DTSCCI-60 Reduce CVEs

build.gradle

@@ -164,6 +164,10 @@ jacocoTestReport.dependsOn {
   subprojects*.test
 }
 
+def versions = [
+  jackson            : '2.17.0'
+]
+
 // before committing a change, make sure task still works
 dependencyUpdates {
   def isNonStable = { String version ->
@@ -198,6 +202,16 @@ dependencyCheck {
   ]
 }
 
+dependencyManagement {
+  dependencies {
+  // Solves CVE-2023-35116
+    dependency group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: versions.jackson
+    dependency group: 'com.fasterxml.jackson.core', name: 'jackson-core', version: versions.jackson
+    dependency group: 'com.fasterxml.jackson.core', name: 'jackson-annotations', version: versions.jackson
+
+  }
+}
+
 repositories {
   mavenLocal()
   mavenCentral()
@@ -224,6 +238,8 @@ ext {
   lombokVersion = '1.18.28'
 }
 
+
+
 dependencies {
   implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web'
   implementation group: 'org.springframework.boot', name: 'spring-boot-starter-actuator'
@@ -246,7 +262,7 @@ dependencies {
   implementation group: 'io.rest-assured', name: 'rest-assured', version: '5.3.1'
   implementation group: 'commons-fileupload', name: 'commons-fileupload', version: '1.5'
   implementation group: 'com.google.guava', name: 'guava', version: '32.1.1-jre'
-  implementation group: 'org.json', name: 'json', version: '20230227'
+  implementation group: 'org.json', name: 'json', version: '20240303'
   implementation group: 'com.fasterxml.woodstox', name: 'woodstox-core', version: '6.5.1'
   implementation group: 'com.launchdarkly', name: 'launchdarkly-java-server-sdk', version: '6.2.1'
 
@@ -277,21 +293,6 @@ dependencies {
   implementation group: 'uk.gov.hmcts.reform', name: 'service-auth-provider-client', version: '4.0.0'
 
 }
-dependencyManagement {
-  dependencies {
-// Fix CVE-2023-42795, CVE-2023-45648
-    dependencySet(group: 'org.apache.tomcat.embed', version: '10.1.16') {
-      entry 'tomcat-embed-core'
-      entry 'tomcat-embed-el'
-      entry 'tomcat-embed-websocket'
-    }
-    // CVE-2023-6378
-    dependencySet(group: 'ch.qos.logback', version: '1.4.14') {
-      entry 'logback-core'
-      entry 'logback-classic'
-    }
-  }
-}
 
 mainClassName = 'uk.gov.hmcts.reform.civil.Application'
 

config/owasp/suppressions.xml

@@ -11,14 +11,6 @@
 
   <!--Please add all the temporary suppression under the below section-->
   <suppress until="2024-10-14">
-    <cve>CVE-2022-1471</cve>
-    <cve>CVE-2022-45688</cve>
-    <cve>CVE-2023-2976</cve>
-    <cve>CVE-2020-8908</cve>
-    <cve>CVE-2023-33201</cve>
-    <cve>CVE-2023-35116</cve>
-    <cve>CVE-2023-41080</cve>
-    <cve>CVE-2023-5072</cve>
     <cve>CVE-2024-22243</cve>
     <cve>CVE-2024-29857</cve>
     <cve>CVE-2024-30172</cve>