CVE vulnerability CVE-2023-35116 (suppressed) and CVE-2023-2976 (fixe…

…d in bundle version 6.7.4) (#2237) * Update bundle to 6.7.3 * Update bundle version * Remove deleted module from config * Add config so CVE scans run on forks * Suppress false positive CVE-2023-35116 in jackson-databind
finos · Jul 3, 2023 · b1198aa · b1198aa
1 parent 7c9d93b
commit b1198aa
Show file tree

Hide file tree

Showing 44 changed files with 64 additions and 45 deletions.
diff --git a/.github/workflows/cve-scanning.yml b/.github/workflows/cve-scanning.yml
@@ -7,6 +7,11 @@ on:
       - 'pom.xml'
       - 'allow-list.xml'
       - '.github/workflows/cve-scanning.yml'
+  pull_request:
+    paths:
+      - 'pom.xml'
+      - 'allow-list.xml'
+      - '.github/workflows/cve-scanning.yml'
 
 jobs:
   build:

diff --git a/.github/workflows/license-scanning.yml b/.github/workflows/license-scanning.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        module-folder: ["./", "./examples", "./rosetta-source", "./rosetta-project", "./distribution", "./scheme-import"]
+        module-folder: ["./", "./examples", "./rosetta-source", "./rosetta-project", "./distribution"]
     steps:
     - uses: actions/checkout@v3
     - name: Set up JDK 11

diff --git a/allow-list.xml b/allow-list.xml
@@ -42,4 +42,12 @@
 	   ]]></notes>
         <cve>CVE-2020-27225</cve>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+	   Suppress false positive CVE-2023-35116 in jackson-databind.
+	   See issue https://github.com/FasterXML/jackson-databind/issues/3972
+	   See CVE https://nvd.nist.gov/vuln/detail/CVE-2023-35116
+	   ]]></notes>
+        <cve>CVE-2023-35116</cve>
+    </suppress>
 </suppressions>
diff --git a/pom.xml b/pom.xml
@@ -82,7 +82,7 @@
 
         <repoServerHost>oss.sonatype.org</repoServerHost>
 
-        <rosetta.bundle.version>6.7.0</rosetta.bundle.version>
+        <rosetta.bundle.version>6.7.4</rosetta.bundle.version>
         <rosetta.code-gen.version>${rosetta.bundle.version}</rosetta.code-gen.version>
         <rosetta.dsl.version>7.10.0</rosetta.dsl.version>
 
@@ -92,6 +92,7 @@
         <jsoup.version>1.15.3</jsoup.version>
         <jaxb.version>2.3.1</jaxb.version>
         <slf4j-api.version>2.0.7</slf4j-api.version>
+        <guava.version>32.0.1-jre</guava.version>
 
         <!-- test -->
         <junit.version>5.9.1</junit.version>
@@ -365,6 +366,11 @@
                 <artifactId>slf4j-api</artifactId>
                 <version>${slf4j-api.version}</version>
             </dependency>
+            <dependency>
+                <groupId>com.google.guava</groupId>
+                <artifactId>guava</artifactId>
+                <version>${guava.version}</version>
+            </dependency>
             <!-- test -->
             <dependency>
                 <groupId>org.junit</groupId>

diff --git a/...sample-files/functions/cme-cleared-confirm-1-17/Basis-ex01-LIBOR-vs-SOFR-func-output.json b/...sample-files/functions/cme-cleared-confirm-1-17/Basis-ex01-LIBOR-vs-SOFR-func-output.json
@@ -2357,7 +2357,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "880cb4f9"
+    "globalKey" : "1d53651d"
   },
   "party" : [ {
     "meta" : {

diff --git a/...n/resources/cdm-sample-files/functions/cme-cleared-confirm-1-17/FRA-ex01-func-output.json b/...n/resources/cdm-sample-files/functions/cme-cleared-confirm-1-17/FRA-ex01-func-output.json
@@ -1051,7 +1051,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "c54779a9"
+    "globalKey" : "c52f5b93"
   },
   "party" : [ {
     "meta" : {

diff --git a/...n/resources/cdm-sample-files/functions/cme-cleared-confirm-1-17/FRA-ex02-func-output.json b/...n/resources/cdm-sample-files/functions/cme-cleared-confirm-1-17/FRA-ex02-func-output.json
@@ -1073,7 +1073,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "196feae2"
+    "globalKey" : "bdcdb2de"
   },
   "party" : [ {
     "meta" : {

diff --git a/...cdm-sample-files/functions/cme-cleared-confirm-1-17/IRS-ex01-Fixed-Float-func-output.json b/...cdm-sample-files/functions/cme-cleared-confirm-1-17/IRS-ex01-Fixed-Float-func-output.json
@@ -1789,7 +1789,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "76bd250c"
+    "globalKey" : "7695487a"
   },
   "party" : [ {
     "meta" : {

diff --git a/...cdm-sample-files/functions/cme-cleared-confirm-1-17/IRS-ex02-Fixed-Float-func-output.json b/...cdm-sample-files/functions/cme-cleared-confirm-1-17/IRS-ex02-Fixed-Float-func-output.json
@@ -2465,7 +2465,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "4ec654bf"
+    "globalKey" : "a1c2be07"
   },
   "party" : [ {
     "meta" : {

diff --git a/...s/cme-cleared-confirm-1-17/IRS-ex03-Fixed-Float-with-Amortizing-Schedule-func-output.json b/...s/cme-cleared-confirm-1-17/IRS-ex03-Fixed-Float-with-Amortizing-Schedule-func-output.json
@@ -2547,7 +2547,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "4d6c5846"
+    "globalKey" : "bef2ef8a"
   },
   "party" : [ {
     "meta" : {

diff --git a/...functions/cme-cleared-confirm-1-17/IRS-ex04-Fixed-Float-with-Compounding-func-output.json b/...functions/cme-cleared-confirm-1-17/IRS-ex04-Fixed-Float-with-Compounding-func-output.json
@@ -3181,7 +3181,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "c368d1b3"
+    "globalKey" : "6874eaab"
   },
   "party" : [ {
     "meta" : {

diff --git a/...s/functions/cme-cleared-confirm-1-17/IRS-ex05-Fixed-Float-with-Long-Stub-func-output.json b/...s/functions/cme-cleared-confirm-1-17/IRS-ex05-Fixed-Float-with-Long-Stub-func-output.json
@@ -2581,7 +2581,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "30c03b14"
+    "globalKey" : "dc2d6688"
   },
   "party" : [ {
     "meta" : {

diff --git a/.../functions/cme-cleared-confirm-1-17/IRS-ex06-Fixed-Float-Non-Deliverable-func-output.json b/.../functions/cme-cleared-confirm-1-17/IRS-ex06-Fixed-Float-Non-Deliverable-func-output.json
@@ -1589,7 +1589,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "8b8f06bd"
+    "globalKey" : "8bb4d8ab"
   },
   "party" : [ {
     "meta" : {

diff --git a/...ctions/cme-cleared-confirm-1-17/IRS-ex07-Fixed-Float-Zero-Coupon-BRL-CDI-func-output.json b/...ctions/cme-cleared-confirm-1-17/IRS-ex07-Fixed-Float-Zero-Coupon-BRL-CDI-func-output.json
@@ -1645,7 +1645,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "fa382d09"
+    "globalKey" : "fa5e1a93"
   },
   "party" : [ {
     "meta" : {

diff --git a/...ample-files/functions/cme-cleared-confirm-1-17/IRS-ex08-Fixed-Float-Zero-func-output.json b/...ample-files/functions/cme-cleared-confirm-1-17/IRS-ex08-Fixed-Float-Zero-func-output.json
@@ -1475,7 +1475,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "3851b1fe"
+    "globalKey" : "a98f6896"
   },
   "party" : [ {
     "meta" : {

diff --git a/...sources/cdm-sample-files/functions/cme-cleared-confirm-1-17/IRS-ex09-OIS-func-output.json b/...sources/cdm-sample-files/functions/cme-cleared-confirm-1-17/IRS-ex09-OIS-func-output.json
@@ -1457,7 +1457,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "e7289ae9"
+    "globalKey" : "5206f4e5"
   },
   "party" : [ {
     "meta" : {

diff --git a/...sources/cdm-sample-files/functions/cme-cleared-confirm-1-17/IRS-ex10-OIS-func-output.json b/...sources/cdm-sample-files/functions/cme-cleared-confirm-1-17/IRS-ex10-OIS-func-output.json
@@ -1457,7 +1457,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "2bc40cec"
+    "globalKey" : "97331c64"
   },
   "party" : [ {
     "meta" : {

diff --git a/...sources/cdm-sample-files/functions/cme-cleared-confirm-1-17/IRS-ex11-OIS-func-output.json b/...sources/cdm-sample-files/functions/cme-cleared-confirm-1-17/IRS-ex11-OIS-func-output.json
@@ -2265,7 +2265,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "40cb2cec"
+    "globalKey" : "945cca14"
   },
   "party" : [ {
     "meta" : {

diff --git a/...s/functions/cme-cleared-confirm-1-17/SWAPTION_TERMINATED_DUE_TO_EXERCISE-func-output.json b/...s/functions/cme-cleared-confirm-1-17/SWAPTION_TERMINATED_DUE_TO_EXERCISE-func-output.json
@@ -1941,7 +1941,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "f8d88b37"
+    "globalKey" : "f8f0ce1d"
   },
   "party" : [ {
     "meta" : {

diff --git a/...le-files/functions/cme-cleared-confirm-1-17/SWAP_CREATED_DUE_TO_EXERCISE-func-output.json b/...le-files/functions/cme-cleared-confirm-1-17/SWAP_CREATED_DUE_TO_EXERCISE-func-output.json
@@ -1705,7 +1705,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "df9189d0"
+    "globalKey" : "dfa7dcb6"
   },
   "party" : [ {
     "meta" : {

diff --git a/...ources/cdm-sample-files/functions/cme-cleared-confirm-1-17/Swaption-ex01-func-output.json b/...ources/cdm-sample-files/functions/cme-cleared-confirm-1-17/Swaption-ex01-func-output.json
@@ -3161,7 +3161,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "1c1f17a8"
+    "globalKey" : "1c06b546"
   },
   "party" : [ {
     "meta" : {

diff --git a/...ources/cdm-sample-files/functions/cme-cleared-confirm-1-17/Swaption-ex02-func-output.json b/...ources/cdm-sample-files/functions/cme-cleared-confirm-1-17/Swaption-ex02-func-output.json
@@ -2251,7 +2251,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "db8483fe"
+    "globalKey" : "698f7386"
   },
   "party" : [ {
     "meta" : {

diff --git a/...ctions/cme-cleared-confirm-1-17/Swaption-ex03-Straddle-Physical-Exercise-func-output.json b/...ctions/cme-cleared-confirm-1-17/Swaption-ex03-Straddle-Physical-Exercise-func-output.json
@@ -3163,7 +3163,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "84a268af"
+    "globalKey" : "847a8d91"
   },
   "party" : [ {
     "meta" : {

diff --git a/...ce/src/main/resources/cdm-sample-files/functions/dtcc-11-0/DDL_NewTrade1-func-output.json b/...ce/src/main/resources/cdm-sample-files/functions/dtcc-11-0/DDL_NewTrade1-func-output.json
@@ -1019,7 +1019,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "9759e70f"
+    "globalKey" : "1ef82c3"
   },
   "party" : [ {
     "meta" : {

diff --git a/...ce/src/main/resources/cdm-sample-files/functions/dtcc-11-0/DDL_NewTrade2-func-output.json b/...ce/src/main/resources/cdm-sample-files/functions/dtcc-11-0/DDL_NewTrade2-func-output.json
@@ -1113,7 +1113,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "fd397bcd"
+    "globalKey" : "8b50ca2d"
   },
   "party" : [ {
     "meta" : {

diff --git a/...ce/src/main/resources/cdm-sample-files/functions/dtcc-11-0/DDL_NewTrade3-func-output.json b/...ce/src/main/resources/cdm-sample-files/functions/dtcc-11-0/DDL_NewTrade3-func-output.json
@@ -915,7 +915,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "7e4d5644"
+    "globalKey" : "2a850d94"
   },
   "party" : [ {
     "meta" : {

diff --git a/...ce/src/main/resources/cdm-sample-files/functions/dtcc-11-0/DDL_NewTrade4-func-output.json b/...ce/src/main/resources/cdm-sample-files/functions/dtcc-11-0/DDL_NewTrade4-func-output.json
@@ -1057,7 +1057,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "d776389c"
+    "globalKey" : "84b15838"
   },
   "party" : [ {
     "meta" : {

diff --git a/...ce/src/main/resources/cdm-sample-files/functions/dtcc-11-0/DDL_NewTrade5-func-output.json b/...ce/src/main/resources/cdm-sample-files/functions/dtcc-11-0/DDL_NewTrade5-func-output.json
@@ -783,7 +783,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "8e150014"
+    "globalKey" : "1cabd26c"
   },
   "party" : [ {
     "meta" : {

diff --git a/...ce/src/main/resources/cdm-sample-files/functions/dtcc-11-0/DDL_NewTrade6-func-output.json b/...ce/src/main/resources/cdm-sample-files/functions/dtcc-11-0/DDL_NewTrade6-func-output.json
@@ -981,7 +981,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "6d405e4c"
+    "globalKey" : "12274664"
   },
   "party" : [ {
     "meta" : {

diff --git a/...unctions/fpml-5-10/processes/msg-cleared-alpha-trade-CFTC-SEC-and-canada-func-output.json b/...unctions/fpml-5-10/processes/msg-cleared-alpha-trade-CFTC-SEC-and-canada-func-output.json
@@ -1538,7 +1538,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "c8e3f5b9"
+    "globalKey" : "6e664fa5"
   },
   "party" : [ {
     "businessUnit" : [ {

diff --git a/...ns/fpml-5-10/processes/msg-ex51-execution-advice-trade-initiation-C01-00-func-output.json b/...ns/fpml-5-10/processes/msg-ex51-execution-advice-trade-initiation-C01-00-func-output.json
@@ -963,7 +963,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "bb8512d2"
+    "globalKey" : "bb5d5160"
   },
   "party" : [ {
     "meta" : {

diff --git a/...l-5-10/processes/msg-ex52-execution-advice-trade-partial-novation-C02-00-func-output.json b/...l-5-10/processes/msg-ex52-execution-advice-trade-partial-novation-C02-00-func-output.json
@@ -1578,7 +1578,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "afeef302"
+    "globalKey" : "afd8b56c"
   },
   "party" : [ {
     "meta" : {

diff --git a/...esses/msg-ex53-execution-advice-trade-partial-novation-correction-C02-10-func-output.json b/...esses/msg-ex53-execution-advice-trade-partial-novation-correction-C02-10-func-output.json
@@ -1578,7 +1578,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "397bf93e"
+    "globalKey" : "396586dc"
   },
   "party" : [ {
     "meta" : {

diff --git a/...ns/fpml-5-10/processes/msg-ex58-execution-advice-trade-initiation-F01-00-func-output.json b/...ns/fpml-5-10/processes/msg-ex58-execution-advice-trade-initiation-F01-00-func-output.json
@@ -899,7 +899,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "a89d04d9"
+    "globalKey" : "a87550f7"
   },
   "party" : [ {
     "meta" : {

diff --git a/...functions/fpml-5-10/processes/msg-ex63-execution-advice-trade-initiation-func-output.json b/...functions/fpml-5-10/processes/msg-ex63-execution-advice-trade-initiation-func-output.json
@@ -1300,7 +1300,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "6edd04f9"
+    "globalKey" : "6ec6d667"
   },
   "party" : [ {
     "meta" : {

diff --git a/...es/functions/fpml-5-10/processes/msg-new-alpha-trade-CFTC-SEC-and-canada-func-output.json b/...es/functions/fpml-5-10/processes/msg-new-alpha-trade-CFTC-SEC-and-canada-func-output.json
@@ -1538,7 +1538,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "cbf2e08e"
+    "globalKey" : "3dd4048e"
   },
   "party" : [ {
     "businessUnit" : [ {

diff --git a/...les/functions/fpml-5-10/processes/msg-new-beta-trade-CFTC-SEC-and-canada-func-output.json b/...les/functions/fpml-5-10/processes/msg-new-beta-trade-CFTC-SEC-and-canada-func-output.json
@@ -1424,7 +1424,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "535b9c15"
+    "globalKey" : "e7f40091"
   },
   "party" : [ {
     "businessUnit" : [ {

diff --git a/...le-files/functions/fpml-5-10/processes/msg-new-trade-CFTC-SEC-and-canada-func-output.json b/...le-files/functions/fpml-5-10/processes/msg-new-trade-CFTC-SEC-and-canada-func-output.json
@@ -1538,7 +1538,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "de00cf57"
+    "globalKey" : "72664a43"
   },
   "party" : [ {
     "businessUnit" : [ {

diff --git a/...m-sample-files/functions/fpml-5-10/processes/msg-new-trade-CFTC-clearing-func-output.json b/...m-sample-files/functions/fpml-5-10/processes/msg-new-trade-CFTC-clearing-func-output.json
@@ -1328,7 +1328,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "ae083cd"
+    "globalKey" : "fd223625"
   },
   "party" : [ {
     "meta" : {

diff --git a/...s/cdm-sample-files/functions/fpml-5-10/processes/msg-partial-termination-func-output.json b/...s/cdm-sample-files/functions/fpml-5-10/processes/msg-partial-termination-func-output.json
@@ -1429,7 +1429,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "41579434"
+    "globalKey" : "cefacea8"
   },
   "party" : [ {
     "businessUnit" : [ {

diff --git a/...-sample-files/functions/fpml-5-10/processes/msg-partial-termination-xccy-func-output.json b/...-sample-files/functions/fpml-5-10/processes/msg-partial-termination-xccy-func-output.json
@@ -823,7 +823,7 @@
     } ]
   },
   "meta" : {
-    "globalKey" : "1ddadcc7"
+    "globalKey" : "ab7e173b"
   },
   "party" : [ {
     "businessUnit" : [ {