Skip to content
Snippets Groups Projects
Commit e4fe51b6de5e authored by Dustin Collins's avatar Dustin Collins
Browse files

Remove cveignore file and references

Closes https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6733

Changelog: removed
parent 12ba24aae50d
No related branches found
No related tags found
1 merge request!72Intermediate build for testing purposes
# ncurses/5.9
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5826
CVE-2019-17594
CVE-2019-17595
CVE-2019-15547
CVE-2019-15548
# libxml2/2.9.10
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5866
CVE-2019-20388
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5867
CVE-2020-7595
# libxslt/1.1.32
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5824
CVE-2019-11068
CVE-2019-5815
# bzip2/1.0.6
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5825
CVE-2019-12900
CVE-2016-3189
# unzip/6.0
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5827
CVE-2016-9844
CVE-2018-18384
CVE-2019-13232
# gnupg/2.2.10
CVE-2019-13050
CVE-2018-1000858
## https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5211
CVE-2019-14855
# openssl/1.1.1g
# Doesn't apply to omnibus-gitlab. Requires openssl version 1.1.1 or later to be used with Apache HTTP Server version 2.4.37, and
# thus for users who bring their own Apache webserver. Even so, the fix is in
# Apache httpd 2.4.38 and not openssl. Hence, ignoring. Check details in
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5793#note_442221086
CVE-2019-0190
# False positives
CVE-2019-1543
CVE-2017-3736
# Entries from CVEIGNORE variable go below this line
<!--
# Read me first!
This process is not required to remove .cveignore entries. See
https://docs.gitlab.com/omnibus/development/broken_master.html#dependency_scanning-job-failed-due-to-one-of-the-dependencies-being-reported-as-vulnerable
for more details.
Create this issue under https://gitlab.com/gitlab-org/security/omnibus-gitlab/
Set the title to: `Description of the original issue`
......
......@@ -56,7 +56,6 @@
| OMNIBUS_GITLAB_MIRROR_PROJECT_ACCESS_TOKEN | Project access token for building a test package. |
| GITLAB_QA_MIRROR_PROJECT_ACCESS_TOKEN | Project access token for triggering a downstream pipeline for end-to-end testing. |
| GITLAB_BOT_MULTI_PROJECT_PIPELINE_POLLING_TOKEN (deprecated) | Trigger token for building a test package. |
| CVEIGNORE | See document on [dependencies being reported as vulnerable](broken_master.md). |
| CI_SLACK_WEBHOOK_URL | Webhook URL for Slack failure notifications. |
| DANGER_GITLAB_API_TOKEN | GitLab API token for dangerbot to post comments to MRs. |
| DEPS_GITLAB_TOKEN | Token used by [dependencies.io](https://www.dependencies.io/gitlab-ci/) to create MRs. |
......
......@@ -664,7 +664,6 @@
dependency_scanning: gl-dependency-scanning-report.json
paths:
- dependency_report.txt
- .cveignore
dependency_update:
image: "${BUILDER_IMAGE_REGISTRY}/ruby_docker:${BUILDER_IMAGE_REVISION}"
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment