From d3ad2288d6520af02d0bacf5e5950ab4b9372ab6 Mon Sep 17 00:00:00 2001
From: Trey Chadick <tchad@labkey.com>
Date: Tue, 5 Sep 2023 07:40:41 -0700
Subject: [PATCH] Backport supression of netty CVE (#564)

Commit: 910ac64de02dfb3172427cbfcb62363e27680fcc
---
 dependencyCheckSuppression.xml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/dependencyCheckSuppression.xml b/dependencyCheckSuppression.xml
index ad9341be2a..f209cc4863 100644
--- a/dependencyCheckSuppression.xml
+++ b/dependencyCheckSuppression.xml
@@ -266,4 +266,17 @@
         <packageUrl regex="true">^pkg:maven/org\.postgresql/postgresql@.*$</packageUrl>
         <vulnerabilityName>CVE-2020-21469</vulnerabilityName>
     </suppress>
+
+    <!--
+    Netty doesn't turn on cert checking by default, so this gets flagged periodically. per the linked discussion
+    this should be handled/enabled when configuring the client to use https.
+     For more info see: https://github.com/jeremylong/DependencyCheck/issues/5912#issuecomment-1699363391 and the subsequent rabbit-hole.
+    -->
+    <suppress>
+        <notes><![CDATA[
+   file name: netty-handler-4.1.94.Final.jar
+   ]]></notes>
+        <packageUrl regex="true">^pkg:maven/io\.netty/netty\-handler@.*$</packageUrl>
+        <vulnerabilityName>CVE-2023-4586</vulnerabilityName>
+    </suppress>
 </suppressions>