This template is intended to be used to document the outcome of the impact analysis related to the known vulnerability reported by Nexus-IQ (CLM tab in Jenkins). Nexus-IQ can identify the known vulnerabilities contained in the components use by onap components.
...
The information related to Repository, Group, Artifact, Version and Problem Code are extracted from the CLM report (see the below screenshot)
| Repository | Group | Impact Analysis | Action |
|---|---|---|---|
| dcaegen2/analytics/tca-gen2 | com.fasterxml.jackson.core | Vulnerable artifact:
Vulnerability report: SONATYPE-2017-0312
| False Positive Classification Reasoning to be confirmed if identified Jackson is only used for converting between POJO to JSON, not the other direction which is reported as vulnerable by CVE-2018-7489. The member call used is ObjectMapper.writeValueAsString. not the risky readValue method. |
| dcaegen2/analytics/tca-gen2 | org.springframework | spring-aop Vulnerability report | Update spring-aop to newer version 5.0.8.RELEASE version |
| dcaegen2/analytics/tca-gen2 | org.springframework.data | spring-data-commons Vulnerability report | Update spring-data-commons to 2.0.8.RELEASE version |
| dcaegen2/analytics/tca | com.fasterxml.jackson.core | jackson-databind:jar:2.4.4 Vulnerable artifact: Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.4.4 located at Module org.onap.dcaegen2.analytics.tca:dcae-analytics-aai:jar:2.2.1-SNAPSHOT Vulnerability report:
| False Positive Classification Reasoning There is no use of |
| dcaegen2/analytics/tca | com.fasterxml.jackson.core | jackson-core:2.4.4 Vulnerable artifacts: <same as jackson-databind 2.4.4 above> Vulnerability report: SONATYPE-2016-0397 SONATYPE-2017-0355 | False Positive Classification Reasoning There is no use of either |
|
| ||
|
| ||
| dcaegen2/collectors/datafile | com.fasterxml.jackson.core | Vulnerable artifacts: Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9. |
6 located at Module org.onap.dcaegen2.collectors.datafile:datafile-app-server:jar:1.0.0-SNAPSHOT Vulnerability report: SONATYPE-2017-0312
| To be assessed if any alternative or Jackson is only used for converting between JSON to POJO only (reverse is flagged under 502 or if below is true If this component is being used as part of Spring Security, then you are not vulnerable if you are running Spring Security 4.2.3.RELEASE or greater for 4.x or Spring Security 5.0.0.M2 or greater for 5.x. (CVE-2017-4995). | ||
|
| ||
| dcaegen2/collectors/hv-ves | com.fasterxml.jackson.core | jackson-databind : 2.9.6 Vulnerable artifacts: Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.4 located at Module org.onap.dcaegen2.collectors.hv-ves:hv-collector-coverage:pom:1.0.0-SNAPSHOT Vulnerability report: | False Positive Classification Reasoning Vulnerable artifacts are used only in following cases:
Other modules affected are component-level-tests and coverage report which also are not used in production environment. Assessment Note To be assessed if any alternative or Jackson is only used for converting between JSON to POJO only (reverse is flagged under 502 or if below is true If this component is being used as part of Spring Security, then you are not vulnerable if you are running Spring Security 4.2.3.RELEASE or greater for 4.x or Spring Security 5.0.0.M2 or greater for 5.x. (CVE-2017-4995). |
|
| ||
| dcaegen2/collectors/ves | com.fasterxml.jackson.core | jackson-databind Vulnerable artifacts: Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.6 located at Module org.onap.dcaegen2.collectors.ves:VESCollector:jar:1.3.1-SNAPSHOT Vulnerability report:
| False Positive Classification Reasoning The application is only vulnerable by using this component, when default typing is enabled and passing in untrusted data to be deserialization which is not the case here. |
| dcaegen2/platform/inventory-api | com.fasterxml.jackson.core | jackson-databind : 2.8.7 Vulnerable artifacts: Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.8.7 located at Module org.onap.dcaegen2.platform:inventory-api:jar:3.0.3 Vulnerability report:
| False Positive Classification Reasoning According to these description, and the fact that the org.onap.dcaegen2.platform:inventory-api code does not enable use of global type information, using Class name as the type id, we believe that this report is a false positive. |
|
| ||
|
| ||
|
| ||
| |
|
| |
|
| ||
|
-Jackson version has been updated to 2.9.6 | ||
| dcaegen2/services/mapper | com.fasterxml.jackson.core | jackson-databind, 2.9.6 Vulnerable artifacts: Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.6 located at Module org.onap.dcaegen2.services.mapper:snmpmapper:jar:0.0.1-SNAPSHOT Vulnerability report: SONATYPE-2017-0312
| False Positive Classification Reasoning There is no use of |
|
| ||
|
| ||
|
| ||
|
| ||
| |||
|
| ||
| dcaegen2/services/prh | com.fasterxml.jackson.core | jackson-databind, 2.9.6 Vulnerable artifacts: Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.6 located at Module org.onap.dcaegen2.services.mapper:snmpmapper:jar:0.0.1-SNAPSHOT Vulnerability report: SONATYPE-2017-0312
| To be assessed if any alternative or Jackson is only used for converting between JSON to POJO only (reverse is flagged under 502 or if below is true If this component is being used as part of Spring Security, then you are not vulnerable if you are running Spring Security 4.2.3.RELEASE or greater for 4.x or Spring Security 5.0.0.M2 or greater for 5.x. (CVE-2017-4995). |