From c2058b206846b1f412476db0e407eff8d21c40bd Mon Sep 17 00:00:00 2001
From: Tara Drwenski <tdrwenski@users.noreply.github.com>
Date: Thu, 27 Jun 2024 12:37:11 -0600
Subject: [PATCH] Suppress spurious/not relevant jfreechart CVEs (#1358)

---
 .../dependency-check-suppression.xml                   | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/project-files/owasp-dependency-check/dependency-check-suppression.xml b/project-files/owasp-dependency-check/dependency-check-suppression.xml
index 116614c9cb..550aa5617f 100644
--- a/project-files/owasp-dependency-check/dependency-check-suppression.xml
+++ b/project-files/owasp-dependency-check/dependency-check-suppression.xml
@@ -24,4 +24,14 @@
     ]]></notes>
     <cve>CVE-2023-35116</cve>
   </suppress>
+  <suppress>
+    <notes><![CDATA[
+   file name: uicdm-5.5.4-SNAPSHOT.tar: jfreechart-1.0.19.jar
+   reason: Disputed CVEs and we do not use the vulnerable components (BubbleXYItemLabelGenerator.java, /chart/annotations/CategoryLineAnnotation, setSeriesNeedle)
+   ]]></notes>
+    <packageUrl regex="true">^pkg:maven/org\.jfree/jfreechart@.*$</packageUrl>
+    <vulnerabilityName>CVE-2024-23076</vulnerabilityName>
+    <vulnerabilityName>CVE-2024-22949</vulnerabilityName>
+    <vulnerabilityName>CVE-2023-52070</vulnerabilityName>
+  </suppress>
 </suppressions>