Casablanca AAI Security/Vulnerability Report
- Amy Zwarico
This table represents the known exploitable and non-exploitable vulnerabilities in third party packages used in the project.
Repository | Group | Impact Analysis | Action |
|---|---|---|---|
| com.fasterxml.jackson.core | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the code base is not using either approach, so the possibility of the exploit vector does not apply. | |
| com.fasterxml.jackson.core | DMaaP client dependency: [INFO] +- org.onap.dmaap.messagerouter.dmaapclient:dmaapClient:jar:1.1.5:compile [INFO] | +- com.fasterxml.jackson.core:jackson-core:jar:2.8.11:compile [INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.8.11.1:compile From Dmaap Security/Vulnerability - Beijing: The application is vulnerable by using this component, when default typing is enabled. Message Router do not use the default typing, so using the jackson-databind will not make message router vulnerable | |
aai/champ | com.fasterxml.jackson.core | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the code base is not using either approach, so the possibility of the exploit vector does not apply. | |
aai/aai-common | com.fasterxml.jackson.core | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the code base is not using either approach, so the possibility of the exploit vector does not apply. | |
| org.codehaus.jackson | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the resources code bases are not using either approach, so the possibility of the exploit vector does not apply. | AAI-900: Security: CVE-2017-7525 jackson-mapper-asl 1.9.2Closed |
| org.codehaus.jackson | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the resources code bases are not using either approach, so the possibility of the exploit vector does not apply. | |
aai/aai-common | org.codehaus.jackson | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the code base is not using either approach, so the possibility of the exploit vector does not apply. | |
aai/search-data-service | com.fasterxml.jackson.core | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the search service is not using either approach, so the possibility of the exploit vector does not apply. | |
aai/esr-server | com.fasterxml.jackson.core | False Positive Explanation: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization. esr-server doesn't invoke this method, esr-server use new Gson().fromJson(String json, Obj.class) and new Gson().toJson(obj) to deserialization and serialization. https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization In esr-server, Gson is used to deserialization and serialization: | |
| org.apache.activemq | Will update in Casablanca Maintenance Release. Issue is a false positive. This vulnerability is dependent on XalanXPathEvaluator.java using an insecure or absent document parser. AAI is not using this class. | |
aai/cacher | org.apache.activemq | Will update in Casablanca Maintenance Release. Issue is a false positive. This vulnerability is dependent on XalanXPathEvaluator.java using an insecure or absent document parser. AAI is not using this class. | https://lf-onap.atlassian.net/browse/AAI-1934 AAI-1935: [cacher] cherry-pick update activemq-broker to 5.15.8 to CasablancaClosed |
aai/cacher | org.apache.activemq | Will update in Casablanca Maintenance Release. Application is vulnerable to the vulnerability, users should secure the system so users cannot snoop network traffic between cacher and the other end of the queue; an old version of aai-common has the import, and cacher should move to the latest, 1.3.2 (see JIRA tickets) | https://lf-onap.atlassian.net/browse/AAI-1936AAI-1937: [cacher] Update aai-core to 1.3.2 or 1.4.0-SNAPSHOTClosed |
aai/champ | commons-httpclient | False positive. This is imported by hadoop which is used for hbase configs; in Beijing, AAI is configured with Janus on cassandra so it will not be accessing these classes. In Casablanca, Champ will serve as a multi-purpose data broker so we will look to upgrade the hadoop libraries to the most current versions. | |
aai/aai-esr-gui | org.webjars.npm bootstrap | False positive. The data-target attribute in bootstrap.js interprets encoded HTML entities as standard HTML entities when data-target is based on user supplied input. data-target attribute is not used | Helpdesk ticket 54851 |
aai/aai-esr-gui | org.webjars.npm bootstrap | False positive. The | |
ai/champ | org.apache.hadoop | False positive. The ONAP system only use Janus on Casandra, so the hadoop libraries are never touched | |
| org.apache.tomcat.embed | AAI is not vulnerable because tomcat is not used in these repos, jetty is the application server. This is a child dependency of springframework, JIRA ticket in next column will address it for the Casablanca Maintenance Release by updating to the latest spring boot. | AAI-1888: Security: Springboot 1.5.15 has new nexusIQ critical exceptionsClosed |
| org.springframework | Will update in maintenance release when upgrading to latest spring boot. False positive. AAI is not serving static resources through the ResourceHttpRequestHandler. | AAI-1888: Security: Springboot 1.5.15 has new nexusIQ critical exceptionsClosed |
| com.google.guava | This dependency is a child dependency of Cassandra which is required for the graphdb; newer versions of Cassandra do not upgrade to a non-vulnerable version of this depedency. Guava is vulnerable to Denial of Service (DoS) when untrusted input is supplied to the | |
aai/search-data-service | com.google.guava | A dependency of a child dependency, json-schema-validator. Even the latest version of json-schema-validator does not have the required fix version for the above components. | |
aai/search-data-service | com.googlecode.libphonenumber | A dependency of a child dependency, json-schema-validator. Even the latest version of json-schema-validator does not have the required fix version for the above components. AAI is not vulnerable to this issue in the dependency, it does not use the component in the way described. | |
aai/search-data-service | javax.mail | A dependency of a child dependency, json-schema-validator. Even the latest version of json-schema-validator does not have the required fix version for the above components. AAI is not vulnerable to this issue in the dependency, it does not use the component in the way described. | |
aai/search-data-service | org.springframework.security | Inherited from spring boot, will be fixed in the Casablanca Maintenance Release. Search data service is not vulnerable to the exploit vectors because it does not perform the functions outlined in the report. | AAI-1895: [search-data-service] Update springboot to 1.5.18 in search-data-serviceClosed |
aai/data-router | com.att.aft | Update to 3.1.200-oss for Casablanca Maintenance Release. data-router does not the hazel cast component so we are not vulnerable in the meantime. | |
aai/esr-server | com.smoketurner.dropwizard | False Positive. The exploit primarily is about enabling polymorphic type handling with the object mapper and writing class specifics into the JSON object. There are two ways of doing this:
By default the ObjectMapper does not enableDefaultTyping, the code base is not using either approach, so the possibility of the exploit vector does not apply. | |
aai/esr-server | com.smoketurner.dropwizard | It's an example brought by indirect dependency. Because the codes are not called by ESR, so it has no impact to ESR and it's downstream project. However, it should and will be deleted from ESR dependencies in the next release. | |
aai/event-client | com.rabbitmq | False positive. Event client in ONAP only uses DMaaP so the rabbitmq dependencies are never used. | AAI-1905: [event-client] Security - com.rabbitmq has vulnerabilitiesClosed |
aai/esr-gui | org.apache.tomcat | ESR GUI is vulnerable. Implementors should secure the system to prevent exploits. We will replace tomcat in the Casablanca Maintenance Release with a version that is not vulnerable. | |
aai/esr-gui | org.apache.tomcat | ESR GUI is vulnerable. Implementors should secure the system to prevent exploits. We will replace tomcat in the Casablanca Maintenance Release with a version that is not vulnerable. | |
aai/esr-gui | org.apache.tomcat | ESR GUI is vulnerable. Implementors should secure the system to prevent exploits. We will replace tomcat in the Casablanca Maintenance Release with a version that is not vulnerable. | |
aai/esr-gui | org.apache.tomcat | ESR GUI is vulnerable. Implementors should secure the system to prevent exploits. We will replace tomcat in the Casablanca Maintenance Release with a version that is not vulnerable. | |
aai/esr-gui | org.apache.tomcat | ESR GUI is vulnerable. Implementors should secure the system to prevent exploits. We will replace tomcat in the Casablanca Maintenance Release with a version that is not vulnerable. | |
aai/esr-gui | org.apache.tomcat | ESR GUI is vulnerable. Implementors should secure the system to prevent exploits. We will replace tomcat in the Casablanca Maintenance Release with a version that is not vulnerable. | |
aai/esr-gui | jquery | ESR GUI is vulnerable. Implementors should secure the system to prevent exploits. We will replace jquery in the Casablanca Maintenance Release with a version that is not vulnerable. | |
aai/esr-gui | bootstrap | ESR GUI is vulnerable. Implementors should secure the system to prevent exploits. We will replace bootstrap in the Casablanca Maintenance Release with a version that is not vulnerable. |