MightyPork/airsonic-custom
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update dependency check

Browse Source
This commit is contained in:
Andrew DeMaria
2019-06-26 10:57:49 -06:00
parent cdc38cb88d
commit 7c7ac3e591
3 changed files with 46 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
airsonic-main/cve-suppressed.xml
+35
View File
@@ -168,4 +168,39 @@
<gav regex="true">^com\.sun\.xml\.bind\.external:relaxng-datatype:.*</gav> <gav regex="true">^com\.sun\.xml\.bind\.external:relaxng-datatype:.*</gav>
<cve>CVE-2018-18749</cve> <cve>CVE-2018-18749</cve>
</suppress> </suppress>
<suppress>
<notes>False positive for jflac-codec</notes>
<gav regex="true">.*jflac-codec.*</gav>
<cve>CVE-2018-14948</cve>
</suppress>
<suppress>
<notes>We do not enable default typing for jackson</notes>
<gav regex="true">.*jackson-databind.*</gav>
<cve>CVE-2019-12814</cve>
</suppress>
<suppress>
<notes>We do not sue the liquibase sdk</notes>
<filePath regex="true">.*liquibase/sdk/.*</filePath>
<cvssBelow>9.0</cvssBelow>
</suppress>
<suppress>
<notes>False positive for tomcat vuln in eclipse jetty/jasper compat lib</notes>
<gav regex="true">^org\.mortbay\.jasper:apache-jsp:.*$</gav>
<cve>CVE-2016-5425</cve>
</suppress>
<suppress>
<notes>False positive for tomcat vuln in eclipse jetty/jasper compat lib</notes>
<gav regex="true">^org\.mortbay\.jasper:apache-jsp:.*$</gav>
<cve>CVE-2017-6056</cve>
</suppress>
<suppress>
<notes>False positive for tomcat vuln in eclipse jetty/jasper compat lib</notes>
<gav regex="true">^org\.mortbay\.jasper:apache-jsp:.*$</gav>
<cve>CVE-2019-10072</cve>
</suppress>
<suppress>
<notes>This cve is for apache standard taglibs before 1.2.3. However jstl:1.2 is a separate PROVIDED lib</notes>
<gav regex="true">^javax\.servlet:jstl:.*$</gav>
<cve>CVE-2015-0254</cve>
</suppress>
</suppressions> </suppressions>
airsonic-main/pom.xml
+1 -1
View File
@@ -538,7 +538,7 @@
<dependency> <dependency>
<groupId>org.postgresql</groupId> <groupId>org.postgresql</groupId>
<artifactId>postgresql</artifactId> <artifactId>postgresql</artifactId>
<version>42.1.4</version> <version>42.2.5</version>
<scope>runtime</scope> <scope>runtime</scope>
</dependency> </dependency>
<dependency> <dependency>
pom.xml
+10 -9
View File
@@ -18,6 +18,7 @@
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<cxf.version>3.3.1</cxf.version> <cxf.version>3.3.1</cxf.version>
<jackson.version>2.9.9</jackson.version> <jackson.version>2.9.9</jackson.version>
<tomcat.version>8.5.42</tomcat.version>
</properties> </properties>
<repositories> <repositories>
@@ -87,7 +88,7 @@
<!-- Import dependency management from Spring Boot --> <!-- Import dependency management from Spring Boot -->
<groupId>org.springframework.boot</groupId> <groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-dependencies</artifactId> <artifactId>spring-boot-dependencies</artifactId>
<version>1.5.20.RELEASE</version> <version>1.5.21.RELEASE</version>
<type>pom</type> <type>pom</type>
<scope>import</scope> <scope>import</scope>
</dependency> </dependency>
@@ -192,37 +193,37 @@
<dependency> <dependency>
<groupId>org.apache.tomcat.embed</groupId> <groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-core</artifactId> <artifactId>tomcat-embed-core</artifactId>
<version>8.5.40</version> <version>${tomcat.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.tomcat.embed</groupId> <groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-el</artifactId> <artifactId>tomcat-embed-el</artifactId>
<version>8.5.40</version> <version>${tomcat.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.tomcat.embed</groupId> <groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-jasper</artifactId> <artifactId>tomcat-embed-jasper</artifactId>
<version>8.5.40</version> <version>${tomcat.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.tomcat.embed</groupId> <groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-websocket</artifactId> <artifactId>tomcat-embed-websocket</artifactId>
<version>8.5.40</version> <version>${tomcat.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.tomcat</groupId> <groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-annotations-api</artifactId> <artifactId>tomcat-annotations-api</artifactId>
<version>8.5.40</version> <version>${tomcat.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.tomcat</groupId> <groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-jdbc</artifactId> <artifactId>tomcat-jdbc</artifactId>
<version>8.5.40</version> <version>${tomcat.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.tomcat</groupId> <groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-juli</artifactId> <artifactId>tomcat-juli</artifactId>
<version>8.5.40</version> <version>${tomcat.version}</version>
</dependency> </dependency>
</dependencies> </dependencies>
</dependencyManagement> </dependencyManagement>
@@ -300,7 +301,7 @@
<plugin> <plugin>
<groupId>org.owasp</groupId> <groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId> <artifactId>dependency-check-maven</artifactId>
<version>4.0.0</version> <version>5.0.0</version>
<inherited>true</inherited> <inherited>true</inherited>
<configuration> <configuration>
<failBuildOnAnyVulnerability>true</failBuildOnAnyVulnerability> <failBuildOnAnyVulnerability>true</failBuildOnAnyVulnerability>