From b698440bfe667c74bffb277350bafb0d126baed6 Mon Sep 17 00:00:00 2001
From: Laksh Singla <lakshsingla@gmail.com>
Date: Wed, 4 Sep 2024 19:37:23 +0530
Subject: [PATCH] suppress cve (#16997)

---
 owasp-dependency-check-suppressions.xml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/owasp-dependency-check-suppressions.xml b/owasp-dependency-check-suppressions.xml
index d25148eb0de..283e882183f 100644
--- a/owasp-dependency-check-suppressions.xml
+++ b/owasp-dependency-check-suppressions.xml
@@ -699,4 +699,13 @@
     ]]></notes>
     <vulnerabilityName>CVE-2024-25638</vulnerabilityName>
   </suppress>
+  <suppress>
+    <!-- The CVE is also not applicable to xz-java because it does not implement xzgrep and therefore is not vulnerable
+     ~ to the filename validation problem. Druid does not use xzgrep but this CVE is popping up because the CPE matches the
+     ~ Java package too. -->
+    <notes><![CDATA[
+    file name: xz-1.9.jar
+    ]]></notes>
+    <vulnerabilityName>CVE-2022-1271</vulnerabilityName>
+  </suppress>
 </suppressions>