Page Comparison

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.5 located at Module org.onap.dcaegen2.analytics.tca-gen2:dcae-analytics-model:jar:3.0.0-SNAPSHOT

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.5 located at Module org.onap.dcaegen2.analytics.tca-gen2:dcae-analytics-tca-core:jar:3.0.0-SNAPSHOT

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.5 located at Module org.onap.dcaegen2.analytics.tca-gen2:dcae-analytics-tca-model:jar:3.0.0-SNAPSHOT

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.5 located at Module org.onap.dcaegen2.analytics.tca-gen2:dcae-analytics-tca-web:jar:3.0.0-SNAPSHOT

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.5 located at Module org.onap.dcaegen2.analytics.tca-gen2:dcae-analytics-test:jar:3.0.0-SNAPSHOT

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.5 located at Module org.onap.dcaegen2.analytics.tca-gen2:dcae-analytics-web:jar:3.0.0-SNAPSHOT

Vulnerability report:

SONATYPE-2017-0312

jackson-databind is vulnerable to Remote Code Execution (RCE). The createBeanDeserializer() function in the BeanDeserializerFactory class allows untrusted Java objects to be deserialized. A remote attacker can exploit this by uploading a malicious serialized object that will result in RCE if the application attempts to deserialize it.

DCAEGEN2-765

False Positive Classification Reasoning to be confirmed

if identified Jackson is only used for converting between POJO to JSON, not the other direction which is reported as vulnerable by CVE-2018-7489. The member call used is ObjectMapper.writeValueAsString. not the risky readValue method.

spring-aop

Vulnerability report

CVE-2018-1258

DCAEGEN2-765

Update spring-aop to newer version 5.0.8.RELEASE version

spring-data-commons

Vulnerability report

CVE-2018-1259

DCAEGEN2-765

Update spring-data-commons to 2.0.8.RELEASE version

jackson-databind:jar:2.4.4

Vulnerable artifact:

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.4.4 located at Module org.onap.dcaegen2.analytics.tca:dcae-analytics-aai:jar:2.2.1-SNAPSHOT
Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.4.4 located at Module org.onap.dcaegen2.analytics.tca:dcae-analytics-cdap-common:jar:2.2.1-SNAPSHOT
Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.4.4 located at Module org.onap.dcaegen2.analytics.tca:dcae-analytics-cdap-plugins:jar:2.2.1-SNAPSHOT
Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.4.4 located at Module org.onap.dcaegen2.analytics.tca:dcae-analytics-cdap-tca:jar:2.2.1-SNAPSHOT
Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.4.4 located at Module org.onap.dcaegen2.analytics.tca:dcae-analytics-common:jar:2.2.1-SNAPSHOT
Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.4.4 located at Module org.onap.dcaegen2.analytics.tca:dcae-analytics-dmaap:jar:2.2.1-SNAPSHOT
Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.4.4 located at Module org.onap.dcaegen2.analytics.tca:dcae-analytics-it:jar:2.2.1-SNAPSHOT
Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.4.4 located at Module org.onap.dcaegen2.analytics.tca:dcae-analytics-model:jar:2.2.1-SNAPSHOT
Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.4.4 located at Module org.onap.dcaegen2.analytics.tca:dcae-analytics-tca:jar:2.2.1-SNAPSHOT

Vulnerability report:

CVE-2017-7525

jackson-databind is vulnerable to Remote Code Execution (RCE). The createBeanDeserializer() function in the BeanDeserializerFactory class allows untrusted Java objects to be deserialized. A remote attacker can exploit this by uploading a malicious serialized object that will result in RCE if the application attempts to deserialize it.

jackson-core:2.4.4

Vulnerable artifacts:

<same as jackson-databind 2.4.4 above>

Vulnerability report:

SONATYPE-2016-0397

SONATYPE-2017-0355

tomcat-embed-core

Vulnerability report

CVE-2018-8014

DCAEGEN2-764

Update tomcat-embed-core to 8.5.32 version

bcprov-jdk15on

Vulnerability report

CVE-2018-1000613

CVE-2018-1000180

DCAEGEN2-764

Upgrade version. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.

Vulnerable artifacts:

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.5 located at Module org.onap.dcaegen2.collectors.datafile:datafile-app-server:jar:1.0.0-SNAPSHOT

Vulnerability report:

SONATYPE-2017-0312

jackson-databind is vulnerable to Remote Code Execution (RCE). The createBeanDeserializer() function in the BeanDeserializerFactory class allows untrusted Java objects to be deserialized. A remote attacker can exploit this by uploading a malicious serialized object that will result in RCE if the application attempts to deserialize it.

DCAEGEN2-764

To be assessed if any alternative or Jackson is only used for converting between JSON to POJO only (reverse is flagged under 502 or if below is true

If this component is being used as part of Spring Security, then you are not vulnerable if you are running Spring Security 4.2.3.RELEASE or greater for 4.x or Spring Security 5.0.0.M2 or greater for 5.x. (CVE-2017-4995).

Vulnerability report

CVE-2018-1258

DCAEGEN2-764

Update spring-aop to newer version 5.0.8.RELEASE version

jackson-databind

Vulnerable artifacts:

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.4 located at Module org.onap.dcaegen2.collectors.hv-ves:hv-collector-coverage:pom:1.0.0-SNAPSHOT
Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.4 located at Module org.onap.dcaegen2.collectors.hv-ves:hv-collector-ct:jar:1.0.0-SNAPSHOT
Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.4 located at Module org.onap.dcaegen2.collectors.hv-ves:hv-collector-dcae-app-simulator:jar:1.0.0-SNAPSHOT
Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.4 located at Module org.onap.dcaegen2.collectors.hv-ves:hv-collector-utils:jar:1.0.0-SNAPSHOT
Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.4 located at Module org.onap.dcaegen2.collectors.hv-ves:hv-collector-xnf-simulator:jar:1.0.0-SNAPSHOT

Vulnerability report:

CVE-2018-7489

DCAEGEN2-766.collectors.hv-ves:hv-collector-xnf-simulator:jar:1.0.0-SNAPSHOT

Vulnerability report:

CVE-2018-7489

DCAEGEN2-766

False Positive Classification Reasoning

Vulnerable artifacts are used only in following cases:

1. CSIT robot testsuites (hv-collector-dcae-app-simulator, hv-collector-xnf-simulator) which obviously does not pose a threat
2. Healthcheck mechanism which ignores client requests and uses ( by dependency to hv-collector-utils ) jackson to create response.

Other modules affected are component-level-tests and coverage report which also are not used in production environment.

Assessment Note

To be assessed if any alternative or Jackson is only used for converting between JSON to POJO only (reverse is flagged under 502 or if below is true

 If this component is being used as part of Spring Security, then you are not vulnerable if you are running Spring Security 4.2.3.RELEASE or greater for 4.x or Spring Security 5.0.0.M2 or greater for 5.x. (CVE-2017-4995).

tomcat-embed-core 

Vulnerability report:

CVE-2018-8014

DCAEGEN2-767

Update tomcat-embed-core to 8.5.32 version

Vulnerable artifacts:

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.6 located at Module org.onap.dcaegen2.collectors.ves:VESCollector:jar:1.3.1-SNAPSHOT

Vulnerability report:

jackson-databind is vulnerable to Remote Code Execution (RCE). The createBeanDeserializer() function in the BeanDeserializerFactory class allows untrusted Java objects to be deserialized. A remote attacker can exploit this by uploading a malicious serialized object that will result in RCE if the application attempts to deserialize it.

502

False Positive Classification Reasoning

The application is only vulnerable by using this component, when default typing is enabled and passing in untrusted data to be deserialization which is not the case here.

jackson-databind

Vulnerable artifacts:

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.8.7 located at Module org.onap.dcaegen2.platform:inventory-api:jar:3.0.3

Vulnerability report:

CVE-2017-7525

jackson-databind is vulnerable to Remote Code Execution (RCE). The createBeanDeserializer() function in the BeanDeserializerFactory class allows untrusted Java objects to be deserialized. A remote attacker can exploit this by uploading a malicious serialized object that will result in RCE if the application attempts to deserialize it.

False Positive Classification Reasoning

According to these description, and the fact that the org.onap.dcaegen2.platform:inventory-api code does not enable use of global type information, using Class name as the type id, we believe that this report is a false positive.

Vulnerability report:

CVE-2017-7657

CVE-2017-7658

DCAEGEN2-768 

Upgrade to latest version - 9.4.12.v20180830

Vulnerability report:

CVE-2018-12538

DCAEGEN2-768

Upgrade to latest version - 9.4.12.v20180830

groovy-all, 2.4.4 

Vulnerability report:

CVE-2016-6814

DCAEGEN2-769

Upgrade to latest version - 2.4.15

Vulnerability report:

CVE-2018-8014

DCAEGEN2-769

Update tomcat-embed-core to 8.5.32 version

Vulnerability report:

CVE-2018-1270

DCAEGEN2-769

Update to 5.0.9.RELEASE version

Vulnerable artifacts:

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.5 located at Module org.onap.dcaegen2.services.mapper.vesadapter:UniversalVesAdapter:jar:0.0.1

Vulnerability report:

SONATYPE-2017-0312

jackson-databind is vulnerable to Remote Code Execution (RCE). The createBeanDeserializer() function in the BeanDeserializerFactory class allows untrusted Java objects to be deserialized. A remote attacker can exploit this by uploading a malicious serialized object that will result in RCE if the application attempts to deserialize it.

DCAEGEN2-769

To be assessed Jackson version can be updated to 2.9.6 (for consistency within application) as jackson related vulnerability can be addressed as single item (below for 2.9.6)

Vulnerable artifacts:

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.6 located at Module org.onap.dcaegen2.services.mapper:snmpmapper:jar:0.0.1-SNAPSHOT

Vulnerability report:

SONATYPE-2017-0312

jackson-databind is vulnerable to Remote Code Execution (RCE). The createBeanDeserializer() function in the BeanDeserializerFactory class allows untrusted Java objects to be deserialized. A remote attacker can exploit this by uploading a malicious serialized object that will result in RCE if the application attempts to deserialize it.

False Positive Classification Reasoning To be confirmed

In mapper, Jackson is only used for converting between POJO to JSON, not the other direction which is reported as vulnerable. The member call used is ObjectMapper.writeValueAsString. not the risky readValue method. Thus we believe the reporting is a false positive.

Vulnerability report:

CVE-2018-1259

DCAEGEN2-769

Update to 2.0.8.RELEASE version

Vulnerability report:

CVE-2012-0881

DCAEGEN2-769

Update to 2.12.0 version

httpclient, 4.5.2

Vulnerability report:

SONATYPE-2017-0359

Sonatype CWE: 22

The Apache httpcomponents component  is vulnerable to Directory Traversal. The normalizePath() function in the URIBuilder class allows directory traversal characters such as ../. An attacker can exploit this vulnerability by sending a specially crafted request containing this sequence in the URL path, allowing the attacker to traverse beyond the allowed directory and retrieve the contents of arbitrary files from the server, leading to information disclosure

DCAEGEN2-769

Update to 4.5.3 or later

spring-core, 5.0.3.RELEASE

Vulnerability report:

CVE-2018-1272

DCAEGEN2-769

Update to 5.0.5.RELEASE or later version

tomcat-embed-core, 8.5.28

Vulnerability report:

CVE-2018-8014

DCAEGEN2-770

bcprov-jdk15on, 1.59

Vulnerable artifacts:

Dependency org.bouncycastle:bcprov-jdk15on:jar:1.59 located at Module org.onap.dcaegen2.services.prh:prh-app-server:jar:1.0.0-SNAPSHOT

Vulnerability report:

CVE-2018-1000613

CVE-2018-1000180

DCAEGEN2-770

No alternate (unflagged) version available. To be assessed if this dependency can be removed or thread not applicable

Vulnerable artifacts:

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.6 located at Module org.onap.dcaegen2.services.mapper:snmpmapper:jar:0.0.1-SNAPSHOT

Vulnerability report:

SONATYPE-2017-0312

jackson-databind is vulnerable to Remote Code Execution (RCE). The createBeanDeserializer() function in the BeanDeserializerFactory class allows untrusted Java objects to be deserialized. A remote attacker can exploit this by uploading a malicious serialized object that will result in RCE if the application attempts to deserialize it.

DCAEGEN2-770

To be assessed if any alternative or Jackson is only used for converting between JSON to POJO only (reverse is flagged under 502 or if below is true

If this component is being used as part of Spring Security, then you are not vulnerable if you are running Spring Security 4.2.3.RELEASE or greater for 4.x or Spring Security 5.0.0.M2 or greater for 5.x. (CVE-2017-4995).