This template is intended to be used to document the outcome of the impact analysis related to the known vulnerability reported by Nexus-IQ (CLM tab in Jenkins). Nexus-IQ can identify the known vulnerabilities contained in the components use by onap components.
...
| Repository | Group | Impact Analysis | Action |
|---|---|---|---|
| dcaegen2/analytics/tca-gen2 | com.fasterxml.jackson.core | False Positive - we are not using the Jackson code in the manner that exposes the vulnerability. | Request exception |
| dcaegen2/analytics/tca | com.fasterxml.jackson.core | False Positive - we are not using the Jackson code in the manner that exposes the vulnerability. There is no use of | No Action (same version as R2) |
| dcaegen2/analytics/tca | com.fasterxml.jackson.core | False Positive There is no use of either | No Action (same version as R2) |
| dcaegen2/collectors/datafile | com.fasterxml.jackson.core | Likely same case as above.There is no non vulnerable version of this component. | Request exception |
| dcaegen2/collectors/hv-ves | com.fasterxml.jackson.core | False Positive Vulnerable artifacts are used only in following cases:
Other modules affected are component-level-tests and coverage report which also are not used in production environment. | Request exception |
| dcaegen2/collectors/ves | com.fasterxml.jackson.core | False Positive The application is only vulnerable by using this component, when default typing is enabled and passing in untrusted data to be deserialization which is not the case here. | Request exception |
| dcaegen2/platform/inventory-api | com.fasterxml.jackson.core | False Positive According to these description, and the fact that the org.onap.dcaegen2.platform:inventory-api code does not enable use of global type information, using Class name as the type id, we believe that this report is a false positive. | Request exception
|
| dcaegen2/services/mapper | com.fasterxml.jackson.core | False Positive There is no use of | Request exception |
| dcaegen2/services/prh | com.fasterxml.jackson.core | There is no non vulnerable version of this component. | Request exception |