From 96206c8f1d6d98d79c68bd50815b16fc464d5d90 Mon Sep 17 00:00:00 2001
From: Aaron Steinfeld <aaron@traceable.ai>
Date: Tue, 19 Sep 2023 10:07:33 -0400
Subject: [PATCH] ci: add suppression for bad cpe declaration

---
 owasp-suppressions.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/owasp-suppressions.xml b/owasp-suppressions.xml
index 4c3786d..a7f4fad 100644
--- a/owasp-suppressions.xml
+++ b/owasp-suppressions.xml
@@ -15,4 +15,14 @@
     <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
     <cve>CVE-2023-35116</cve>
   </suppress>
+  <suppress until="2023-11-30Z">
+    <notes><![CDATA[
+   This CVE is declared fixed from 9.4.52, but the vuln db is not reflecting that. Suppress that specific version until
+   db is updated.
+   Ref:
+   https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j
+   ]]></notes>
+    <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty/jetty\-servlets@9.4.52\..*$</packageUrl>
+    <vulnerabilityName>CVE-2023-36479</vulnerabilityName>
+  </suppress>
 </suppressions> 
\ No newline at end of file