2021-12-14 Security Subcommittee Meeting Notes

CVE-2021-44228

• https://www.kaspersky.com/blog/log4shell-critical-vulnerability-in-apache-log4j/43124/

• https://nexus-iq.wl.linuxfoundation.org/assets/index.html#/vulnerabilities/CVE-2021-44228:

Issue impacting specific versions of log4j-core. ONAP projects still using version 1 that might not be (depends on configuration) but it is not supported for a long time (since 2012).

We recommend immediate upgrade to latest log4j-core version: 2.16 in both Istanbul maintenance release and in Jakarta. 

How vulnerability message reaches end user?

ongoing

For tracking purpose dedicated Jira tickets to be opened per project and per both releases.

DMaaP upgrades

Logj-core  to be upgraded but for others there are transitive dependencies. Comments to be provided in the sestricted Wiki.

ongoing

Maybe worth to open a ticket to Sonatype with dependecies issues. 

AJSC dependencies - Amy will check with AT&T maintainer.

Trivi scans

Issue with containerD - not possible to have information on CVEs. Compatibility only with DockerD and Postman.

Threadfix removes duplication of findings from different sources.

ongoing

Brian to share info on their Jfrog  for Image scanning.

Jakarta proposed versions update

https://wiki.onap.org/display/DW/Database%2C+Java%2C+Python%2C+Docker%2C+Kubernetes%2C+and+Image+Versions

• CentOS version – verify AS-IS state to define TO-BE state, if version 8 used - > 8 stream proposed.

• Additional environmental components - updated

Centos images used: https://logs.onap.org/onap-integration/daily/onap_daily_pod4_master/2021-12/06_03-20/infrastructure-healthcheck/k8s/kubernetes-status/versions.html

ongoing

Centos issue to be raised at the upcoming PTLs call.

SCA analysis

Jira tickets created for each project.

ongoing

Ticket to be submitted via LF IT to Sonatype - issue with API documentation.

PTL meeting update

• SECCOM GRs and BPs reminder

• Info on CVE-2021-44228

• architecture review with Chaker

• unmaintaned meeting 

done

Next week meeting with Thomas for unmaintained presentation for DDF

TSC meeting update

Request on supporting unmaintned topic 

VVP and VNFSDK no nominations for PTL

Issue with use case slicing

Modelling has PTL and co-PTL.

M1 approved

27th January for M2

done

SBOMs

Which repos/projects to take into account?

Start with pilot (1 or 2 projects) – info e-mail to be sent to PTLs

• DCAE (Vijay)

• CPS (Toine)

Work required: review of the artifacts generated if it is accurate.

ongoing

info e-mail to be sent to PTLs.

Jess to be contacted.

Amy to send an e-mail to Vijay. 

Muddasar to prepare info on what is needed on PTLs side to review artifacts.

Quality gates

3 levels under consideration: bronze, silver and gold. Basic level could be reacjing 55% of code coverage.

https://docs.sonarqube.org/latest/user-guide/metric-definitions/

Tables about project maturity (self reported) while we are doing measured approach.

• https://lf-onap.atlassian.net/wiki/display/DW/Jakarta+Release+Platform+Maturity

ongoing

SECCOM presentations for incoming DDF (January).

SECCOM topics and overall agenda proposal:

• https://teamup.com/ksgw6qzqcmg9zbzsfq?view=MD&date=2022-1-10&calendars=8227292,8227785,8227782,8310707,8310614

• ONAP Security: Jakarta Global Requirements and Best Practices

  • Tuesday, 11th of January, 4:30 UTC

• Unmaintained code handling and its impact on documentation (SECCOM + Documentation) - main session stream Amy/Pawel/Thomas/Eric – Topic

  • Wednesday, 12th of January, 2:30 UTC

• Code quality demo - main session stream – Fabian/Pawel/Kevin/Toine – Topic

  • Tuesday, 11th of January, 3:30 UTC

Interproject proposals:

•  

  •  

    • SBOMs ONAP story – Muddasar/Pawel Topic

    • Monday, 10th of January, 2:30 UTC

ongoing

SECCOM MEETING CALL WILL BE HELD ON 21st OF DECEMBER'21. 

Quality gates for code quality improvements - continuation of the discussion.

SBOM next steps - which repos/projects to take into account?