Merge branch 'ignore-cves'

mullvad · Aug 23, 2024 · 4edc4fc · 4edc4fc
2 parents 16f8739 + 489f616
commit 4edc4fc
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 0 deletions.
diff --git a/ci/ios/upload-vm/osv-scanner.toml b/ci/ios/upload-vm/osv-scanner.toml
@@ -0,0 +1,8 @@
+# See repository root `osv-scanner.toml` for instructions and rules for this file.
+
+# rexml: The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML
+# that has many deep elements that have same local name attributes.
+[[IgnoredVulns]]
+id = "CVE-2024-43398" # GHSA-952p-6rrq-rcjv
+ignoreUntil = 2024-11-23
+reason = "rexml only parses trusted input (responses from Apple's APIs) in this code"
diff --git a/gui/osv-scanner.toml b/gui/osv-scanner.toml
@@ -42,3 +42,9 @@ reason = "We don't utilize the signing features in browserify"
 id = "CVE-2024-42459" # GHSA-f7q4-pwc6-w24p
 ignoreUntil = 2024-10-15
 reason = "We don't utilize the signing features in browserify"
+
+# micromatch (dev): Regular Expression Denial of Service (ReDoS) in micromatch
+[[IgnoredVulns]]
+id = "CVE-2024-4067" # GHSA-952p-6rrq-rcjv
+ignoreUntil = 2024-11-23
+reason = "This is just a dev dependency, and we don't have untrusted input to micromatch there"
diff --git a/ios/osv-scanner.toml b/ios/osv-scanner.toml
@@ -0,0 +1,8 @@
+# See repository root `osv-scanner.toml` for instructions and rules for this file.
+
+# rexml: The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML
+# that has many deep elements that have same local name attributes.
+[[IgnoredVulns]]
+id = "CVE-2024-43398" # GHSA-952p-6rrq-rcjv
+ignoreUntil = 2024-11-23
+reason = "rexml only parses trusted input (responses from Apple's APIs) in this code"