OWASP Dependency Check plugin suppressions.xml examples

Introduction

One of the features of the OWASP dependency check plugin is to be able to suppress reported vulnerabilities, for example because they are false-positives for your configuration, or no new version is available yet, so you want to suppress the alert for a certain period of time.

Those suppressions you specify in the suppressions.xml file. The format is specified here.

But not all possibilities of suppressing have examples. Especially those where you just want to exclude a whole set of packages, e.g. everything of the Spring framework starting with 'spring-', like 'spring-webflux', 'spring-web' etc for a given version.

After some trial and here I came up with some more additional useful examples.

Solution

Setup

• Kotlin 1.8.10
• Gradle
• Spring Boot 2.7.9
• failBuildOnCVSS set to 7
• OWASP plugin versions tested: 7.2.1, 8.0.0

Examples

Reported vulnerabilities as HIGH

• logback-core-1.3.0.jar
• logback-classic-1.3.0.jar

Suppressions:

• <packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback-core@1.3.*$</packageUrl>
  Will not show logback-core anymore in the report as HIGH.
  
  
• <packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback.*@1.3.*$</packageUrl>
  Will not report neither logback-core nor logback-classic anymore as vulnerabilities.

Full example of the suppression:

    <suppress until="2023-10-01Z">

        <notes><![CDATA[

        No new version exists yet for any version after this version.

        ]]></notes>

        <packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback.*@1.3.*$</packageUrl>

        <vulnerabilityName>CVE-2021-42550</vulnerabilityName>

    </suppress>

Reported vulnerabilities as HIGH

• spring-webflux-5.3.25.jar
• spring-messaging-5.3.25.jar

Suppressions:

• <packageUrl regex="true">^pkg:maven/org\.springframework/spring-.*@5.3.25$</packageUrl>
  Will not report neither of the two as vulnerabilities anymore.

Notice the ".*" used!

Full example of the suppression:

    <suppress until="2023-10-01Z">

        <notes><![CDATA[

        No new version exists yet for any version after 5.3.26, which has the same issue.

        ]]></notes>

        <packageUrl regex="true">^pkg:maven/org\.springframework/spring-.*@5.3.25$</packageUrl>

        <vulnerabilityName>CVE-2023-20860</vulnerabilityName>

        <vulnerabilityName>CVE-2016-1000027</vulnerabilityName>

    </suppress>

And here some examples that don't work:

• <packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback-*@1.3.*$</packageUrl>
  Shows both logback-core and logback-classic again in the report.
  
  
• <packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback*@1.3.*$</packageUrl>
  Shows both logback-core and logback-classic again in the report.

Another thing to know from here: the vulnerabilities report can show an issue as MEDIUM, while the vulnerability reports as a 8.5 in the CVSSv2 ranking, while the CVSSv3 rates it at 6.6. So the report seems to take only the CVSSv3 value into account for the Highest Severity level.

Best of this Week Summary 10 May - 16 May 2010

• Finally a new version of the OWASP Top 10 Web Security Vulnerabilities. Previous versions were from 2007 and 2004.
  


• Lower level 8 potential jQuery optimization tips.
  


• A post explaining implementing RSS feeds with new Spring 3 features like AbstractRssFeedView.
  


• Oracle's ADF is starting to support mobile clients too with ADF Mobile Client. The technology preview for Blackberry is available now. Here's a tutorial PDF that shows how to develop a basic mobile browser application and a native app.
  

Best of this Week Summary 19 November - 25 November 2007

• For software companies to test the security skills of their IT employees, the Secure Programming Council created this "Essential Skills for Secure Programmers Using Java/Java JEE". The draft is now open for public review for 60 days. Other languages like C++ and PHP will follow. Amongst the people in the Java steering committee are Ed Tracy and assisting them are for example people from the OWASP. Definitely a good initiative.
  


• In October W3C wrote a proposal to allow cross domain capabilities (same-origin-policy) for the XMLHttpRequest (XHR) object. This article summarizes it and also compares it with the JSONRequest proposal.
  


• Great presentations that contain comparisons of several Java web frameworks: JSF, Spring MVC, GWT, Seam, Stripes, Struts2, Tapestry and Wicket. Also included are Flex and Grails. Definitely a good starting point if you're starting with a web framework selection. Note that the general trend is that Tapestry is being used less and less, while Wicket is on the rise. GWT I would not use quickly for deployment on Internet sites since it creates quite large Javascript code. For intranet this constraint is a lot less serious. Note that soon you should be able to minimize the required Javascript libraries, thus improving download time. This is a presentation of Matt Raible where he compares a bunch of web frameworks in this 1 hour funny presentation, from a developer's point of view. He also asks who uses what (Hibernate, Websphere, Struts, JSF, Wicket etc). The above mentioned presentations are updated version of the one used in this presentation. His conclusion is that there is no real winner yet.
  


• A nice how-to on how you can write RESTful web services in Java that conform to the JAX-RS: Java API for RESTful Web Services (JSR-311) specification. This JSR should be in Java EE 6.