Page Comparison

Vulnerable artifacts:

Vulnerable artifact:

Vulnerable artifact:

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.8.11 located at Module org.onap.dcaegen2.collectors.ves:VESCollector:jar

Vulnerability report:

CVE-2017-7525 originally reports that the application is vulnerable by using this component, when default typing is enabled. More details about the vulnerability is provided by https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization.

False Positive Classification Reasoning:

Vulnerable artifact:

Vulnerability report: incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

False Positive Classification Reasoning:

Vulnerable artifact:

Dependency org.springframework:spring-expression:jar:5.0.4.RELEASE located at Module org.onap.dcaegen2.services.mapper.vesadapter:snmpmapper:jar:0.0.1

Vulnerability report:

older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

False Positive Classification Reasoning:

In mapper, there is no use of STOMP over websocket. There fore we believe that this is a false positive.

Vulnerable artifact:

Dependency com.fasterxml.jackson.core:jackson-databind:jar:2.9.5 located at Module org.onap.dcaegen2.services.mapper.vesadapter:UniversalVesAdapter:jar:0.0.1

Vulnerability report:

jackson-databind is vulnerable to Remote Code Execution (RCE). A remote attacker can exploit this by uploading a malicious serialized object that will result in RCE if the application attempts to deserialize it.

False Positive Classification Reasoning:

Vulnerable artifact:

Vulnerability report:

older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

False Positive Classification Reasoning:

The identified vulnerability exists when serving static artifact from Windows host. Our use is neither from a Windows host, or serving static file. Therefore we believe this is afalse positive.

incomplete fix for the CVE-2017-7525 deserialization flaw

FasterXML 2.9.5 released March 2018, supposed to correct this behavior (in tests currently).

All vulnerabilities addressed, according to CLM scan on 04/21. https://nexus-iq.wl.linuxfoundation.org/assets/index.html#/reports/dcaegen2-services-prh/a66b0ace9ec046c18cda082800e0fddc

Vulnerability report:

SONATYPE-2017-0312

jackson-databind is vulnerable to Remote Code Execution (RCE). The createBeanDeserializer() function in the BeanDeserializerFactory class allows untrusted Java objects to be deserialized. A remote attacker can exploit this by uploading a malicious serialized object that will result in RCE if the application attempts to deserialize it.

False Positive Classification Reasoning to be confirmed

if identified Jackson is only used for converting between POJO to JSON, not the other direction which is reported as vunerable by CVE-2018-7489. The member call used is ObjectMapper.writeValueAsString. not the risky readValue method.

spring-aop

Vulnerability report

CVE-2018-1258

spring-data-commons

Vulnerability report

CVE-2018-1259