[ZOOKEEPER-4469] Suppress OWASP false positives related to Netty TCNative

• Type: Task
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 3.8.0, 3.7.1, 3.6.4
• Component/s: build
• Labels: pull-request-available
• Assignee: Enrico Olivelli
• Reporter: Enrico Olivelli
• Created: 11/Feb/22 11:15
• Updated: 09/Oct/23 11:20
• Resolved: 14/Feb/22 08:16

Description

OWASP check is reporting this CVEs against netty-tcnative-2.0.48.Final

Those are not problems that affect ZooKeeper, we can exclude them

[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '0.0': 
[ERROR] 
[ERROR] netty-tcnative-2.0.48.Final.jar: CVE-2021-43797, CVE-2019-16869, CVE-2015-2156, CVE-2021-37136, CVE-2014-3488, CVE-2021-37137, CVE-2019-20445, CVE-2019-20444, CVE-2021-21295, CVE-2021-21409, CVE-2021-21290

 

Issue Links

• relates to: ZOOKEEPER-4462 Upgrade Netty TCNative to 2.0.48
• links to: GitHub Pull Request #1817