From 3e6d2245504178bd9af9f05d73efb5bb2e6ba358 Mon Sep 17 00:00:00 2001
From: tesshu <webmaster@tesshu.com>
Date: Tue, 12 Feb 2019 09:35:59 +0900
Subject: [PATCH] #1 CVE-2018-1000840

stax-api-1.0.1.jar
stax-api-1.0-2.jar
---
 airsonic-main/cve-suppressed.xml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/airsonic-main/cve-suppressed.xml b/airsonic-main/cve-suppressed.xml
index 9a5c02a2..152e4de7 100644
--- a/airsonic-main/cve-suppressed.xml
+++ b/airsonic-main/cve-suppressed.xml
@@ -1,5 +1,14 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd">
+
+    <!-- Provisional >> -->
+    <suppress>
+       <notes><![CDATA[False Positive for stax]]></notes>
+       <gav regex="true">^.*$</gav>
+       <cve>CVE-2018-1000840</cve>
+    </suppress>
+    <!-- << Provisional -->
+
     <suppress>
         <notes><![CDATA[RC4 vulnerability in ssl. We don't use ssl at the application container level]]></notes>
         <gav regex="true">^.*$</gav>