From 0f0a6e6e6366ad450b524e56bafca7be9118391d Mon Sep 17 00:00:00 2001
From: Aaron Steinfeld <aaron@traceable.ai>
Date: Wed, 3 Jan 2024 17:35:01 -0500
Subject: [PATCH] chore: update suppressions

---
 owasp-suppressions.xml | 44 +++++++++++++++---------------------------
 1 file changed, 16 insertions(+), 28 deletions(-)

diff --git a/owasp-suppressions.xml b/owasp-suppressions.xml
index f2f07904..c34b3a80 100644
--- a/owasp-suppressions.xml
+++ b/owasp-suppressions.xml
@@ -1,34 +1,22 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
-    <suppress>
-        <notes><![CDATA[
+  <suppress>
+    <notes><![CDATA[
    Any hypertrace dep
    ]]></notes>
-        <packageUrl regex="true">^pkg:maven/org\.hypertrace\..*@.*$</packageUrl>
-        <cpe>cpe:/a:grpc:grpc</cpe>
-        <cpe>cpe:/a:service_project:service</cpe>
-        <cpe>cpe:/a:utils_project:utils</cpe>
-        <cpe>cpe:/a:processing:processing</cpe>
-    </suppress>
-    <suppress until="2023-11-30Z">
-        <notes><![CDATA[
-  This vulnerability is disputed, with the argument that SSL configuration is the responsibility of the client rather
-  than the transport. The change in default is under consideration for the next major Netty release, revisit then.
-  Regardless, our client (which is what brings in this dependency) enables the concerned feature, hostname verification
-  Ref:
-  https://github.com/grpc/grpc-java/issues/10033
-  https://github.com/netty/netty/issues/8537#issuecomment-1527896917
+    <packageUrl regex="true">^pkg:maven/org\.hypertrace\..*@.*$</packageUrl>
+    <cpe>cpe:/a:grpc:grpc</cpe>
+    <cpe>cpe:/a:service_project:service</cpe>
+    <cpe>cpe:/a:utils_project:utils</cpe>
+    <cpe>cpe:/a:processing:processing</cpe>
+  </suppress>
+  <suppress until="2024-01-31Z">
+    <notes><![CDATA[
+   Legitimate vulnerability, but unlikely to be exploited in practice as issues are with args
+   that are not under user control like radix. Expect the severity to be revised, but revisit
+   once fix is released. Ref: https://github.com/seancfoley/IPAddress/issues/118
    ]]></notes>
-        <packageUrl regex="true">^pkg:maven/io\.netty/netty.*@.*$</packageUrl>
-        <vulnerabilityName>CVE-2023-4586</vulnerabilityName>
-    </suppress>
-    <suppress until="2023-12-31Z">
-        <notes><![CDATA[
-   This CVE (rapid RST) is already mitigated as our servers aren't directly exposed, but it's also
-   addressed in 1.59.1, which the CVE doesn't reflect (not all grpc impls versions are exactly aligned).
-   Ref: https://github.com/grpc/grpc-java/pull/10675
-   ]]></notes>
-        <packageUrl regex="true">^pkg:maven/io\.grpc/grpc\-.*@.*$</packageUrl>
-        <cve>CVE-2023-44487</cve>
-    </suppress>
+    <packageUrl regex="true">^pkg:maven/com\.github\.seancfoley/ipaddress@.*$</packageUrl>
+    <vulnerabilityName>CVE-2023-50570</vulnerabilityName>
+  </suppress>
 </suppressions>
\ No newline at end of file