[ZOOKEEPER-4478] Suppress OWASP false positives zookeeper-jute-3.8.0-SNAPSHOT.jar: CVE-2021-29425, CVE-2021-28164, CVE-2021-34429

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.8.0, 3.7.1, 3.6.4
• Labels: pull-request-available
• Assignee: Unassigned
• Reporter: Enrico Olivelli
• Created: 24/Feb/22 07:50
• Updated: 09/Oct/23 11:20
• Resolved: 25/Feb/22 07:00

Description

While preparing a new RC for 3.8.0 today the OWASP checker started to report locally (not on jenkins) these errors:

 

 

[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '0.0': 
[ERROR] 
[ERROR] zookeeper-jute-3.8.0-SNAPSHOT.jar: CVE-2021-29425, CVE-2021-28164, CVE-2021-34429
[ERROR] 
[ERROR] See the dependency-check report for more details.
[ERROR] 

 

 

Issue Links

• links to: GitHub Pull Request #1824