<commit_before><?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
  <suppress>
    <notes><![CDATA[
   Hawtio console vulns; we aren't affected.
   ]]>    </notes>
    <packageUrl regex="true">^pkg:maven/org\.apache\.activemq/activemq.*$</packageUrl>
    <cve>CVE-2015-5183</cve>
    <cve>CVE-2015-5184</cve>
  </suppress>
  <suppress>
    <notes><![CDATA[
   CSRF in jolokia; we don't care.
   ]]>    </notes>
    <packageUrl regex="true">^pkg:maven/org\.apache\.activemq/activemq.*$</packageUrl>
    <cve>CVE-2015-5182</cve>
  </suppress>
  <suppress>
    <notes><![CDATA[
    file name: javax.security.auth.message-1.0.0.v201108011116.jar, isn't geronimo!
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.orbit/javax\.security\.auth\.message@.*$</packageUrl>
    <cpe>cpe:/a:apache:geronimo</cpe>
  </suppress>
  <suppress>
    <notes><![CDATA[
    javax.websocket-api != Java-WebSocket (INTERLOK-3284)
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/javax\.websocket/javax\.websocket\-api@.*$</packageUrl>
    <cve>CVE-2020-11050</cve>
  </suppress>
  <suppress>
    <notes><![CDATA[
    javax.websocket-client-api != Java-WebSocket (INTERLOK-3284)
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/javax\.websocket/javax\.websocket\-client\-api@.*$</packageUrl>
    <cve>CVE-2020-11050</cve>
  </suppress>
  <suppress>
    <notes><![CDATA[
    This CVE is a ruby CVE : https://nvd.nist.gov/vuln/detail/CVE-2020-10663
    ]]></notes>
    <cve>CVE-2020-10663</cve>
  </suppress>
  <suppress>
    <notes><![CDATA[
    This CVE is a NPM Node/CVE... https://nvd.nist.gov/vuln/detail/CVE-2020-7712
    ]]></notes>
    <cve>CVE-2020-7712</cve>
  </suppress>
  <suppress>
    <notes><![CDATA[
    file name: mxparser-1.2.1.jar matched from : cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:* versions up to (including) 1.4.6
     - This is the replacement for xpp3 which is made by xstream but isn't xstream so the regexp is all wrong.
     - we can't do
      <packageUrl regex="true">^pkg:maven/io\.github\.x\-stream/mxparser@.*$</packageUrl>
      <cpe>cpe:/a:xstream_project:xstream</cpe>
      Because this causes it to have a low-confidence match against some oracle crap so just exclude the explicit CVEs
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/io\.github\.x\-stream/mxparser@.*$</packageUrl>
    <cve>CVE-2013-7285</cve>
    <cve>CVE-2016-3674</cve>
    <cve>CVE-2017-7957</cve>
    <cve>CVE-2020-26217</cve>
    <cve>CVE-2020-26258</cve>
    <cve>CVE-2020-26259</cve>
    <cve>CVE-2021-21341</cve>
    <cve>CVE-2021-21342</cve>
    <cve>CVE-2021-21343</cve>
    <cve>CVE-2021-21344</cve>
    <cve>CVE-2021-21345</cve>
    <cve>CVE-2021-21346</cve>
    <cve>CVE-2021-21347</cve>
    <cve>CVE-2021-21348</cve>
    <cve>CVE-2021-21349</cve>
    <cve>CVE-2021-21350</cve>
    <cve>CVE-2021-21351</cve>
  </suppress>
  <suppress>
    <notes><![CDATA[
    file name: log4j-1.2-*.jar
    This CVE matches a AWS CVE for a hotfix they patched a JVM with. This is a false positive
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/org\.apache\.logging\.log4j/log4j.*$</packageUrl>
    <cve>CVE-2022-33915</cve>
  </suppress>  
</suppressions><commit_msg>Suppress CVE as only Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions are affected<commit_after><?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
  <suppress>
    <notes><![CDATA[
   Hawtio console vulns; we aren't affected.
   ]]>    </notes>
    <packageUrl regex="true">^pkg:maven/org\.apache\.activemq/activemq.*$</packageUrl>
    <cve>CVE-2015-5183</cve>
    <cve>CVE-2015-5184</cve>
  </suppress>
  <suppress>
    <notes><![CDATA[
   CSRF in jolokia; we don't care.
   ]]>    </notes>
    <packageUrl regex="true">^pkg:maven/org\.apache\.activemq/activemq.*$</packageUrl>
    <cve>CVE-2015-5182</cve>
  </suppress>
  <suppress>
    <notes><![CDATA[
    file name: javax.security.auth.message-1.0.0.v201108011116.jar, isn't geronimo!
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.orbit/javax\.security\.auth\.message@.*$</packageUrl>
    <cpe>cpe:/a:apache:geronimo</cpe>
  </suppress>
  <suppress>
    <notes><![CDATA[
    javax.websocket-api != Java-WebSocket (INTERLOK-3284)
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/javax\.websocket/javax\.websocket\-api@.*$</packageUrl>
    <cve>CVE-2020-11050</cve>
  </suppress>
  <suppress>
    <notes><![CDATA[
    javax.websocket-client-api != Java-WebSocket (INTERLOK-3284)
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/javax\.websocket/javax\.websocket\-client\-api@.*$</packageUrl>
    <cve>CVE-2020-11050</cve>
  </suppress>
  <suppress>
    <notes><![CDATA[
    This CVE is a ruby CVE : https://nvd.nist.gov/vuln/detail/CVE-2020-10663
    ]]></notes>
    <cve>CVE-2020-10663</cve>
  </suppress>
  <suppress>
    <notes><![CDATA[
    This CVE is a NPM Node/CVE... https://nvd.nist.gov/vuln/detail/CVE-2020-7712
    ]]></notes>
    <cve>CVE-2020-7712</cve>
  </suppress>
  <suppress>
    <notes><![CDATA[
    file name: mxparser-1.2.1.jar matched from : cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:* versions up to (including) 1.4.6
     - This is the replacement for xpp3 which is made by xstream but isn't xstream so the regexp is all wrong.
     - we can't do
      <packageUrl regex="true">^pkg:maven/io\.github\.x\-stream/mxparser@.*$</packageUrl>
      <cpe>cpe:/a:xstream_project:xstream</cpe>
      Because this causes it to have a low-confidence match against some oracle crap so just exclude the explicit CVEs
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/io\.github\.x\-stream/mxparser@.*$</packageUrl>
    <cve>CVE-2013-7285</cve>
    <cve>CVE-2016-3674</cve>
    <cve>CVE-2017-7957</cve>
    <cve>CVE-2020-26217</cve>
    <cve>CVE-2020-26258</cve>
    <cve>CVE-2020-26259</cve>
    <cve>CVE-2021-21341</cve>
    <cve>CVE-2021-21342</cve>
    <cve>CVE-2021-21343</cve>
    <cve>CVE-2021-21344</cve>
    <cve>CVE-2021-21345</cve>
    <cve>CVE-2021-21346</cve>
    <cve>CVE-2021-21347</cve>
    <cve>CVE-2021-21348</cve>
    <cve>CVE-2021-21349</cve>
    <cve>CVE-2021-21350</cve>
    <cve>CVE-2021-21351</cve>
  </suppress>
  <suppress>
    <notes><![CDATA[
    file name: log4j-1.2-*.jar
    This CVE matches a AWS CVE for a hotfix they patched a JVM with. This is a false positive
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/org\.apache\.logging\.log4j/log4j.*$</packageUrl>
    <cve>CVE-2022-33915</cve>
  </suppress>
  <suppress>
     <notes><![CDATA[
     file name: jetty-io-9.4.48.v20220622.jar
	 Only Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions are affected
     ]]></notes>
     <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty/jetty\-io@.*$</packageUrl>
     <vulnerabilityName>CVE-2022-2191</vulnerabilityName>
  </suppress>
</suppressions>
{'fraction_non_alphanumeric': 0.19809442548350398, 'fraction_numerical': 0.08617747440273038, 'mean_word_length': 3.291031116534472, 'pattern_counts': {'":': 0, '<': 248, '<?xml version=': 2, '>': 248, 'https://': 6, 'lorem ipsum': 0, 'www.': 0, 'xml': 4}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 2, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2938950', 'n_tokens_mistral': 3387, 'n_tokens_neox': 2915, 'n_words': 431}