generated from eclipse-velocitas/vehicle-app-python-template
-
Notifications
You must be signed in to change notification settings - Fork 0
/
.ort.yml
77 lines (75 loc) · 3.49 KB
/
.ort.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
# Copyright (c) 2022 Robert Bosch GmbH and Microsoft Corporation
#
# This program and the accompanying materials are made available under the
# terms of the Apache License, Version 2.0 which is available at
# https://www.apache.org/licenses/LICENSE-2.0.
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# SPDX-License-Identifier: Apache-2.0
curations:
packages:
- id: "PyPI::pytest-cov:4.0.0"
curations:
comment: "Proper license is defined in package repository https://pypi.org/project/pytest-cov/"
concluded_license: "MIT"
- id: "PyPI::coverage:6.5.0"
curations:
comment: "Proper license is defined in package repository https://pypi.org/project/coverage/"
concluded_license: "Apache-2.0"
- id: "PyPI::gitdb:4.0.10"
curations:
comment: "Proper license is defined in package repository https://pypi.org/project/gitdb/"
concluded_license: "BSD-3-Clause"
- id: "PyPI::grpcio:1.48.2"
curations:
comment: "Proper license is defined in package repository https://pypi.org/project/grpcio/"
concluded_license: "Apache-2.0"
- id: "PyPI::identify:2.5.9"
curations:
comment: "Proper license is defined in package repository https://pypi.org/project/identify/"
concluded_license: "MIT"
- id: "PyPI::setuptools:67.2.0"
curations:
comment: "Proper license is defined in package repository https://pypi.org/project/setuptools/"
concluded_license: "MIT"
- id: "PyPI::packaging:23.0"
curations:
comment: "Proper license is defined in package repository https://pypi.org/project/packaging/"
concluded_license: "Apache-2.0"
resolutions:
vulnerabilities:
- id: "CVE-2022-42969"
reason: "INEFFECTIVE_VULNERABILITY"
comment: "Vulnerability only applicable for SVN projects. Requires a change to be made by a third party https://github.com/pytest-dev/py/issues/287"
- id: "CVE-2018-20225"
reason: "MITIGATED_VULNERABILITY"
comment: "Mitigating control: avoiding use of the --extra-index-url parameter for pip"
- id: "CVE-2019-20907"
reason: "INVALID_MATCH_VULNERABILITY"
comment: "Only applicable for python version <=3.8.3 or <3.9.0-b5 python 3.10 in use"
- id: "CVE-2019-20916"
reason: "INVALID_MATCH_VULNERABILITY"
comment: "pip < 19.2 is affected pip in use 22.3.1"
- id: "sonatype-2012-0071"
reason: "INVALID_MATCH_VULNERABILITY"
comment: "only relevan for python 2.7 python 3.10 in use"
- id: "sonatype-2022-6046"
reason: "INVALID_MATCH_VULNERABILITY"
comment: "affected wheel < 0.38.4 wheel = 0.38.4 in use"
- id: " CVE-2022-33124"
reason: "CANT_FIX_VULNERABILITY"
comment: "aiohttp consider this vulnerability as false possitive. No prove that issue leads to DoS attack. Requires a change to be made by a third party"
- id: "CVE-2020-11023"
reason: "INEFFECTIVE_VULNERABILITY"
comment: "No evidences that pkg:pypi/[email protected] is affected. mainly jquery package is affected"
- id: "CVE-2022-24439"
reason: "INEFFECTIVE_VULNERABILITY"
comment: "bandit has dependency on gitpython but not using affected functinality. No usage of gitpython directly"
- id: "CVE-2022-23491"
reason: "INVALID_MATCH_VULNERABILITY"
comment: "certifi is not used by our components directly or indirectly"