From: Malena Ebert <63863184+malena-ebert-sonarsource@users.noreply.github.com>
Date: Mon, 12 Oct 2020 13:16:48 +0000 (+0200)
Subject: Update owasp-suppressions.xml
X-Git-Tag: 8.6.0.39681~178
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=c5566b7b0e3d69e2cb04000dd7aaae43151b7ba2;p=sonarqube.git

Update owasp-suppressions.xml
---

diff --git a/owasp-suppressions.xml b/owasp-suppressions.xml
index 96f7512c91f..f2ee8bf0694 100644
--- a/owasp-suppressions.xml
+++ b/owasp-suppressions.xml
@@ -197,4 +197,22 @@
     <packageUrl regex="true">^pkg:maven/com\.sonarsource\.vsts/alm\-gallery\-client@.*$</packageUrl>
     <cpe>cpe:/a:gallery:gallery</cpe>
   </suppress>
+  
+  <!-- False Positive: Version of kotlin lib is not vulnerable to this CVE -->
+  <suppress>
+   <notes><![CDATA[
+   file name: kotlin-stdlib-common-1.4.10.jar
+   ]]></notes>
+   <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin\-stdlib(\-common)?@1.4.10$</packageUrl>
+   <cve>CVE-2020-15824</cve>
+  </suppress>
+  
+  <!-- False Positive: The CVE is for hazelcast:1.8.0 not hazelcast-client-protocol -->
+  <suppress>
+   <notes><![CDATA[
+   file name: hazelcast-3.12.9.jar (shaded: com.hazelcast:hazelcast-client-protocol:1.8.0)
+   ]]></notes>
+   <packageUrl regex="true">^pkg:maven/com\.hazelcast/hazelcast\-client\-protocol@.*$</packageUrl>
+   <cve>CVE-2016-10750</cve>
+  </suppress>
 </suppressions>