rewrite-maven-plugin/suppressions.xml at main · openrewrite/rewrite-maven-plugin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
    <suppress until="2026-08-01Z">
        <notes><![CDATA[
       CVE-2026-53914 is unsafe deserialization of untrusted Kotlin build-cache
       metadata, allowing code execution (fixed in Kotlin 2.4.20). It requires local
       access, high privileges and high attack complexity (CVSS 6.7; the scanner
       inflates it to CRITICAL). Here org.jetbrains.kotlin:kotlin-stdlib arrives as a
       runtime dependency of the rewrite-kotlin recipe module, but the vulnerable code
       path is the Kotlin build-cache metadata deserialization in the Kotlin Gradle
       plugin / build tooling, which is not present in kotlin-stdlib and is not used by
       this Maven plugin. No GA toolchain at 2.4.20 has been released yet (only
       2.4.20-Beta1), so there is nothing to bump to. Re-evaluate when 2.4.20 goes GA.
       Added: 2026-07-03
       ]]></notes>
        <cve>CVE-2026-53914</cve>
    </suppress>
    <suppress until="2026-08-01Z">
        <notes><![CDATA[
       jackson-databind polymorphic-typing / deserialization advisories:
       CVE-2026-54512 (PolymorphicTypeValidator bypass via generic type parameters),
       CVE-2026-54513 (allowIfSubTypeIsArray allowlist bypass), CVE-2026-54514
       (InetSocketAddress eager DNS resolution / SSRF) and CVE-2026-54515
       (case-insensitive deserialization bypasses per-property @JsonIgnoreProperties).
       All require enabling default/polymorphic typing on attacker-controlled input;
       rewrite-maven-plugin uses jackson only to read Maven/recipe configuration and
       serialized LSTs, not untrusted polymorphic JSON, so the gadget paths are not
       reachable. jackson is managed centrally via jackson-bom (2.21.4). Re-evaluate
       when the jackson-bom moves to the clean 2.21.5+ patch release.
       Added: 2026-07-03
       ]]></notes>
        <cve>CVE-2026-54512</cve>
        <cve>CVE-2026-54513</cve>
        <cve>CVE-2026-54514</cve>
        <cve>CVE-2026-54515</cve>
    </suppress>
</suppressions>