ci: update suppressions (#57)

hypertrace · Jul 31, 2024 · 3e2f5b1 · 3e2f5b1
1 parent 1da2000
commit 3e2f5b1
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/dependency-check/global-suppressions.xml b/dependency-check/global-suppressions.xml
@@ -10,7 +10,7 @@
     <cpe>cpe:/a:processing:processing</cpe>
     <cpe>cpe:/a:avro_project:avro</cpe>
   </suppress>
-  <suppress until="2024-07-31Z">
+  <suppress until="2024-10-31Z">
     <notes><![CDATA[
    This CVE is declared fixed from 9.4.52, but the vuln db is not reflecting that. Suppress that specific version until
    db is updated.
@@ -111,4 +111,11 @@
     <cve>CVE-2024-23081</cve>
     <cve>CVE-2024-23082</cve>
   </suppress>
+  <suppress>
+    <notes><![CDATA[
+    CVE indicates 19.11 is a fixed version, but incorrectly matches it
+   ]]></notes>
+    <packageUrl regex="true">^pkg:maven/com\.graphql\-java/graphql\-java@19\.11$</packageUrl>
+    <vulnerabilityName>CVE-2024-40094</vulnerabilityName>
+  </suppress>
 </suppressions>