cleanup already resolved CVEs #15447
Conversation
|
In this PR, we had removed the dependency check on contrib extensions. Can you run the check manually to ensure that you are not removing genuine suppressions for contrib extensions? |
| <notes><![CDATA[ | ||
| file name: hadoop-*-3.3.1.jar | ||
| ]]></notes> | ||
| <cve>CVE-2015-7430</cve> |
There was a problem hiding this comment.
The justification is lost during refactoring
There was a problem hiding this comment.
Added a bit of context.
| <cve>CVE-2023-31419</cve> | ||
| </suppress> | ||
|
|
||
| <suppress> |
There was a problem hiding this comment.
can you add justifications for the suppressions?
There was a problem hiding this comment.
Added a bit of context.
@abhishekagarwal87
It seems I have removed suppressions for some of the contrib extensions, however as I started re-adding them, there is even more issues in them (re-enabled scans for all the contrib repos and oh my!) |
|
oops. I missed to post the link - #15026 |
|
I was initially thinking that we keep the old suppressions anyway but it's probably better to get rid of those if we are not doing a scan anyway. |
|
I'm almost done adding suppressions for the remaining modules - there are plenty missing from pre-pruning. I have not added reasoning to those. |
|
To remove an extension that is not being maintained, you can start a thread on dev@druid.apache.org. If there is consensus, we can remove the extension. |
| <cve>CVE-2021-33813</cve> | ||
| </suppress> | ||
| <notes><
Description
Remove the crud from the dependency-check suppression file
This PR has: