UNCLASSIFIED - NO CUI

Whitelist ClamAV finding for Kiali

  1. Create a file called clamav-whitelist in the affected project repository.

  2. Add the name of the finding to the file in the following format: Html.Exploit.CVE_2016_7240-3. An example is shown here: https://repo1.dso.mil/dsop/checkmarx/cxlite/cxlite/-/blob/development/clamav-whitelist.

  3. Ensure that the clamav-whitelist file can only be changed or merged by those in the CODEOWNERS file in the .gitlab directory within the repository. In order to do this, navigate to the ./gitlab/CODEOWNERS file and add the following:

[ClamAV Whitelist File]
clamav-whitelist @ironbank-security-team 
  1. Add a CI/CD variable at the project level named CLAMAV_WHITELIST with a value of 1.
Edited by gavin.scallon