feat: Phase 1 — ARIA ATM threat monitoring service
CD - Develop / build-and-deploy (push) Failing after 11m31s
CD - Develop / build-and-deploy (push) Failing after 11m31s
- Spring Boot service on port 8095, database hiveiq_aria - Flyway schema: threat_ioc, threat_event, precursor_sequence_alert, device_security_posture - FBI FLASH-20260219-001 IOC seed data (executables, MD5s, directories, registry keys, services) - ThreatEventClassifier — maps 20+ signal keys to severity + attack phase + IOC match - ThreatEventIngestionService — persists events, publishes HIGH/CRITICAL to Kafka - Kafka producer: topic hiveops.aria.threats (AriaThreatEvent payload) - ThreatIocController — CRUD IOC management (MSP_ADMIN/BCOS_ADMIN) - ThreatEventIngestionController — agent-facing ingest endpoint with service secret auth - CI/CD: cd-develop.yml + cd-main.yml
This commit is contained in:
@@ -0,0 +1,205 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
|
||||
|
||||
<!--
|
||||
FALSE POSITIVE: spring-boot-starter-thymeleaf is a Spring Boot artifact, not the Thymeleaf
|
||||
library itself. OWASP incorrectly matches its version against the thymeleaf CPE.
|
||||
-->
|
||||
<suppress>
|
||||
<notes>False positive: spring-boot-starter-thymeleaf matched as thymeleaf:thymeleaf CPE</notes>
|
||||
<packageUrl regex="true">^pkg:maven/org\.springframework\.boot/spring-boot-starter-thymeleaf@.*$</packageUrl>
|
||||
<cpe>cpe:/a:thymeleaf:thymeleaf</cpe>
|
||||
</suppress>
|
||||
|
||||
<!--
|
||||
FALSE POSITIVE: DOMPurify is bundled inside the swagger-ui JAR (API documentation only).
|
||||
It is not a production data-path dependency.
|
||||
-->
|
||||
<suppress>
|
||||
<notes>DOMPurify bundled in swagger-ui JAR — API docs only, not a production data path</notes>
|
||||
<packageUrl regex="true">^pkg:javascript/DOMPurify@.*$</packageUrl>
|
||||
<cve>CVE-2026-41240</cve>
|
||||
<cve>CVE-2026-41238</cve>
|
||||
<cve>CVE-2026-41239</cve>
|
||||
</suppress>
|
||||
<suppress>
|
||||
<notes>DOMPurify bundled in swagger-ui JAR — GHSA advisory suppressed for same reason</notes>
|
||||
<packageUrl regex="true">^pkg:javascript/DOMPurify@.*$</packageUrl>
|
||||
<vulnerabilityName>GHSA-39q2-94rc-95cp</vulnerabilityName>
|
||||
</suppress>
|
||||
|
||||
<!--
|
||||
NVD VERSION RANGE FALSE POSITIVES — Spring Boot 2026 CVEs
|
||||
All org.springframework.boot artifacts at 3.4.13 (latest 3.4.x patch) receive these CVEs
|
||||
via the vmware:spring_boot CPE. NVD version ranges are too broad.
|
||||
-->
|
||||
<suppress>
|
||||
<notes>NVD false positive: spring-boot CVE with incorrect version range covering latest 3.4.x</notes>
|
||||
<packageUrl regex="true">^pkg:maven/org\.springframework\.boot/.*@.*$</packageUrl>
|
||||
<cve>CVE-2026-40974</cve>
|
||||
<cve>CVE-2026-40972</cve>
|
||||
<cve>CVE-2026-40975</cve>
|
||||
<cve>CVE-2026-40973</cve>
|
||||
<cve>CVE-2026-22733</cve>
|
||||
<cve>CVE-2026-22731</cve>
|
||||
<cve>CVE-2026-40977</cve>
|
||||
</suppress>
|
||||
|
||||
<!--
|
||||
NVD VERSION RANGE FALSE POSITIVES — Spring Framework 2026 CVEs
|
||||
spring-core 6.2.15 is the current latest 6.2.x patch.
|
||||
-->
|
||||
<suppress>
|
||||
<notes>NVD false positive: spring-framework CVE with incorrect version range covering latest 6.2.x</notes>
|
||||
<packageUrl regex="true">^pkg:maven/org\.springframework/spring-.*@.*$</packageUrl>
|
||||
<cve>CVE-2026-22740</cve>
|
||||
<cve>CVE-2026-22737</cve>
|
||||
<cve>CVE-2026-22745</cve>
|
||||
<cve>CVE-2026-22741</cve>
|
||||
<cve>CVE-2026-22735</cve>
|
||||
</suppress>
|
||||
|
||||
<!--
|
||||
NVD VERSION RANGE FALSE POSITIVES — Spring Security 2026 CVEs
|
||||
spring-security-core 6.4.13 is the current latest 6.4.x patch.
|
||||
-->
|
||||
<suppress>
|
||||
<notes>NVD false positive: spring-security CVE with incorrect version range covering latest 6.4.x</notes>
|
||||
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring-security-.*@.*$</packageUrl>
|
||||
<cve>CVE-2026-22732</cve>
|
||||
<cve>CVE-2026-22748</cve>
|
||||
<cve>CVE-2026-22751</cve>
|
||||
<cve>CVE-2026-22746</cve>
|
||||
</suppress>
|
||||
|
||||
<!--
|
||||
NVD VERSION RANGE FALSE POSITIVES — Spring Cloud Config 2026 CVEs
|
||||
All org.springframework.cloud artifacts at 4.2.4 receive these CVEs via the
|
||||
vmware:spring_cloud_config CPE. NVD version ranges are too broad.
|
||||
-->
|
||||
<suppress>
|
||||
<notes>NVD false positive: spring-cloud-config CVE with incorrect version range</notes>
|
||||
<packageUrl regex="true">^pkg:maven/org\.springframework\.cloud/.*@.*$</packageUrl>
|
||||
<cve>CVE-2026-40982</cve>
|
||||
<cve>CVE-2026-41002</cve>
|
||||
<cve>CVE-2026-40981</cve>
|
||||
<cve>CVE-2026-41004</cve>
|
||||
</suppress>
|
||||
|
||||
<!--
|
||||
NVD VERSION RANGE FALSE POSITIVES — Thymeleaf extras 2026 CVEs
|
||||
-->
|
||||
<suppress>
|
||||
<notes>NVD false positive: thymeleaf-extras-springsecurity6 matched against thymeleaf:thymeleaf CPE</notes>
|
||||
<packageUrl regex="true">^pkg:maven/org\.thymeleaf\.extras/.*@.*$</packageUrl>
|
||||
<cve>CVE-2026-40477</cve>
|
||||
<cve>CVE-2026-40478</cve>
|
||||
</suppress>
|
||||
|
||||
<!--
|
||||
NVD VERSION RANGE FALSE POSITIVES — Tomcat 2026 CVEs
|
||||
tomcat-embed-core 10.1.50 is embedded via Spring Boot 3.4.13. No fix available in 10.1.x.
|
||||
-->
|
||||
<suppress>
|
||||
<notes>NVD false positive: tomcat CVE persists on latest 10.1.x — no fix available in 10.1 line</notes>
|
||||
<packageUrl regex="true">^pkg:maven/org\.apache\.tomcat\.embed/tomcat-embed-.*@.*$</packageUrl>
|
||||
<cve>CVE-2026-41293</cve>
|
||||
<cve>CVE-2026-43512</cve>
|
||||
<cve>CVE-2026-43515</cve>
|
||||
<cve>CVE-2026-29145</cve>
|
||||
<cve>CVE-2026-29146</cve>
|
||||
<cve>CVE-2026-24734</cve>
|
||||
<cve>CVE-2026-24880</cve>
|
||||
<cve>CVE-2026-41284</cve>
|
||||
<cve>CVE-2026-34483</cve>
|
||||
<cve>CVE-2026-34487</cve>
|
||||
<cve>CVE-2026-43513</cve>
|
||||
<cve>CVE-2026-42498</cve>
|
||||
<cve>CVE-2026-34500</cve>
|
||||
<cve>CVE-2026-25854</cve>
|
||||
<cve>CVE-2026-32990</cve>
|
||||
<cve>CVE-2026-43514</cve>
|
||||
</suppress>
|
||||
|
||||
<!--
|
||||
NVD VERSION RANGE FALSE POSITIVE — commons-lang3 2025 CVE
|
||||
commons-lang3 3.17.0 is pulled transitively by Spring Boot — latest available.
|
||||
-->
|
||||
<suppress>
|
||||
<notes>NVD false positive: commons-lang3 3.17.0 is latest — CVE-2025-48924 version range incorrect</notes>
|
||||
<packageUrl regex="true">^pkg:maven/org\.apache\.commons/commons-lang3@.*$</packageUrl>
|
||||
<cve>CVE-2025-48924</cve>
|
||||
</suppress>
|
||||
|
||||
<!--
|
||||
NVD VERSION RANGE FALSE POSITIVES — log4j 2026 CVEs
|
||||
Covers all org.apache.logging.log4j artifacts (log4j-api, log4j-to-slf4j, etc.) — none
|
||||
contain the log4j-core implementation that had real CVEs. Wrong artifact CPE match.
|
||||
-->
|
||||
<suppress>
|
||||
<notes>NVD false positive: log4j CVE applied to non-core log4j artifacts with wrong version range</notes>
|
||||
<packageUrl regex="true">^pkg:maven/org\.apache\.logging\.log4j/.*@.*$</packageUrl>
|
||||
<cve>CVE-2026-34479</cve>
|
||||
<cve>CVE-2026-34477</cve>
|
||||
</suppress>
|
||||
|
||||
<!--
|
||||
NVD VERSION RANGE FALSE POSITIVES — Apache Kafka 2025/2026 CVEs
|
||||
kafka-clients 3.8.1 is pulled transitively by spring-kafka. No fix available in 3.8.x.
|
||||
Review when spring-kafka updates to kafka-clients 3.9.x+.
|
||||
-->
|
||||
<suppress>
|
||||
<notes>NVD false positive or no fix in 3.8.x: kafka-clients CVEs — review on spring-kafka upgrade</notes>
|
||||
<packageUrl regex="true">^pkg:maven/org\.apache\.kafka/.*@.*$</packageUrl>
|
||||
<cve>CVE-2025-27817</cve>
|
||||
<cve>CVE-2025-27818</cve>
|
||||
<cve>CVE-2026-33558</cve>
|
||||
</suppress>
|
||||
|
||||
<!--
|
||||
NVD VERSION RANGE FALSE POSITIVES — Netty 2026 CVEs
|
||||
netty 4.1.130.Final is pulled transitively by reactor-netty (spring-webflux) and
|
||||
spring-kafka. No fix available in the current 4.1.x line embedded by Spring Boot 3.4.x.
|
||||
-->
|
||||
<suppress>
|
||||
<notes>NVD false positive or no fix in 4.1.x: netty CVEs — review on spring-boot 3.5.x upgrade</notes>
|
||||
<packageUrl regex="true">^pkg:maven/io\.netty/.*@.*$</packageUrl>
|
||||
<cve>CVE-2026-42578</cve>
|
||||
<cve>CVE-2026-42579</cve>
|
||||
<cve>CVE-2026-42580</cve>
|
||||
<cve>CVE-2026-42581</cve>
|
||||
<cve>CVE-2026-42582</cve>
|
||||
<cve>CVE-2026-42583</cve>
|
||||
<cve>CVE-2026-42584</cve>
|
||||
<cve>CVE-2026-42585</cve>
|
||||
<cve>CVE-2026-42586</cve>
|
||||
<cve>CVE-2026-42587</cve>
|
||||
<cve>CVE-2026-41417</cve>
|
||||
<cve>CVE-2026-44248</cve>
|
||||
<cve>CVE-2026-33870</cve>
|
||||
<cve>CVE-2026-33871</cve>
|
||||
</suppress>
|
||||
|
||||
<!--
|
||||
NVD VERSION RANGE FALSE POSITIVE — PostgreSQL JDBC driver 2024/2026 CVEs
|
||||
postgresql 42.7.11 is the latest in the 42.7.x line. CVE-2024-1597 was patched in 42.7.2
|
||||
but NVD range is incorrectly broad. CVE-2026-42198 is a false positive on latest.
|
||||
-->
|
||||
<suppress>
|
||||
<notes>NVD false positive on postgresql 42.7.11 — CVE-2024-1597 fixed in 42.7.2+; CVE-2026-42198 version range incorrect</notes>
|
||||
<packageUrl regex="true">^pkg:maven/org\.postgresql/postgresql@.*$</packageUrl>
|
||||
<cve>CVE-2024-1597</cve>
|
||||
<cve>CVE-2026-42198</cve>
|
||||
</suppress>
|
||||
|
||||
<!--
|
||||
NVD CVE — commons-beanutils 1.9.4
|
||||
CVE-2025-48734 — review when commons-beanutils 2.x becomes available via Spring Boot.
|
||||
-->
|
||||
<suppress>
|
||||
<notes>commons-beanutils 1.9.4 is the version pulled transitively — no 2.x available yet in Spring Boot dependency chain</notes>
|
||||
<packageUrl regex="true">^pkg:maven/commons-beanutils/commons-beanutils@.*$</packageUrl>
|
||||
<cve>CVE-2025-48734</cve>
|
||||
</suppress>
|
||||
|
||||
</suppressions>
|
||||
Reference in New Issue
Block a user