openmrs-core/dependency-check-suppressions.xml at master · praisekavuma4/openmrs-core · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
<?xml version="1.0"?>
<!--

    This Source Code Form is subject to the terms of the Mozilla Public License,
    v. 2.0. If a copy of the MPL was not distributed with this file, You can
    obtain one at http://mozilla.org/MPL/2.0/. OpenMRS is also distributed under
    the terms of the Healthcare Disclaimer located at http://openmrs.org/license.

    Copyright (C) OpenMRS Inc. OpenMRS is a registered trademark and the OpenMRS
    graphic logo is a trademark of OpenMRS Inc.

-->
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
	<suppress>
	   <notes><![CDATA[
	   file name: openmrs-liquibase-3.0.0-SNAPSHOT.jar
	   ]]></notes>
	   <packageUrl regex="true">^pkg:maven/org\.openmrs\.liquibase/openmrs-liquibase@.*$</packageUrl>
	   <cve>CVE-2022-0839</cve>
	</suppress>
	<suppress>
	   <notes><![CDATA[
	   jQuery bundled inside Maven Fluido site skin (build-time reporting only, not a runtime dependency).
	   Triggered by SpotBugs maven plugin rendering reports with maven-fluido-skin.
	   ]]></notes>
	   <packageUrl regex="true">^pkg:javascript/jquery@.*$</packageUrl>
	   <vulnerabilityName regex="true">^jquery issue:.*$</vulnerabilityName>
	</suppress>
	<suppress>
	   <notes><![CDATA[
	   False positives: these CVEs are matched against the openmrs.war file via CPE
	   cpe:2.3:a:openmrs:openmrs but refer to vulnerabilities in older OpenMRS releases
	   or the OpenMRS Reference Application, not the current openmrs-core codebase.

	   CVE-2026-40076 (Zip Slip during .omod extraction) is already fixed here: both
	   ModuleUtil.expandJar and ModuleUtil.expand reject entries that normalize outside
	   the target directory.
	   CVE-2026-40075 (ModuleResourcesServlet path traversal) is already fixed here:
	   ModuleResourcesServlet.getFile rejects paths that do not normalize within the
	   module resources base path.
	   CVE-2021-43094 (file exfiltration via /images and /initfilter/scripts) is already
	   fixed here: StartupFilter normalizes the resolved path and rejects requests that
	   resolve outside the served directory.
	   The remaining CVEs (CVE-2017-12796, CVE-2025-25928, CVE-2014-8073, CVE-2025-25927)
	   target the legacy admin UI / Reference Application (e.g. /admin/users/user.form),
	   which is not part of openmrs-core.
	   ]]></notes>
	   <cpe>cpe:2.3:a:openmrs:openmrs</cpe>
	   <cve>CVE-2026-40076</cve>
	   <cve>CVE-2026-40075</cve>
	   <cve>CVE-2021-43094</cve>
	   <cve>CVE-2017-12796</cve>
	   <cve>CVE-2025-25928</cve>
	   <cve>CVE-2014-8073</cve>
	   <cve>CVE-2025-25927</cve>
	</suppress>
	<suppress>
	   <notes><![CDATA[
	   False positive. Per the Apache advisory (GHSA-hf6x-8p5f-cgmf and the
	   oss-security announcement) both CVEs affect the 5.x artifact
	   org.apache.httpcomponents.core5:httpcore5 only (5.4.2 / 5.5-beta1 and
	   earlier); CVE-2026-54428 targets the HTTP/2 HPACK decoder, which the 4.x
	   line does not implement. We pull org.apache.httpcomponents:httpcore 4.4.16
	   transitively (hibernate-search elasticsearch rest4 client -> httpclient
	   4.5.14); 4.4.16 is the final 4.4.x release, so there is no 4.x upstream fix.
	   Dependency-Check matches it via the shared apache:httpcomponents_core CPE.
	   The regex is scoped to 4.4.x so a future move onto the affected 5.x line
	   would correctly resurface these CVEs rather than stay suppressed.
	   ]]></notes>
	   <packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents/httpcore(-nio)?@4\.4\..*$</packageUrl>
	   <cve>CVE-2026-54399</cve>
	   <cve>CVE-2026-54428</cve>
	</suppress>
</suppressions>