CVE-suppressions.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright 2024 REGnosys
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->

<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
   <suppress>
      <notes><![CDATA[
      This CVE only affects projects fetching p2 repo's over HTTP, but we use HTTPS.
      ]]></notes>
      <cve>CVE-2021-41033</cve>
   </suppress>
   <suppress>
	  <notes><![CDATA[
	  We are using Reload4j, which is a secure drop-in replacement for log4j.
	  ]]></notes>
	  <cve>CVE-2020-9493</cve>
	</suppress>
	<suppress>
	   <notes><![CDATA[
	   We are using Reload4j, which is a secure drop-in replacement for log4j.
	   ]]></notes>
	   <cve>CVE-2022-23307</cve>
	</suppress>
	<suppress>
	   <notes><![CDATA[
	   This CVE is not about org.junit.platform.commons. It seems the check is
	   too loose.
	   ]]></notes>
	   <cve>CVE-2020-27225</cve>
	</suppress>
	<suppress>
	   <notes><![CDATA[
	   This CVE only affects projects using Xtext prior to 2.18.0.
	   ]]></notes>
	   <cve>CVE-2019-10249</cve>
	</suppress>
	<suppress>
	   <notes><![CDATA[
	   Calling the method `com.google.common.io.Files.createTempDir` is a vulnerability,
	   but we do not call it.
	   ]]></notes>
	   <cve>CVE-2020-8908</cve>
	</suppress>
	<suppress>
	   <notes><![CDATA[
	   We are not creating SVG's with Batik of Apache XML Graphics.
	   ]]></notes>
	   <cve>CVE-2022-41704</cve>
	</suppress>
	<suppress>
	   <notes><![CDATA[
	   We are not creating SVG's with Batik of Apache XML Graphics.
	   ]]></notes>
	   <cve>CVE-2022-42890</cve>
	</suppress>
	<suppress>
	   	<notes><![CDATA[
	   This CVE is not about org.eclipse.e4.emf.xpath. It seems the check is
	   too loose.
	   ]]></notes>
	   <cve>CVE-2022-41852</cve>
	</suppress>
	<suppress>
	   <notes><![CDATA[
	   This only affects milestone and RC versions, but we use a stable release.
	   ]]></notes>
	   <cve>CVE-2020-15824</cve>
	</suppress>
</suppressions>