AAI R3 Security/Vulnerability Threat Analysis
- James Forsyth
- Kenny Paul
This template is intended to be used to document the outcome of the impact analysis related to the known vulnerability reported by Nexus-IQ (CLM tab in Jenkins). Nexus-IQ can identify the known vulnerabilities contained in the components use by onap components.
This table will be presented to TSC at Code Freeze milestone (M4) to the TSC.
It is recommended to first update to the latest version of the third party components available. In case the latest third party components still reports some vulnerabilities, you must provide an impact analysis as illustrated in the example below.
In the case where you have nested third party components (a third party component embedding another third party component) and there is NO CVE number for the upstream third party component (meaning the third party component you are embedding), it is recommended to open a vulnerability issue on the upstream third party component.
The following table is addressing 2 different scenarios:
Confirmation of a vulnerability including an action
False Positive
The information related to Repository, Group, Artifact, Version and Problem Code are extracted from the CLM report (see the below screenshot)
Repository | Group | Impact Analysis | Action |
|---|---|---|---|
| org.apache.hadoop | False positive. The ONAP system only use Janus on Casandra, so the hadoop libraries are never touched | AAI-1887- [champ] [security] Hadoop vulnerabilitySUBMITTED |
| com.fasterxml.jackson.core | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the search service is not using either approach, so the possibility of the exploit vector does not apply. | |
| com.google.guava | A dependency of a child dependency, json-schema-validator. Even the latest version of json-schema-validator does not have the required fix version for the above components. | |
| com.googlecode.libphonenumber | A dependency of a child dependency, json-schema-validator. Even the latest version of json-schema-validator does not have the required fix version for the above components. AAI is not vulnerable to this issue in the dependency, it does not use the component in the way described. | |
| javax.mail | A dependency of a child dependency, json-schema-validator. Even the latest version of json-schema-validator does not have the required fix version for the above components. AAI is not vulnerable to this issue in the dependency, it does not use the component in the way described. | |
| org.springframework.security | Inherited from spring boot, will be fixed in the Casablanca Maintenance Release. Search data service is not vulnerable to the exploit vectors because it does not perform the functions outlined in the report. | AAI-1895- [search-data-service] Update springboot to 1.5.17 in search-data-serviceOPEN |
| org.springframework | Will update in maintenance release when upgrading to latest spring boot. False positive. AAI is not serving static resources through the ResourceHttpRequestHandler. | AAI-1888- Security: Springboot 1.5.15 has new nexusIQ critical exceptionsOPEN |
| org.apache.tomcat.embed | AAI is not vulnerable because tomcat is not used in these repos, jetty is the application server. This is a child dependency of springframework, JIRA ticket in next column will address it for the Casablanca Maintenance Release by updating to the latest spring boot. | AAI-1888- Security: Springboot 1.5.15 has new nexusIQ critical exceptionsOPEN |
| com.fasterxml.jackson.core | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the code base is not using either approach, so the possibility of the exploit vector does not apply. | |
| com.fasterxml.jackson.core | DMaaP client dependency: [INFO] +- org.onap.dmaap.messagerouter.dmaapclient:dmaapClient:jar:1.1.5:compile [INFO] | +- com.fasterxml.jackson.core:jackson-core:jar:2.8.11:compile [INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.8.11.1:compile From Dmaap Security/Vulnerability - Beijing: The application is vulnerable by using this component, when default typing is enabled. Message Router do not use the default typing, so using the jackson-databind will not make message router vulnerable | |
| com.rabbitmq | False positive. Event client in ONAP only uses DMaaP so the rabbitmq dependencies are never used. | AAI-1905: [event-client] Security - com.rabbitmq has vulnerabilitiesClosed |
| com.fasterxml.jackson.core | False Positive Explanation: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization. esr-server doesn't invoke this method, esr-server use new Gson().fromJson(String json, Obj.class) and new Gson().toJson(obj) to deserialization and serialization. https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization In esr-server, Gson is used to deserialization and serialization: | |
| com.smoketurner.dropwizard | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the code base is not using either approach, so the possibility of the exploit vector does not apply. | |
| com.smoketurner.dropwizard | @Bo Lv (ESR SME) please comment if ear-server is vulnerable to CVE-2018-110987 (rabbitmq) | |
| org.apache.tomcat | ESR GUI is vulnerable. Implementors should secure the system to prevent exploits. We will replace tomcat in the Casablanca Maintenance Release with a version that is not vulnerable. | |
| jquery | ESR GUI is vulnerable. Implementors should secure the system to prevent exploits. We will replace jquery in the Casablanca Maintenance Release with a version that is not vulnerable. | |
| bootstrap | ESR GUI is vulnerable. Implementors should secure the system to prevent exploits. We will replace bootstrap in the Casablanca Maintenance Release with a version that is not vulnerable. | |
| com.att.aft | Update to 3.1.200-oss for Casablanca Maintenance Release. data-router does not the hazel cast component so we are not vulnerable in the meantime. | |
| com.fasterxml.jackson.core | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the code base is not using either approach, so the possibility of the exploit vector does not apply. | |
| org.codehaus.jackson | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the resources code bases are not using either approach, so the possibility of the exploit vector does not apply. | |
| commons-httpclient | False positive. This is imported by hadoop which is used for hbase configs; in Beijing, AAI is configured with Janus on cassandra so it will not be accessing these classes. In Casablanca, Champ will serve as a multi-purpose data broker so we will look to upgrade the hadoop libraries to the most current versions. | |
| org.apache.activemq | Will update in Casablanca Maintenance Release. Issue is a false positive. This vulnerability is dependent on XalanXPathEvaluator.java using an insecure or absent document parser. AAI is not using this class. | AAI-1934: [cacher] Update activemq-broker to 5.15.8Closed AAI-1935: [cacher] cherry-pick update activemq-broker to 5.15.8 to CasablancaClosed |
| org.apache.activemq | Will update in Casablanca Maintenance Release. Application is vulnerable to the vulnerability, users should secure the system so users cannot snoop network traffic between cacher and the other end of the queue; an old version of aai-common has the import, and cacher should move to the latest, 1.3.2 (see JIRA tickets) | |
| org.apache.activemq | Will update in Casablanca Maintenance Release. Issue is a false positive. This vulnerability is dependent on XalanXPathEvaluator.java using an insecure or absent document parser. AAI is not using this class. | |
| org.codehaus.jackson | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the resources code bases are not using either approach, so the possibility of the exploit vector does not apply. | |
| org.webjars.npm bootstrap | False positive. The data-target attribute in bootstrap.js interprets encoded HTML entities as standard HTML entities when data-target is based on user supplied input. data-target attribute is not used | Helpdesk ticket 54851 |
| org.webjars.npm bootstrap | False positive. The | |
| com.google.guava | This dependency is a child dependency of Cassandra which is required for the graphdb; newer versions of Cassandra do not upgrade to a non-vulnerable version of this depedency. Guava is vulnerable to Denial of Service (DoS) when untrusted input is supplied to the | |
| com.fasterxml.jackson.core | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the code base is not using either approach, so the possibility of the exploit vector does not apply. | |
| org.codehaus.jackson | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the code base is not using either approach, so the possibility of the exploit vector does not apply. |