suppressions.xml

build.gradle

@@ -83,12 +83,6 @@ subprojects {
             exclude module: 'sailfish-core'
             exclude module: 'sailfish-common'
         }
-
-        configureEach.resolutionStrategy.dependencySubstitution {
-            substitute(module('org.apache.mina:mina-core:2.0.21'))
-                    .using(module('org.apache.mina:mina-core:2.0.25'))
-                    .because("vulnerability in transitive dependency in transitive dependency of sailfish 3.3.241")
-        }
     }
 
     dependencies {
@@ -170,6 +164,8 @@ subprojects {
 }
 
 dependencyCheck {
+    suppressionFile = file('suppressions.xml')
+
     formats=['SARIF', 'JSON', 'HTML']
     failBuildOnCVSS=5
 

suppressions.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+    <suppress>
+        <notes><![CDATA[Suppress CVE-2021-41973 (vulnerability in HTTP Header decoder) in Apache MINA because MINA's HTTP Header decoder is not used in this project]]>
+        </notes>
+        <filePath regex="true">.*/apache-mina-core-2.0.21.2.jar</filePath>
+        <cve>CVE-2021-41973</cve>
+    </suppress>
+</suppressions>