svn commit: r1885644 - in /db/torque/trunk: suppression-owasp-fp.xml torque-maven-plugin/pom.xml

Author: gk
Date: Mon Jan 18 12:40:07 2021
New Revision: 1885644

URL: http://svn.apache.org/viewvc?rev=1885644&view=rev
Log:
- fixed another and suppressed another vulnerability

Modified:
    db/torque/trunk/suppression-owasp-fp.xml
    db/torque/trunk/torque-maven-plugin/pom.xml

Modified: db/torque/trunk/suppression-owasp-fp.xml
URL: http://svn.apache.org/viewvc/db/torque/trunk/suppression-owasp-fp.xml?rev=1885644&r1=1885643&r2=1885644&view=diff
==============================================================================
--- db/torque/trunk/suppression-owasp-fp.xml (original)
+++ db/torque/trunk/suppression-owasp-fp.xml Mon Jan 18 12:40:07 2021
@@ -18,7 +18,7 @@
  under the License.
 -->
 <!-- general cft. https://jeremylong.github.io/DependencyCheck/general/suppression.html -->
-<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.1.xsd">
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
   <!-- https://issues.apache.org/jira/browse/LOG4J2-1863 i.e. log4j 2.8.2 fixes, but affected versions match only log4j2 2.x, not log4j 1.x -->
   <suppress>
      <notes><![CDATA[
@@ -35,4 +35,13 @@
      <gav regex="true">^org\.codehaus\.groovy:groovy-.*:.*$</gav>
      <cve>CVE-2016-6497</cve>
   </suppress>
+   <!-- fixed: updated log4j2 to 2.14.0 (2.13.2 or later) -->
+    <suppress>
+       <notes><![CDATA[
+       file name: failureaccess-1.0.1.jar
+       ]]></notes>
+       <packageUrl regex="true">^pkg:maven/com\.google\.guava/failureaccess@.*$</packageUrl>
+       <cve>CVE-2020-8908</cve>
+    </suppress>
+    <!-- fixed: updated to guava 30.0 or later -->
 </suppressions>
\ No newline at end of file

Modified: db/torque/trunk/torque-maven-plugin/pom.xml
URL: http://svn.apache.org/viewvc/db/torque/trunk/torque-maven-plugin/pom.xml?rev=1885644&r1=1885643&r2=1885644&view=diff
==============================================================================
--- db/torque/trunk/torque-maven-plugin/pom.xml (original)
+++ db/torque/trunk/torque-maven-plugin/pom.xml Mon Jan 18 12:40:07 2021
@@ -94,7 +94,7 @@
     <dependency>
         <groupId>org.apache.logging.log4j</groupId>
         <artifactId>log4j-slf4j-impl</artifactId>
-        <version>2.13.0</version>
+        <version>${log4j2.version}</version>
     </dependency>
     
      <dependency>