Unsuppressing Security Vulnerabilities

The System Administrator can unsuppress a security vulnerability for one, some, or all of the component versions for which it was previously suppressed. The following sections provide more details:

• Effects of Unsuppressing a Security Vulnerability
• Unsuppressing a Security Vulnerability

Effects of Unsuppressing a Security Vulnerability

When you unsuppress a security vulnerability, the effects of the vulnerability’s previous suppression are reversed. That is, once a vulnerability is unsuppressed for a specific component version, it is now counted in vulnerability totals or is visibly listed at the project, inventory, and component-version levels. The count increase is evident on the project dashboards and on the Vulnerabilities bar graphs in the Web UI, as well as in subsequently generated API responses and reports (Project and Audit). Likewise, the actual vulnerability is now visible in the list of vulnerabilities on the Security Vulnerabilities window (which is opened when you click a Vulnerabilities bar graph) or in API responses or reports.

Note:The Vulnerabilities bar graph in the UI is shown on the Inventory view, in the Lookup Component window for a specific component version, and in Inventory Details for a given inventory item (both on the Project Inventory tab and in the Analysis Workbench).

The following describes the impact that unsuppressing a security vulnerability has on other features of Code Insight:

• Advanced Search on the Project Inventory tab and Inventory View—When an inventory search is based the vulnerability name or severity, the results now list any inventory items that are associated the unsuppressed vulnerability.
• Alerts—Any alerts that were automatically closed due to the previous vulnerability suppression are automatically reopened. Open and closed alert counts are adjusted to reflect the changes on the Project Inventory tab, in the Analysis Workbench, and on the Inventory view.
• Policies—Once a security vulnerability is unsuppressed, no changes are initially propagated to those review policies that are based on vulnerabilities. However, each time one of these policies is triggered thereafter (that is, when an inventory item is published), the policy will now consider the vulnerability when determining whether to automatically approve or reject the published inventory item.

Additionally, a change in policy due to the unsuppression of a vulnerability does not change the existing approval/rejection status of a published inventory item unless the item is manually recalled and then republished.

• Subsequent scans and rescans—Once a vulnerability is unsuppressed, it is reflected in the results of subsequent rescans and initial scans, whether incremental or full.

Unsuppressing a Security Vulnerability

The following procedure is used to unsuppress a security vulnerability for one, some, or all of component versions for which it was previously suppressed.

Only a Code Insight System Administrator can perform this operation.

Note:A System Administrator can also unsuppress a security vulnerability using the UnSuppress vulnerability REST API. For more information about this API, see the Code Insight Swagger documentation, available from the Help > REST API Guide option on the main Code Insight menu. (To access this menu, click the icon in the upper right corner of the Code Insight web page.)

To unsuppress a security vulnerability, do the following:

1. Open the Suppressed Vulnerabilities tab using the steps described in Viewing Suppressed Security Vulnerabilities.
2. In the list of suppressed vulnerabilities (in grid format), locate the vulnerability that you want to unsuppress, and click its associated Unsuppress button.

The Unsuppress Vulnerability window is displayed.

3. Complete all editable fields on the window to define the unsuppression process for the vulnerability. For a description of these fields, see Unsuppress Vulnerability Window.
4. Click Unsuppress. Then click OK in the pop-up to acknowledge that the vulnerability has been successfully unsuppressed for the specified component versions.

You are returned to the Suppressed Vulnerabilities tab. The list of suppressed vulnerabilities on the tab is now modified in one of two ways:

• If the vulnerability was unsuppressed for one or some of the component versions for which it was previously suppressed, those versions are no longer listed for the vulnerability. The remaining suppressed versions are still listed for the vulnerability.
• If the vulnerability was unsuppressed for all of the component versions for which it was previously suppressed, the vulnerability is longer shown in the list.