Merge pull request #555 from hmcts/DTSRD-327

Addressed CVE-2021-22044

Author: lukasz-wolski

build.gradle

@@ -521,6 +521,11 @@ dependencyManagement {
       entry 'tomcat-embed-el'
       entry 'tomcat-embed-websocket'
     }
+    //CVE-2021-22044
+    dependencySet(group: 'org.springframework.cloud', version: '3.1.5') {
+        entry 'spring-cloud-starter-openfeign'
+        entry 'spring-cloud-openfeign-core'
+    }
     // CVE-2021-22060, CVE-2022-22965, CVE-2022-22950, CVE-2022-22971, CVE-2022-22968, CVE-2022-22970, CVE-2022-31690, CVE-2022-31692
     dependency(group: 'org.springframework', name: 'spring-corespring-core', version: '5.3.26') //remove this line after spring boot upgrade to 2.7.7 and spring frame work to 6.0
   }

config/owasp/suppressions.xml

@@ -30,12 +30,6 @@
         <packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
         <cve>CVE-2021-4235</cve>
     </suppress>
-    <suppress>
-      <notes>CVE-2022-22978 suppression (false positive), because spring security already at (5.7.5) this is higher than the vulnerable versions
-        (5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4)
-        https://tanzu.vmware.com/security/cve-2022-22978</notes>
-      <cve>CVE-2021-22044</cve>
-    </suppress>
     <suppress>
      <cve>CVE-2022-45688</cve>
       <cve>CVE-2023-24998</cve>