...
This table will be presented to TSC at Code Freeze milestone (M4) to the TSC.
It is recommended to first first update to the latest version of of the third party components available. In case the latest third party components still reports some vulnerabilities, you must provide an impact analysis as illustrated in the example below.
In the case where you have nested third party components (a third party component embedding another third party component) and there is is NO CVE number number for the upstream third party component (meaning the third party component you are embedding), it is recommended to open a vulnerability issue on the upstream third party component.
...
The information related to Repository, Group, Artifact, Version and Problem Code are extracted from the CLM report (see the below screenshot)
Repository | Group | Impact Analysis | Action |
|---|---|---|---|
|
| org.apache.hadoop | False positive. The ONAP system only use Janus on Casandra, so the hadoop libraries are never touched |
|
|
| com.fasterxml.jackson.core | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the |
search service is not using either approach, so the possibility of the exploit vector does not apply. | |
|
|
| com. |
| google. |
DMaaP client dependency:
From Dmaap Security/Vulnerability - Beijing: The application is vulnerable by using this component, when default typing is enabled. Message Router do not use the default typing, so using the jackson-databind will not make message router vulnerable
| guava | A dependency of a child dependency, json-schema-validator. Even the latest version of json-schema-validator does not have the required fix version for the above components. | ||
| com.googlecode.libphonenumber | A dependency of a child dependency, json-schema-validator. Even the latest version of json-schema-validator does not have the required fix version for the above components. AAI is not vulnerable to this issue in the dependency, it does not use the component in the way described. | |
| javax.mail | A dependency of a child dependency, json-schema-validator. Even the latest version of json-schema-validator does not have the required fix version for the above components. AAI is not vulnerable to this issue in the dependency, it does not use the component in the way described. | |
| org.springframework.security | Inherited from spring boot, will be fixed in the Casablanca Maintenance Release. Search data service is not vulnerable to the exploit vectors because it does not perform the functions outlined in the report. |
|
| org.springframework | Will update in maintenance release when upgrading to latest spring boot. False positive. AAI is not serving static resources through the ResourceHttpRequestHandler. |
|
| org.apache.tomcat.embed | AAI is not vulnerable because tomcat is not used in these repos, jetty is the application server. This is a child dependency of springframework, JIRA ticket in next column will address it for the Casablanca Maintenance Release by updating to the latest spring boot. |
|
| com.fasterxml.jackson.core |
- aai/aai-resouces
- aai/aai-traversal
- aai/champ
- aai/aai-common
False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the |
code |
base is not using either approach, so the possibility of the exploit vector does not apply. | |||||||||||||
| com.fasterxml.jackson.core | DMaaP client dependency: [INFO] +- org.onap.dmaap.messagerouter.dmaapclient:dmaapClient:jar:1.1.5:compile[INFO] | +- com.fasterxml.jackson.core:jackson-core:jar:2.8.11:compile [INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.8.11.1:compileFrom Dmaap Security/Vulnerability - Beijing: The application is vulnerable by using this component, when default typing is enabled. Message Router do not use the default typing, so using the jackson-databind will not make message router vulnerable | |||||||||||
| com.rabbitmq | False positive. Event client in ONAP only uses DMaaP so the rabbitmq dependencies are never used. |
| ||||||||||
| com.fasterxml.jackson.core | False Positive Explanation: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization. esr-server doesn't invoke this method, esr-server use new Gson().fromJson(String json, Obj.class) |
and new Gson().toJson(obj) |
to deserialization and serialization. https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization In esr-server, Gson is used to deserialization and serialization: | |
|
| com.smoketurner.dropwizard |
False |
A dependency of a child dependency, json-schema-validator. Even the latest version of json-schema-validator does not have the required fix version for the above components.
javax.mail
aai/data-router
This artifact is a child dependency for data-router which comes from camel-cxf:2.22.1, and 2.22.1 is the latest version available for camel-cxf.
- aai/aai-common
- aai/traversal
- aai/graphadmin
- aai/aai-common
- aai/resources
- aai/traversal
- aai/graphadmin
aai/aai-resources
aai/cacher
aai/aai-common
Can the security team show the AAI/ESR team how this component is showing up the dependencies? If you look at the dependency tree it's not called out, so we are not sure how to proceed: https://jenkins.onap.org/job/aai-esr-server-maven-clm-master/12/consoleFull
From Pawel: "as it is related to - jackson-databind is vulnerable to Remote Code Execution (RCE). Please simply add this line into your analysis."
Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the code base is not using either approach, so the possibility of the exploit vector does not apply. |
| ||||||||||||
| com.smoketurner.dropwizard | Bo Lv (ESR SME) please comment if ear-server is vulnerable to CVE-2018-110987 (rabbitmq) | |||||||||||
| org.apache.tomcat | ESR GUI is vulnerable. Implementors should secure the system to prevent exploits. We will replace tomcat in the Casablanca Maintenance Release with a version that is not vulnerable. |
| ||||||||||
| jquery | ESR GUI is vulnerable. Implementors should secure the system to prevent exploits. We will replace jquery in the Casablanca Maintenance Release with a version that is not vulnerable. |
|
- aai/resources
- aai/traversal
- aai/champ
- aai/gizmo
- aai/search-data-service
- aai/data-router
- aai/sparky-be
- aai/graphadmin
- aai/cacher
| ||
| bootstrap | ESR GUI is vulnerable. Implementors should secure the system to prevent exploits. We will replace bootstrap in the Casablanca Maintenance Release with a version that is not vulnerable. |
|
| ||
|
| com.att.aft | Update to 3.1.200-oss for Casablanca Maintenance Release. data-router does not the hazel cast component so we are not vulnerable in the meantime. |
|
| |||
| com.fasterxml.jackson.core | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the code base is not using either approach, so the possibility of the exploit vector does not apply. | |
| org.codehaus.jackson | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the resources code bases are not using either approach, so the possibility of the exploit vector does not apply. | |
| commons-httpclient | False positive. This is imported by hadoop which is used for hbase configs; in Beijing, AAI is configured with Janus on cassandra so it will not be accessing these classes. In Casablanca, Champ will serve as a multi-purpose data broker so we will look to upgrade the hadoop libraries to the most current versions. | |
| org.apache.activemq | Will update in Casablanca Maintenance Release. Issue is a false positive. This vulnerability is dependent on XalanXPathEvaluator.java using an insecure or absent document parser. AAI is not using this class. |
|
|
| ||
| org.apache.activemq | Will update in Casablanca Maintenance Release. Application is vulnerable to the vulnerability, users should secure the system so users cannot snoop network traffic between cacher and the other end of the queue; an old version of aai-common has the import, and cacher should move to the latest, 1.3.2 (see JIRA tickets) |
|
| ||
|
| org.apache.activemq | Will update in Casablanca Maintenance Release. Issue is a false positive. This vulnerability is dependent on XalanXPathEvaluator.java using an insecure or absent document parser. AAI is not using this class. |
|
| |||
| org.codehaus.jackson | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the resources code bases are not using either approach, so the possibility of the exploit vector does not apply. | |
| org.webjars.npm bootstrap | False positive. The data-target attribute in bootstrap.js interprets encoded HTML entities as standard HTML entities when data-target is based on user supplied input. data-target attribute is not used | Helpdesk ticket 54851 |
| org.webjars.npm bootstrap | False positive. The show()function in the tooltip.js file allows HTML and scripts in the data-container tooltip attribute values in the DOM elements without proper sanitization. The show() function is not used | |
| com.google.guava | This dependency is a child dependency of Cassandra which is required for the graphdb; newer versions of Cassandra do not upgrade to a non-vulnerable version of this depedency. Guava is vulnerable to Denial of Service (DoS) when untrusted input is supplied to the AtomicDoubleArray and CompoundOrdering classes - AAI doesn't depend on guava to do this anywhere. Non-vulnerable versions of guava are not backward compatible with the version used by Cassandra | |
| com.fasterxml.jackson.core | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the code base is not using either approach, so the possibility of the exploit vector does not apply. | |
| org.codehaus.jackson | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the code base is not using either approach, so the possibility of the exploit vector does not apply. |