
@@ -102,14 +10,6 @@
10210
<packageUrl regex="true">^pkg:maven/com\.squareup\.okio/okio.*@.*$</packageUrl>
10311
<cve>CVE-2023-3635</cve>
10412
</suppress>
105-
<suppress until="2023-12-01Z">
106-
<notes><![CDATA[
107-
This CVE only affect certain test cases so suppressing until patched.
108-
https://nvd.nist.gov/vuln/detail/CVE-2023-3782
109-
]]></notes>
110-
<packageUrl regex="true">^pkg:maven/com\.squareup\.okhttp3/.*@.*$</packageUrl>
111-
<cve>CVE-2023-3782</cve>
112-
</suppress>
11313
<suppress until="2024-09-01Z">
11414
<notes><![CDATA[
11515
False-positive related to Drupal rather than Android development.
@@ -118,13 +18,4 @@
11818
<packageUrl regex="true">^pkg:maven/androidx\.test\.services/storage@.*$</packageUrl>
11919
<cve>CVE-2014-9152</cve>
12020
</suppress>
121-
<suppress until="2024-05-01Z">
122-
<notes><![CDATA[
123-
Suppressing since the affected function isn't used in this project. No upstream fixes
124-
are available at the time of adding this suppression.
125-
https://nvd.nist.gov/vuln/detail/CVE-2024-23080
126-
]]></notes>
127-
<packageUrl regex="true">^pkg:maven/joda-time/joda-time@.*$</packageUrl>
128-
<cve>CVE-2024-23080</cve>
129-
</suppress>
13021
</suppressions>

0 commit comments

Comments
 (0)