Add false positive suppression for dependency check

-- CVE-2024-43591 is not applicable -- Update azure libraries
Consensys · Oct 17, 2024 · ea531cd · ea531cd
1 parent af3ee4e
commit ea531cd
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 3 deletions.
diff --git a/gradle/owasp-suppression.xml b/gradle/owasp-suppression.xml
@@ -1,6 +1,17 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
     <!-- See https://jeremylong.github.io/DependencyCheck/general/suppression.html for examples -->
+    <suppress>
+        <notes><![CDATA[
+          FALSE POSITIVE
+          file name: azure-json-1.1.0.jar
+          As per https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43591
+          this vulnerability is applicable on Azure Service Connector and Azure CLI.
+          We are not using these libraries in our code.
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/com\.azure/azure-json@.*$</packageUrl>
+        <cve>CVE-2024-43591</cve>
+    </suppress>
     <suppress>
         <notes><![CDATA[
           file name: azure-identity-1.13.1.jar

diff --git a/gradle/versions.gradle b/gradle/versions.gradle
@@ -128,9 +128,9 @@ dependencyManagement {
     dependency 'com.github.arteam:simple-json-rpc-server:1.3'
     dependency 'com.github.arteam:simple-json-rpc-client:1.3'
 
-    dependency 'com.azure:azure-security-keyvault-secrets:4.8.4'
-    dependency 'com.azure:azure-security-keyvault-keys:4.8.5'
-    dependency 'com.azure:azure-identity:1.13.1'
+    dependency 'com.azure:azure-security-keyvault-secrets:4.8.7'
+    dependency 'com.azure:azure-security-keyvault-keys:4.8.8'
+    dependency 'com.azure:azure-identity:1.14.0'
 
     dependency 'com.zaxxer:HikariCP:5.1.0'
     dependency 'org.postgresql:postgresql:42.7.3'