Merge pull request #583 from hmcts/cve-fixes-010324

Version bumped to resolve CVE
hmcts · Apr 16, 2024 · 857dfbe · 857dfbe
2 parents 8ee0eea + 444121f
commit 857dfbe
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 7 deletions.
diff --git a/build.gradle b/build.gradle
@@ -174,11 +174,10 @@ dependencies {
     implementation group: 'org.springframework.security', name: 'spring-security-crypto', version: springSecurity
 
     // dependency check
-    implementation 'org.owasp:dependency-check-gradle'
+    implementation group: 'org.owasp', name: 'dependency-check-gradle', version: '9.0.9'
     constraints {
-        implementation('org.owasp:dependency-check-gradle:9.0.9') {
-        }
-        implementation('org.owasp:dependency-check-core:9.0.9') {
+        implementation('org.apache.commons:commons-compress:1.26.0') {
+            because 'Latest version of dependency-check-gradle (9.0.9) brings in commons-compress v1.25.0 which has a CVE'
         }
     }
 

diff --git a/dependency-check-suppressions.xml b/dependency-check-suppressions.xml
@@ -2,9 +2,10 @@
   <suppress>
     <notes>Temporary Suppression
         CVE-2023-33202 refer [Ticket]
-        CVE-2024-25710 refer [Ticket]
         CVE-2024-26308 refer [Ticket]
-        CVE-2024-1597 refer [Ticket]
+        CVE-2024-23686 refer [Ticket]
+        CVE-2022-45868 refer [Ticket]
+        CVE-2023-35116 refer [Ticket]
         CVE-2023-34053 refer [Ticket]
         CVE-2023-34055 refer [Ticket]
         CVE-2023-34042 refer [Ticket]
@@ -13,7 +14,6 @@
         CVE-2023-42795 refer [Ticket]
         CVE-2023-45648 refer [Ticket]</notes>
     <cve>CVE-2023-33202</cve>
-    <cve>CVE-2024-25710</cve>
     <cve>CVE-2024-26308</cve>
     <cve>CVE-2024-1597</cve>
     <cve>CVE-2023-34053</cve>