<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2010-2025 Evolveum and contributors
  ~
  ~ Licensed under the EUPL-1.2 or later.
  -->

<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
  <!-- IMPORTANT: It may be bit weird, having first reason for suppresion, then the issue suppresed,
       but dependency-chek uses strict schema and they decided on that order of elements.
       When any of suppresion has notes and cve reordered, it will not load suppression file
  -->
  <suppress>
      <notes>False Positive. Derby is not part of production build of midPoint, it is used only for testing.</notes>
      <cve>CVE-2022-46337</cve>
  </suppress>
  
  <suppress>
      <notes>False Positive. Jetty is not part of production build of midPoint, it is used only for testing.</notes>
      <cve>CVE-2023-36478</cve>
      <cve>CVE-2023-44487</cve>
      <cve>CVE-2023-40167</cve>
      <cve>CVE-2023-36479</cve>
      <cve>CVE-2023-41900</cve>
  </suppress>
  <suppress>
      <notes>
          False Positive. midPoint does not use crypto-js for any crypthographic functionality. crypto-js is transitive dependency
          of pdfkit (whose functionality is also not used by midPoint), which is transitive dependency of AdminLTE
      </notes>
      <cve>CVE-2023-46233</cve>
  </suppress>
  <suppress>
      <notes>
          False Positive. CVE is disputed, since library is not used with untrusted data. Janino is not used with user supplied input.
      </notes>
      <cve>CVE-2023-33546</cve>
  </suppress>
  <suppress>
      <notes>
          False Positive. Jackson Databind in midPoint is not used to directly serialize untrusted graph of objects.
      </notes>
      <cve>CVE-2023-35116</cve>
  </suppress>
  <suppress>
      <notes>
          False Positive. Apache Ivy is transitive dependency via Groovy 4.0 All (intended for Groovy Scripting Support).
          MidPoint and build system does not use Apache Ivy.
      </notes>
      <cve>CVE-2022-46751</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. CVE was withdrawn from NVD NIST, since investigation of original CVE showed it was not a security issue, but tooling still reports it as issue.
    </notes>
    <cve>CVE-2021-23334</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint uses AdminLTE library, which depends on pdfmake, but does not use any functionality related to pdfmake.
    </notes>
    <cve>CVE-2022-46161</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint binaries does not contain or use BCEL in deployment. BCEL is used only in unit testing libraries.
    </notes>
    <cve>CVE-2022-42920</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint binaries does not contain or use Berkeley DB Java Edition in deployment. It is only used in unit testing libraries.
    </notes>
    <cve>CVE-2017-3604</cve>
    <cve>CVE-2017-3605</cve>
    <cve>CVE-2017-3606</cve>
    <cve>CVE-2017-3607</cve>
    <cve>CVE-2017-3608</cve>
    <cve>CVE-2017-3609</cve>
    <cve>CVE-2017-3610</cve>
    <cve>CVE-2017-3611</cve>
    <cve>CVE-2017-3612</cve>
    <cve>CVE-2017-3613</cve>
    <cve>CVE-2017-3614</cve>
    <cve>CVE-2017-3615</cve>
    <cve>CVE-2017-3616</cve>
    <cve>CVE-2017-3617</cve>
    <cve>CVE-2020-2981</cve>
    <cve>CVE-2019-2708</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. midPoint uses Spring Security, but does not use Spring WebFlux, so it is unaffected.
    </notes>
    <cve>CVE-2023-34034</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. H2 is not recommended for production use, only for demo testing use-cases.
    </notes>
    <cve>CVE-2021-42392</cve>
    <cve>CVE-2022-23221</cve>
    <cve>CVE-2018-14335</cve>
    <cve>CVE-2022-45868</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint and its dependencies does not use affected functionality of SnakeYaml.
    </notes>
    <cve>CVE-2022-1471</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use Spring Security in a way neccessary to cause described vulnerability.
    </notes>
    <cve>CVE-2022-31692</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not run as ActiveMQ Artemis server, only client.
    </notes>
    <cve>CVE-2022-23913</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use OpenSSL for SSL and crypthography.
    </notes>
    <cve>CVE-2023-0217</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use OpenSSL for SSL and crypthography.
    </notes>
    <cve>CVE-2023-0401</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use OpenSSL for SSL and crypthography.
    </notes>
    <cve>CVE-2023-0464</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use OpenSSL for SSL and crypthography.
    </notes>
    <cve>CVE-2023-0216</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use OpenSSL for SSL and crypthography.
    </notes>
    <cve>CVE-2022-3996</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use OpenSSL for SSL and crypthography.
    </notes>
    <cve>CVE-2022-4450</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use OpenSSL for SSL and crypthography.
    </notes>
    <cve>CVE-2023-0286</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use WYSIWYG editors from AdminLTE.
    </notes>
    <cve>CVE-2022-24729</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use affected functionality (BeanDeserializer) during JSON / YAML parsing.
    </notes>
    <cve>CVE-2022-42004</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use affected functionality (BeanDeserializer) during JSON / YAML parsing.
    </notes>
    <cve>CVE-2022-42003</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use Moment.js on server-side.
    </notes>
    <cve>CVE-2022-31129</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use Moment.js on server-side.
    </notes>
    <cve>CVE-2022-24785</cve>
  </suppress>
  <suppress>
    <notes>
      Updated Netty Library in upcoming 4.4.5 release.
    </notes>
    <cve>CVE-2022-41881</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use affected functionality of library.
    </notes>
    <cve>CVE-2022-3171</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use affected functionality of library.
    </notes>
    <cve>CVE-2022-3509</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use affected functionality of library.
    </notes>
    <cve>CVE-2022-3510</cve>
  </suppress>
  <suppress>
    <notes>
      Minor. MidPoint integrator and/or MidPoint Administrator is only person able to edit JDBC URL.
    </notes>
    <cve>CVE-2022-26520</cve>
  </suppress>
  <suppress>
    <notes>
      Updated Spring Framework in upcoming midPoint 4.4.5 release.
    </notes>
    <cve>CVE-2023-20860</cve>
  </suppress>
  <suppress>
    <notes>
      Minor. Fixed use of dependency to be not affected by this issue. Fix is available in upcoming midPoint 4.4.5 release.
    </notes>
    <cve>CVE-2022-40152</cve>
  </suppress>
  <!-- Wicket: Midpoint uses Wicket 9.5 or newer since midPoint 4.4.1 -->
  <suppress>
    <notes>
      False Positive. MidPoint uses Wicket 9.5 in midPoint 4.4.1 and newer versions in other releases.
    </notes>
    <cve>CVE-2017-15719</cve>
  </suppress>
    <suppress>
    <notes>
      False Positive. MidPoint uses Wicket 9.5 in midPoint 4.4.1 and newer versions in other releases. MidPoint does not use WYSIWYG editor.
    </notes>
    <cve>CVE-2018-1325</cve>
  </suppress>
    <suppress>
    <notes>
      False Positive. MidPoint uses Wicket 9.5 in midPoint 4.4.1 and newer versions in other releases.
    </notes>
    <cve>CVE-2021-23937</cve>
  </suppress>

  <!-- Busybox: Busybox is not used by midPoint, but is part of docker container. -->
  <suppress>
    <notes>
      False Positive. busybox is bundled in docker container, but midPoint does not use it during normal run.
    </notes>
    <cve>CVE-2022-28391</cve>
  </suppress>
    <suppress>
    <notes>
      False Positive. busybox is bundled in docker container, but midPoint does not use it during normal run.
    </notes>
    <cve>CVE-2022-30065</cve>
  </suppress>

  <!-- Bootstrap: MidPoint uses newer unaffected version of bootstrap. -->
  <suppress>
    <notes>
      False Positive. MidPoint 4.4.1 uses AdminLTE 2.4.18, which contains Bootstrap 3.4.1 which is not affected.
    </notes>
    <cve>CVE-2016-10735</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint 4.4.1 uses AdminLTE 2.4.18, which contains Bootstrap 3.4.1 which is not affected.
    </notes>
    <cve>CVE-2018-20676</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint 4.4.1 uses AdminLTE 2.4.18, which contains Bootstrap 3.4.1 which is not affected.
    </notes>
    <cve>CVE-2019-8331</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint 4.4.1 uses AdminLTE 2.4.18, which contains Bootstrap 3.4.1 which is not affected.
    </notes>
    <cve>CVE-2018-20677</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint and Wicket are not used to display HTML from untrusted sources.
    </notes>
    <cve>CVE-2020-11023</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. midPoint does not use LDAP CertStore for certificate validations. 
    </notes>
    <cve>CVE-2023-33201</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. Default tomcat application is not exposed.
    </notes>
    <cve>CVE-2023-41080</cve>
  </suppress>
  <suppress>
    <notes>
      False positive. Okio is not used in midPoint directly, Okio is used only in ninja tool
    </notes>
    <cve>CVE-2023-3635</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use xmlsec with debug logging enebaled.
    </notes>
    <cve>CVE-2023-44483</cve>
  </suppress>
  <suppress>
    <notes>
      False Positive. MidPoint does not use logback in a way leading to vulnerability.
    </notes>
    <cve>CVE-2023-6378</cve>
  </suppress>
</suppressions>
