44 lines
2.9 KiB
XML
44 lines
2.9 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
|
|
<suppress>
|
|
<notes><![CDATA[
|
|
This can be suppressed because it is a transient dependency of the `pre-commit-hooks` dependency, which only uses ruamel-yaml if the YAML-specific hooks are actually run.
|
|
|
|
Additionally, the vulnerability CVE-2022-3064 (Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.) only applies when parsing untrusted (user-supplied) YAML, which isn't the case here.
|
|
The gist: Never trust a user-submitted YAML file! This could DoS your app!
|
|
]]></notes>
|
|
<packageUrl regex="true">^pkg:pypi/ruamel-yaml-clib@.*$</packageUrl>
|
|
<cve>CVE-2022-3064</cve>
|
|
</suppress>
|
|
<suppress>
|
|
<notes><![CDATA[
|
|
This can be suppressed because it is a transient dependency of the `pre-commit-hooks` dependency, which only uses ruamel-yaml if the YAML-specific hooks are actually run.
|
|
|
|
Additionally, the vulnerability CVE-2021-4235 (Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.) only applies when parsing untrusted (user-supplied) YAML, which isn't the case here.
|
|
The gist: Never trust a user-submitted YAML file! This could DoS your app!
|
|
]]></notes>
|
|
<packageUrl regex="true">^pkg:pypi/ruamel-yaml-clib@.*$</packageUrl>
|
|
<cve>CVE-2021-4235</cve>
|
|
</suppress>
|
|
<suppress>
|
|
<notes><![CDATA[
|
|
This can be suppressed because it is a transient dependency of the `pre-commit-hooks` dependency, which only uses ruamel-yaml if the YAML-specific hooks are actually run.
|
|
|
|
Additionally, the vulnerability CVE-2022-3064 (Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.) only applies when parsing untrusted (user-supplied) YAML, which isn't the case here.
|
|
The gist: Never trust a user-submitted YAML file! This could DoS your app!
|
|
]]></notes>
|
|
<packageUrl regex="true">^pkg:pypi/ruamel-yaml@.*$</packageUrl>
|
|
<cve>CVE-2022-3064</cve>
|
|
</suppress>
|
|
<suppress>
|
|
<notes><![CDATA[
|
|
This can be suppressed because it is a transient dependency of the `pre-commit-hooks` dependency, which only uses ruamel-yaml if the YAML-specific hooks are actually run.
|
|
|
|
Additionally, the vulnerability CVE-2021-4235 (Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.) only applies when parsing untrusted (user-supplied) YAML, which isn't the case here.
|
|
The gist: Never trust a user-submitted YAML file! This could DoS your app!
|
|
]]></notes>
|
|
<packageUrl regex="true">^pkg:pypi/ruamel-yaml@.*$</packageUrl>
|
|
<cve>CVE-2021-4235</cve>
|
|
</suppress>
|
|
</suppressions>
|