Update various vulnerabilities suppressions (#963)

Update various vulnerabilities suppressions that are not relevant to Web3Signer build.
Consensys · Jan 19, 2024 · b375e7d · b375e7d
1 parent 671de39
commit b375e7d
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 18 deletions.
diff --git a/gradle/owasp-suppression.xml b/gradle/owasp-suppression.xml
@@ -1,23 +1,12 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
     <!-- See https://jeremylong.github.io/DependencyCheck/general/suppression.html for examples -->
-    <suppress until="2024-01-16">
-        <notes><![CDATA[
-        Temporary suppression, as it's arguably a false positive: https://github.com/netty/netty/issues/8537#issuecomment-1527896917
-        The correct thing to do is ensure hostname verification is enabled: https://codetinkering.com/enable-hostname-verification-netty/
-        This is indeed the case for Azure, which is the netty-handler: https://github.com/Azure/azure-sdk-for-java/issues/18286#issuecomment-947958978
-        The other vulnerable lib is besu-metrics, which might want looking at, will see if this CVE gets flagged in besu first
-        file name: netty-handler-4.1.100.Final.jar
-        ]]></notes>
-        <packageUrl regex="true">^pkg:maven/io\.netty/netty*@*.*$</packageUrl>
-        <vulnerabilityName>CVE-2023-4586</vulnerabilityName>
-    </suppress>
-    <suppress until="2024-01-16">
+    <suppress until="2024-03-16">
         <notes><![CDATA[
         Suppress CVE-2023-36415 as this should only be applicable on version up to but excluding 1.10.2.
         https://github.com/jeremylong/DependencyCheck/issues/5992
         ]]></notes>
-        <packageUrl regex="true">^pkg:maven/com\.azure/azure\-identity@1\.10\.[2-9]$</packageUrl>
+        <packageUrl regex="true">^pkg:maven/com\.azure/azure\-identity@1\.11\.[1-9]$</packageUrl>
         <vulnerabilityName>CVE-2023-36415</vulnerabilityName>
     </suppress>
     <suppress>
@@ -27,21 +16,21 @@
         <packageUrl regex="true">^pkg:maven/com\.squareup\.okhttp3/.*$</packageUrl>
         <cve>CVE-2023-3782</cve>
     </suppress>
-    <suppress until="2024-01-16">
+    <suppress until="2024-03-16">
         <notes><![CDATA[
         FP per issue #6100 - CVE-2023-36052 since it is related to Azure-cli not to the azure-core libraries
         ]]></notes>
         <packageUrl regex="true">^pkg:maven/com\.azure/azure*@*.*$</packageUrl>
         <cve>CVE-2023-36052</cve>
     </suppress>
-    <suppress until="2024-01-16">
+    <suppress until="2024-03-16">
         <notes><![CDATA[
         CVE relates to attach on gRPC servers (not clients) and is dependent on the Netty version used
         ]]></notes>
         <packageUrl regex="true">^pkg:maven/io\.grpc/grpc\-.*$</packageUrl>
         <cve>CVE-2023-44487</cve>
     </suppress>
-    <suppress until="2024-01-16">
+    <suppress until="2024-03-16">
         <notes><![CDATA[
         CVE relates to usage hostname verification when using TLS and doesn't apply as we use Tuweni for this
         ]]></notes>

diff --git a/gradle/versions.gradle b/gradle/versions.gradle
@@ -126,11 +126,11 @@ dependencyManagement {
     dependency 'com.github.arteam:simple-json-rpc-server:1.3'
     dependency 'com.github.arteam:simple-json-rpc-client:1.3'
 
-    dependencySet(group: 'com.azure', version: '4.7.1') {
+    dependencySet(group: 'com.azure', version: '4.7.3') {
       entry 'azure-security-keyvault-secrets'
       entry 'azure-security-keyvault-keys'
     }
-    dependency 'com.azure:azure-identity:1.10.4'
+    dependency 'com.azure:azure-identity:1.11.1'
 
     dependency 'com.zaxxer:HikariCP:5.0.1'
     dependency 'org.postgresql:postgresql:42.5.3'