From 6dc721af24528f14b81765ac032a9f0b84e8fe95 Mon Sep 17 00:00:00 2001
From: Joe DiPol <joe.dipol@oracle.com>
Date: Thu, 27 Jul 2023 10:33:03 -0700
Subject: [PATCH] Suppress disputed Jackson CVE (#7257)

---
 etc/dependency-check-suppression.xml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/etc/dependency-check-suppression.xml b/etc/dependency-check-suppression.xml
index c6a09c97b7d..ac1df681b82 100644
--- a/etc/dependency-check-suppression.xml
+++ b/etc/dependency-check-suppression.xml
@@ -106,5 +106,21 @@
    <vulnerabilityName>CVE-2023-22006</vulnerabilityName>
 </suppress>
 
+<!-- 
+    This CVE is being disputed by the Jackson project and the community seems in agreement that this
+    CVE should be rejected. We are suppressing this for now to reduce noise in our scan and will
+    continue to monitor progress.
+    https://nvd.nist.gov/vuln/detail/CVE-2023-35116
+    https://github.com/FasterXML/jackson-databind/issues/3972
+
+-->
+<suppress>
+   <notes><![CDATA[
+   file name: jackson-databind-2.15.2.jar
+   ]]></notes>
+   <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
+   <cve>CVE-2023-35116</cve>
+</suppress>
+
 
 </suppressions>