Merge pull request #1577 from hmcts/AM-2885_CVE-2023-3635_Fix

AM-2885 CVE-2023-3635 okio 3.5.0 dependencySet added
hmcts · Sep 20, 2023 · 104471b · 104471b
2 parents ba092e1 + 0a2660f
commit 104471b
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/build.gradle b/build.gradle
@@ -553,6 +553,10 @@ dependencyManagement {
             entry 'jackson-core'
             entry 'jackson-annotations'
         }
+        // CVE-2023-3635 override okio dependency in azure-servicebus:3.6.7
+        dependencySet(group: 'com.squareup.okio', version: '3.5.0') {
+            entry 'okio'
+        }
     }
 }
 

diff --git a/config/owasp/suppressions.xml b/config/owasp/suppressions.xml
@@ -9,8 +9,4 @@
         <notes>https://tools.hmcts.net/jira/browse/AM-2839 jackson-databind</notes>
         <cve>CVE-2023-35116</cve>
     </suppress>
-    <suppress>
-        <notes>https://tools.hmcts.net/jira/browse/AM-2885 okio</notes>
-        <cve>CVE-2023-3635</cve>
-    </suppress>
 </suppressions>