From 9e94c5fde72c50d36ad6bfa2e1842546da52e221 Mon Sep 17 00:00:00 2001
From: Sean Li <xili9@microsoft.com>
Date: Tue, 4 Aug 2026 22:12:21 -0700
Subject: [PATCH 1/2] Suppress false positive OWASP dependency-check findings
 on azure artifacts

The daily OWASP dependency check has been failing with 6 CVEs, all of which
are CPE mismatches rather than real vulnerabilities.

CVE-2026-33117 affects azure-security-keyvault-keys < 4.10.6, which is not a
dependency of this project. NVD maps it to the generic
cpe:2.3:a:microsoft:azure_sdk_for_java "up to (excluding) 4.10.6", so it
matches every com.azure artifact whose own unrelated version happens to be
below 4.10.6: azure-core 1.58.1, azure-core-http-netty 1.16.5,
azure-identity 1.18.3 and azure-json 1.5.1. Those version lines will never
reach 4.10.6, so no upgrade can ever clear this finding.

CVE-2026-39882, CVE-2026-40894, CVE-2026-41078, CVE-2026-41178 and
CVE-2026-44967 are OpenTelemetry Go, .NET and C++ issues with no Java
component. dependency-check infers cpe:2.3:a:opentelemetry:opentelemetry from
the azure-monitor-opentelemetry-autoconfigure artifact name, and 1.5.0 sorts
below every one of their fixed versions (1.6.0, 1.15.3, 1.27.0, 1.42.0,
1.43.0). Suppressing that inferred CPE for this one artifact also stops future
OpenTelemetry CVEs from other languages from breaking the build, while leaving
genuine CVEs against the Azure Java library reported via its Maven purl.

The first suppression is scoped to com.azure purls excluding
azure-security-keyvault-keys, so it cannot mask the real vulnerability if that
dependency is ever added.
---
 .../dependency-check-suppressions.xml         | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/buildscripts/dependency-check-suppressions.xml b/buildscripts/dependency-check-suppressions.xml
index e05a8051c10..fa36afd355a 100644
--- a/buildscripts/dependency-check-suppressions.xml
+++ b/buildscripts/dependency-check-suppressions.xml
@@ -30,6 +30,26 @@
     </notes>
     <cve>CVE-2024-35255</cve>
   </suppress>
+  <suppress>
+    <notes>
+      CVE-2026-33117 affects azure-security-keyvault-keys (fixed in 4.10.6), which we do not depend on.
+      NVD maps it to the generic cpe:2.3:a:microsoft:azure_sdk_for_java "up to (excluding) 4.10.6",
+      so it matches every com.azure artifact whose own (unrelated) version is below 4.10.6,
+      e.g. azure-core 1.58.1, azure-core-http-netty 1.16.5, azure-identity 1.18.3, azure-json 1.5.1.
+    </notes>
+    <cve>CVE-2026-33117</cve>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[
+      azure-monitor-opentelemetry-autoconfigure is an Azure Java library, but dependency-check infers
+      cpe:2.3:a:opentelemetry:opentelemetry from its name. That CPE then matches OpenTelemetry
+      Go / .NET / C++ CVEs whose fixed versions happen to be higher than this artifact's version,
+      e.g. CVE-2026-39882 and CVE-2026-41178 (Go), CVE-2026-40894 and CVE-2026-41078 (.NET),
+      CVE-2026-44967 (C++). None of them apply to Java.
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/com\.azure/azure-monitor-opentelemetry-autoconfigure@.*$</packageUrl>
+    <cpe>cpe:2.3:a:opentelemetry:opentelemetry</cpe>
+  </suppress>
   <suppress>
     <notes>
       CVE-2023-35116 is not a valid CVE, see comment from library maintainer

From eb7f58ad2d67cbd3d453768c6d910af087f90885 Mon Sep 17 00:00:00 2001
From: Sean Li <xili9@microsoft.com>
Date: Tue, 4 Aug 2026 22:12:41 -0700
Subject: [PATCH 2/2] edit

---
 buildscripts/dependency-check-suppressions.xml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/buildscripts/dependency-check-suppressions.xml b/buildscripts/dependency-check-suppressions.xml
index fa36afd355a..b50351ad23c 100644
--- a/buildscripts/dependency-check-suppressions.xml
+++ b/buildscripts/dependency-check-suppressions.xml
@@ -31,12 +31,15 @@
     <cve>CVE-2024-35255</cve>
   </suppress>
   <suppress>
-    <notes>
+    <notes><![CDATA[
       CVE-2026-33117 affects azure-security-keyvault-keys (fixed in 4.10.6), which we do not depend on.
       NVD maps it to the generic cpe:2.3:a:microsoft:azure_sdk_for_java "up to (excluding) 4.10.6",
       so it matches every com.azure artifact whose own (unrelated) version is below 4.10.6,
       e.g. azure-core 1.58.1, azure-core-http-netty 1.16.5, azure-identity 1.18.3, azure-json 1.5.1.
-    </notes>
+      Those version lines will never reach 4.10.6, so upgrading cannot clear this finding.
+      If azure-security-keyvault-keys is ever added as a dependency, revisit this suppression.
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/com\.azure/(?!azure-security-keyvault-keys@).*$</packageUrl>
     <cve>CVE-2026-33117</cve>
   </suppress>
   <suppress>