CIV-9876 Cleanup CVE issues (#3064)

hmcts · Jul 31, 2023 · 9281fde · 9281fde
1 parent 85931bf
commit 9281fde
Showing 1 changed file with 3 additions and 20 deletions.
diff --git a/config/owasp/suppressions.xml b/config/owasp/suppressions.xml
@@ -14,40 +14,23 @@
     <notes>Temporarily suppressing it as the latest camunda connector 1.5.6 seem to have the vulnerability.</notes>
     <cve>CVE-2021-37533</cve>
   </suppress>
-  <suppress until="2023-06-05">
-    <cve>CVE-2021-4277</cve>
-    <cve>CVE-2022-3064</cve>
-    <cve>CVE-2021-4235</cve>
-  </suppress>
   <suppress until="2023-10-05">
     <notes>Temporarily suppressing as the latest snakeyaml 1.33 also has these vulnerabilities.</notes>
     <packageUrl regex="true">^pkg:maven/org.yaml/snakeyaml@.*$</packageUrl>
     <cve>CVE-2022-3064</cve>
     <cve>CVE-2021-4235</cve>
     <cve>CVE-2022-1471</cve>
   </suppress>
-  <suppress until="2023-07-05">
-    <cve>CVE-2022-45143</cve>
-    <cve>CVE-2021-4235</cve>
-    <cve>CVE-2022-3064</cve>
-    <cve>CVE-2022-34305</cve>
-    <cve>CVE-2022-42252</cve>
-  </suppress>
-  <suppress until="2023-07-26">
-    <cve>CVE-2023-28708</cve>
-    <cve>CVE-2023-20861</cve>
-  </suppress>
+
   <suppress until="2024-04-04">
     <cve>CVE-2023-20860</cve>
     <cve>CVE-2023-20863</cve>
     <cve>CVE-2023-28709</cve>
     <cve>CVE-2023-2976</cve>
     <cve>CVE-2022-1471</cve>
+    <cve>CVE-2023-3782</cve>
   </suppress>
-  <suppress until="2023-07-24">
-    <notes>Requires updating spring dependencies to 5.3.27. Better address that in a different ticket</notes>
-    <cve>CVE-2023-20863</cve>
-  </suppress>
+
   <suppress until="2023-08-29">
     <cve>CVE-2023-28709</cve>
     <cve>CVE-2023-35116</cve>